Техническая информация
Для обеспечения автозапуска и распространения
Модифицирует следующие ключи реестра
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'JavaUpdate' = '%APPDATA%\Oracle\Java\JavaUpdate.exe'
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\_mei39642\vcruntime140.dll
- %TEMP%\_mei39642\vcruntime140_1.dll
- %TEMP%\_mei39642\_bz2.pyd
- %TEMP%\_mei39642\_ctypes.pyd
- %TEMP%\_mei39642\_decimal.pyd
- %TEMP%\_mei39642\_hashlib.pyd
- %TEMP%\_mei39642\_lzma.pyd
- %TEMP%\_mei39642\_socket.pyd
- %TEMP%\_mei39642\_wmi.pyd
- %TEMP%\_mei39642\api-ms-win-core-console-l1-1-0.dll
- %TEMP%\_mei39642\api-ms-win-core-datetime-l1-1-0.dll
- %TEMP%\_mei39642\api-ms-win-core-debug-l1-1-0.dll
- %TEMP%\_mei39642\api-ms-win-core-errorhandling-l1-1-0.dll
- %TEMP%\_mei39642\api-ms-win-core-file-l1-1-0.dll
- %TEMP%\_mei39642\api-ms-win-core-file-l1-2-0.dll
- %TEMP%\_mei39642\api-ms-win-core-file-l2-1-0.dll
- %TEMP%\_mei39642\api-ms-win-core-handle-l1-1-0.dll
- %TEMP%\_mei39642\api-ms-win-core-heap-l1-1-0.dll
- %TEMP%\_mei39642\api-ms-win-core-interlocked-l1-1-0.dll
- %TEMP%\_mei39642\api-ms-win-core-libraryloader-l1-1-0.dll
- %TEMP%\_mei39642\api-ms-win-core-localization-l1-2-0.dll
- %TEMP%\_mei39642\api-ms-win-core-memory-l1-1-0.dll
- %TEMP%\_mei39642\api-ms-win-core-namedpipe-l1-1-0.dll
- %TEMP%\_mei39642\api-ms-win-core-path-l1-1-0.dll
- %TEMP%\_mei39642\api-ms-win-core-processenvironment-l1-1-0.dll
- %TEMP%\_mei39642\api-ms-win-core-processthreads-l1-1-0.dll
- %TEMP%\_mei39642\api-ms-win-core-processthreads-l1-1-1.dll
- %TEMP%\_mei39642\api-ms-win-core-profile-l1-1-0.dll
- %TEMP%\_mei39642\api-ms-win-core-rtlsupport-l1-1-0.dll
- %TEMP%\_mei39642\api-ms-win-core-string-l1-1-0.dll
- %TEMP%\_mei39642\api-ms-win-core-synch-l1-1-0.dll
- %TEMP%\_mei39642\api-ms-win-core-synch-l1-2-0.dll
- %TEMP%\_mei39642\api-ms-win-core-sysinfo-l1-1-0.dll
- %TEMP%\_mei39642\api-ms-win-core-timezone-l1-1-0.dll
- %TEMP%\_mei39642\api-ms-win-core-util-l1-1-0.dll
- %TEMP%\_mei39642\api-ms-win-crt-conio-l1-1-0.dll
- %TEMP%\_mei39642\api-ms-win-crt-convert-l1-1-0.dll
- %TEMP%\_mei39642\api-ms-win-crt-environment-l1-1-0.dll
- %TEMP%\_mei39642\api-ms-win-crt-filesystem-l1-1-0.dll
- %TEMP%\_mei39642\api-ms-win-crt-heap-l1-1-0.dll
- %TEMP%\_mei39642\api-ms-win-crt-locale-l1-1-0.dll
- %TEMP%\_mei39642\api-ms-win-crt-math-l1-1-0.dll
- %TEMP%\_mei39642\api-ms-win-crt-process-l1-1-0.dll
- %TEMP%\_mei39642\api-ms-win-crt-runtime-l1-1-0.dll
- %TEMP%\_mei39642\api-ms-win-crt-stdio-l1-1-0.dll
- %TEMP%\_mei39642\api-ms-win-crt-string-l1-1-0.dll
- %TEMP%\_mei39642\api-ms-win-crt-time-l1-1-0.dll
- %TEMP%\_mei39642\api-ms-win-crt-utility-l1-1-0.dll
- %TEMP%\_mei39642\base_library.zip
- %TEMP%\_mei39642\libcrypto-3.dll
- %TEMP%\_mei39642\libffi-8.dll
- %TEMP%\_mei39642\python313.dll
- %TEMP%\_mei39642\select.pyd
- %TEMP%\_mei39642\ucrtbase.dll
- %TEMP%\_mei39642\unicodedata.pyd
- %APPDATA%\oracle\java\javaupdate.exe
- %TEMP%\6zfctl93
- %TEMP%\app_qqxsu89b\spyhunter-5.20-5-85330-installer.exe
- %TEMP%\_mei37322\vcruntime140.dll
- %TEMP%\_mei37322\vcruntime140_1.dll
- %TEMP%\_mei37322\_bz2.pyd
- %TEMP%\_mei37322\_ctypes.pyd
- %TEMP%\_mei37322\_decimal.pyd
- %TEMP%\_mei37322\_hashlib.pyd
- %TEMP%\_mei37322\_lzma.pyd
- %TEMP%\_mei37322\_socket.pyd
- %TEMP%\_mei37322\_wmi.pyd
- %TEMP%\_mei37322\api-ms-win-core-console-l1-1-0.dll
- %TEMP%\_mei37322\api-ms-win-core-datetime-l1-1-0.dll
- %TEMP%\_mei37322\api-ms-win-core-debug-l1-1-0.dll
- %TEMP%\_mei37322\api-ms-win-core-errorhandling-l1-1-0.dll
- %TEMP%\_mei37322\api-ms-win-core-file-l1-1-0.dll
- %TEMP%\_mei37322\api-ms-win-core-file-l1-2-0.dll
- %TEMP%\_mei37322\api-ms-win-core-file-l2-1-0.dll
- %TEMP%\_mei37322\api-ms-win-core-handle-l1-1-0.dll
- %TEMP%\_mei37322\api-ms-win-core-heap-l1-1-0.dll
- %TEMP%\_mei37322\api-ms-win-core-interlocked-l1-1-0.dll
- %TEMP%\_mei37322\api-ms-win-core-libraryloader-l1-1-0.dll
- %TEMP%\_mei37322\api-ms-win-core-localization-l1-2-0.dll
- %TEMP%\_mei37322\api-ms-win-core-memory-l1-1-0.dll
- %TEMP%\_mei37322\api-ms-win-core-namedpipe-l1-1-0.dll
- %TEMP%\_mei37322\api-ms-win-core-path-l1-1-0.dll
- %TEMP%\_mei37322\api-ms-win-core-processenvironment-l1-1-0.dll
- %TEMP%\_mei37322\api-ms-win-core-processthreads-l1-1-0.dll
- %TEMP%\_mei37322\api-ms-win-core-processthreads-l1-1-1.dll
- %TEMP%\_mei37322\api-ms-win-core-profile-l1-1-0.dll
- %TEMP%\_mei37322\api-ms-win-core-rtlsupport-l1-1-0.dll
- %TEMP%\_mei37322\api-ms-win-core-string-l1-1-0.dll
- %TEMP%\_mei37322\api-ms-win-core-synch-l1-1-0.dll
- %TEMP%\_mei37322\api-ms-win-core-synch-l1-2-0.dll
- %TEMP%\_mei37322\api-ms-win-core-sysinfo-l1-1-0.dll
- %TEMP%\_mei37322\api-ms-win-core-timezone-l1-1-0.dll
- %TEMP%\_mei37322\api-ms-win-core-util-l1-1-0.dll
- %TEMP%\_mei37322\api-ms-win-crt-conio-l1-1-0.dll
- %TEMP%\_mei37322\api-ms-win-crt-convert-l1-1-0.dll
- %TEMP%\_mei37322\api-ms-win-crt-environment-l1-1-0.dll
- %TEMP%\_mei37322\api-ms-win-crt-filesystem-l1-1-0.dll
- %TEMP%\_mei37322\api-ms-win-crt-heap-l1-1-0.dll
- %TEMP%\_mei37322\api-ms-win-crt-locale-l1-1-0.dll
- %TEMP%\_mei37322\api-ms-win-crt-math-l1-1-0.dll
- %TEMP%\_mei37322\api-ms-win-crt-process-l1-1-0.dll
- %TEMP%\_mei37322\api-ms-win-crt-runtime-l1-1-0.dll
- %TEMP%\_mei37322\api-ms-win-crt-stdio-l1-1-0.dll
- %TEMP%\_mei37322\api-ms-win-crt-string-l1-1-0.dll
- %TEMP%\_mei37322\api-ms-win-crt-time-l1-1-0.dll
- %TEMP%\_mei37322\api-ms-win-crt-utility-l1-1-0.dll
- %TEMP%\_mei37322\base_library.zip
- %TEMP%\_mei37322\libcrypto-3.dll
- %TEMP%\_mei37322\libffi-8.dll
- %TEMP%\_mei37322\python313.dll
- %TEMP%\_mei37322\select.pyd
- %TEMP%\_mei37322\ucrtbase.dll
- %TEMP%\_mei37322\unicodedata.pyd
- %TEMP%\esg_setup.log
Присваивает атрибут 'скрытый' для следующих файлов
- %APPDATA%\oracle\java\javaupdate.exe
Удаляет файлы, которые сам же создал
- %TEMP%\6zfctl93
- %TEMP%\_mei39642\api-ms-win-core-console-l1-1-0.dll
- %TEMP%\_mei39642\api-ms-win-core-datetime-l1-1-0.dll
- %TEMP%\_mei39642\api-ms-win-core-debug-l1-1-0.dll
- %TEMP%\_mei39642\api-ms-win-core-errorhandling-l1-1-0.dll
- %TEMP%\_mei39642\api-ms-win-core-file-l1-1-0.dll
- %TEMP%\_mei39642\api-ms-win-core-file-l1-2-0.dll
- %TEMP%\_mei39642\api-ms-win-core-file-l2-1-0.dll
- %TEMP%\_mei39642\api-ms-win-core-handle-l1-1-0.dll
- %TEMP%\_mei39642\api-ms-win-core-heap-l1-1-0.dll
- %TEMP%\_mei39642\api-ms-win-core-interlocked-l1-1-0.dll
- %TEMP%\_mei39642\api-ms-win-core-libraryloader-l1-1-0.dll
- %TEMP%\_mei39642\api-ms-win-core-localization-l1-2-0.dll
- %TEMP%\_mei39642\api-ms-win-core-memory-l1-1-0.dll
- %TEMP%\_mei39642\api-ms-win-core-namedpipe-l1-1-0.dll
- %TEMP%\_mei39642\api-ms-win-core-path-l1-1-0.dll
- %TEMP%\_mei39642\api-ms-win-core-processenvironment-l1-1-0.dll
- %TEMP%\_mei39642\api-ms-win-core-processthreads-l1-1-0.dll
- %TEMP%\_mei39642\api-ms-win-core-processthreads-l1-1-1.dll
- %TEMP%\_mei39642\api-ms-win-core-profile-l1-1-0.dll
- %TEMP%\_mei39642\api-ms-win-core-rtlsupport-l1-1-0.dll
- %TEMP%\_mei39642\api-ms-win-core-string-l1-1-0.dll
- %TEMP%\_mei39642\api-ms-win-core-synch-l1-1-0.dll
- %TEMP%\_mei39642\api-ms-win-core-synch-l1-2-0.dll
- %TEMP%\_mei39642\api-ms-win-core-sysinfo-l1-1-0.dll
- %TEMP%\_mei39642\api-ms-win-core-timezone-l1-1-0.dll
- %TEMP%\_mei39642\api-ms-win-core-util-l1-1-0.dll
- %TEMP%\_mei39642\api-ms-win-crt-conio-l1-1-0.dll
- %TEMP%\_mei39642\api-ms-win-crt-convert-l1-1-0.dll
- %TEMP%\_mei39642\api-ms-win-crt-environment-l1-1-0.dll
- %TEMP%\_mei39642\api-ms-win-crt-filesystem-l1-1-0.dll
- %TEMP%\_mei39642\api-ms-win-crt-heap-l1-1-0.dll
- %TEMP%\_mei39642\api-ms-win-crt-locale-l1-1-0.dll
- %TEMP%\_mei39642\api-ms-win-crt-math-l1-1-0.dll
- %TEMP%\_mei39642\api-ms-win-crt-process-l1-1-0.dll
- %TEMP%\_mei39642\api-ms-win-crt-runtime-l1-1-0.dll
- %TEMP%\_mei39642\api-ms-win-crt-stdio-l1-1-0.dll
- %TEMP%\_mei39642\api-ms-win-crt-string-l1-1-0.dll
- %TEMP%\_mei39642\api-ms-win-crt-time-l1-1-0.dll
- %TEMP%\_mei39642\api-ms-win-crt-utility-l1-1-0.dll
- %TEMP%\_mei39642\base_library.zip
- %TEMP%\_mei39642\libcrypto-3.dll
- %TEMP%\_mei39642\libffi-8.dll
- %TEMP%\_mei39642\python313.dll
- %TEMP%\_mei39642\select.pyd
- %TEMP%\_mei39642\ucrtbase.dll
- %TEMP%\_mei39642\unicodedata.pyd
- %TEMP%\_mei39642\vcruntime140.dll
- %TEMP%\_mei39642\vcruntime140_1.dll
- %TEMP%\_mei39642\_bz2.pyd
- %TEMP%\_mei39642\_ctypes.pyd
- %TEMP%\_mei39642\_decimal.pyd
- %TEMP%\_mei39642\_hashlib.pyd
- %TEMP%\_mei39642\_lzma.pyd
- %TEMP%\_mei39642\_socket.pyd
- %TEMP%\_mei39642\_wmi.pyd
Сетевая активность
Подключается к
- 'localhost':49693
- 'ge####.enigmasoft.net':443
- 'localhost':49696
- 'in#######.enigmasoftware.com':80
- 'localhost':49699
- 'in#######.enigmasoftware.com':443
- 'localhost':49702
- 'localhost':49705
- 'localhost':49708
- 'go#####a###ytics.com':443
- 'localhost':49711
- 'localhost':49714
- 'localhost':49717
- 'localhost':49720
- 'localhost':49723
TCP
Запросы HTTP GET
- http://in#######.enigmasoftware.com/log_collect.cfg
Другие
- 'localhost':49693
- 'localhost':49694
- 'ge####.enigmasoft.net':443
- 'localhost':49696
- 'localhost':49697
- 'localhost':49699
- 'localhost':49700
- 'in#######.enigmasoftware.com':443
- 'localhost':49702
- 'localhost':49703
- 'localhost':49705
- 'localhost':49706
- 'localhost':49708
- 'localhost':49709
- 'localhost':49711
- 'localhost':49712
- 'go#####a###ytics.com':443
- 'localhost':49714
- 'localhost':49715
- 'localhost':49717
- 'localhost':49718
- 'localhost':49720
- 'localhost':49721
- 'localhost':49723
- 'localhost':49724
UDP
- DNS ASK ge####.enigmasoft.net
- DNS ASK in#######.enigmasoftware.com
- DNS ASK go#####a###ytics.com
Другое
Создает и запускает на исполнение
- '%APPDATA%\oracle\java\javaupdate.exe'
- '%TEMP%\app_qqxsu89b\spyhunter-5.20-5-85330-installer.exe'
Перезапускает анализируемый образец
