Техническая информация
Для обеспечения автозапуска и распространения
Модифицирует следующие ключи реестра
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '.e' = 'C:\User\bin\java -jar C:\User\x.jar'
Вредоносные функции
Создает и запускает на исполнение (эксплоит)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass -windowstyle hidden -File %TEMP%\GHyuttfgfHJGHUyutUYgh54568977SDFSDF.PS1
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\ghyuttfgfhjghuyutuygh54568977sdfsdf.ps1
- C:\user\bin\lcms.dll
- C:\user\bin\ktab.exe
- C:\user\bin\klist.exe
- C:\user\bin\kinit.exe
- C:\user\bin\keytool.exe
- C:\user\bin\jsoundds.dll
- C:\user\bin\jsound.dll
- C:\user\bin\jsdt.dll
- C:\user\bin\jpeg.dll
- C:\user\bin\jp2ssv.dll
- C:\user\bin\jp2native.dll
- C:\user\bin\jp2launcher.exe
- C:\user\bin\jp2iexp.dll
- C:\user\bin\jli.dll
- C:\user\bin\jfxwebkit.dll
- C:\user\bin\mlib_image.dll
- C:\user\bin\jfxmedia.dll
- C:\user\bin\jfr.dll
- C:\user\bin\jdwp.dll
- C:\user\bin\jawtaccessbridge.dll
- C:\user\bin\jawtaccessbridge-32.dll
- C:\user\bin\jawt.dll
- C:\user\bin\java_crw_demo.dll
- C:\user\bin\javaws.exe
- C:\user\bin\javaw.exe
- C:\user\bin\javafx_iio.dll
- C:\user\bin\javafx_font.dll
- C:\user\bin\javacpl.exe
- C:\user\bin\javacpl.cpl
- C:\user\bin\jjs.exe
- C:\user\bin\deploy.dll
- C:\user\bin\msvcp140.dll
- C:\user\bin\client\jvm.dll
- C:\user\bin\zip.dll
- C:\user\bin\wsdetect.dll
- C:\user\bin\windowsaccessbridge.dll
- C:\user\bin\windowsaccessbridge-32.dll
- C:\user\bin\w2k_lsa_auth.dll
- C:\user\bin\verify.dll
- C:\user\bin\vcruntime140.dll
- C:\user\bin\unpack200.exe
- C:\user\bin\unpack.dll
- C:\user\bin\ucrtbase.dll
- C:\user\bin\tnameserv.exe
- C:\user\bin\t2k.dll
- C:\user\bin\sunmscapi.dll
- C:\user\bin\javaaccessbridge.dll
- C:\user\bin\management.dll
- C:\user\bin\ssv.dll
- C:\user\bin\splashscreen.dll
- C:\user\bin\servertool.exe
- C:\user\bin\rmiregistry.exe
- C:\user\bin\rmid.exe
- C:\user\bin\resource.dll
- C:\user\bin\prism_sw.dll
- C:\user\bin\prism_d3d.dll
- C:\user\bin\prism_common.dll
- C:\user\bin\policytool.exe
- C:\user\bin\pack200.exe
- C:\user\bin\orbd.exe
- C:\user\bin\npt.dll
- C:\user\bin\nio.dll
- C:\user\bin\ssvagent.exe
- C:\user\bin\net.dll
- C:\user\bin\javaaccessbridge-32.dll
- C:\user\bin\java.exe
- C:\user\bin\java.dll
- C:\user\bin\api-ms-win-core-memory-l1-1-0.dll
- C:\user\bin\api-ms-win-crt-conio-l1-1-0.dll
- C:\user\bin\api-ms-win-core-xstate-l2-1-0.dll
- C:\user\bin\api-ms-win-core-util-l1-1-0.dll
- C:\user\bin\api-ms-win-core-timezone-l1-1-0.dll
- C:\user\bin\api-ms-win-core-sysinfo-l1-1-0.dll
- C:\user\bin\api-ms-win-core-synch-l1-2-0.dll
- C:\user\bin\api-ms-win-core-synch-l1-1-0.dll
- C:\user\bin\api-ms-win-core-string-l1-1-0.dll
- C:\user\bin\api-ms-win-core-rtlsupport-l1-1-0.dll
- C:\user\bin\api-ms-win-core-profile-l1-1-0.dll
- C:\user\bin\api-ms-win-core-processthreads-l1-1-1.dll
- C:\user\bin\api-ms-win-core-processthreads-l1-1-0.dll
- C:\user\bin\api-ms-win-core-processenvironment-l1-1-0.dll
- C:\user\bin\client\xusage.txt
- C:\user\bin\api-ms-win-crt-environment-l1-1-0.dll
- C:\user\bin\api-ms-win-core-localization-l1-2-0.dll
- C:\user\bin\api-ms-win-core-libraryloader-l1-1-0.dll
- C:\user\bin\api-ms-win-core-interlocked-l1-1-0.dll
- C:\user\bin\api-ms-win-core-heap-l1-1-0.dll
- C:\user\bin\api-ms-win-core-handle-l1-1-0.dll
- C:\user\bin\api-ms-win-core-file-l2-1-0.dll
- C:\user\bin\api-ms-win-core-file-l1-2-0.dll
- C:\user\bin\api-ms-win-core-file-l1-1-0.dll
- C:\user\bin\api-ms-win-core-errorhandling-l1-1-0.dll
- C:\user\bin\api-ms-win-core-debug-l1-1-0.dll
- C:\user\bin\api-ms-win-core-datetime-l1-1-0.dll
- C:\user\bin\api-ms-win-core-console-l1-2-0.dll
- C:\user\bin\api-ms-win-core-console-l1-1-0.dll
- C:\user\sysinternalssuite.zip
- C:\user\bin\api-ms-win-core-namedpipe-l1-1-0.dll
- C:\user\bin\sunec.dll
- C:\user\bin\api-ms-win-crt-filesystem-l1-1-0.dll
- C:\user\bin\api-ms-win-crt-math-l1-1-0.dll
- C:\user\bin\api-ms-win-crt-heap-l1-1-0.dll
- C:\user\bin\java-rmi.exe
- C:\user\bin\jabswitch.exe
- C:\user\bin\jaas_nt.dll
- C:\user\bin\j2pkcs11.dll
- C:\user\bin\j2pcsc.dll
- C:\user\bin\instrument.dll
- C:\user\bin\hprof.dll
- C:\user\bin\gstreamer-lite.dll
- C:\user\bin\glib-lite.dll
- C:\user\bin\glass.dll
- C:\user\bin\fxplugins.dll
- C:\user\bin\fontmanager.dll
- C:\user\bin\eula.dll
- C:\user\bin\api-ms-win-crt-locale-l1-1-0.dll
- C:\user\bin\dt_socket.dll
- C:\user\bin\api-ms-win-crt-convert-l1-1-0.dll
- C:\user\bin\decora_sse.dll
- C:\user\bin\dcpr.dll
- C:\user\bin\concrt140.dll
- C:\user\bin\bci.dll
- C:\user\bin\awt.dll
- C:\user\bin\api-ms-win-crt-utility-l1-1-0.dll
- C:\user\bin\api-ms-win-crt-time-l1-1-0.dll
- C:\user\bin\api-ms-win-crt-string-l1-1-0.dll
- C:\user\bin\api-ms-win-crt-stdio-l1-1-0.dll
- C:\user\bin\api-ms-win-crt-runtime-l1-1-0.dll
- C:\user\bin\api-ms-win-crt-process-l1-1-0.dll
- C:\user\bin\api-ms-win-crt-private-l1-1-0.dll
- C:\user\bin\api-ms-win-crt-multibyte-l1-1-0.dll
- C:\user\bin\dt_shmem.dll
- C:\user\bin\dtplugin\deployjava1.dll
Сетевая активность
TCP
Запросы HTTP GET
- http://62.#38.8.50/dd.txt
- http://62.#38.8.50/jre.zip
