Техническая информация
Вредоносные функции
Запускает на исполнение
- '<SYSTEM32>\taskkill.exe' /PID 4232 /F
- '<SYSTEM32>\taskkill.exe' /PID 1252 /F
- '<SYSTEM32>\taskkill.exe' /PID 4968 /F
- '<SYSTEM32>\taskkill.exe' /PID 3040 /F
- '<SYSTEM32>\taskkill.exe' /PID 4396 /F
Завершает или пытается завершить
следующие пользовательские процессы:
- firefox.exe
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\dec_41bdfaa9-9ea3-498f-96aa-cc681404e6b1.db
- C:\securityhelper\manifest.json
- C:\securityhelper\background.js
- C:\securityhelper\content.js
- C:\securityhelper\injected.js
- C:\securityhelper\popup.html
- C:\securityhelper\icon.png
- <DRIVERS>\etc\hosts.bak
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\startup\.cache
- C:\users\public\documents\.system
- %TEMP%\dec_4366a9ba-8b4f-498d-a416-dac04986cc40.db
- %TEMP%\dec_d3594c3f-8c53-4470-995a-3e5e7f027634.db
Изменяет следующие файлы
- %HOMEPATH%\desktop\google chrome.lnk
- %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\microsoft edge.lnk
- %APPDATA%\microsoft\windows\start menu\programs\google chrome\google chrome.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft edge.lnk
Сетевая активность
Подключается к
- 'localhost':49694
UDP
- DNS ASK ap#.##legram.org
- DNS ASK di##ord.com
- DNS ASK ap#.#pify.org
- DNS ASK fi#####.###tings.services.mozilla.com
- DNS ASK co########gnature-2.cdn.mozilla.net
Другое
Ищет следующие окна
- ClassName: '' WindowName: ''
- ClassName: 'Mozilla_firefox_default-release_RemoteWindow' WindowName: ''
- ClassName: 'OleMainThreadWndClass' WindowName: ''
Запускает на исполнение
- '<SYSTEM32>\ipconfig.exe' /all
- '<SYSTEM32>\wbem\wmic.exe' path win32_VideoController get name
- '<SYSTEM32>\cmd.exe' /C reg query HKCU\Software\Valve\Steam /v SteamPath
- '<SYSTEM32>\reg.exe' query HKCU\Software\Valve\Steam /v SteamPath
- '<SYSTEM32>\cmd.exe' /C reg query HKLM\SOFTWARE\WOW6432Node\Valve\Steam /v InstallPath
- '<SYSTEM32>\reg.exe' query HKLM\SOFTWARE\WOW6432Node\Valve\Steam /v InstallPath
- '<SYSTEM32>\cmd.exe' /C reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Riot Game client" /v InstallLocation
- '<SYSTEM32>\reg.exe' query "HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Riot Game client" /v InstallLocation
- '<SYSTEM32>\cmd.exe' /C reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\EpicGamesLauncher /v InstallLocation
- '<SYSTEM32>\getmac.exe'
- '<SYSTEM32>\reg.exe' query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\EpicGamesLauncher /v InstallLocation
- '%ProgramFiles%\mozilla firefox\firefox.exe' --load-extension=C:\SecurityHelper --disable-blink-features=AutomationControlled --no-first-run --no-default-browser-check --restore-last-session
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "New-Item -Path 'HKCU:\Software\Policies\Google\Chrome' -Force; New-ItemProperty -Path 'HKCU:\Software\Policies\Google\Chrome' -N...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "New-Item -Path 'HKCU:\Software\Policies\BraveSoftware\Brave' -Force; New-ItemProperty -Path 'HKCU:\Software\Policies\BraveSoftwa...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "New-Item -Path 'HKCU:\Software\Policies\Microsoft\Edge' -Force; New-ItemProperty -Path 'HKCU:\Software\Policies\Microsoft\Edge' ...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "New-Item -Path 'HKCU:\Software\Policies\Google\Chrome\ExtensionInstallForcelist' -Force; New-ItemProperty -Path 'HKCU:\Software\...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "New-Item -Path 'HKCU:\Software\Policies\BraveSoftware\Brave\ExtensionInstallForcelist' -Force; New-ItemProperty -Path 'HKCU:\Sof...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "New-Item -Path 'HKCU:\Software\Policies\Microsoft\Edge\ExtensionInstallForcelist' -Force; New-ItemProperty -Path 'HKCU:\Software...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$sh = New-Object -ComObject WScript.Shell; Get-ChildItem -Path '%HOMEPATH%\Desktop' -Filter '*.lnk' -Recurse -ErrorAction Silent...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$sh = New-Object -ComObject WScript.Shell; Get-ChildItem -Path '%APPDATA%\Microsoft\Internet Explorer\Quick Launch\User Pinned\T...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$sh = New-Object -ComObject WScript.Shell; Get-ChildItem -Path '%APPDATA%\Microsoft\Windows\Start Menu\Programs' -Filter '*.lnk'...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$sh = New-Object -ComObject WScript.Shell; Get-ChildItem -Path '%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs' -Filter...
