Trojan.Hosts.53230

Техническая информация

Изменения в файловой системе

Создает следующие файлы

%TEMP%\aut37f4.tmp
%CommonProgramFiles(x86)%\~vpegsfg.tmp
%TEMP%\nsn41e8.tmp\userinfo.dll
%ProgramFiles(x86)%\mirillis\action!\preinstall.exe
%ProgramFiles(x86)%\mirillis\action!\action.exe
%ProgramFiles(x86)%\mirillis\action!\action.vbs
%ProgramFiles(x86)%\mirillis\action!\action_launcher_x86.exe
%ProgramFiles(x86)%\mirillis\action!\action_launcher_x64.exe
%ProgramFiles(x86)%\mirillis\action!\action_logon.exe
%ProgramFiles(x86)%\mirillis\action!\action_svc.exe
%ProgramFiles(x86)%\mirillis\action!\action_x64.bin
%ProgramFiles(x86)%\mirillis\action!\action_x64.dll
%ProgramFiles(x86)%\mirillis\action!\action_x86.bin
%ProgramFiles(x86)%\mirillis\action!\action_x86.dll
%ProgramFiles(x86)%\mirillis\action!\actionplayer.exe
%ProgramFiles(x86)%\mirillis\action!\aenc.dll
%ProgramFiles(x86)%\mirillis\action!\aenc2.dll
%ProgramFiles(x86)%\mirillis\action!\amf-component-vce-windesktop32.dll
%ProgramFiles(x86)%\mirillis\action!\amf-core-windesktop32.dll
%ProgramFiles(x86)%\mirillis\action!\amfenc.dll
%ProgramFiles(x86)%\mirillis\action!\msvcp100.dll
%ProgramFiles(x86)%\mirillis\action!\msvcr100.dll
%ProgramFiles(x86)%\mirillis\action!\apu2enc.dll
%ProgramFiles(x86)%\mirillis\action!\nvencodeapi.dll
%ProgramFiles(x86)%\mirillis\action!\d3dx9_40.dll
%ProgramFiles(x86)%\mirillis\action!\eula_action!.rtf
%ProgramFiles(x86)%\mirillis\action!\ficvdec_x64.dll
%ProgramFiles(x86)%\mirillis\action!\ficvdec_x64.reg
%ProgramFiles(x86)%\mirillis\action!\ficvdec_x86.dll
%ProgramFiles(x86)%\mirillis\action!\ficvdec_x86.reg
%ProgramFiles(x86)%\mirillis\action!\libmfxsw32.dll
%ProgramFiles(x86)%\mirillis\action!\muxer.dll
%ProgramFiles(x86)%\mirillis\action!\rcu.dll
%ProgramFiles(x86)%\mirillis\action!\register_ficv_codec.bat
%ProgramFiles(x86)%\mirillis\action!\res0407.dll
%ProgramFiles(x86)%\mirillis\action!\res0407_ex.dll
%ProgramFiles(x86)%\mirillis\action!\res0409.dll
%ProgramFiles(x86)%\mirillis\action!\res0409_ex.dll
%ProgramFiles(x86)%\mirillis\action!\res040a.dll
%ProgramFiles(x86)%\mirillis\action!\res040a_ex.dll
%ProgramFiles(x86)%\mirillis\action!\res040c.dll
%ProgramFiles(x86)%\mirillis\action!\res040c_ex.dll
%ProgramFiles(x86)%\mirillis\action!\res0410.dll
%ProgramFiles(x86)%\mirillis\action!\res0410_ex.dll
%ProgramFiles(x86)%\mirillis\action!\res0411.dll
%ProgramFiles(x86)%\mirillis\action!\res0411_ex.dll
%ProgramFiles(x86)%\mirillis\action!\res0413.dll
%ProgramFiles(x86)%\mirillis\action!\res0413_ex.dll
%ProgramFiles(x86)%\mirillis\action!\res0415.dll
%ProgramFiles(x86)%\mirillis\action!\res0415_ex.dll
%ProgramFiles(x86)%\mirillis\action!\res0416.dll
%ProgramFiles(x86)%\mirillis\action!\res0416_ex.dll
%ProgramFiles(x86)%\mirillis\action!\res0418.dll
%ProgramFiles(x86)%\mirillis\action!\res0418_ex.dll
%ProgramFiles(x86)%\mirillis\action!\res0419.dll
%ProgramFiles(x86)%\mirillis\action!\res0419_ex.dll
%ProgramFiles(x86)%\mirillis\action!\res042a.dll
%ProgramFiles(x86)%\mirillis\action!\res042a_ex.dll
%ProgramFiles(x86)%\mirillis\action!\res0816.dll
%ProgramFiles(x86)%\mirillis\action!\res0816_ex.dll
%ProgramFiles(x86)%\mirillis\action!\resa936.dll
%ProgramFiles(x86)%\mirillis\action!\resa936_ex.dll
%ProgramFiles(x86)%\mirillis\action!\resb936.dll
%ProgramFiles(x86)%\mirillis\action!\resb936_ex.dll
%ProgramFiles(x86)%\mirillis\action!\ui_res.dll
%ProgramFiles(x86)%\mirillis\action!\ui_res_150.dll
%ProgramFiles(x86)%\mirillis\action!\upload_login.exe
%ProgramFiles(x86)%\mirillis\action!\tldr.dll
%ProgramFiles(x86)%\mirillis\action!\tutorial_launcher.exe
%ProgramFiles(x86)%\mirillis\action!\player_theme.dll
%ProgramFiles(x86)%\mirillis\action!\tscap.bin
%ProgramFiles(x86)%\mirillis\action!\vcap.dll
%ProgramFiles(x86)%\mirillis\action!\booter.exe
%ProgramFiles(x86)%\mirillis\action!\tutorial\1.html
%ProgramFiles(x86)%\mirillis\action!\tutorial\2.html
%ProgramFiles(x86)%\mirillis\action!\tutorial\3.html
%ProgramFiles(x86)%\mirillis\action!\tutorial\4.html
%ProgramFiles(x86)%\mirillis\action!\tutorial\5.html
%ProgramFiles(x86)%\mirillis\action!\tutorial\6.html
%ProgramFiles(x86)%\mirillis\action!\tutorial\7.html
%ProgramFiles(x86)%\mirillis\action!\tutorial\8.html
%ProgramFiles(x86)%\mirillis\action!\tutorial\9.html
%ProgramFiles(x86)%\mirillis\action!\tutorial\10.html
%ProgramFiles(x86)%\mirillis\action!\tutorial\11.html
%ProgramFiles(x86)%\mirillis\action!\tutorial\12.html
%ProgramFiles(x86)%\mirillis\action!\tutorial\13.html
%ProgramFiles(x86)%\mirillis\action!\tutorial\14.html
%ProgramFiles(x86)%\mirillis\action!\uninstall.exe
C:\users\public\desktop\action!.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\mirillis\action!\action!.lnk
%TEMP%\nsn41e8.tmp\system.dll
%TEMP%\{e1bf399b-a435-4b35-8d28-8ac8375fb51d}.png
%LOCALAPPDATA%\microsoft\windows\explorer\notifyicon\microsoft.explorer.notification.{8bbb495b-0fbe-e178-11d0-174ada6dc65b}.png

Присваивает атрибут 'скрытый' для следующих файлов

%CommonProgramFiles(x86)%\~vpegsfg.tmp

Удаляет файлы, которые сам же создал

%TEMP%\aut37f4.tmp
%ProgramFiles(x86)%\mirillis\action!\preinstall.exe
%ProgramFiles(x86)%\mirillis\action!\booter.exe
%ProgramFiles(x86)%\mirillis\action!\nvencodeapi.dll
%TEMP%\nsn41e8.tmp\system.dll
%TEMP%\nsn41e8.tmp\userinfo.dll
%TEMP%\{e1bf399b-a435-4b35-8d28-8ac8375fb51d}.png
%CommonProgramFiles(x86)%\~vpegsfg.tmp
%LOCALAPPDATA%\microsoft\windows\explorer\notifyicon\microsoft.explorer.notification.{8bbb495b-0fbe-e178-11d0-174ada6dc65b}.png

Изменяет файл HOSTS.

Другое

Ищет следующие окна

ClassName: 'Action_WndClass_1000' WindowName: 'Action!'

Создает и запускает на исполнение

'%CommonProgramFiles(x86)%\~vpegsfg.tmp' /S
'%ProgramFiles(x86)%\mirillis\action!\preinstall.exe' "action_x86.dll" "action_x64.dll" "apu2enc.dll" "aenc.dll" "Action_x64.bin" "Action_x86.bin" "action_svc.exe" "action_logon.exe" "action_launcher_x86.exe" "action_launcher_x64.exe" "action.exe"
'%ProgramFiles(x86)%\mirillis\action!\booter.exe' 6