Trojan.KillProc.21015

Техническая информация

Вредоносные функции:

Создает и запускает на исполнение:

%TEMP%\nsj5.tmp\ns14.tmp "netsh.exe" firewall delete allowedprogram "<Текущая директория>\WinVncSC.exe"
%TEMP%\nsj5.tmp\ns15.tmp "netsh.exe" firewall delete allowedprogram "<Текущая директория>\WinVncSC.exe" All
%TEMP%\nsj5.tmp\ns16.tmp REG.EXE DELETE "HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\uvnc_service\Security" /f
%TEMP%\nsj5.tmp\ns11.tmp "kill.exe" 1click
%TEMP%\nsj5.tmp\ns12.tmp "tskill.exe" 1click
%TEMP%\nsj5.tmp\ns13.tmp "taskkill.exe" /F /IM 1click.exe /T
%TEMP%\nsj5.tmp\ns1A.tmp "sc.exe" stop uvnc_service
%TEMP%\nsj5.tmp\ns1B.tmp "net.exe" stop uvnc_service
%TEMP%\nsj5.tmp\ns1C.tmp "sc.exe" delete uvnc_service
%TEMP%\nsj5.tmp\ns17.tmp REG.EXE DELETE "HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\uvnc_service\Enum" /f
%TEMP%\nsj5.tmp\ns18.tmp REG.EXE DELETE "HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\uvnc_service" /f
%TEMP%\nsj5.tmp\ns19.tmp REG.EXE DELETE "HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\OneClick-Server" /f
%TEMP%\nsj5.tmp\ns8.tmp "sc.exe" stop uvnc_service
%TEMP%\nsj5.tmp\ns9.tmp "net.exe" stop uvnc_service
%TEMP%\nsj5.tmp\nsA.tmp "sc.exe" delete uvnc_service
%TEMP%\A~ADVANTIGu_.exe _?=<Текущая директория>\
%TEMP%\nsj5.tmp\ns6.tmp "<Текущая директория>\WinVncSC.exe" -uninstall
%TEMP%\nsj5.tmp\ns7.tmp "<Текущая директория>\WinVncSC.exe" -kill
%TEMP%\nsj5.tmp\nsE.tmp "kill.exe" avncmenu
%TEMP%\nsj5.tmp\nsF.tmp "tskill.exe" AvncMenu
%TEMP%\nsj5.tmp\ns10.tmp "taskkill.exe" /F /IM AvncMenu.exe /T
%TEMP%\nsj5.tmp\nsB.tmp "kill.exe" WinVncSC
%TEMP%\nsj5.tmp\nsC.tmp "tskill.exe" WinVncSC
%TEMP%\nsj5.tmp\nsD.tmp "taskkill.exe" /F /IM WinVncSC.exe /T

Запускает на исполнение:

<SYSTEM32>\taskkill.exe /F /IM 1click.exe /T
<SYSTEM32>\tskill.exe 1click
<SYSTEM32>\taskkill.exe /F /IM AvncMenu.exe /T
<SYSTEM32>\reg.exe DELETE "HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\uvnc_service\Security" /f
<SYSTEM32>\reg.exe DELETE "HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\OneClick-Server" /f
<SYSTEM32>\reg.exe DELETE "HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\uvnc_service" /f
<SYSTEM32>\reg.exe DELETE "HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\uvnc_service\Enum" /f
<SYSTEM32>\net1.exe stop uvnc_service
<SYSTEM32>\net.exe stop uvnc_service
<SYSTEM32>\sc.exe stop uvnc_service
<SYSTEM32>\sc.exe delete uvnc_service
<SYSTEM32>\tskill.exe AvncMenu
<SYSTEM32>\taskkill.exe /F /IM WinVncSC.exe /T
<SYSTEM32>\tskill.exe WinVncSC