Техническая информация
Для обеспечения автозапуска и распространения
Модифицирует следующие ключи реестра
- [HKLM\SOFTWARE\CLASSES\gxdteSecShares\shell\open\command] '' = '"%ALLUSERSPROFILE%\projone\potcm\ssreader.exe" "%1"'
Устанавливает следующие настройки сервисов
- [HKLM\System\CurrentControlSet\Services\pobus] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\pobus] 'ImagePath' = '%ALLUSERSPROFILE%\projone\potcm\pobus64.exe'
- [HKLM\System\CurrentControlSet\Services\poflt64] 'ImagePath' = '<DRIVERS>\poflt64.sys'
Создает следующие сервисы
- 'pobus' %ALLUSERSPROFILE%\projone\potcm\pobus64.exe
- 'poflt64' <DRIVERS>\poflt64.sys
Вредоносные функции
Для затруднения выявления своего присутствия в системе
изменяет следующие системные настройки:
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoControlPanel' = '00000000'
Регистрирует фильтр файловой системы
- [HKLM\SYSTEM\CurrentControlSet\Services\poflt64] 'Group' = 'FSFilter Content Screener'
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\aaf3be38-4b05-4ed1-b361-9e9393211611\kvj.jpg
- %ALLUSERSPROFILE%\projone\potcm\procmgr64.dll
- %ALLUSERSPROFILE%\projone\potcm\protocolfilters.dll
- %ALLUSERSPROFILE%\projone\potcm\rptcache64.dll
- %ALLUSERSPROFILE%\projone\potcm\rtfile64.dll
- %ALLUSERSPROFILE%\projone\potcm\rtinfo64.dll
- %ALLUSERSPROFILE%\projone\potcm\screenhooks32.dll
- %ALLUSERSPROFILE%\projone\potcm\prntmgr32.dll
- %ALLUSERSPROFILE%\projone\potcm\prntmgr64.dll
- %ALLUSERSPROFILE%\projone\potcm\scrnrcd64.dll
- %ALLUSERSPROFILE%\projone\potcm\shlext64.dll
- %ALLUSERSPROFILE%\projone\potcm\siriuv32.dll
- %ALLUSERSPROFILE%\projone\potcm\siriuv64.dll
- %ALLUSERSPROFILE%\projone\potcm\sqlcipher32.dll
- %ALLUSERSPROFILE%\projone\potcm\sqlcipher64.dll
- %ALLUSERSPROFILE%\projone\potcm\sscanner64.dll
- %ALLUSERSPROFILE%\projone\potcm\sensinfo64.dll
- %ALLUSERSPROFILE%\projone\potcm\setuphlpr.dll
- %ALLUSERSPROFILE%\projone\potcm\ssleay64.dll
- %ALLUSERSPROFILE%\projone\potcm\ssleay32.dll
- %ALLUSERSPROFILE%\projone\potcm\powfp643.sys
- %ALLUSERSPROFILE%\projone\potcm\pobus64.exe
- %ALLUSERSPROFILE%\projone\potcm\poda32.exe
- %ALLUSERSPROFILE%\projone\potcm\poda64.exe
- %ALLUSERSPROFILE%\projone\potcm\podumper32.dll
- %ALLUSERSPROFILE%\projone\potcm\podumper64.dll
- %ALLUSERSPROFILE%\projone\potcm\powfp643_win7.sys
- %ALLUSERSPROFILE%\projone\potcm\patch32.dll
- %ALLUSERSPROFILE%\projone\potcm\powol64.dll
- %ALLUSERSPROFILE%\projone\potcm\poflt64.sys
- %ALLUSERSPROFILE%\projone\potcm\poprotect64.dll
- %ALLUSERSPROFILE%\projone\potcm\poprotect664.sys
- %ALLUSERSPROFILE%\projone\potcm\poprotect664_win7.sys
- %ALLUSERSPROFILE%\projone\potcm\poscsaver.exe
- %ALLUSERSPROFILE%\projone\potcm\powall64.dll
- %ALLUSERSPROFILE%\projone\potcm\poflt64_win7.sys
- %ALLUSERSPROFILE%\projone\potcm\pomqc3.dll
- %ALLUSERSPROFILE%\projone\potcm\pomqc364.dll
- %ALLUSERSPROFILE%\projone\potcm\athenw64.dll
- %ALLUSERSPROFILE%\projone\potcm\swvv64.sys
- <DRIVERS>\poflt64.sys
- %ALLUSERSPROFILE%\projone\cache\procicon\a74fa600b876.png
- %ALLUSERSPROFILE%\projone\potcm\ffmpeg.exe
- %ALLUSERSPROFILE%\projone\potcm\cache\ico\softwareico\263ca57e049d3d40.png
- %WINDIR%\logs\accelerator
- %ALLUSERSPROFILE%\projone\potcm\cache\ico\softwareico\385b39a7dd9fe2e4.png
- %ALLUSERSPROFILE%\projone\potcm\cache\ico\softwareico\07afbf33b7c6adb0.png
- %ALLUSERSPROFILE%\projone\potcm\cache\upgrade\upgradeclients.json
- <SYSTEM32>\config\systemprofile\appdata\local\gdipfontcachev1.dat
- %ALLUSERSPROFILE%\projone\potcm\cache\ico\softwareico\499fa385d18e4c58.png
- %ALLUSERSPROFILE%\projone\potcm\cache\ico\softwareico\5df969625afbba07.png
- %WINDIR%\logs\ignored.tmp
- %ALLUSERSPROFILE%\projone\potcm\cache\upgrade\acagent.exe
- %ALLUSERSPROFILE%\projone\potcm\cache\ico\softwareico\671a13971812ca52.png
- %LOCALAPPDATA%\projone\a0cc00f1\20241105\009206.tmp
- %ALLUSERSPROFILE%\projone\potcm\cache\upgrade\client_upgrade.json
- %WINDIR%\logs\accelerator_client
- %ALLUSERSPROFILE%\projone\cache\procicon\8fa72b206fd7.png
- %WINDIR%\temp\1a05.tmp.json.json
- %WINDIR%\temp\1a05.tmp.json
- %ALLUSERSPROFILE%\projone\potcm\unrar32.dll
- %ALLUSERSPROFILE%\projone\potcm\usbmgr64.dll
- %ALLUSERSPROFILE%\projone\potcm\winpcap_inst.exe
- %ALLUSERSPROFILE%\projone\potcm\workflow64.dll
- %ALLUSERSPROFILE%\projone\servaddrbackup
- %ALLUSERSPROFILE%\projone\potcm\log\pobus64\20241105124625_pobus64-0.log
- %ALLUSERSPROFILE%\projone\potcm\log\pobus64\20241105124650_pobus64-0.log
- C:\system volume information\cid
- %ALLUSERSPROFILE%\projone\potcm\unrar64.dll
- D:\system volume information\cid
- %ALLUSERSPROFILE%\projone\potcm\log\poda32\20241105124704_poda32-0.log
- %WINDIR%\temp\1b10cd9dbd71369e
- %ALLUSERSPROFILE%\projone\addons\addon_desc.json
- %ALLUSERSPROFILE%\projone\potcm\cache\software.json
- %ALLUSERSPROFILE%\projone\potcm\cache\software.bk.json
- %ALLUSERSPROFILE%\projone\potcm\log\poda64\20241105124710_poda64-0.log
- %ALLUSERSPROFILE%\projone\potcm\odipus64.dll
- %ALLUSERSPROFILE%\projone\potcm\log\poda32\20241105124652_poda32-0.log
- %ALLUSERSPROFILE%\projone\potcm\patch64.dll
- %ALLUSERSPROFILE%\projone\potcm\npcap_inst.exe
- %ALLUSERSPROFILE%\projone\potcm\nnagent32.dll
- %ALLUSERSPROFILE%\projone\potcm\nfwfp64_win7.sys
- %ALLUSERSPROFILE%\projone\potcm\skin\gxonecli
- %ALLUSERSPROFILE%\projone\potcm\skin\pochat
- %ALLUSERSPROFILE%\projone\potcm\skin\posoftmgr
- %ALLUSERSPROFILE%\projone\potcm\skin\shlext
- %ALLUSERSPROFILE%\projone\potcm\skin\sscannerwnd
- %ALLUSERSPROFILE%\projone\potcm\skin\enced_offline.ico
- %ALLUSERSPROFILE%\projone\potcm\skin\dtescanner
- %ALLUSERSPROFILE%\projone\potcm\skin\gxlogo.png
- %ALLUSERSPROFILE%\projone\potcm\skin\sscreator
- %ALLUSERSPROFILE%\projone\potcm\skin\woumgr
- %ALLUSERSPROFILE%\projone\potcm\actmon64.dll
- %ALLUSERSPROFILE%\projone\potcm\anyconn64.dll
- %ALLUSERSPROFILE%\projone\potcm\assistda.exe
- %ALLUSERSPROFILE%\projone\potcm\assisthost.exe
- %ALLUSERSPROFILE%\projone\potcm\skin\sswallpaper.jpg
- %ALLUSERSPROFILE%\projone\potcm\skin\wfchost
- %ALLUSERSPROFILE%\projone\potcm\skin\wfviewer
- %ALLUSERSPROFILE%\projone\potcm\skin\enced_normal.ico
- %ALLUSERSPROFILE%\projone\potcm\skin\clientinfo
- %ALLUSERSPROFILE%\projone\potcm\assisths.exe
- %TEMP%\aaf3be38-4b05-4ed1-b361-9e9393211611\potcm.7z
- %ALLUSERSPROFILE%\projone\potcm\athens32.dll
- %ALLUSERSPROFILE%\projone\potcm\athens64.dll
- %ALLUSERSPROFILE%\projone\potcm\athenx32.dll
- %ALLUSERSPROFILE%\projone\potcm\athenx64.dll
- %ALLUSERSPROFILE%\projone\potcm\lang\zh_cn.json
- %ALLUSERSPROFILE%\projone\potcm\reg.bat
- %TEMP%\aaf3be38-4b05-4ed1-b361-9e9393211611\za.exe
- %ALLUSERSPROFILE%\projone\potcm\sirius32.dll
- %ALLUSERSPROFILE%\projone\potcm\siriuw64.dll
- %ALLUSERSPROFILE%\projone\potcm\siriux32.dll
- %ALLUSERSPROFILE%\projone\potcm\siriux64.dll
- %ALLUSERSPROFILE%\projone\potcm\sj\11k6pcpe
- %ALLUSERSPROFILE%\projone\potcm\sj\n7v6jj0c
- %ALLUSERSPROFILE%\projone\potcm\sj\tidnqn2t
- %ALLUSERSPROFILE%\projone\potcm\skin\bakviewer
- %ALLUSERSPROFILE%\projone\potcm\siriuw32.dll
- %LOCALAPPDATA%\projone\a0cc00f1\20241105\009206
- %ALLUSERSPROFILE%\projone\potcm\swvv64_win7.sys
- %ALLUSERSPROFILE%\projone\potcm\athenw32.dll
- %ALLUSERSPROFILE%\projone\potcm\clientbase64.dll
- %ALLUSERSPROFILE%\projone\potcm\libcrypto-1_1.dll
- %ALLUSERSPROFILE%\projone\potcm\libcurl32.dll
- %ALLUSERSPROFILE%\projone\potcm\libcurl64.dll
- %ALLUSERSPROFILE%\projone\potcm\libeay32.dll
- %ALLUSERSPROFILE%\projone\potcm\libeay64.dll
- %ALLUSERSPROFILE%\projone\potcm\lang\lang-2052.dll
- %ALLUSERSPROFILE%\projone\potcm\libssl-1_1.dll
- %ALLUSERSPROFILE%\projone\potcm\leakways64.dll
- %ALLUSERSPROFILE%\projone\potcm\naca32.dll
- %ALLUSERSPROFILE%\projone\potcm\nfapi.dll
- %ALLUSERSPROFILE%\projone\potcm\nfentry32.dll
- %ALLUSERSPROFILE%\projone\potcm\nftdi32.sys
- %ALLUSERSPROFILE%\projone\potcm\nfwfp32.sys
- %ALLUSERSPROFILE%\projone\potcm\nfwfp64.sys
- %ALLUSERSPROFILE%\projone\potcm\magichk32.dll
- %ALLUSERSPROFILE%\projone\potcm\skin\enced_unauthorized.ico
- %ALLUSERSPROFILE%\projone\potcm\nacmacwatch.dll
- %ALLUSERSPROFILE%\projone\potcm\langrp64.dll
- %ALLUSERSPROFILE%\projone\potcm\intcap64.dll
- %ALLUSERSPROFILE%\projone\potcm\imagent64.dll
- %ALLUSERSPROFILE%\projone\potcm\clientstat.exe
- %ALLUSERSPROFILE%\projone\potcm\cryptdt.dll
- %ALLUSERSPROFILE%\projone\potcm\ctask64.dll
- %ALLUSERSPROFILE%\projone\potcm\deskmgr32.dll
- %ALLUSERSPROFILE%\projone\potcm\doced64.dll
- %ALLUSERSPROFILE%\projone\potcm\docext.dll
- %ALLUSERSPROFILE%\projone\potcm\clientbase32.dll
- %ALLUSERSPROFILE%\projone\potcm\docguard64.dll
- %ALLUSERSPROFILE%\projone\potcm\filedp64.dll
- %ALLUSERSPROFILE%\projone\potcm\frcinst32.dll
- %ALLUSERSPROFILE%\projone\potcm\gxdte64.dll
- %ALLUSERSPROFILE%\projone\potcm\gxdte64.sys
- %ALLUSERSPROFILE%\projone\potcm\gxdte64_win7.sys
- %ALLUSERSPROFILE%\projone\potcm\gxonecli.exe
- %ALLUSERSPROFILE%\projone\potcm\hecate32.dll
- %ALLUSERSPROFILE%\projone\potcm\docscanner64.dll
- %ALLUSERSPROFILE%\projone\potcm\hermes32.dll
- %ALLUSERSPROFILE%\projone\potcm\backup64.dll
- %ALLUSERSPROFILE%\projone\potcm\cache\ico\softwareico\68bcbab07c506699.png
Удаляет следующие файлы
- %ALLUSERSPROFILE%\projone\potcm\siriuw32.dll.5204112d.dirty
- %ALLUSERSPROFILE%\projone\potcm\siriuw64.dll.38480864.dirty
- %ALLUSERSPROFILE%\projone\potcm\siriux32.dll.9e75b05b.dirty
- %ALLUSERSPROFILE%\projone\potcm\siriux64.dll.e00d1d48.dirty
- %ALLUSERSPROFILE%\projone\addons\addon_desc.json
- %WINDIR%\temp\1a05.tmp.json.json
- %WINDIR%\temp\1a05.tmp.json
- %ALLUSERSPROFILE%\projone\potcm\cache\software.json
- %ALLUSERSPROFILE%\projone\potcm\cache\upgrade\upgradeclients.json
- %LOCALAPPDATA%\projone\a0cc00f1\20241105\009206.tmp
Перемещает следующие файлы
- %ALLUSERSPROFILE%\projone\potcm\siriux32.dll в %ALLUSERSPROFILE%\projone\potcm\siriux32.dll.9e75b05b.dirty
- %ALLUSERSPROFILE%\projone\potcm\siriux64.dll в %ALLUSERSPROFILE%\projone\potcm\siriux64.dll.e00d1d48.dirty
- %ALLUSERSPROFILE%\projone\potcm\siriuw32.dll в %ALLUSERSPROFILE%\projone\potcm\siriuw32.dll.5204112d.dirty
- %ALLUSERSPROFILE%\projone\potcm\siriuw64.dll в %ALLUSERSPROFILE%\projone\potcm\siriuw64.dll.38480864.dirty
- %WINDIR%\logs\ignored.tmp в %WINDIR%\logs\ignored
- %ALLUSERSPROFILE%\projone\potcm\cache\upgrade\acagent.exe в %ALLUSERSPROFILE%\projone\potcm\acagent.exe
Сетевая активность
Подключается к
- 'da##########use-339014.hostingersite.com':443
- 'localhost':49181
- '20#.#38.220.159':13003
- '20#.#38.220.159':13001
- '20#.#38.220.159':13027
- '20#.#38.220.159':13023
TCP
Запросы HTTP POST
- http://20#.###.220.159:13023/api/user/login2 via 20#.#38.220.159
Другие
- '20#.#38.220.159':13001
- '20#.#38.220.159':13027
UDP
- DNS ASK da##########use-339014.hostingersite.com
Другое
Создает и запускает на исполнение
- '%TEMP%\aaf3be38-4b05-4ed1-b361-9e9393211611\za.exe' x C:/Users/user/AppData/Local/Temp/aaf3be38-4b05-4ed1-b361-9e9393211611/potcm.7z -pAb123456789 -o%ALLUSERSPROFILE%/projone -y
- '%ALLUSERSPROFILE%\projone\potcm\pobus64.exe' /i
- '%ALLUSERSPROFILE%\projone\potcm\pobus64.exe'
- '%ALLUSERSPROFILE%\projone\potcm\poda32.exe' 3a18d58c
- '%ALLUSERSPROFILE%\projone\potcm\assisths.exe'
- '%ALLUSERSPROFILE%\projone\potcm\poda32.exe' 712e221c
- '%ALLUSERSPROFILE%\projone\potcm\poda64.exe' 712e221c_64
Запускает на исполнение
- '<SYSTEM32>\cmd.exe' /c %ALLUSERSPROFILE%\projone\potcm\reg.bat
- '<SYSTEM32>\regsvr32.exe' /s shlext64.dll
- '<SYSTEM32>\regsvr32.exe' /s "%ALLUSERSPROFILE%\projone\potcm\shlext64.dll" (со скрытым окном)
- '%ALLUSERSPROFILE%\projone\potcm\assisths.exe' (со скрытым окном)
