Техническая информация
Вредоносные функции
Для затруднения выявления своего присутствия в системе
добавляет исключения антивируса:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' powershell Add-MpPreference -ExclusionProcess C:\*
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' powershell Add-MpPreference -ExclusionPath C:\*
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' powershell Set-MpPreference -DisableRealtimeMonitoring 1 -ErrorAction SilentlyContinue
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' powershell Set-MpPreference -DisableIntrusionPreventionSystem 1 -ErrorAction SilentlyContinue
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' powershell Set-MpPreference -DisableIOAVProtection 1 -ErrorAction SilentlyContinue
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' powershell Set-MpPreference -DisableScriptScanning 1 -ErrorAction SilentlyContinue
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionProcess C:\*
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath C:\*
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-MpPreference -DisableRealtimeMonitoring 1 -ErrorAction SilentlyContinue
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-MpPreference -DisableIOAVProtection 1 -ErrorAction SilentlyContinue
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-MpPreference -DisableIntrusionPreventionSystem 1 -ErrorAction SilentlyContinue
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-MpPreference -DisableScriptScanning 1 -ErrorAction SilentlyContinue
Запускает на исполнение
- '<SYSTEM32>\netsh.exe' firewall add allowedprogram "%HOMEPATH%\csrss.exe" "csrss.exe" ENABLE
Внедряет код в
следующие системные процессы:
- %WINDIR%\explorer.exe
Ищет следующие окна с целью
обнаружения утилит для анализа:
- ClassName: 'FilemonClass', WindowName: ''
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
- ClassName: 'RegmonClass', WindowName: ''
Изменения в файловой системе
Создает следующие файлы
- %WINDIR%\mu.dll
- %WINDIR%\dec.exe
- %WINDIR%\system\facmh.dll
- %TEMP%\etilqs_jikipngezqy5ocj
- %TEMP%\etilqs_ttcfyghiqyuu8da
- %TEMP%\etilqs_vrndgcsinmmf5z0
- %TEMP%\etilqs_rpokztknyfpgzts
- %TEMP%\etilqs_zyqu1fzirxoyl3c
- %TEMP%\etilqs_6z9pfgnarly3um6
- %TEMP%\etilqs_tdbnwwfjd3ik1fc
Присваивает атрибут 'скрытый' для следующих файлов
- %WINDIR%\dec.exe
- %WINDIR%\mu.dll
Сетевая активность
Подключается к
- 'au######te.geo.opera.com':80
- 'au######te.geo.opera.com':443
TCP
Запросы HTTP GET
- http://au######te.geo.opera.com/geolocation/
Другие
- 'au######te.geo.opera.com':443
UDP
- DNS ASK google.com
- DNS ASK au######te.geo.opera.com
Другое
Ищет следующие окна
- ClassName: 'File Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: 'Process Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: 'Registry Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: '18467-41' WindowName: ''
- ClassName: 'Opera_MessageWindow' WindowName: '%APPDATA%\Opera Software\Opera Stable'
Создает и запускает на исполнение
- '%WINDIR%\dec.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' powershell Add-MpPreference -ExclusionProcess C:\*' (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' powershell Set-MpPreference -HighThreatDefaultAction Allow -ErrorAction SilentlyContinue' (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' powershell Set-MpPreference -ModerateThreatDefaultAction Allow -ErrorAction SilentlyContinue' (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' powershell Set-MpPreference -LowThreatDefaultAction Allow -ErrorAction SilentlyContinue' (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' powershell Set-MpPreference -DisableScriptScanning 1 -ErrorAction SilentlyContinue' (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' powershell Set-MpPreference -DisableScanningNetworkFiles 1 -ErrorAction SilentlyContinue' (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' powershell Set-MpPreference -DisableScanningMappedNetworkDrivesForFullScan 1 -ErrorAction SilentlyContinue' (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' powershell Set-MpPreference -DisableBlockAtFirstSeen 1 -ErrorAction SilentlyContinue' (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' powershell Set-MpPreference -DisableRemovableDriveScanning 1 -ErrorAction SilentlyContinue' (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' powershell Set-MpPreference -DisableIntrusionPreventionSystem 1 -ErrorAction SilentlyContinue' (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' powershell Set-MpPreference -DisableBehaviorMonitoring 1 -ErrorAction SilentlyContinue' (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' powershell Set-MpPreference -DisableArchiveScanning 1 -ErrorAction SilentlyContinue' (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' powershell Set-MpPreference -DisableRealtimeMonitoring 1 -ErrorAction SilentlyContinue' (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' powershell Set-MpPreference -EnableControlledFolderAccess Disabled' (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' powershell Add-MpPreference -ExclusionPath C:\*' (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' powershell Set-MpPreference -DisableIOAVProtection 1 -ErrorAction SilentlyContinue' (со скрытым окном)
- '<SYSTEM32>\netsh.exe' firewall add allowedprogram "%HOMEPATH%\csrss.exe" "csrss.exe" ENABLE' (со скрытым окном)
Запускает на исполнение
- '%ProgramFiles(x86)%\opera\launcher.exe' -noautoupdate -- "https://discord.gg/XuGdxq2J"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-MpPreference -HighThreatDefaultAction Allow -ErrorAction SilentlyContinue
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=renderer --alt-high-dpi-setting=96 --disable-direct-npapi-requests --enable-deferred-image-decoding --lang=en-US --enable-proprietary-media-types-playback --disable-client-side-phishing-...
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=renderer --alt-high-dpi-setting=96 --disable-direct-npapi-requests --enable-deferred-image-decoding --lang=en-US --enable-proprietary-media-types-playback --extension-process --enable-we...
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="1264.4.94992654\1169044676" --lang=en-US --no-sandbox --enable-proprietary-media-types-playback /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="1264.5.425740291\1659322351" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="1264.6.476343548\882924883" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' --type=utility --channel="1264.4.94992654\1169044676" --lang=en-US --no-sandbox --enable-proprietary-media-types-playback /prefetch:-645351001 /crash-reporter-parent-id=3948
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' powershell Set-MpPreference -ModerateThreatDefaultAction Allow -ErrorAction SilentlyContinue
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="1264.7.1274244158\750203439" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="1264.9.746954355\1244836509" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="1264.10.285256252\1923408581" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="1264.11.514694474\111062286" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="1264.12.216226567\1350161" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="1264.15.221915599\1443307620" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="1264.16.1992553846\1939941753" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="1264.17.1431593649\784551241" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-MpPreference -LowThreatDefaultAction Allow -ErrorAction SilentlyContinue
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=gpu-process --channel="1264.0.943333545\741104403" --enable-proprietary-media-types-playback --supports-dual-gpus=false --gpu-driver-bug-workarounds=1,19,42 --gpu-vendor-id=0x0000 --gpu-...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-MpPreference -DisableRemovableDriveScanning 1 -ErrorAction SilentlyContinue
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-MpPreference -DisableScanningNetworkFiles 1 -ErrorAction SilentlyContinue
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-MpPreference -ModerateThreatDefaultAction Allow -ErrorAction SilentlyContinue
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' powershell Set-MpPreference -DisableArchiveScanning 1 -ErrorAction SilentlyContinue
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' powershell Set-MpPreference -DisableBehaviorMonitoring 1 -ErrorAction SilentlyContinue
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' powershell Set-MpPreference -DisableRemovableDriveScanning 1 -ErrorAction SilentlyContinue
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' powershell Set-MpPreference -DisableBlockAtFirstSeen 1 -ErrorAction SilentlyContinue
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' powershell Set-MpPreference -DisableScanningMappedNetworkDrivesForFullScan 1 -ErrorAction SilentlyContinue
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' powershell Set-MpPreference -DisableScanningNetworkFiles 1 -ErrorAction SilentlyContinue
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' powershell Set-MpPreference -LowThreatDefaultAction Allow -ErrorAction SilentlyContinue
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="1264.18.643468033\2093932571" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="1264.8.1934641771\2141905180" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' -noautoupdate --ran-launcher -- https://discord.gg/XuGdxq2J
- '<SYSTEM32>\cmd.exe' /c start %WINDIR%\dec.exe
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' -noautoupdate --ran-launcher -- https://discord.gg/XuGdxq2J /crash-reporter-parent-id=1264
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-MpPreference -EnableControlledFolderAccess Disabled
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-MpPreference -DisableBehaviorMonitoring 1 -ErrorAction SilentlyContinue
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-MpPreference -DisableArchiveScanning 1 -ErrorAction SilentlyContinue
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-MpPreference -DisableBlockAtFirstSeen 1 -ErrorAction SilentlyContinue
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-MpPreference -DisableScanningMappedNetworkDrivesForFullScan 1 -ErrorAction SilentlyContinue
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' powershell Set-MpPreference -EnableControlledFolderAccess Disabled
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' powershell Set-MpPreference -HighThreatDefaultAction Allow -ErrorAction SilentlyContinue
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="1264.19.1066866401\1823248989" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
