Trojan.PWS.Banker1.12022

Техническая информация

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\conhost.exe' /pid=3264
'<SYSTEM32>\cacls.exe' /pid=3028
'<SYSTEM32>\conhost.exe' /pid=3680
'<SYSTEM32>\cacls.exe' /pid=3688
'<SYSTEM32>\conhost.exe' /pid=3592
'<SYSTEM32>\conhost.exe' /pid=3892
'<SYSTEM32>\conhost.exe' /pid=3036
'<SYSTEM32>\cacls.exe' /pid=3596
'<SYSTEM32>\cacls.exe' "%PROGRAM_FILES%\Scpad" /T /E /C /P Todos:F SYSTEM:N
'<SYSTEM32>\conhost.exe' "%WINDIR%\Downloaded Program Files\*.*" /T /E /C /P SYSTEM:N
'<SYSTEM32>\cacls.exe' "%PROGRAM_FILES%\Scpad\*" /T /E /C /P Todos:N
'<SYSTEM32>\cacls.exe' "%PROGRAM_FILES%\Scpad\*.gpc" /T /E /C /P Todos:N
'<SYSTEM32>\conhost.exe' "%PROGRAM_FILES%\Scpad\*.gpc" /T /E /C /P Todos:N
'<SYSTEM32>\conhost.exe' "%PROGRAM_FILES%\Scpad\*" /T /E /C /P SYSTEM:N
'<SYSTEM32>\cacls.exe'
'<SYSTEM32>\conhost.exe' "C:\Arquivos de Programas\Scpad\*.*" /T /E /C /P SYSTEM:N
'<SYSTEM32>\conhost.exe' /pid=3940
'<SYSTEM32>\cacls.exe' /pid=4392
'<SYSTEM32>\conhost.exe' /pid=5296
'<SYSTEM32>\cacls.exe' /pid=4356
'<SYSTEM32>\conhost.exe' /pid=4412
'<SYSTEM32>\conhost.exe' /pid=5272
'<SYSTEM32>\cacls.exe' /pid=5448
'<SYSTEM32>\cacls.exe' /pid=5656
'<SYSTEM32>\conhost.exe' /pid=6048
'<SYSTEM32>\cacls.exe' /pid=3672
'<SYSTEM32>\cacls.exe' /pid=3712
'<SYSTEM32>\conhost.exe' /pid=1968
'<SYSTEM32>\conhost.exe' /pid=1680
'<SYSTEM32>\conhost.exe' /pid=4156
'<SYSTEM32>\conhost.exe' /pid=4232
'<SYSTEM32>\cacls.exe' /pid=148
'<SYSTEM32>\conhost.exe' /pid=2980
'<SYSTEM32>\cacls.exe' "%PROGRAM_FILES%\Scpad\*.exe" /T /E /C /P Todos:N
'<SYSTEM32>\cacls.exe' "<DRIVERS>\GbpNdisrd.sys" /T /E /C /P SYSTEM:N
'<SYSTEM32>\cacls.exe' "%PROGRAM_FILES%\GbPlugin\*.dll" /T /E /C /P SYSTEM:N
'<SYSTEM32>\sc.exe' delete GbpSv
'<SYSTEM32>\cacls.exe' "<DRIVERS>\gbpkm.sys" /T /E /C /P SYSTEM:N
'<SYSTEM32>\cacls.exe' "%PROGRAM_FILES%\GbPlugin\*.gpc" /T /E /C /P SYSTEM:N
'<SYSTEM32>\cacls.exe' "%PROGRAM_FILES%\GbPlugin\*.dll" /T /E /C /P Todos:N
'<SYSTEM32>\cacls.exe' "%PROGRAM_FILES%\GbPlugin\*.*" /T /E /C /P SYSTEM:N
'<SYSTEM32>\cacls.exe' "%PROGRAM_FILES%\GbPlugin\*" /T /E /C /P SYSTEM:N
'<SYSTEM32>\cacls.exe' "%WINDIR%\Downloaded Program Files\*" /T /E /C /P SYSTEM:N
'<SYSTEM32>\cacls.exe' "%WINDIR%\Downloaded Program Files\*.gpc" /T /E /C /P SYSTEM:N
'<SYSTEM32>\cacls.exe' "%WINDIR%\Downloaded Program Files\*.dll" /T /E /C /P SYSTEM:N
'<SYSTEM32>\cacls.exe' "%WINDIR%\Downloaded Program Files\*.*" /T /E /C /P SYSTEM:N
'<SYSTEM32>\cacls.exe' "%WINDIR%\Downloaded Program Files\*" /T /E /C /P Todos:N
'<SYSTEM32>\cacls.exe' "%WINDIR%\Downloaded Program Files\*.gpc" /T /E /C /P Todos:N
'<SYSTEM32>\cacls.exe' "%WINDIR%\Downloaded Program Files\*.dll" /T /E /C /P Todos:N
'<SYSTEM32>\cacls.exe' "%WINDIR%\Downloaded Program Files\gbiehuni.dll" /T /E /C /P Todos:N SYSTEM:N
'<SYSTEM32>\cacls.exe' "%PROGRAM_FILES%\GbPlugin\*.exe" /T /E /C /P Todos:N
'<SYSTEM32>\cacls.exe' "C:\Arquivos de Programas\Scpad\*.gpc" /T /E /C /P Todos:N
'<SYSTEM32>\cacls.exe' "%PROGRAM_FILES%\Scpad\*.dll" /T /E /C /P SYSTEM:N
'<SYSTEM32>\cacls.exe' "C:\Arquivos de Programas\Scpad\gbiehuni.dll" /T /E /C /P Todos:N SYSTEM:N
'<SYSTEM32>\cacls.exe' "C:\Arquivos de Programas\Scpad\*" /T /E /C /P Todos:N
'<SYSTEM32>\cacls.exe' "%PROGRAM_FILES%\Scpad\*.gpc" /T /E /C /P SYSTEM:N
'<SYSTEM32>\cacls.exe' "%PROGRAM_FILES%\Scpad\*.dll" /T /E /C /P Todos:N
'<SYSTEM32>\cacls.exe' "%PROGRAM_FILES%\Scpad\*.*" /T /E /C /P SYSTEM:N
'<SYSTEM32>\cacls.exe' "%PROGRAM_FILES%\Scpad\*" /T /E /C /P SYSTEM:N
'<SYSTEM32>\cacls.exe' "%PROGRAM_FILES%\GbPlugin" /T /E /C /P Todos:F SYSTEM:N
'<SYSTEM32>\cacls.exe' "C:\Arquivos de Programas\Scpad\*.dll" /T /E /C /P SYSTEM:N
'<SYSTEM32>\cacls.exe' "%PROGRAM_FILES%\GbPlugin\*" /T /E /C /P Todos:N
'<SYSTEM32>\cacls.exe' "%PROGRAM_FILES%\GbPlugin\*.gpc" /T /E /C /P Todos:N
'<SYSTEM32>\cacls.exe' "C:\Arquivos de Programas\Scpad\*.gpc" /T /E /C /P SYSTEM:N
'<SYSTEM32>\cacls.exe' "C:\Arquivos de Programas\Scpad\*.dll" /T /E /C /P Todos:N
'<SYSTEM32>\cacls.exe' "C:\Arquivos de Programas\Scpad\*.*" /T /E /C /P SYSTEM:N
'<SYSTEM32>\cacls.exe' "C:\Arquivos de Programas\Scpad\*" /T /E /C /P SYSTEM:N