Техническая информация
Для обеспечения автозапуска и распространения
Создает или изменяет следующие файлы
- <SYSTEM32>\tasks\firefox default browser agent cf253aae678ab5e8
Вредоносные функции
Внедряет код в
следующие системные процессы:
- %WINDIR%\syswow64\explorer.exe
- %WINDIR%\explorer.exe
следующие пользовательские процессы:
- iexplore.exe
Перехватывает функции
в браузерах
- Процесс iexplore.exe, модуль wininet.dll
- Процесс firefox.exe, модуль nss3.dll
Ищет ветки реестра, отвечающие за хранение паролей сторонними программами
- [<HKCU>\Software\Martin Prikryl]
- [<HKLM>\Software\Wow6432Node\Martin Prikryl]
Читает файлы, отвечающие за хранение паролей сторонними программами
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %APPDATA%\opera software\opera stable\login data
- %APPDATA%\mozilla\firefox\profiles.ini
- %APPDATA%\thunderbird\profiles.ini
Изменения в файловой системе
Создает следующие файлы
- %APPDATA%\udttcig
- %LOCALAPPDATA%low\ad1rf3am8r\api-ms-win-core-libraryloader-l1-1-0.dll
- %LOCALAPPDATA%low\ad1rf3am8r\api-ms-win-core-interlocked-l1-1-0.dll
- %LOCALAPPDATA%low\ad1rf3am8r\api-ms-win-core-heap-l1-1-0.dll
- %LOCALAPPDATA%low\ad1rf3am8r\api-ms-win-core-handle-l1-1-0.dll
- %LOCALAPPDATA%low\ad1rf3am8r\api-ms-win-core-file-l2-1-0.dll
- %LOCALAPPDATA%low\ad1rf3am8r\api-ms-win-core-file-l1-2-0.dll
- %LOCALAPPDATA%low\ad1rf3am8r\api-ms-win-crt-utility-l1-1-0.dll
- %LOCALAPPDATA%low\ad1rf3am8r\api-ms-win-crt-time-l1-1-0.dll
- %LOCALAPPDATA%low\ad1rf3am8r\api-ms-win-crt-string-l1-1-0.dll
- %LOCALAPPDATA%low\ad1rf3am8r\api-ms-win-crt-stdio-l1-1-0.dll
- %LOCALAPPDATA%low\ad1rf3am8r\api-ms-win-crt-runtime-l1-1-0.dll
- %LOCALAPPDATA%low\ad1rf3am8r\api-ms-win-crt-process-l1-1-0.dll
- %LOCALAPPDATA%low\ad1rf3am8r\api-ms-win-crt-private-l1-1-0.dll
- %LOCALAPPDATA%low\ad1rf3am8r\api-ms-win-crt-multibyte-l1-1-0.dll
- %LOCALAPPDATA%low\ad1rf3am8r\api-ms-win-crt-math-l1-1-0.dll
- %LOCALAPPDATA%low\ad1rf3am8r\api-ms-win-crt-locale-l1-1-0.dll
- %LOCALAPPDATA%low\ad1rf3am8r\api-ms-win-crt-heap-l1-1-0.dll
- %LOCALAPPDATA%low\ad1rf3am8r\api-ms-win-crt-filesystem-l1-1-0.dll
- %LOCALAPPDATA%low\ad1rf3am8r\api-ms-win-crt-environment-l1-1-0.dll
- %LOCALAPPDATA%low\ad1rf3am8r\api-ms-win-crt-convert-l1-1-0.dll
- %LOCALAPPDATA%low\ad1rf3am8r\api-ms-win-crt-conio-l1-1-0.dll
- %LOCALAPPDATA%low\ad1rf3am8r\api-ms-win-core-timezone-l1-1-0.dll
- %LOCALAPPDATA%low\ad1rf3am8r\api-ms-win-core-util-l1-1-0.dll
- %LOCALAPPDATA%low\ad1rf3am8r\api-ms-win-core-localization-l1-2-0.dll
- %LOCALAPPDATA%low\ad1rf3am8r\api-ms-win-core-memory-l1-1-0.dll
- %TEMP%\f0b1.tmp
- %TEMP%\f0b0.tmp
- %TEMP%\f0a0.tmp
- %TEMP%\f09f.tmp
- %TEMP%\f08e.tmp
- %TEMP%\f08d.tmp
- %TEMP%\f07d.tmp
- %TEMP%\f06c.tmp
- %TEMP%\efb0.tmp
- %TEMP%\ef9f.tmp
- %TEMP%\ef6e.tmp
- %LOCALAPPDATA%low\ad1rf3am8r\mozmapi32.dll
- %TEMP%\eec2.tmp
- %TEMP%\eeb1.tmp-shm
- %TEMP%\eeb1.tmp
- %TEMP%\ea20.exe
- %LOCALAPPDATA%low\2hxqpoo9fzs.zip
- %LOCALAPPDATA%low\el4nz5eh2n
- %LOCALAPPDATA%low\m9efdwbh7-shm
- %LOCALAPPDATA%low\m9efdwbh7
- %LOCALAPPDATA%low\fraqbc8ws-shm
- %LOCALAPPDATA%low\fraqbc8ws
- %LOCALAPPDATA%low\ad1rf3am8r\api-ms-win-core-sysinfo-l1-1-0.dll
- %LOCALAPPDATA%low\ad1rf3am8r\api-ms-win-core-synch-l1-2-0.dll
- %LOCALAPPDATA%low\ad1rf3am8r\api-ms-win-core-synch-l1-1-0.dll
- %LOCALAPPDATA%low\ad1rf3am8r\qipcap.dll
- %LOCALAPPDATA%low\ad1rf3am8r\prldap60.dll
- %LOCALAPPDATA%low\ad1rf3am8r\nssdbm3.dll
- %LOCALAPPDATA%low\ad1rf3am8r\ej7xg7cq_5q.zip
- %LOCALAPPDATA%\microsoft\vault\4bf4c442-9b8a-41a0-b380-dd4a704ddb28\policy.vpol
- %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch
- %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch
- %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\policy.vpol
- %LOCALAPPDATA%low\bbsqwy6yhk
- %LOCALAPPDATA%low\gxix4a2dre
- %LOCALAPPDATA%low\exuieaoeii
- %LOCALAPPDATA%low\3solbph71y
- %LOCALAPPDATA%low\x3cf3ednhm
- %LOCALAPPDATA%low\rqf69azbla
- %LOCALAPPDATA%low\rywtiizs2t
- %LOCALAPPDATA%low\1xvpfvjcrg
- %LOCALAPPDATA%low\fraqbc8wsa
- %LOCALAPPDATA%low\sqlite3.dll
- %TEMP%\8e2b.exe
- %APPDATA%\twcfdrr
- %LOCALAPPDATA%low\ad1rf3am8r\ucrtbase.dll
- %LOCALAPPDATA%low\ad1rf3am8r\vcruntime140.dll
- %LOCALAPPDATA%low\ad1rf3am8r\softokn3.dll
- %LOCALAPPDATA%low\ad1rf3am8r\accessiblehandler.dll
- %LOCALAPPDATA%low\ad1rf3am8r\api-ms-win-core-string-l1-1-0.dll
- %LOCALAPPDATA%low\ad1rf3am8r\accessiblemarshal.dll
- %LOCALAPPDATA%low\ad1rf3am8r\api-ms-win-core-rtlsupport-l1-1-0.dll
- %LOCALAPPDATA%low\ad1rf3am8r\api-ms-win-core-profile-l1-1-0.dll
- %LOCALAPPDATA%low\ad1rf3am8r\api-ms-win-core-processthreads-l1-1-1.dll
- %LOCALAPPDATA%low\ad1rf3am8r\api-ms-win-core-processthreads-l1-1-0.dll
- %LOCALAPPDATA%low\ad1rf3am8r\api-ms-win-core-processenvironment-l1-1-0.dll
- %LOCALAPPDATA%low\ad1rf3am8r\api-ms-win-core-namedpipe-l1-1-0.dll
- %LOCALAPPDATA%low\ad1rf3am8r\nssckbi.dll
- %LOCALAPPDATA%low\ad1rf3am8r\nss3.dll
- %LOCALAPPDATA%low\ad1rf3am8r\msvcp140.dll
- %TEMP%\ef8f.tmp
- %TEMP%\f0c2.tmp
- %LOCALAPPDATA%low\ad1rf3am8r\mozglue.dll
- %LOCALAPPDATA%low\ad1rf3am8r\mapiproxy_inuse.dll
- %LOCALAPPDATA%low\ad1rf3am8r\mapiproxy.dll
- %LOCALAPPDATA%low\ad1rf3am8r\libegl.dll
- %LOCALAPPDATA%low\ad1rf3am8r\lgpllibs.dll
- %LOCALAPPDATA%low\ad1rf3am8r\ldif60.dll
- %LOCALAPPDATA%low\ad1rf3am8r\ldap60.dll
- %LOCALAPPDATA%low\ad1rf3am8r\ia2marshal.dll
- %LOCALAPPDATA%low\ad1rf3am8r\freebl3.dll
- %LOCALAPPDATA%low\ad1rf3am8r\breakpadinjector.dll
- %LOCALAPPDATA%low\ad1rf3am8r\mozmapi32_inuse.dll
- %TEMP%\f0c2.tmp-shm
Присваивает атрибут 'скрытый' для следующих файлов
- %APPDATA%\udttcig
- %APPDATA%\twcfdrr
Удаляет следующие файлы
- %LOCALAPPDATA%low\fraqbc8wsa
- %LOCALAPPDATA%low\ad1rf3am8r\nssckbi.dll
- %LOCALAPPDATA%low\ad1rf3am8r\nss3.dll
- %LOCALAPPDATA%low\ad1rf3am8r\msvcp140.dll
- %LOCALAPPDATA%low\ad1rf3am8r\mozmapi32_inuse.dll
- %LOCALAPPDATA%low\ad1rf3am8r\mozmapi32.dll
- %LOCALAPPDATA%low\ad1rf3am8r\mozglue.dll
- %LOCALAPPDATA%low\ad1rf3am8r\mapiproxy_inuse.dll
- %LOCALAPPDATA%low\ad1rf3am8r\mapiproxy.dll
- %LOCALAPPDATA%low\ad1rf3am8r\libegl.dll
- %LOCALAPPDATA%low\ad1rf3am8r\lgpllibs.dll
- %LOCALAPPDATA%low\ad1rf3am8r\ldif60.dll
- %LOCALAPPDATA%low\ad1rf3am8r\ldap60.dll
- %LOCALAPPDATA%low\ad1rf3am8r\ia2marshal.dll
- %LOCALAPPDATA%low\ad1rf3am8r\freebl3.dll
- %LOCALAPPDATA%low\ad1rf3am8r\breakpadinjector.dll
- %LOCALAPPDATA%low\ad1rf3am8r\api-ms-win-crt-utility-l1-1-0.dll
- %LOCALAPPDATA%low\ad1rf3am8r\api-ms-win-crt-time-l1-1-0.dll
- %LOCALAPPDATA%low\ad1rf3am8r\api-ms-win-crt-string-l1-1-0.dll
- %LOCALAPPDATA%low\ad1rf3am8r\api-ms-win-crt-stdio-l1-1-0.dll
- %LOCALAPPDATA%low\ad1rf3am8r\api-ms-win-crt-process-l1-1-0.dll
- %LOCALAPPDATA%low\ad1rf3am8r\api-ms-win-crt-runtime-l1-1-0.dll
- %LOCALAPPDATA%low\ad1rf3am8r\nssdbm3.dll
- %LOCALAPPDATA%low\ad1rf3am8r\prldap60.dll
- %TEMP%\f0b1.tmp
- %TEMP%\f0b0.tmp
- %TEMP%\f0a0.tmp
- %TEMP%\f09f.tmp
- %TEMP%\f08e.tmp
- %TEMP%\f08d.tmp
- %TEMP%\f07d.tmp
- %TEMP%\f06c.tmp
- %TEMP%\efb0.tmp
- %TEMP%\ef8f.tmp
- %LOCALAPPDATA%low\ad1rf3am8r\api-ms-win-core-synch-l1-1-0.dll
- %TEMP%\ef6e.tmp
- %TEMP%\eec2.tmp
- %TEMP%\eeb1.tmp
- %TEMP%\eeb1.tmp-shm
- %LOCALAPPDATA%low\sqlite3.dll
- %LOCALAPPDATA%low\ad1rf3am8r\vcruntime140.dll
- %LOCALAPPDATA%low\ad1rf3am8r\ucrtbase.dll
- %LOCALAPPDATA%low\ad1rf3am8r\softokn3.dll
- %LOCALAPPDATA%low\ad1rf3am8r\qipcap.dll
- %LOCALAPPDATA%low\ad1rf3am8r\api-ms-win-crt-private-l1-1-0.dll
- %LOCALAPPDATA%low\ad1rf3am8r\api-ms-win-crt-multibyte-l1-1-0.dll
- %LOCALAPPDATA%low\ad1rf3am8r\api-ms-win-crt-math-l1-1-0.dll
- %LOCALAPPDATA%low\ad1rf3am8r\api-ms-win-core-file-l1-2-0.dll
- %LOCALAPPDATA%low\ad1rf3am8r\accessiblemarshal.dll
- %LOCALAPPDATA%low\ad1rf3am8r\accessiblehandler.dll
- %LOCALAPPDATA%low\2hxqpoo9fzs.zip
- %LOCALAPPDATA%low\el4nz5eh2n
- %LOCALAPPDATA%low\m9efdwbh7
- %LOCALAPPDATA%low\m9efdwbh7-shm
- %LOCALAPPDATA%low\fraqbc8ws
- %LOCALAPPDATA%low\fraqbc8ws-shm
- %LOCALAPPDATA%low\ad1rf3am8r\ej7xg7cq_5q.zip
- %LOCALAPPDATA%low\bbsqwy6yhk
- %LOCALAPPDATA%low\gxix4a2dre
- %LOCALAPPDATA%low\exuieaoeii
- %LOCALAPPDATA%low\3solbph71y
- %LOCALAPPDATA%low\x3cf3ednhm
- %LOCALAPPDATA%low\rqf69azbla
- %LOCALAPPDATA%low\rywtiizs2t
- %LOCALAPPDATA%low\1xvpfvjcrg
- %LOCALAPPDATA%low\ad1rf3am8r\api-ms-win-core-handle-l1-1-0.dll
- %LOCALAPPDATA%low\ad1rf3am8r\api-ms-win-core-heap-l1-1-0.dll
- %LOCALAPPDATA%low\ad1rf3am8r\api-ms-win-core-file-l2-1-0.dll
- %LOCALAPPDATA%low\ad1rf3am8r\api-ms-win-core-interlocked-l1-1-0.dll
- %LOCALAPPDATA%low\ad1rf3am8r\api-ms-win-crt-locale-l1-1-0.dll
- %LOCALAPPDATA%low\ad1rf3am8r\api-ms-win-core-libraryloader-l1-1-0.dll
- %LOCALAPPDATA%low\ad1rf3am8r\api-ms-win-crt-heap-l1-1-0.dll
- %LOCALAPPDATA%low\ad1rf3am8r\api-ms-win-crt-filesystem-l1-1-0.dll
- %LOCALAPPDATA%low\ad1rf3am8r\api-ms-win-crt-environment-l1-1-0.dll
- %LOCALAPPDATA%low\ad1rf3am8r\api-ms-win-crt-convert-l1-1-0.dll
- %LOCALAPPDATA%low\ad1rf3am8r\api-ms-win-crt-conio-l1-1-0.dll
- %LOCALAPPDATA%low\ad1rf3am8r\api-ms-win-core-util-l1-1-0.dll
- %LOCALAPPDATA%low\ad1rf3am8r\api-ms-win-core-timezone-l1-1-0.dll
- %LOCALAPPDATA%low\ad1rf3am8r\api-ms-win-core-sysinfo-l1-1-0.dll
- %TEMP%\ef9f.tmp
- %TEMP%\f0c2.tmp-shm
- %LOCALAPPDATA%low\ad1rf3am8r\api-ms-win-core-string-l1-1-0.dll
- %LOCALAPPDATA%low\ad1rf3am8r\api-ms-win-core-rtlsupport-l1-1-0.dll
- %LOCALAPPDATA%low\ad1rf3am8r\api-ms-win-core-profile-l1-1-0.dll
- %LOCALAPPDATA%low\ad1rf3am8r\api-ms-win-core-processthreads-l1-1-1.dll
- %LOCALAPPDATA%low\ad1rf3am8r\api-ms-win-core-processthreads-l1-1-0.dll
- %LOCALAPPDATA%low\ad1rf3am8r\api-ms-win-core-processenvironment-l1-1-0.dll
- %LOCALAPPDATA%low\ad1rf3am8r\api-ms-win-core-namedpipe-l1-1-0.dll
- %LOCALAPPDATA%low\ad1rf3am8r\api-ms-win-core-memory-l1-1-0.dll
- %LOCALAPPDATA%low\ad1rf3am8r\api-ms-win-core-localization-l1-2-0.dll
- %LOCALAPPDATA%low\ad1rf3am8r\api-ms-win-core-synch-l1-2-0.dll
- %TEMP%\f0c2.tmp
Самоудаляется.
Сетевая активность
Подключается к
- 're######istforaugust9.xyz':80
- '10#.#4.209.121':80
- '5.###.156.120':80
TCP
Запросы HTTP GET
- http://5.###.156.120//l/f/8BO_nnsBPvGyIjkLeKq8/cda2f3d03972f1a5d9de224c1fc73f063ed596c0
- http://5.###.156.120//l/f/8BO_nnsBPvGyIjkLeKq8/31e020ab7830e68982752cd8f98152b8b079e2a5
- http://re######istforaugust9.xyz/reestr.exe
- http://re######istforaugust9.xyz/raccon.exe
Запросы HTTP POST
- http://5.###.156.120/
- http://re######istforaugust9.xyz/
Другие
- 'te##te.in':443
UDP
- DNS ASK re######istforaugust1.xyz
- DNS ASK re######istforaugust2.xyz
- DNS ASK re######istforaugust3.xyz
- DNS ASK re######istforaugust4.xyz
- DNS ASK re######istforaugust5.xyz
- DNS ASK re######istforaugust6.xyz
- DNS ASK re######istforaugust7.xyz
- DNS ASK re######istforaugust8.xyz
- DNS ASK re######istforaugust9.xyz
- DNS ASK te##te.in
Другое
Создает и запускает на исполнение
- '%TEMP%\8e2b.exe'
- '%TEMP%\ea20.exe'
Запускает на исполнение
- '%WINDIR%\syswow64\explorer.exe'
- '%WINDIR%\explorer.exe'
