Trojan.MulDrop27.1055

Техническая информация

Вредоносные функции

Запускает на исполнение

'<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="Adobe Unlicensed Pop-up" dir=out action=block remoteip=52.##2.204.11,54.##7.187.23,52.#.13.197,23.##.254.206,18.##5.140.40,18.##5.140.27,18.##5.140.90,18.##5...

Запускает большое число процессов

Изменения в файловой системе

Создает следующие файлы

%TEMP%\adobe temp\blockips.cmd
nul

Удаляет следующие файлы

%TEMP%\adobe temp\blockips.cmd

Сетевая активность

UDP

DNS ASK ad##e.io
DNS ASK 84.###.#51.205.in-addr.arpa
DNS ASK ns####.awsdns-42.com
DNS ASK 11#.###.#51.205.in-addr.arpa
DNS ASK ns#####.awsdns-14.co.uk
DNS ASK 3u######bj.adobestats.io
DNS ASK ns#####.awsdns-48.org
DNS ASK ad###stats.io
DNS ASK 67.###.#51.205.in-addr.arpa
DNS ASK ns###.awsdns-08.com
DNS ASK 90.###.#51.205.in-addr.arpa
DNS ASK ns#####.awsdns-43.co.uk
DNS ASK 13#.###.#51.205.in-addr.arpa
DNS ASK ns#####.awsdns-16.org
DNS ASK 23#.###.#51.205.in-addr.arpa
DNS ASK ns#####.awsdns-61.net
DNS ASK ns####.awsdns-56.net
DNS ASK 19#.###.#51.205.in-addr.arpa

Другое

Создает и запускает на исполнение

'<SYSTEM32>\cmd.exe' /c ""%TEMP%\Adobe Temp\BlockIPs.cmd" "' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c IF DEFINED InstChk ( START "" "<Текущая директория>\..\Set-up.exe" )' (со скрытым окном)

Перезапускает анализируемый образец

Запускает на исполнение

'<SYSTEM32>\cmd.exe' /c ""%TEMP%\Adobe Temp\BlockIPs.cmd" "
'<SYSTEM32>\cmd.exe' /c 2>nul nslookup 3u6k9as4bj.adobestats.io ns-1415.awsdns-48.org|findstr /r /c:"[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*"|findstr /i /v /c:"Address:"
'<SYSTEM32>\nslookup.exe' 3u6k9as4bj.adobestats.io ns-1415.awsdns-48.org
'<SYSTEM32>\findstr.exe' /l /c:",18.##5.140.40,"
'<SYSTEM32>\cmd.exe' /S /D /c" echo ,52.##2.204.11,54.##7.187.23,52.#.13.197,23.##.254.206,18.##5.140.40,"
'<SYSTEM32>\findstr.exe' /l /c:",18.##5.140.27,"
'<SYSTEM32>\cmd.exe' /S /D /c" echo ,52.##2.204.11,54.##7.187.23,52.#.13.197,23.##.254.206,18.##5.140.40,18.##5.140.27,"
'<SYSTEM32>\findstr.exe' /l /c:",18.##5.140.90,"
'<SYSTEM32>\cmd.exe' /S /D /c" echo ,52.##2.204.11,54.##7.187.23,52.#.13.197,23.##.254.206,18.##5.140.40,18.##5.140.27,18.##5.140.90,"
'<SYSTEM32>\findstr.exe' /l /c:",18.##5.140.111,"
'<SYSTEM32>\cmd.exe' /c 2>nul nslookup 3u6k9as4bj.adobestats.io ns-1654.awsdns-14.co.uk|findstr /r /c:"[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*"|findstr /i /v /c:"Address:"
'<SYSTEM32>\nslookup.exe' 3u6k9as4bj.adobestats.io ns-1654.awsdns-14.co.uk
'<SYSTEM32>\cmd.exe' /S /D /c" echo ,52.##2.204.11,54.##7.187.23,52.#.13.197,23.##.254.206,18.##5.140.40,18.##5.140.27,18.##5.140.90,18.##5.140.111,"
'<SYSTEM32>\cmd.exe' /c 2>nul nslookup 3u6k9as4bj.adobestats.io ns-340.awsdns-42.com|findstr /r /c:"[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*"|findstr /i /v /c:"Address:"
'<SYSTEM32>\nslookup.exe' 3u6k9as4bj.adobestats.io ns-340.awsdns-42.com
'<SYSTEM32>\cmd.exe' /c 2>nul nslookup 3u6k9as4bj.adobestats.io ns-962.awsdns-56.net|findstr /r /c:"[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*"|findstr /i /v /c:"Address:"
'<SYSTEM32>\nslookup.exe' 3u6k9as4bj.adobestats.io ns-962.awsdns-56.net
'<SYSTEM32>\findstr.exe' /l /c:",34.##3.227.236,"
'<SYSTEM32>\cmd.exe' /S /D /c" echo ,52.##2.204.11,54.##7.187.23,52.#.13.197,23.##.254.206,18.##5.140.40,18.##5.140.27,18.##5.140.90,18.##5.140.111,34.##3.227.236,"
'<SYSTEM32>\findstr.exe' /l /c:",10#.#2.247.231,"
'<SYSTEM32>\cmd.exe' /S /D /c" echo ,52.##2.204.11,54.##7.187.23,52.#.13.197,23.##.254.206,18.##5.140.40,18.##5.140.27,18.##5.140.90,18.##5.140.111,34.##3.227.236,10#.#2.247.231,"
'<SYSTEM32>\findstr.exe' /l /c:",18.##7.85.246,"
'<SYSTEM32>\cmd.exe' /S /D /c" echo ,52.##2.204.11,54.##7.187.23,52.#.13.197,23.##.254.206,18.##5.140.40,18.##5.140.27,18.##5.140.90,18.##5.140.111,34.##3.227.236,10#.#2.247.231,18.##7.85.246,"
'<SYSTEM32>\findstr.exe' /l /c:",54.##4.73.197,"
'<SYSTEM32>\nslookup.exe' -type=ns adobestats.io 8.#.8.8
'<SYSTEM32>\cmd.exe' /S /D /c" echo ,52.##2.204.11,54.##7.187.23,52.#.13.197,23.##.254.206,18.##5.140.40,18.##5.140.27,18.##5.140.90,18.##5.140.111,34.##3.227.236,10#.#2.247.231,18.##7.85.246,54.##4.73.197,"
'<SYSTEM32>\cmd.exe' /c 2>nul nslookup -type=ns adobestats.io 8.#.8.8|findstr /i /l /c:"nameserver = "
'<SYSTEM32>\cmd.exe' /c 2>nul nslookup adobe.io ns-67.awsdns-08.com|findstr /r /c:"[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*"|findstr /i /v /c:"Address:"
'<SYSTEM32>\netsh.exe' advfirewall firewall delete rule name="Adobe Unlicensed Pop-up" dir=out
'<SYSTEM32>\ping.exe' -4 -n 2 8.#.8.8
'<SYSTEM32>\findstr.exe' /i /l /c:"TTL="
'<SYSTEM32>\cmd.exe' /c 2>nul nslookup -type=ns adobe.io 8.#.8.8|findstr /i /l /c:"nameserver = "
'<SYSTEM32>\nslookup.exe' -type=ns adobe.io 8.#.8.8
'<SYSTEM32>\findstr.exe' /i /l /c:"nameserver = "
'<SYSTEM32>\cmd.exe' /c 2>nul nslookup adobe.io ns-1001.awsdns-61.net|findstr /r /c:"[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*"|findstr /i /v /c:"Address:"
'<SYSTEM32>\nslookup.exe' adobe.io ns-1001.awsdns-61.net
'<SYSTEM32>\findstr.exe' /r /c:"[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*"
'<SYSTEM32>\findstr.exe' /i /v /c:"Address:"
'<SYSTEM32>\cmd.exe' /S /D /c" echo ,"
'<SYSTEM32>\findstr.exe' /l /c:",52.##2.204.11,"
'<SYSTEM32>\cmd.exe' /S /D /c" echo ,52.##2.204.11,"
'<SYSTEM32>\findstr.exe' /l /c:",54.##7.187.23,"
'<SYSTEM32>\cmd.exe' /S /D /c" echo ,52.##2.204.11,54.##7.187.23,"
'<SYSTEM32>\findstr.exe' /l /c:",52.#.13.197,"
'<SYSTEM32>\cmd.exe' /S /D /c" echo ,52.##2.204.11,54.##7.187.23,52.#.13.197,"
'<SYSTEM32>\findstr.exe' /l /c:",23.##.254.206,"
'<SYSTEM32>\cmd.exe' /c 2>nul nslookup adobe.io ns-1159.awsdns-16.org|findstr /r /c:"[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*"|findstr /i /v /c:"Address:"
'<SYSTEM32>\nslookup.exe' adobe.io ns-1159.awsdns-16.org
'<SYSTEM32>\cmd.exe' /S /D /c" echo ,52.##2.204.11,54.##7.187.23,52.#.13.197,23.##.254.206,"
'<SYSTEM32>\cmd.exe' /c 2>nul nslookup adobe.io ns-1882.awsdns-43.co.uk|findstr /r /c:"[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*"|findstr /i /v /c:"Address:"
'<SYSTEM32>\nslookup.exe' adobe.io ns-1882.awsdns-43.co.uk
'<SYSTEM32>\nslookup.exe' adobe.io ns-67.awsdns-08.com
'<SYSTEM32>\cmd.exe' /c IF DEFINED InstChk ( START "" "<Текущая директория>\..\Set-up.exe" )