Trojan.Inject5.59182

Техническая информация

Вредоносные функции

Внедряет код в

следующие системные процессы:

<SYSTEM32>\setspn.exe

Изменения в файловой системе

Создает следующие файлы

%WINDIR%\windowsshell7256.log
%WINDIR%\windowssystemupdate05.log

Самоудаляется.

Сетевая активность

Подключается к

'co##############e-chains.prod.autograph.services.mozaws.net':443
'47.#8.35.46':36281
'<LOCALNET>..89.0':51420
'<LOCALNET>..89.2':51420
'<LOCALNET>..89.4':51420
'<LOCALNET>..89.1':51420
'<LOCALNET>..89.8':51420
'<LOCALNET>..89.6':51420
'<LOCALNET>..89.12':51420
'<LOCALNET>..89.14':51420
'<LOCALNET>..89.18':51420
'<LOCALNET>..89.20':51420
'<LOCALNET>..89.22':51420
'<LOCALNET>..89.24':51420
'<LOCALNET>..89.26':51420
'<LOCALNET>..89.28':51420
'<LOCALNET>..89.30':51420
'<LOCALNET>..89.32':51420
'<LOCALNET>..89.34':51420
'<LOCALNET>..89.10':51420
'<LOCALNET>..89.16':51420
'<LOCALNET>..89.36':51420
'<LOCALNET>..89.38':51420
'<LOCALNET>..89.40':51420
'<LOCALNET>..89.42':51420
'<LOCALNET>..89.44':51420
'<LOCALNET>..89.48':51420
'<LOCALNET>..89.46':51420
'<LOCALNET>..89.50':51420
'<LOCALNET>..89.9':51420
'<LOCALNET>..89.52':51420
'<LOCALNET>..89.62':51420
'<LOCALNET>..89.3':51420
'<LOCALNET>..89.13':51420
'<LOCALNET>..89.58':51420
'<LOCALNET>..89.60':51420
'<LOCALNET>..89.5':51420
'<LOCALNET>..89.17':51420
'<LOCALNET>..89.54':51420
'<LOCALNET>..89.66':51420
'<LOCALNET>..89.19':51420
'<LOCALNET>..89.68':51420
'<LOCALNET>..89.21':51420
'<LOCALNET>..89.23':51420
'<LOCALNET>..89.25':51420
'<LOCALNET>..89.70':51420
'<LOCALNET>..89.72':51420
'<LOCALNET>..89.7':51420
'<LOCALNET>..89.27':51420
'<LOCALNET>..89.74':51420
'<LOCALNET>..89.76':51420
'<LOCALNET>..89.31':51420
'<LOCALNET>..89.33':51420
'<LOCALNET>..89.35':51420
'<LOCALNET>..89.39':51420
'<LOCALNET>..89.41':51420
'<LOCALNET>..89.43':51420
'<LOCALNET>..89.78':51420
'<LOCALNET>..89.45':51420
'<LOCALNET>..89.47':51420
'<LOCALNET>..89.56':51420
'<LOCALNET>..89.80':51420
'<LOCALNET>..89.64':51420
'<LOCALNET>..89.82':51420
'<LOCALNET>..89.84':51420
'<LOCALNET>..89.88':51420
'<LOCALNET>..89.55':51420
'<LOCALNET>..89.86':51420
'<LOCALNET>..89.57':51420
'<LOCALNET>..89.59':51420
'<LOCALNET>..89.90':51420
'<LOCALNET>..89.61':51420
'<LOCALNET>..89.67':51420
'<LOCALNET>..89.69':51420
'<LOCALNET>..89.77':51420
'<LOCALNET>..89.71':51420
'<LOCALNET>..89.79':51420
'<LOCALNET>..89.81':51420
'<LOCALNET>..89.92':51420
'<LOCALNET>..89.65':51420
'<LOCALNET>..89.94':51420
'<LOCALNET>..89.15':51420
'<LOCALNET>..89.11':51420
'<LOCALNET>..89.37':51420
'<LOCALNET>..89.49':51420
'<LOCALNET>..89.75':51420
'<LOCALNET>..89.51':51420
'<LOCALNET>..89.96':51420
'<LOCALNET>..89.53':51420
'<LOCALNET>..89.100':51420
'<LOCALNET>..89.102':51420
'<LOCALNET>..89.73':51420
'<LOCALNET>..89.104':51420
'<LOCALNET>..89.106':51420
'<LOCALNET>..89.108':51420
'<LOCALNET>..89.110':51420
'<LOCALNET>..89.29':51420
'<LOCALNET>..89.98':51420
'<LOCALNET>..89.89':51420
'<LOCALNET>..89.91':51420
'<LOCALNET>..89.95':51420
'<LOCALNET>..89.112':51420
'<LOCALNET>..89.99':51420
'<LOCALNET>..89.101':51420
'<LOCALNET>..89.93':51420
'<LOCALNET>..89.105':51420
'<LOCALNET>..89.107':51420
'<LOCALNET>..89.63':51420
'<LOCALNET>..89.83':51420
'<LOCALNET>..89.97':51420
'<LOCALNET>..89.114':51420
'<LOCALNET>..89.116':51420
'<LOCALNET>..89.85':51420
'<LOCALNET>..89.87':51420
'<LOCALNET>..89.103':51420
'<LOCALNET>..89.118':51420
'<LOCALNET>..89.120':51420
'<LOCALNET>..89.122':51420
'<LOCALNET>..89.124':51420
'<LOCALNET>..89.126':51420
'<LOCALNET>..89.128':51420
'<LOCALNET>..89.130':51420
'<LOCALNET>..89.132':51420
'<LOCALNET>..89.134':51420
'<LOCALNET>..89.136':51420
'<LOCALNET>..89.138':51420
'<LOCALNET>..89.140':51420
'<LOCALNET>..89.142':51420
'<LOCALNET>..89.109':51420
'<LOCALNET>..89.113':51420
'<LOCALNET>..89.115':51420
'<LOCALNET>..89.119':51420
'<LOCALNET>..89.117':51420
'<LOCALNET>..89.125':51420
'<LOCALNET>..89.123':51420
'<LOCALNET>..89.121':51420
'<LOCALNET>..89.129':51420
'<LOCALNET>..89.131':51420
'<LOCALNET>..89.127':51420
'<LOCALNET>..89.133':51420
'<LOCALNET>..89.137':51420
'<LOCALNET>..89.144':51420
'<LOCALNET>..89.139':51420
'<LOCALNET>..89.146':51420
'<LOCALNET>..89.111':51420
'<LOCALNET>..89.135':51420
'<LOCALNET>..89.141':51420
'<LOCALNET>..89.148':51420
'<LOCALNET>..89.150':51420
'<LOCALNET>..89.152':51420
'<LOCALNET>..89.156':51420
'<LOCALNET>..89.160':51420
'<LOCALNET>..89.164':51420
'<LOCALNET>..89.158':51420
'<LOCALNET>..89.154':51420
'<LOCALNET>..89.162':51420
'<LOCALNET>..89.143':51420
'<LOCALNET>..89.151':51420
'<LOCALNET>..89.149':51420
'<LOCALNET>..89.161':51420
'<LOCALNET>..89.155':51420
'<LOCALNET>..89.157':51420
'<LOCALNET>..89.145':51420
'<LOCALNET>..89.153':51420
'<LOCALNET>..89.147':51420
'<LOCALNET>..89.159':51420
'<LOCALNET>..89.163':51420
'<LOCALNET>..89.166':51420
'<LOCALNET>..89.167':51420
'<LOCALNET>..89.165':51420
'<LOCALNET>..89.168':51420
'<LOCALNET>..89.169':51420
'<LOCALNET>..89.171':51420
'<LOCALNET>..89.173':51420
'<LOCALNET>..89.170':51420
'<LOCALNET>..89.174':51420
'<LOCALNET>..89.177':51420
'<LOCALNET>..89.176':51420
'<LOCALNET>..89.181':51420
'<LOCALNET>..89.178':51420
'<LOCALNET>..89.184':51420
'<LOCALNET>..89.175':51420
'<LOCALNET>..89.179':51420
'<LOCALNET>..89.187':51420
'<LOCALNET>..89.180':51420
'<LOCALNET>..89.189':51420
'<LOCALNET>..89.186':51420
'<LOCALNET>..89.190':51420
'<LOCALNET>..89.192':51420
'<LOCALNET>..89.193':51420
'<LOCALNET>..89.194':51420
'<LOCALNET>..89.196':51420
'<LOCALNET>..89.198':51420
'<LOCALNET>..89.172':51420
'<LOCALNET>..89.197':51420
'<LOCALNET>..89.183':51420
'<LOCALNET>..89.188':51420
'<LOCALNET>..89.185':51420
'<LOCALNET>..89.199':51420
'<LOCALNET>..89.182':51420
'<LOCALNET>..89.191':51420
'<LOCALNET>..89.195':51420
'43.##9.192.68':46283
'47.##.113.58':46282

TCP

Другие

'47.#8.35.46':36281

UDP

DNS ASK co##############e-chains.prod.autograph.services.mozaws.net
'255.255.255.255':11917

Другое

Запускает на исполнение

'<SYSTEM32>\setspn.exe'
'<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 4 "<SYSTEM32>\setspn.exe"
'<SYSTEM32>\cmd.exe' /c del <Полный путь к файлу> >> NUL (со скрытым окном)