Техническая информация
Для обеспечения автозапуска и распространения
Модифицирует следующие ключи реестра
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\] 'CSRSS' = '"%ALLUSERSPROFILE%\Drivers\csrss.exe"'
Создает или изменяет следующие файлы
- <SYSTEM32>\tasks\firefox default browser agent fdece41dc5aeaef5
Модифицирует главную загрузочную запись (MBR).
Вредоносные функции
Внедряет код в
следующие пользовательские процессы:
- f825.exe
Изменения в файловой системе
Создает следующие файлы
- %APPDATA%\crsvgbc
- %TEMP%\is-k8onb.tmp\_isetup\_iscrypt.dll
- %TEMP%\nst952f.tmp
- %LOCALAPPDATA%\cd-rom emulator\is-fi35s.tmp
- %LOCALAPPDATA%\cd-rom emulator\is-ej1rq.tmp
- %LOCALAPPDATA%\cd-rom emulator\is-68nbn.tmp
- %LOCALAPPDATA%\cd-rom emulator\is-djn6g.tmp
- %LOCALAPPDATA%\cd-rom emulator\is-qn44o.tmp
- %LOCALAPPDATA%\cd-rom emulator\is-g6hl6.tmp
- %LOCALAPPDATA%\cd-rom emulator\is-6h6eo.tmp
- %LOCALAPPDATA%\cd-rom emulator\unins000.dat
- %LOCALAPPDATA%\cd-rom emulator\is-usbh0.tmp
- %LOCALAPPDATA%\cd-rom emulator\is-osu1g.tmp
- %LOCALAPPDATA%\cd-rom emulator\is-ep0e6.tmp
- %LOCALAPPDATA%\cd-rom emulator\is-35hgr.tmp
- %LOCALAPPDATA%\cd-rom emulator\is-8g8ed.tmp
- %LOCALAPPDATA%\cd-rom emulator\is-lqajh.tmp
- %LOCALAPPDATA%\cd-rom emulator\languages\is-acb3a.tmp
- %LOCALAPPDATA%\cd-rom emulator\is-r321g.tmp
- %TEMP%\is-k8onb.tmp\_isetup\_isdecmp.dll
- %LOCALAPPDATA%\cd-rom emulator\is-pct5i.tmp
- %TEMP%\is-k8onb.tmp\_isetup\_shfoldr.dll
- %TEMP%\4kpv6a~1\cached-certs.tmp
- %TEMP%\f1bd.dll
- %TEMP%\f825.exe
- %TEMP%\dc.exe
- %TEMP%\2177.exe
- %ALLUSERSPROFILE%\drivers\csrss.exe
- %TEMP%\4kpv6a~1\state.tmp
- %TEMP%\38b0.exe
- %TEMP%\4kpv6a~1\unverified-microdesc-consensus.tmp
- %TEMP%\4kpv6a~1\cached-microdesc-consensus.tmp
- %TEMP%\is-gjfea.tmp\84de.tmp
- %TEMP%\4kpv6a~1\cached-microdescs.new
- %TEMP%\6378.exe
- %TEMP%\288c47bbc1871b439df19ff4df68f076.exe
- %TEMP%\installsetup4.exe
- %TEMP%\fourthx.exe
- %TEMP%\broomsetup.exe
- %TEMP%\84de.exe
- %TEMP%\nsy8af1.tmp\inetc.dll
- %TEMP%\is-k8onb.tmp\_isetup\_setup64.tmp
- %LOCALAPPDATA%\cd-rom emulator\cdromemulator.exe
Присваивает атрибут 'скрытый' для следующих файлов
- %APPDATA%\crsvgbc
- %ALLUSERSPROFILE%\drivers\csrss.exe
Удаляет следующие файлы
- %TEMP%\f1bd.dll
- %TEMP%\4kpv6a~1\unverified-microdesc-consensus
- %TEMP%\4kpv6a~1\state
- %LOCALAPPDATA%\cd-rom emulator\libgcc_s_dw2-1.dll
Перемещает следующие файлы
- %TEMP%\4kpv6a~1\state.tmp в %TEMP%\4kpv6a~1\state
- %LOCALAPPDATA%\cd-rom emulator\is-lqajh.tmp в %LOCALAPPDATA%\cd-rom emulator\setting.ini
- %LOCALAPPDATA%\cd-rom emulator\is-8g8ed.tmp в %LOCALAPPDATA%\cd-rom emulator\sdl2.dll
- %LOCALAPPDATA%\cd-rom emulator\is-35hgr.tmp в %LOCALAPPDATA%\cd-rom emulator\swresample-3.dll
- %LOCALAPPDATA%\cd-rom emulator\is-ep0e6.tmp в %LOCALAPPDATA%\cd-rom emulator\zlib1.dll
- %LOCALAPPDATA%\cd-rom emulator\is-osu1g.tmp в %LOCALAPPDATA%\cd-rom emulator\libbz2-1.dll
- %LOCALAPPDATA%\cd-rom emulator\is-usbh0.tmp в %LOCALAPPDATA%\cd-rom emulator\libwinpthread-1.dll
- %LOCALAPPDATA%\cd-rom emulator\is-6h6eo.tmp в %LOCALAPPDATA%\cd-rom emulator\libvorbisenc-2.dll
- %LOCALAPPDATA%\cd-rom emulator\languages\is-acb3a.tmp в %LOCALAPPDATA%\cd-rom emulator\languages\turkish.ini
- %LOCALAPPDATA%\cd-rom emulator\is-pct5i.tmp в %LOCALAPPDATA%\cd-rom emulator\libvorbis-0.dll
- %LOCALAPPDATA%\cd-rom emulator\is-qn44o.tmp в %LOCALAPPDATA%\cd-rom emulator\libiconv-2.dll
- %LOCALAPPDATA%\cd-rom emulator\is-68nbn.tmp в %LOCALAPPDATA%\cd-rom emulator\avutil-56.dll
- %LOCALAPPDATA%\cd-rom emulator\is-ej1rq.tmp в %LOCALAPPDATA%\cd-rom emulator\libgcc_s_dw2-1.dll
- %LOCALAPPDATA%\cd-rom emulator\is-fi35s.tmp в %LOCALAPPDATA%\cd-rom emulator\unins000.exe
- %TEMP%\4kpv6a~1\cached-microdesc-consensus.tmp в %TEMP%\4kpv6a~1\cached-microdesc-consensus
- %TEMP%\4kpv6a~1\cached-certs.tmp в %TEMP%\4kpv6a~1\cached-certs
- %TEMP%\4kpv6a~1\unverified-microdesc-consensus.tmp в %TEMP%\4kpv6a~1\unverified-microdesc-consensus
- %LOCALAPPDATA%\cd-rom emulator\is-g6hl6.tmp в %LOCALAPPDATA%\cd-rom emulator\libogg-0.dll
- %LOCALAPPDATA%\cd-rom emulator\is-r321g.tmp в %LOCALAPPDATA%\cd-rom emulator\cdromemulator.exe
Подменяет следующие файлы
- %TEMP%\4kpv6a~1\state.tmp
- %TEMP%\4kpv6a~1\state
- %LOCALAPPDATA%\cd-rom emulator\libgcc_s_dw2-1.dll
Самоудаляется.
Сетевая активность
Подключается к
- 'se####ation17io.io':80
- 'ji#######aeropuertojauja.com':443
- 'pe######itycoachkaniika.com':443
- 'qu#######ertiessolutions.com':443
- 'tr#######lermobilerepair.com':443
- 'localhost':49313
- 'sh#######gakiagriculture.com':443
- 'of#######anecorsopuppies.com':443
- 'ka#######-lovingtogarden.com':443
- 'na#######wholesalestudio.com':443
- 'ma#######nuevaeradigital.com':443
- 'pr######licanfoundation.com':443
- 'tr#######ttmerchofficial.com':443
- 'pa#######loutpostpodcast.com':80
- 'ka#######ociatesbuilders.com':80
- 'ha#######mesestateagency.com':443
- 'si#######ianmoviereviews.com':443
- 'pr#######eforming-sieves.com':443
- 'localhost':49299
- 'localhost':49297
- 'localhost':49295
- 'localhost':49293
- 'localhost':49291
- 'localhost':49289
- 'in#######bgardeningguide.com':443
- 'ro######ricaexpeditions.com':443
- 'sa######ternationalvisa.com':443
- 'ka#######n-slot-oyunlari.com':443
- 'localhost':49352
- 'localhost':49350
- 'localhost':49348
- 'sa######intangnusantara.com':443
- 'localhost':49345
- 'localhost':49343
- 'tv#######ceilingbrackets.com':80
- 'pa######marrakechourika.com':443
- 'pt#######ekaryaindonesia.com':443
- 'la#######rofferincubator.com':443
- 'ma#######cqassistanteweb.com':443
- 'in#######industryconnect.com':443
- 'na#######decuadarionegro.com':443
- 'ka#######iguespsicologia.com':443
- 'ka#######digitalmarketer.com':443
- 'sk#######tionandservices.com':443
- 'st#######nginear-cortexi.com':443
- 'pr######andribajaringan.com':443
- 'si######ladoraycircular.com':443
- 'localhost':49328
- 'sh#######teticconsulting.com':443
- 'ma#######iliatemarketing.com':443
- 'sh######angeleschargers.com':443
- 'qu######ovationsupplies.com':443
- 'localhost':49354
- 'localhost':49287
- 'localhost':49285
- 'localhost':49283
- 'localhost':49223
- 'localhost':49221
- 'localhost':49219
- 'localhost':49217
- 'localhost':49215
- 'localhost':49213
- 'localhost':49211
- 'localhost':49209
- 'localhost':49207
- 'localhost':49205
- 'localhost':49203
- 'localhost':49201
- '18#.#72.128.127':80
- '18#.#72.128.90':80
- 'localhost':40097
- 'mo####.sunaviat.com':80
- 'tr##c.com':80
- '18#.#72.128.19':80
- '19#.#00.153.7':9000
- '18#.#4.185.90':9001
- '5.##1.51.52':9001
- '10#.#53.41.98':9001
- 'localhost':49186
- 'localhost':49224
- 'localhost':49227
- 'localhost':49229
- 'localhost':49231
- 'localhost':49280
- 'localhost':49277
- 'localhost':49275
- 'localhost':49273
- 'localhost':49271
- 'localhost':49269
- 'localhost':49267
- 'localhost':49265
- 'localhost':49263
- 'localhost':49255
- 'localhost':49260
- 'localhost':49256
- 'localhost':49258
- 'localhost':49251
- 'localhost':49252
- 'localhost':49249
- 'localhost':49247
- 'localhost':49245
- 'localhost':49243
- 'localhost':49241
- 'localhost':49239
- 'localhost':49237
- 'localhost':49235
- 'localhost':49233
- 'localhost':49279
- 'vi#######elitesuperstore.com':443
TCP
Запросы HTTP GET
- http://18#.#72.128.19/288c47bbc1871b439df19ff4df68f0776.exe
- http://tr##c.com/check/index.php
- http://mo####.sunaviat.com/data/pdf/may.exe
- http://x5###############dj2m6eq4amkkpndbqyvmvaz6yl4mmfco6oqxsqd.onion/upd.php?n=#################################################################################################################...
- http://18#.#72.128.90/cpa/ping.php?su##############
- http://18#.#72.128.127/syncUpd.exe
- http://x5###############dj2m6eq4amkkpndbqyvmvaz6yl4mmfco6oqxsqd.onion/task.php?n=################################################################################################################...
- http://ka#######ociatesbuilders.com/wp-login.php
- http://pa#######loutpostpodcast.com/administrator/
- http://tv#######ceilingbrackets.com/wp-login.php
Запросы HTTP POST
- http://se####ation17io.io/index.php
Другие
- '5.##1.51.52':9001
- 'qu######ovationsupplies.com':443
- 'localhost':49210
- 'ro######ricaexpeditions.com':443
- 'localhost':49226
- 'na#######wholesalestudio.com':443
- 'localhost':49262
- 'localhost':49202
- 'ma#######iliatemarketing.com':443
- 'localhost':49253
- 'localhost':49248
- 'localhost':49261
- 'sh#######gakiagriculture.com':443
- 'localhost':49246
- 'tr#######lermobilerepair.com':443
- 'pr######licanfoundation.com':443
- 'localhost':49232
- 'localhost':49259
- 'sk#######tionandservices.com':443
- 'localhost':49344
- 'ji#######aeropuertojauja.com':443
- 'si######ladoraycircular.com':443
- 'ka#######n-slot-oyunlari.com':443
- 'qu#######ertiessolutions.com':443
- 'sa######ternationalvisa.com':443
- 'in#######industryconnect.com':443
- 'ka#######iguespsicologia.com':443
- 'st#######nginear-cortexi.com':443
- 'localhost':49244
- 'localhost':49220
- 'la#######rofferincubator.com':443
- 'ka#######digitalmarketer.com':443
- 'localhost':49314
- 'pe######itycoachkaniika.com':443
- 'pa######marrakechourika.com':443
- 'ma#######cqassistanteweb.com':443
- 'na#######decuadarionegro.com':443
- 'of#######anecorsopuppies.com':443
- 'sh#######teticconsulting.com':443
- 'localhost':49242
- 'localhost':49228
- 'si#######ianmoviereviews.com':443
- 'localhost':49254
- 'localhost':49240
- 'localhost':49250
- 'localhost':49212
- 'localhost':49284
- 'localhost':49268
- 'pr#######eforming-sieves.com':443
- 'localhost':49236
- 'localhost':49278
- 'localhost':49264
- 'localhost':49199
- 'localhost':49197
- 'localhost':40097
- '19#.#00.153.7':9000
- '18#.#4.185.90':9001
- 'localhost':49225
- 'localhost':49206
- 'localhost':49230
- 'localhost':49257
- 'localhost':49238
- 'localhost':49222
- 'localhost':49218
- 'localhost':49234
- 'localhost':49214
- 'sh#######sonvillejaguars.com':443
- 'localhost':49296
- 'ma#######nuevaeradigital.com':443
- 'tr#######ttmerchofficial.com':443
- 'localhost':49286
- 'localhost':49276
- 'localhost':49300
- 'localhost':49272
- 'localhost':49281
- 'localhost':49216
- 'localhost':49292
- 'ha#######mesestateagency.com':443
- 'pt#######ekaryaindonesia.com':443
UDP
- DNS ASK se####ation17io.io
- DNS ASK sh#######teticconsulting.com
- DNS ASK of#######anecorsopuppies.com
- DNS ASK sh#######gakiagriculture.com
- DNS ASK qu#######ertiessolutions.com
- DNS ASK ne#######isteperlesmetal.com
- DNS ASK st#######nginear-cortexi.com
- DNS ASK sk#######tionandservices.com
- DNS ASK tr#######lermobilerepair.com
- DNS ASK pr######andribajaringan.com
- DNS ASK pe######itycoachkaniika.com
- DNS ASK qu######ovationsupplies.com
- DNS ASK sa######ternationalvisa.com
- DNS ASK ro######ricaexpeditions.com
- DNS ASK si######ladoraycircular.com
- DNS ASK in#######industryconnect.com
- DNS ASK ka#######digitalmarketer.com
- DNS ASK ka#######iguespsicologia.com
- DNS ASK da#######.thepaperlessagent.com
- DNS ASK ka#######n-slot-oyunlari.com
- DNS ASK ma#######cqassistanteweb.com
- DNS ASK na#######decuadarionegro.com
- DNS ASK ma#######iliatemarketing.com
- DNS ASK sh######angeleschargers.com
- DNS ASK tv#######ceilingbrackets.com
- DNS ASK vi#######elitesuperstore.com
- DNS ASK na#######wholesalestudio.com
- DNS ASK wh#######dprojectconsult.com
- DNS ASK ma#######nuevaeradigital.com
- DNS ASK tr#######ttmerchofficial.com
- DNS ASK tr##c.com
- DNS ASK mo####.sunaviat.com
- DNS ASK pa######marrakechourika.com
- DNS ASK pe#######omultiservicios.com
- DNS ASK pe######onesdevehiculos.com
- DNS ASK to#######ningconsultants.com
- DNS ASK so#######iglia-architect.com
- DNS ASK si#######ianmoviereviews.com
- DNS ASK ri#######lthandwellbeing.com
- DNS ASK th#######ebusinesssummit.com
- DNS ASK su#######ravelandcruises.com
- DNS ASK sh#######sonvillejaguars.com
- DNS ASK ro#######ibeiroter###uta.com
- DNS ASK pi######dejugueteonline.com
- DNS ASK pr######licanfoundation.com
- DNS ASK pr#######eforming-sieves.com
- DNS ASK ra######oseleatherworks.com
- DNS ASK pt#######ekaryaindonesia.com
- DNS ASK sa######intangnusantara.com
- DNS ASK ha#######mesestateagency.com
- DNS ASK in#######bgardeningguide.com
- DNS ASK pa#######loutpostpodcast.com
- DNS ASK ka#######ociatesbuilders.com
- DNS ASK ka#######-lovingtogarden.com
- DNS ASK la#######rofferincubator.com
- DNS ASK ji#######aeropuertojauja.com
- DNS ASK ur#######controlservices.com
Другое
Ищет следующие окна
- ClassName: '' WindowName: 'jc7fbd_Flash2202FixClass_jc7fbd'
Создает и запускает на исполнение
- '%TEMP%\f825.exe'
- '%TEMP%\dc.exe'
- '%TEMP%\2177.exe'
- '%TEMP%\38b0.exe'
- '%TEMP%\6378.exe'
- '%TEMP%\288c47bbc1871b439df19ff4df68f076.exe'
- '%TEMP%\installsetup4.exe'
- '%TEMP%\fourthx.exe'
- '%TEMP%\84de.exe'
- '%TEMP%\broomsetup.exe'
- '%TEMP%\is-gjfea.tmp\84de.tmp' /SL5="$10282,4502673,54272,%TEMP%\84DE.exe"
- '%TEMP%\nst952f.tmp'
Запускает на исполнение
- '<SYSTEM32>\regsvr32.exe' /s %TEMP%\F1BD.dll
