Trojan.Encoder.33865

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'NR' = '"%TEMP%\NitroRansomware.exe"'

Изменения в файловой системе

Создает следующие файлы

%TEMP%\nitroransomware.exe
%TEMP%\_mei23122\python3.dll
%TEMP%\_mei23122\pyexpat.pyd
%TEMP%\_mei23122\psutil\_psutil_windows.pyd
%TEMP%\_mei23122\nacl\_sodium.pyd
%TEMP%\_mei23122\multidict\_multidict.cp39-win_amd64.pyd
%TEMP%\_mei23122\mfc140u.dll
%TEMP%\_mei23122\libssl-1_1.dll
%TEMP%\_mei23122\libffi-7.dll
%TEMP%\_mei23122\libcrypto-1_1.dll
%TEMP%\_mei23122\cryptography\hazmat\bindings\_rust.pyd
%TEMP%\_mei23122\cryptography\hazmat\bindings\_openssl.pyd
%TEMP%\_mei23122\pywin32_system32\pythoncom39.dll
%TEMP%\_mei23122\python39.dll
%TEMP%\_mei23122\aiohttp\_http_parser.cp39-win_amd64.pyd
%TEMP%\_mei23122\aiohttp\_helpers.cp39-win_amd64.pyd
%TEMP%\_mei23122\aiohttp\_frozenlist.cp39-win_amd64.pyd
%TEMP%\_mei23122\_win32sysloader.pyd
%TEMP%\_mei23122\_uuid.pyd
%TEMP%\_mei23122\_ssl.pyd
%TEMP%\_mei23122\_sqlite3.pyd
%TEMP%\_mei23122\_socket.pyd
%TEMP%\_mei23122\_queue.pyd
%TEMP%\_mei23122\_overlapped.pyd
%TEMP%\_mei23122\_multiprocessing.pyd
%TEMP%\_mei23122\aiohttp\_websocket.cp39-win_amd64.pyd
%TEMP%\_mei23122\crypto\hash\_sha256.pyd
%TEMP%\_mei23122\pywin32_system32\pywintypes39.dll
%TEMP%\_mei23122\setuptools-56.0.0.dist-info\dependency_links.txt
%TEMP%\_mei23122\setuptools-56.0.0.dist-info\wheel
%TEMP%\_mei23122\setuptools-56.0.0.dist-info\record
%TEMP%\_mei23122\setuptools-56.0.0.dist-info\metadata
%TEMP%\_mei23122\setuptools-56.0.0.dist-info\license
%TEMP%\_mei23122\setuptools-56.0.0.dist-info\installer
%TEMP%\_mei23122\cryptography-39.0.0.dist-info\top_level.txt
%TEMP%\_mei23122\cryptography-39.0.0.dist-info\wheel
%TEMP%\_mei23122\cryptography-39.0.0.dist-info\record
%TEMP%\_mei23122\cryptography-39.0.0.dist-info\metadata
%TEMP%\_mei23122\cryptography-39.0.0.dist-info\license.psf
%TEMP%\_mei23122\cryptography-39.0.0.dist-info\license.bsd
%TEMP%\_mei23122\cryptography-39.0.0.dist-info\license.apache
%TEMP%\_mei23122\cryptography-39.0.0.dist-info\license
%TEMP%\_mei23122\cryptography-39.0.0.dist-info\installer
%TEMP%\_mei23122\certifi\cacert.pem
%TEMP%\_mei23122\base_library.zip
%TEMP%\_mei23122\yarl\_quoting_c.cp39-win_amd64.pyd
%TEMP%\_mei23122\win32ui.pyd
%TEMP%\_mei23122\win32trace.pyd
%TEMP%\_mei23122\win32crypt.pyd
%TEMP%\_mei23122\win32com\shell\shell.pyd
%TEMP%\_mei23122\win32api.pyd
%TEMP%\_mei23122\unicodedata.pyd
%TEMP%\_mei23122\sqlite3.dll
%TEMP%\_mei23122\_lzma.pyd
%TEMP%\_mei23122\aiohttp\_http_writer.cp39-win_amd64.pyd
%TEMP%\_mei23122\_hashlib.pyd
%TEMP%\_mei23122\_elementtree.pyd
%TEMP%\_mei23122\_decimal.pyd
%TEMP%\_mei23122\crypto\cipher\_raw_ctr.pyd
%TEMP%\_mei23122\crypto\hash\_md5.pyd
%TEMP%\_mei23122\crypto\hash\_md4.pyd
%TEMP%\_mei23122\crypto\hash\_md2.pyd
%TEMP%\_mei23122\crypto\hash\_blake2s.pyd
%TEMP%\_mei23122\crypto\hash\_blake2b.pyd
%TEMP%\_mei23122\crypto\cipher\_raw_ofb.pyd
%TEMP%\_mei23122\crypto\cipher\_raw_ocb.pyd
%TEMP%\_mei23122\crypto\cipher\_raw_eksblowfish.pyd
%TEMP%\_mei23122\crypto\cipher\_raw_ecb.pyd
%TEMP%\_mei23122\crypto\cipher\_raw_des3.pyd
%TEMP%\_mei23122\crypto\cipher\_raw_des.pyd
%TEMP%\_mei23122\crypto\cipher\_raw_cfb.pyd
%TEMP%\_mei23122\crypto\hash\_sha1.pyd
%TEMP%\_mei23122\crypto\cipher\_raw_cbc.pyd
%TEMP%\_mei23122\crypto\cipher\_raw_cast.pyd
%TEMP%\_mei23122\crypto\cipher\_raw_blowfish.pyd
%TEMP%\_mei23122\crypto\cipher\_raw_arc2.pyd
%TEMP%\_mei23122\crypto\cipher\_raw_aesni.pyd
%TEMP%\_mei23122\crypto\cipher\_raw_aes.pyd
%TEMP%\_mei23122\crypto\cipher\_pkcs1_decode.pyd
%TEMP%\_mei23122\crypto\cipher\_chacha20.pyd
%TEMP%\_mei23122\crypto\cipher\_salsa20.pyd
%TEMP%\_mei23122\crypto\cipher\_arc4.pyd
%TEMP%\hi.exe
%TEMP%\_mei23122\setuptools-56.0.0.dist-info\entry_points.txt
%TEMP%\_mei23122\select.pyd
%TEMP%\_mei23122\crypto\hash\_sha224.pyd
%TEMP%\_mei23122\crypto\hash\_sha512.pyd
%TEMP%\_mei23122\crypto\hash\_ripemd160.pyd
%TEMP%\_mei23122\_ctypes.pyd
%TEMP%\_mei23122\_cffi_backend.cp39-win_amd64.pyd
%TEMP%\_mei23122\_bz2.pyd
%TEMP%\_mei23122\_brotli.cp39-win_amd64.pyd
%TEMP%\_mei23122\_asyncio.pyd
%TEMP%\_mei23122\vcruntime140_1.dll
%TEMP%\_mei23122\vcruntime140.dll
%TEMP%\_mei23122\pil\_webp.cp39-win_amd64.pyd
%TEMP%\_mei23122\pil\_imagingtk.cp39-win_amd64.pyd
%TEMP%\_mei23122\pil\_imagingcms.cp39-win_amd64.pyd
%TEMP%\_mei23122\pil\_imaging.cp39-win_amd64.pyd
%TEMP%\_mei23122\msvcp140.dll
%TEMP%\_mei23122\crypto\util\_strxor.pyd
%TEMP%\_mei23122\crypto\util\_cpuid_c.pyd
%TEMP%\_mei23122\crypto\publickey\_x25519.pyd
%TEMP%\_mei23122\crypto\publickey\_ed448.pyd
%TEMP%\_mei23122\crypto\publickey\_ed25519.pyd
%TEMP%\_mei23122\crypto\publickey\_ec_ws.pyd
%TEMP%\_mei23122\crypto\protocol\_scrypt.pyd
%TEMP%\_mei23122\crypto\math\_modexp.pyd
%TEMP%\_mei23122\crypto\hash\_poly1305.pyd
%TEMP%\_mei23122\crypto\hash\_keccak.pyd
%TEMP%\_mei23122\crypto\hash\_ghash_portable.pyd
%TEMP%\_mei23122\crypto\hash\_ghash_clmul.pyd
%TEMP%\_mei23122\crypto\hash\_sha384.pyd
%TEMP%\_mei23122\setuptools-56.0.0.dist-info\top_level.txt

Другое

Создает и запускает на исполнение

'%TEMP%\nitroransomware.exe'
'%TEMP%\hi.exe'
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -EncodedCommand "PAAjAG0AaQBkACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAcQB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwA...' (со скрытым окном)
'%TEMP%\nitroransomware.exe' ' (со скрытым окном)
'%TEMP%\hi.exe' ' (со скрытым окном)

Запускает на исполнение

'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -EncodedCommand "PAAjAG0AaQBkACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAcQB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwA...