Техническая информация
Вредоносные функции
Запускает на исполнение
- '%WINDIR%\syswow64\taskkill.exe' /im "IggedFrog12.exe" /f
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\is-9ra9i.tmp\<Имя файла>.tmp
- %ProgramFiles(x86)%\iggedfrog\translation\is-0g2sc.tmp
- %ProgramFiles(x86)%\iggedfrog\translation\is-flk7s.tmp
- %ProgramFiles(x86)%\iggedfrog\is-h06hg.tmp
- %ProgramFiles(x86)%\iggedfrog\is-injit.tmp
- %ProgramFiles(x86)%\iggedfrog\extensions\meta\translation\is-pikg9.tmp
- %ProgramFiles(x86)%\iggedfrog\extensions\meta\translation\is-clvi9.tmp
- %ProgramFiles(x86)%\iggedfrog\extensions\meta\translation\is-aav8h.tmp
- %ProgramFiles(x86)%\iggedfrog\is-5jksn.tmp
- %ProgramFiles(x86)%\iggedfrog\extensions\meta\translation\is-dtfl5.tmp
- %ProgramFiles(x86)%\iggedfrog\extensions\meta\translation\is-tako0.tmp
- %ProgramFiles(x86)%\iggedfrog\extensions\meta\translation\is-093o7.tmp
- %ProgramFiles(x86)%\iggedfrog\extensions\meta\translation\is-6pb2i.tmp
- %ProgramFiles(x86)%\iggedfrog\extensions\meta\translation\is-nj54i.tmp
- %ProgramFiles(x86)%\iggedfrog\extensions\meta\is-4lqlq.tmp
- %ProgramFiles(x86)%\iggedfrog\extensions\meta\is-hqega.tmp
- %ProgramFiles(x86)%\iggedfrog\extensions\meta\is-ui29v.tmp
- %ProgramFiles(x86)%\iggedfrog\translation\is-54k7b.tmp
- %ProgramFiles(x86)%\iggedfrog\translation\is-sf414.tmp
- %ProgramFiles(x86)%\iggedfrog\translation\is-6lmg1.tmp
- %ProgramFiles(x86)%\iggedfrog\translation\is-7rq91.tmp
- %ProgramFiles(x86)%\iggedfrog\translation\is-lr1p2.tmp
- %TEMP%\is-9sr9n.tmp\_isetup\_setup64.tmp
- %TEMP%\is-9sr9n.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-9sr9n.tmp\_isetup\_iscrypt.dll
- %ProgramFiles(x86)%\iggedfrog\is-djlng.tmp
- %ProgramFiles(x86)%\iggedfrog\is-lqj0k.tmp
- %ProgramFiles(x86)%\iggedfrog\is-chb3i.tmp
- %ProgramFiles(x86)%\iggedfrog\is-h57sg.tmp
- %ProgramFiles(x86)%\iggedfrog\unins000.dat
- %ProgramFiles(x86)%\iggedfrog\extensions\meta\translation\is-ff36d.tmp
- %ProgramFiles(x86)%\iggedfrog\is-q5lcg.tmp
- %ProgramFiles(x86)%\iggedfrog\translation\is-f8agr.tmp
- %ProgramFiles(x86)%\iggedfrog\translation\is-8n3p3.tmp
- %ProgramFiles(x86)%\iggedfrog\translation\is-us2um.tmp
- %ProgramFiles(x86)%\iggedfrog\translation\is-10b7u.tmp
- %ProgramFiles(x86)%\iggedfrog\translation\is-q3qod.tmp
- %ProgramFiles(x86)%\iggedfrog\translation\is-c6em1.tmp
- %ProgramFiles(x86)%\iggedfrog\translation\is-isq2a.tmp
- %TEMP%\is-9sr9n.tmp\_isetup\_regdll.tmp
- %ProgramFiles(x86)%\iggedfrog\translation\is-mt6f1.tmp
- %ProgramFiles(x86)%\iggedfrog\iggedfrog12.exe
Удаляет следующие файлы
- %TEMP%\is-9ra9i.tmp\<Имя файла>.tmp
- %ProgramFiles(x86)%\iggedfrog\iggedfrog12.exe
Перемещает следующие файлы
- %ProgramFiles(x86)%\iggedfrog\is-djlng.tmp в %ProgramFiles(x86)%\iggedfrog\unins000.exe
- %ProgramFiles(x86)%\iggedfrog\translation\is-0g2sc.tmp в %ProgramFiles(x86)%\iggedfrog\translation\spanish.xml
- %ProgramFiles(x86)%\iggedfrog\translation\is-flk7s.tmp в %ProgramFiles(x86)%\iggedfrog\translation\turkish.xml
- %ProgramFiles(x86)%\iggedfrog\is-h06hg.tmp в %ProgramFiles(x86)%\iggedfrog\license.txt
- %ProgramFiles(x86)%\iggedfrog\is-injit.tmp в %ProgramFiles(x86)%\iggedfrog\whatsnew.txt
- %ProgramFiles(x86)%\iggedfrog\extensions\meta\translation\is-pikg9.tmp в %ProgramFiles(x86)%\iggedfrog\extensions\meta\translation\meta_english.xml
- %ProgramFiles(x86)%\iggedfrog\extensions\meta\translation\is-clvi9.tmp в %ProgramFiles(x86)%\iggedfrog\extensions\meta\translation\meta_german.xml
- %ProgramFiles(x86)%\iggedfrog\extensions\meta\translation\is-dtfl5.tmp в %ProgramFiles(x86)%\iggedfrog\extensions\meta\translation\meta_japanese.xml
- %ProgramFiles(x86)%\iggedfrog\extensions\meta\is-hqega.tmp в %ProgramFiles(x86)%\iggedfrog\extensions\meta\interop.dsolefile.dll
- %ProgramFiles(x86)%\iggedfrog\extensions\meta\translation\is-ff36d.tmp в %ProgramFiles(x86)%\iggedfrog\extensions\meta\translation\meta_portuguese-br.xml
- %ProgramFiles(x86)%\iggedfrog\extensions\meta\translation\is-tako0.tmp в %ProgramFiles(x86)%\iggedfrog\extensions\meta\translation\meta_romanian.xml
- %ProgramFiles(x86)%\iggedfrog\extensions\meta\translation\is-093o7.tmp в %ProgramFiles(x86)%\iggedfrog\extensions\meta\translation\meta_russian.xml
- %ProgramFiles(x86)%\iggedfrog\extensions\meta\translation\is-6pb2i.tmp в %ProgramFiles(x86)%\iggedfrog\extensions\meta\translation\meta_spanish.xml
- %ProgramFiles(x86)%\iggedfrog\extensions\meta\translation\is-nj54i.tmp в %ProgramFiles(x86)%\iggedfrog\extensions\meta\translation\meta_turkish.xml
- %ProgramFiles(x86)%\iggedfrog\extensions\meta\is-4lqlq.tmp в %ProgramFiles(x86)%\iggedfrog\extensions\meta\dsofile.dll
- %ProgramFiles(x86)%\iggedfrog\translation\is-sf414.tmp в %ProgramFiles(x86)%\iggedfrog\translation\slovak.xml
- %ProgramFiles(x86)%\iggedfrog\extensions\meta\translation\is-aav8h.tmp в %ProgramFiles(x86)%\iggedfrog\extensions\meta\translation\meta_hungarian.xml
- %ProgramFiles(x86)%\iggedfrog\translation\is-54k7b.tmp в %ProgramFiles(x86)%\iggedfrog\translation\russian.xml
- %ProgramFiles(x86)%\iggedfrog\translation\is-f8agr.tmp в %ProgramFiles(x86)%\iggedfrog\translation\chinese-traditional.xml
- %ProgramFiles(x86)%\iggedfrog\is-lqj0k.tmp в %ProgramFiles(x86)%\iggedfrog\iggedfrog12.exe
- %ProgramFiles(x86)%\iggedfrog\is-chb3i.tmp в %ProgramFiles(x86)%\iggedfrog\wildfrog.dll
- %ProgramFiles(x86)%\iggedfrog\is-h57sg.tmp в %ProgramFiles(x86)%\iggedfrog\taggedfrog.extensions.dll
- %ProgramFiles(x86)%\iggedfrog\is-q5lcg.tmp в %ProgramFiles(x86)%\iggedfrog\tfshellmenu.dll
- %ProgramFiles(x86)%\iggedfrog\is-5jksn.tmp в %ProgramFiles(x86)%\iggedfrog\componentfactory.krypton.toolkit.dll
- %ProgramFiles(x86)%\iggedfrog\translation\is-mt6f1.tmp в %ProgramFiles(x86)%\iggedfrog\translation\chinese-simplified.xml
- %ProgramFiles(x86)%\iggedfrog\translation\is-8n3p3.tmp в %ProgramFiles(x86)%\iggedfrog\translation\dutch.xml
- %ProgramFiles(x86)%\iggedfrog\translation\is-7rq91.tmp в %ProgramFiles(x86)%\iggedfrog\translation\portuguese-br.xml
- %ProgramFiles(x86)%\iggedfrog\translation\is-us2um.tmp в %ProgramFiles(x86)%\iggedfrog\translation\english.xml
- %ProgramFiles(x86)%\iggedfrog\translation\is-10b7u.tmp в %ProgramFiles(x86)%\iggedfrog\translation\french.xml
- %ProgramFiles(x86)%\iggedfrog\translation\is-q3qod.tmp в %ProgramFiles(x86)%\iggedfrog\translation\german.xml
- %ProgramFiles(x86)%\iggedfrog\translation\is-c6em1.tmp в %ProgramFiles(x86)%\iggedfrog\translation\hungarian.xml
- %ProgramFiles(x86)%\iggedfrog\translation\is-isq2a.tmp в %ProgramFiles(x86)%\iggedfrog\translation\italian.xml
- %ProgramFiles(x86)%\iggedfrog\translation\is-lr1p2.tmp в %ProgramFiles(x86)%\iggedfrog\translation\japanese.xml
- %ProgramFiles(x86)%\iggedfrog\translation\is-6lmg1.tmp в %ProgramFiles(x86)%\iggedfrog\translation\romanian.xml
- %ProgramFiles(x86)%\iggedfrog\extensions\meta\is-ui29v.tmp в %ProgramFiles(x86)%\iggedfrog\extensions\meta\taggedfrog.extensions.meta.dll
Сетевая активность
Подключается к
- '45.##.253.51':80
TCP
Запросы HTTP GET
- http://45.##.253.51/publisher.php?su#########
Другое
Ищет следующие окна
- ClassName: '729D3B62-61C0-2478-9F8D-0A542019BEDA' WindowName: ''
- ClassName: '' WindowName: ''
Создает и запускает на исполнение
- '%TEMP%\is-9ra9i.tmp\<Имя файла>.tmp' /SL5="$E0154,1598830,135168,<Полный путь к файлу>"
- '%ProgramFiles(x86)%\iggedfrog\iggedfrog12.exe'
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /im "IggedFrog12.exe" /f & erase "%ProgramFiles(x86)%\IggedFrog\IggedFrog12.exe" & exit' (со скрытым окном)
Запускает на исполнение
- '%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\IggedFrog\TFShellMenu.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\IggedFrog\extensions\Meta\dsofile.dll"
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /im "IggedFrog12.exe" /f & erase "%ProgramFiles(x86)%\IggedFrog\IggedFrog12.exe" & exit
