Техническая информация
Для обеспечения автозапуска и распространения
Создает или изменяет следующие файлы
- %TEMP%\temp.txt
Вредоносные функции
Читает файлы, отвечающие за хранение паролей сторонними программами
- %HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx
- %HOMEPATH%\desktop\thlps_keeper_mayer_1965.docx
- %HOMEPATH%\desktop\testee.cer
- %HOMEPATH%\desktop\split.avi
- %HOMEPATH%\desktop\sdszfo.docx
- %HOMEPATH%\desktop\sdksampleunprivdeveloper.cer
- %HOMEPATH%\desktop\sdksampleprivdeveloper.cer
- %HOMEPATH%\desktop\sdkfailsafeemulator.cer
- %HOMEPATH%\desktop\ovp25012015.doc
- %HOMEPATH%\desktop\nwfieldnotes1966.docx
- %HOMEPATH%\desktop\hanni_umami_chapter.doc
- %HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx
- %HOMEPATH%\desktop\february_catalogue__2015.doc
- %HOMEPATH%\desktop\dashborder_192.bmp
- %HOMEPATH%\desktop\cveuropeo.doc
- %HOMEPATH%\desktop\contosoroot.cer
- %HOMEPATH%\desktop\coffee.bmp
- %HOMEPATH%\desktop\applicantform_en.doc
- %HOMEPATH%\desktop\toolbar.bmp
- %APPDATA%\mozilla\firefox\profiles.ini
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\sss.png
- %TEMP%\show.exe
- %TEMP%\hide.exe
- %TEMP%\01.exe
- %TEMP%\temp.txt
- %TEMP%\shell.ps1
- %TEMP%\attck.exe
Перемещает следующие файлы
- %TEMP%\temp.txt в %APPDATA%\microsoft\windows\recent\customdestinations\590aee7bdd69b59b.customdestinations-ms
Изменяет следующие файлы
- %TEMP%\temp.txt
Подменяет следующие исполняемые файлы
- %APPDATA%\Mozilla\Firefox\Profiles\v08trqk6.default-release\gmp-widevinecdm\4.10.1582.2\widevinecdm.dll
- %APPDATA%\Telegram Desktop\Telegram.exe
- %APPDATA%\Telegram Desktop\unins000.exe
- %APPDATA%\Telegram Desktop\Updater.exe
Подменяет следующие файлы
- %HOMEPATH%\Desktop\aoc_saq_d_v3_merchant.docx
- %APPDATA%\Mozilla\Firefox\Profiles\v08trqk6.default-release\handlers.json
- %APPDATA%\Mozilla\Firefox\Profiles\v08trqk6.default-release\pkcs11.txt
- %APPDATA%\Mozilla\Firefox\Profiles\v08trqk6.default-release\prefs.js
- %APPDATA%\Mozilla\Firefox\Profiles\v08trqk6.default-release\saved-telemetry-pings\2a211dea-1f81-457a-9f7c-a174126ff0dd
- %APPDATA%\Mozilla\Firefox\Profiles\v08trqk6.default-release\saved-telemetry-pings\71d7d59d-5451-4f15-bb9e-420e88a3061f
- %APPDATA%\Mozilla\Firefox\Profiles\v08trqk6.default-release\saved-telemetry-pings\9cd37e15-817f-4044-81be-e43af1dfc595
- %APPDATA%\Mozilla\Firefox\Profiles\v08trqk6.default-release\saved-telemetry-pings\dc35f7c9-5b80-4042-a301-e84d8619b27e
- %APPDATA%\Mozilla\Firefox\Profiles\v08trqk6.default-release\search.json.mozlz4
- %APPDATA%\Mozilla\Firefox\Profiles\v08trqk6.default-release\SecurityPreloadState.txt
- %APPDATA%\Mozilla\Firefox\Profiles\v08trqk6.default-release\security_state\data.safe.bin
- %APPDATA%\Mozilla\Firefox\Profiles\v08trqk6.default-release\sessionCheckpoints.json
- %APPDATA%\Mozilla\Firefox\Profiles\v08trqk6.default-release\sessionstore-backups\previous.jsonlz4
- %APPDATA%\Mozilla\Firefox\Profiles\v08trqk6.default-release\sessionstore-backups\recovery.baklz4
- %APPDATA%\Mozilla\Firefox\Profiles\v08trqk6.default-release\sessionstore-backups\recovery.jsonlz4
- %APPDATA%\Mozilla\Firefox\Profiles\v08trqk6.default-release\sessionstore-backups\upgrade.jsonlz4-20200708170202
- %APPDATA%\Mozilla\Firefox\Profiles\v08trqk6.default-release\shield-preference-experiments.json
- %APPDATA%\Mozilla\Firefox\Profiles\v08trqk6.default-release\SiteSecurityServiceState.txt
- %APPDATA%\Mozilla\Firefox\Profiles\v08trqk6.default-release\gmp-widevinecdm\4.10.1582.2\widevinecdm.dll.sig
- %APPDATA%\Mozilla\Firefox\installs.ini
- %APPDATA%\Mozilla\Firefox\Profiles\v08trqk6.default-release\gmp-widevinecdm\4.10.1582.2\widevinecdm.dll.lib
- %APPDATA%\Mozilla\Firefox\Profiles\v08trqk6.default-release\gmp-widevinecdm\4.10.1582.2\LICENSE.txt
- %APPDATA%\Mozilla\Firefox\Profiles\m15ucxjx.default\user.js
- %APPDATA%\Mozilla\Firefox\Profiles\v08trqk6.default-release\addons.json
- %APPDATA%\Mozilla\Firefox\Profiles\v08trqk6.default-release\addonStartup.json.lz4
- %APPDATA%\Mozilla\Firefox\Profiles\v08trqk6.default-release\AlternateServices.txt
- %APPDATA%\Mozilla\Firefox\Profiles\v08trqk6.default-release\bookmarkbackups\bookmarks-2024-04-01_11_w-7ab47BTxTEWDh4A2YEHg==.jsonlz4
- %APPDATA%\Mozilla\Firefox\Profiles\v08trqk6.default-release\broadcast-listeners.json
- %APPDATA%\Mozilla\Firefox\Profiles\v08trqk6.default-release\compatibility.ini
- %APPDATA%\Mozilla\Firefox\Profiles\v08trqk6.default-release\containers.json
- %APPDATA%\Mozilla\Firefox\Profiles\v08trqk6.default-release\crashes\store.json.mozlz4
- %APPDATA%\Mozilla\Firefox\Profiles\v08trqk6.default-release\datareporting\archived\2023-09\1694565729016.2a211dea-1f81-457a-9f7c-a174126ff0dd.new-profile.jsonlz4
- %APPDATA%\Mozilla\Firefox\Profiles\v08trqk6.default-release\datareporting\archived\2023-09\1694565729047.dc35f7c9-5b80-4042-a301-e84d8619b27e.event.jsonlz4
- %APPDATA%\Mozilla\Firefox\Profiles\v08trqk6.default-release\datareporting\archived\2023-09\1694565729067.9cd37e15-817f-4044-81be-e43af1dfc595.main.jsonlz4
- %APPDATA%\Mozilla\Firefox\Profiles\v08trqk6.default-release\datareporting\archived\2023-09\1694565729070.71d7d59d-5451-4f15-bb9e-420e88a3061f.first-shutdown.jsonlz4
- %APPDATA%\Mozilla\Firefox\Profiles\v08trqk6.default-release\datareporting\session-state.json
- %APPDATA%\Mozilla\Firefox\Profiles\v08trqk6.default-release\datareporting\state.json
- %APPDATA%\Mozilla\Firefox\Profiles\v08trqk6.default-release\extension-preferences.json
- %APPDATA%\Mozilla\Firefox\Profiles\v08trqk6.default-release\extensions.json
- %APPDATA%\Mozilla\Firefox\Profiles\v08trqk6.default-release\gmp-widevinecdm\4.10.1582.2\manifest.json
- %APPDATA%\Mozilla\Firefox\Profiles\m15ucxjx.default\times.json
- %APPDATA%\Mozilla\Firefox\Profiles\v08trqk6.default-release\storage\default\moz-extension+++5fc1ef9c-f7bf-452f-a7ef-92635f5362ce^userContextId=4294967295\.metadata-v2
- %APPDATA%\Mozilla\Firefox\Profiles\v08trqk6.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite
- %APPDATA%\Thunderbird\Profiles\chdgbv82.default-release\datareporting\archived\2023-09\1694565729925.d8154144-ac52-40e8-b685-b640783b2c0d.main.jsonlz4
- %APPDATA%\Thunderbird\Profiles\chdgbv82.default-release\datareporting\archived\2023-09\1694565729926.199a0618-6d48-4205-858d-6b9a8ba9e913.first-shutdown.jsonlz4
- %APPDATA%\Thunderbird\Profiles\chdgbv82.default-release\datareporting\session-state.json
- %APPDATA%\Thunderbird\Profiles\chdgbv82.default-release\datareporting\state.json
- %APPDATA%\Thunderbird\Profiles\chdgbv82.default-release\directoryTree.json
- %APPDATA%\Thunderbird\Profiles\chdgbv82.default-release\enigmail.sqlite
- %APPDATA%\Thunderbird\Profiles\chdgbv82.default-release\extension-preferences.json
- %APPDATA%\Microsoft\Windows\SendTo\Documents.mydocs
- %APPDATA%\Thunderbird\Profiles\chdgbv82.default-release\extensions.json
- %APPDATA%\Thunderbird\Profiles\chdgbv82.default-release\formhistory.sqlite
- %APPDATA%\Thunderbird\Profiles\chdgbv82.default-release\global-messages-db.sqlite
- %APPDATA%\Thunderbird\Profiles\chdgbv82.default-release\history.sqlite
- %APPDATA%\Thunderbird\Profiles\chdgbv82.default-release\openpgp.sqlite
- %APPDATA%\Thunderbird\Profiles\chdgbv82.default-release\parent.lock
- %APPDATA%\Thunderbird\Profiles\chdgbv82.default-release\permissions.sqlite
- %APPDATA%\Thunderbird\Profiles\chdgbv82.default-release\pkcs11.txt
- %APPDATA%\Thunderbird\Profiles\chdgbv82.default-release\crashes\store.json.mozlz4
- %APPDATA%\Thunderbird\Profiles\chdgbv82.default-release\datareporting\archived\2023-09\1694565729880.22a456d0-5d02-445b-9603-4fe4b9e5c45c.new-profile.jsonlz4
- %APPDATA%\Mozilla\Firefox\Profiles\v08trqk6.default-release\storage\permanent\chrome\.metadata-v2
- %APPDATA%\Mozilla\Firefox\Profiles\v08trqk6.default-release\storage\default\moz-extension+++5fc1ef9c-f7bf-452f-a7ef-92635f5362ce^userContextId=4294967295\idb\3647222921wleabcEoxlt-eengsairo.sql...
- %APPDATA%\Thunderbird\Profiles\chdgbv82.default-release\blist.sqlite
- %APPDATA%\Mozilla\Firefox\Profiles\v08trqk6.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite
- %APPDATA%\Mozilla\Firefox\Profiles\v08trqk6.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite
- %APPDATA%\Mozilla\Firefox\Profiles\v08trqk6.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite
- %APPDATA%\Mozilla\Firefox\Profiles\v08trqk6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
- %APPDATA%\Mozilla\Firefox\Profiles\v08trqk6.default-release\times.json
- %APPDATA%\Mozilla\Firefox\Profiles\v08trqk6.default-release\TRRBlacklist.txt
- %APPDATA%\Mozilla\Firefox\Profiles\v08trqk6.default-release\user.js
- %APPDATA%\Mozilla\Firefox\Profiles\v08trqk6.default-release\xulstore.json
- %APPDATA%\Mozilla\Firefox\profiles.ini
- %APPDATA%\Thunderbird\Crash Reports\InstallTime20210406220621
- %APPDATA%\Thunderbird\installs.ini
- %APPDATA%\Thunderbird\Profiles\chdgbv82.default-release\abook.sqlite
- %APPDATA%\Thunderbird\Profiles\chdgbv82.default-release\addons.json
- %APPDATA%\Thunderbird\Profiles\chdgbv82.default-release\addonStartup.json.lz4
- %APPDATA%\Thunderbird\Profiles\chdgbv82.default-release\AlternateServices.txt
- %APPDATA%\Thunderbird\Profiles\chdgbv82.default-release\compatibility.ini
- %APPDATA%\Mozilla\Firefox\Profiles\v08trqk6.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite
- %APPDATA%\Thunderbird\Profiles\chdgbv82.default-release\cookies.sqlite
- %APPDATA%\Mozilla\Firefox\Crash Reports\InstallTime20200708170202
- %APPDATA%\Microsoft\Windows\Start Menu\Programs\WinRAR\WinRAR.lnk
- %APPDATA%\Microsoft\Windows\Start Menu\Programs\WinRAR\WinRAR help.lnk
- %HOMEPATH%\Documents\desktop.ini
- %HOMEPATH%\Searches\desktop.ini
- %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-3150914307-1777937420-491476919-1000\f58155b4b1d5a524ca0261c3ee99fb50_d99ef00b-ccd3-4f1d-9980-90ac453b0b47
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\desktop.ini
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Firefox.lnk
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Opera.lnk
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Windows Explorer.lnk
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Windows Media Player.lnk
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk
- %APPDATA%\Microsoft\Protect\CREDHIST
- %HOMEPATH%\Pictures\desktop.ini
- %APPDATA%\Microsoft\Protect\S-1-5-21-3150914307-1777937420-491476919-1000\3e7a4b63-cd41-4806-916a-59fd454c04f2
- %HOMEPATH%\Music\desktop.ini
- %HOMEPATH%\Desktop\Telegram.lnk
- %TEMP%\temp.txt
- %HOMEPATH%\Desktop\applicantform_en.doc
- %HOMEPATH%\Desktop\coffee.bmp
- %HOMEPATH%\Desktop\contosoroot.cer
- %HOMEPATH%\Desktop\cveuropeo.doc
- %HOMEPATH%\Desktop\dashBorder_192.bmp
- %HOMEPATH%\Desktop\desktop.ini
- %HOMEPATH%\Desktop\february_catalogue__2015.doc
- %HOMEPATH%\Desktop\Google Chrome.lnk
- %HOMEPATH%\Desktop\hadac_newsletter_july_2010_final.docx
- %HOMEPATH%\Desktop\hanni_umami_chapter.doc
- %HOMEPATH%\Desktop\nwfieldnotes1966.docx
- %HOMEPATH%\Desktop\ovp25012015.doc
- %HOMEPATH%\Desktop\SDKFailsafeEmulator.cer
- %HOMEPATH%\Desktop\SDKSamplePrivDeveloper.cer
- %HOMEPATH%\Desktop\SDKSampleUnprivDeveloper.cer
- %HOMEPATH%\Desktop\sdszfo.docx
- %HOMEPATH%\Downloads\desktop.ini
- %APPDATA%\Microsoft\Protect\S-1-5-21-3150914307-1777937420-491476919-1000\51da22b7-9513-4885-adb9-cd2e72f47f0a
- %HOMEPATH%\Videos\desktop.ini
- %APPDATA%\Microsoft\Protect\S-1-5-21-3150914307-1777937420-491476919-1000\Preferred
- %APPDATA%\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\computer.lnk
- %APPDATA%\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini
- %APPDATA%\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk
- %APPDATA%\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Private Character Editor.lnk
- %APPDATA%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows Explorer.lnk
- %APPDATA%\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini
- %APPDATA%\Microsoft\Windows\Start Menu\Programs\desktop.ini
- %APPDATA%\Microsoft\Windows\Start Menu\Programs\Google Chrome\Google Chrome.lnk
- %APPDATA%\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk
- %APPDATA%\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
- %APPDATA%\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini
- %APPDATA%\Microsoft\Windows\Start Menu\Programs\Maintenance\Help.lnk
- %APPDATA%\Microsoft\Windows\Start Menu\Programs\Telegram Desktop\Telegram.lnk
- %APPDATA%\Microsoft\Windows\Start Menu\Programs\Telegram Desktop\Uninstall Telegram.lnk
- %APPDATA%\Microsoft\Windows\Start Menu\Programs\WinRAR\Console RAR manual.lnk
- %APPDATA%\Microsoft\Windows\Start Menu\Programs\WinRAR\What is new in the latest version.lnk
- %APPDATA%\Microsoft\Windows\Start Menu\Programs\Accessories\Run.lnk
- %APPDATA%\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini
- %APPDATA%\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Control Panel.lnk
- %APPDATA%\Microsoft\Windows\Start Menu\Programs\Accessories\Notepad.lnk
- %APPDATA%\Microsoft\Windows\Start Menu\Programs\Accessories\Command Prompt.lnk
- %APPDATA%\Microsoft\Windows\Libraries\desktop.ini
- %APPDATA%\Microsoft\Windows\Libraries\Music.library-ms
- %APPDATA%\Microsoft\Windows\Libraries\Pictures.library-ms
- %APPDATA%\Microsoft\Windows\Libraries\Videos.library-ms
- %APPDATA%\Microsoft\Windows\Recent\AutomaticDestinations\1b4dd67f29cb1962.automaticDestinations-ms
- %APPDATA%\Microsoft\Windows\Recent\desktop.ini
- %APPDATA%\Microsoft\Windows\SendTo\Compressed (zipped) Folder.ZFSendToTarget
- %APPDATA%\Microsoft\Windows\SendTo\Desktop (create shortcut).DeskLink
- %APPDATA%\Thunderbird\Profiles\chdgbv82.default-release\places.sqlite
- %APPDATA%\Thunderbird\Profiles\chdgbv82.default-release\favicons.sqlite
- %APPDATA%\Microsoft\Windows\SendTo\Desktop.ini
- %APPDATA%\Microsoft\Windows\SendTo\Mail Recipient.MAPIMail
- %APPDATA%\Microsoft\Windows\Start Menu\desktop.ini
- %APPDATA%\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini
- %APPDATA%\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Ease of Access.lnk
- %APPDATA%\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Magnify.lnk
- %APPDATA%\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Narrator.lnk
- %APPDATA%\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\On-Screen Keyboard.lnk
- %APPDATA%\Microsoft\Windows\Libraries\Documents.library-ms
- %APPDATA%\Microsoft\Windows\SendTo\Fax Recipient.lnk
- %APPDATA%\Thunderbird\Profiles\chdgbv82.default-release\prefs.js
Изменяет множество файлов пользовательских данных (Trojan.Encoder).
Другое
Ищет следующие окна
- ClassName: 'EDIT' WindowName: ''
Создает и запускает на исполнение
- '%TEMP%\hide.exe'
- '%TEMP%\01.exe'
- '%TEMP%\attck.exe'
Запускает на исполнение
- '<SYSTEM32>\cmd.exe' /c powershell.exe -ExecutionPolicy Bypass -File "shell.ps1"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass -File "shell.ps1"
