Техническая информация
Для обеспечения автозапуска и распространения
Модифицирует следующие ключи реестра
- [HKLM\SOFTWARE\Classes\CLSID\{FCEA18FF-BC55-4E63-94D7-1B2EFBFE706F}\Shell\Open\Command] '' = '%ProgramFiles%\StartAllBack\StartAllBackCfg.exe'
- [HKLM\SOFTWARE\Classes\sib-reactivate\shell\open\command] '' = '"%ProgramFiles%\StartAllBack\StartAllBackCfg.exe" /reactivate %1'
- [HKLM\SOFTWARE\Classes\sib-activate\shell\open\command] '' = '"%ProgramFiles%\StartAllBack\StartAllBackCfg.exe" /activate %1'
Создает или изменяет следующие файлы
- <SYSTEM32>\tasks\startallback update
- <SYSTEM32>\tasks\createexplorershellunelevatedtask
Вредоносные функции
Запускает на исполнение
- '<SYSTEM32>\taskkill.exe' /F /IM explorer.exe
- '<SYSTEM32>\taskkill.exe' /F /IM sndvol.exe
- '<SYSTEM32>\taskkill.exe' /F /IM shellhost.exe
- '<SYSTEM32>\taskkill.exe' /F /IM prevhost.exe
- '<SYSTEM32>\taskkill.exe' /IM explorer.exe /f
Завершает или пытается завершить
следующие системные процессы:
- %WINDIR%\explorer.exe
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\autd7fc.tmp
- %TEMP%\ghost\banner.jpg
- %TEMP%\ghost\setup.exe
- %TEMP%\sibsfx.f5048698\orbs\clover.svg
- %TEMP%\sibsfx.f5048698\orbs\e1evenorb-pr.png
- %TEMP%\sibsfx.f5048698\orbs\w8logo.svg
- %TEMP%\sibsfx.f5048698\orbs\windows 7.orb
- %TEMP%\sibsfx.f5048698\ribbon\theme-dark\accessmedia.svg
- %TEMP%\sibsfx.f5048698\ribbon\theme-dark\easyaccess.svg
- %TEMP%\sibsfx.f5048698\ribbon\theme-dark\windows.addremoveprograms.svg
- %TEMP%\sibsfx.f5048698\ribbon\theme-dark\windows.computer.manage.svg
- %TEMP%\sibsfx.f5048698\ribbon\theme-dark\windows.copytomenu.svg
- %TEMP%\sibsfx.f5048698\ribbon\theme-dark\windows.folderoptions.svg
- %TEMP%\sibsfx.f5048698\ribbon\theme-dark\windows.help.svg
- %TEMP%\sibsfx.f5048698\ribbon\theme-dark\windows.layout.svg
- %TEMP%\sibsfx.f5048698\ribbon\theme-dark\windows.movetomenu.svg
- %TEMP%\sibsfx.f5048698\ribbon\theme-dark\windows.multiverb.cmd.svg
- %TEMP%\sibsfx.f5048698\ribbon\theme-dark\windows.multiverb.cmdpromptasadministrator.svg
- %TEMP%\sibsfx.f5048698\ribbon\theme-dark\windows.open.svg
- %TEMP%\sibsfx.f5048698\ribbon\theme-dark\windows.opencontrolpanel.svg
- %TEMP%\sibsfx.f5048698\ribbon\theme-dark\windows.pastelink.svg
- %TEMP%\sibsfx.f5048698\ribbon\theme-dark\windows.removeproperties.svg
- %TEMP%\sibsfx.f5048698\ribbon\theme-dark\windows.ribbonpermissionsdialog.svg
- %TEMP%\sibsfx.f5048698\ribbon\theme-dark\windows.shareprivate.svg
- %TEMP%\sibsfx.f5048698\ribbon\theme-dark\windows.slideshow.svg
- %TEMP%\sibsfx.f5048698\ribbon\theme-dark\windows.systemproperties.svg
- %TEMP%\sibsfx.f5048698\ribbon\theme-dark\windows.troubleshoot.svg
- %TEMP%\sibsfx.f5048698\ribbon\theme-light\accessmedia.svg
- %TEMP%\sibsfx.f5048698\ribbon\theme-light\easyaccess.svg
- %TEMP%\sibsfx.f5048698\ribbon\theme-light\windows.addremoveprograms.svg
- %TEMP%\sibsfx.f5048698\ribbon\theme-light\windows.computer.manage.svg
- %TEMP%\sibsfx.f5048698\ribbon\theme-light\windows.copytomenu.svg
- %TEMP%\sibsfx.f5048698\ribbon\theme-light\windows.edit.svg
- %TEMP%\sibsfx.f5048698\ribbon\theme-light\windows.email.svg
- %TEMP%\sibsfx.f5048698\ribbon\theme-light\windows.folderoptions.svg
- %TEMP%\sibsfx.f5048698\ribbon\theme-light\windows.help.svg
- %TEMP%\sibsfx.f5048698\ribbon\theme-light\windows.layout.svg
- %TEMP%\sibsfx.f5048698\ribbon\theme-light\windows.movetomenu.svg
- %TEMP%\sibsfx.f5048698\ribbon\theme-light\windows.multiverb.cmd.svg
- %TEMP%\sibsfx.f5048698\ribbon\theme-light\windows.multiverb.cmdpromptasadministrator.svg
- %TEMP%\sibsfx.f5048698\ribbon\theme-light\windows.open.svg
- %TEMP%\sibsfx.f5048698\ribbon\theme-light\windows.opencontrolpanel.svg
- %TEMP%\sibsfx.f5048698\ribbon\theme-light\windows.pastelink.svg
- %TEMP%\sibsfx.f5048698\ribbon\theme-light\windows.removeproperties.svg
- %TEMP%\sibsfx.f5048698\ribbon\theme-light\windows.ribbonpermissionsdialog.svg
- %TEMP%\sibsfx.f5048698\ribbon\theme-light\windows.shareprivate.svg
- %TEMP%\sibsfx.f5048698\ribbon\theme-light\windows.slideshow.svg
- %TEMP%\sibsfx.f5048698\ribbon\theme-light\windows.systemproperties.svg
- %TEMP%\sibsfx.f5048698\ribbon\theme-light\windows.troubleshoot.svg
- %TEMP%\sibsfx.f5048698\styles\plain8.msstyles
- %TEMP%\sibsfx.f5048698\styles\windows 7.msstyles
- %TEMP%\sibsfx.f5048698\darkmagica64.dll
- %TEMP%\sibsfx.f5048698\darkmagicloadera64.exe
- %TEMP%\sibsfx.f5048698\darkmagicloaderx64.exe
- %TEMP%\sibsfx.f5048698\darkmagicloaderx86.exe
- %TEMP%\sibsfx.f5048698\darkmagicx64.dll
- %TEMP%\sibsfx.f5048698\darkmagicx86.dll
- %TEMP%\sibsfx.f5048698\startallbacka64.dll
- %TEMP%\sibsfx.f5048698\startallbackcfg.exe
- %TEMP%\sibsfx.f5048698\startallbackloadera64.dll
- %TEMP%\sibsfx.f5048698\startallbackloaderx64.dll
- %TEMP%\sibsfx.f5048698\startallbackx64.dll
- %TEMP%\sibsfx.f5048698\updatecheck.exe
- %ProgramFiles%\startallback\startallbackx64.dll
- %ProgramFiles%\startallback\startallbackcfg.exe
- %ProgramFiles%\startallback\updatecheck.exe
- %ProgramFiles%\startallback\darkmagicx64.dll
- %ProgramFiles%\startallback\darkmagicloaderx64.exe
- %ProgramFiles%\startallback\darkmagicx86.dll
- %ProgramFiles%\startallback\darkmagicloaderx86.exe
- %ProgramFiles%\startallback\startallbackloaderx64.dll
- %ProgramFiles%\startallback\orbs\clover.svg
- %ProgramFiles%\startallback\orbs\e1evenorb-pr.png
- %ProgramFiles%\startallback\orbs\w8logo.svg
- %ProgramFiles%\startallback\orbs\windows 7.orb
- %ProgramFiles%\startallback\styles\plain8.msstyles
- %ProgramFiles%\startallback\styles\windows 7.msstyles
- %ProgramFiles%\startallback\ribbon\theme-dark\accessmedia.svg
- %ProgramFiles%\startallback\ribbon\theme-dark\easyaccess.svg
- %ProgramFiles%\startallback\ribbon\theme-dark\windows.addremoveprograms.svg
- %ProgramFiles%\startallback\ribbon\theme-dark\windows.computer.manage.svg
- %ProgramFiles%\startallback\ribbon\theme-dark\windows.copytomenu.svg
- %ProgramFiles%\startallback\ribbon\theme-dark\windows.folderoptions.svg
- %ProgramFiles%\startallback\ribbon\theme-dark\windows.help.svg
- %ProgramFiles%\startallback\ribbon\theme-dark\windows.layout.svg
- %ProgramFiles%\startallback\ribbon\theme-dark\windows.movetomenu.svg
- %ProgramFiles%\startallback\ribbon\theme-dark\windows.multiverb.cmd.svg
- %ProgramFiles%\startallback\ribbon\theme-dark\windows.multiverb.cmdpromptasadministrator.svg
- %ProgramFiles%\startallback\ribbon\theme-dark\windows.open.svg
- %ProgramFiles%\startallback\ribbon\theme-dark\windows.opencontrolpanel.svg
- %ProgramFiles%\startallback\ribbon\theme-dark\windows.pastelink.svg
- %ProgramFiles%\startallback\ribbon\theme-dark\windows.removeproperties.svg
- %ProgramFiles%\startallback\ribbon\theme-dark\windows.ribbonpermissionsdialog.svg
- %ProgramFiles%\startallback\ribbon\theme-dark\windows.shareprivate.svg
- %ProgramFiles%\startallback\ribbon\theme-dark\windows.slideshow.svg
- %ProgramFiles%\startallback\ribbon\theme-dark\windows.systemproperties.svg
- %ProgramFiles%\startallback\ribbon\theme-dark\windows.troubleshoot.svg
- %ProgramFiles%\startallback\ribbon\theme-light\accessmedia.svg
- %ProgramFiles%\startallback\ribbon\theme-light\easyaccess.svg
- %ProgramFiles%\startallback\ribbon\theme-light\windows.addremoveprograms.svg
- %ProgramFiles%\startallback\ribbon\theme-light\windows.computer.manage.svg
- %ProgramFiles%\startallback\ribbon\theme-light\windows.copytomenu.svg
- %ProgramFiles%\startallback\ribbon\theme-light\windows.edit.svg
- %ProgramFiles%\startallback\ribbon\theme-light\windows.email.svg
- %ProgramFiles%\startallback\ribbon\theme-light\windows.folderoptions.svg
- %ProgramFiles%\startallback\ribbon\theme-light\windows.help.svg
- %ProgramFiles%\startallback\ribbon\theme-light\windows.layout.svg
- %ProgramFiles%\startallback\ribbon\theme-light\windows.movetomenu.svg
- %ProgramFiles%\startallback\ribbon\theme-light\windows.multiverb.cmd.svg
- %ProgramFiles%\startallback\ribbon\theme-light\windows.multiverb.cmdpromptasadministrator.svg
- %ProgramFiles%\startallback\ribbon\theme-light\windows.open.svg
- %ProgramFiles%\startallback\ribbon\theme-light\windows.opencontrolpanel.svg
- %ProgramFiles%\startallback\ribbon\theme-light\windows.pastelink.svg
- %ProgramFiles%\startallback\ribbon\theme-light\windows.removeproperties.svg
- %ProgramFiles%\startallback\ribbon\theme-light\windows.ribbonpermissionsdialog.svg
- %ProgramFiles%\startallback\ribbon\theme-light\windows.shareprivate.svg
- %ProgramFiles%\startallback\ribbon\theme-light\windows.slideshow.svg
- %ProgramFiles%\startallback\ribbon\theme-light\windows.systemproperties.svg
- %ProgramFiles%\startallback\ribbon\theme-light\windows.troubleshoot.svg
- %TEMP%\sabtask.xml
- %TEMP%\aut4b0b.tmp
- %TEMP%\ghost\patch.exe
- %ProgramFiles%\startallback\patch.exe
- %TEMP%\dup2patcher.dll
- %ProgramFiles%\startallback\kill.cmd
- %ProgramFiles%\startallback\start.cmd
Удаляет файлы, которые сам же создал
- %TEMP%\autd7fc.tmp
- %TEMP%\aut4b0b.tmp
- %ProgramFiles%\startallback\kill.cmd
- %ProgramFiles%\startallback\start.cmd
- %TEMP%\dup2patcher.dll
- %ProgramFiles%\startallback\patch.exe
Изменяет следующие файлы
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\microsoft\cryptneturlcache\metadata\77ec63bda74bd0d0e0426dc8f8008506
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\microsoft\cryptneturlcache\metadata\57c8edb95df3f0ad4ee2dc2b8cfd4157
Сетевая активность
Подключается к
- 'st####llback.com':443
- '19#.#32.210.172':80
- 'x1.#.lencr.org':80
- 'r1#.#.lencr.org':80
- 'st#########.sfo3.cdn.digitaloceanspaces.com':443
- 'ap#.msn.com':443
- 'oneocsp.microsoft.com':80
- '19#.#32.214.172':80
TCP
Запросы HTTP GET
- http://r1#.#.lencr.org/39.crl
- http://oneocsp.microsoft.com/ocsp/MFQwUjBQME4wTDAJBgUrDgMCGgUABBR0TBEVYklX7A9yLoLD9hqmCWDxFgQU3pGGSLehMVkx8UtfB6nciHnaqHYCEzMAAAAPMyBlN%2B5Crk8AAAAAAA8%3D
Другие
- 'st####llback.com':443
- 'r1#.#.lencr.org':443
- 'ap#.msn.com':443
UDP
- DNS ASK st####llback.com
- DNS ASK x1.#.lencr.org
- DNS ASK r1#.#.lencr.org
- DNS ASK st#########.sfo3.cdn.digitaloceanspaces.com
- DNS ASK ap#.msn.com
- DNS ASK oneocsp.microsoft.com
Другое
Ищет следующие окна
- ClassName: '' WindowName: ''
- ClassName: 'Progman' WindowName: ''
- ClassName: 'Proxy Desktop' WindowName: ''
- ClassName: 'ApplicationFrameWindow' WindowName: ''
- ClassName: 'BUTTON' WindowName: ''
- ClassName: 'SystemTray_Main' WindowName: ''
- ClassName: 'BluetoothNotificationAreaIconWindowClass' WindowName: 'BluetoothNotificationAreaIconWindowClass'
- ClassName: 'BluetoothNotificationAreaIconWindowClass' WindowName: ''
Создает и запускает на исполнение
- '%TEMP%\ghost\setup.exe' /elevated /silent
- '%TEMP%\sibsfx.f5048698\startallbackcfg.exe' /install /elevated /silent
- '%ProgramFiles%\startallback\patch.exe' /silent /overwrite
Запускает на исполнение
- '<SYSTEM32>\schtasks.exe' /Delete /TN "\StartIsBack health check" /F (со скрытым окном)
- '<SYSTEM32>\tskill.exe' explorer (со скрытым окном)
- '<SYSTEM32>\schtasks.exe' /Create /TN "\StartAllBack Update" /XML "%TEMP%\sabtask.xml" (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c "%ProgramFiles%\StartAllBack\kill.cmd"
- '<SYSTEM32>\cmd.exe' /c "%ProgramFiles%\StartAllBack\start.cmd"
- '%WINDIR%\explorer.exe'
- '%WINDIR%\explorer.exe' /NoUACCheck
- '%WINDIR%\systemapps\microsoft.windows.search_cw5n1h2txyewy\searchapp.exe' -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
- '<SYSTEM32>\svchost.exe' -k appmodel -p -s camsvc
- '%TEMP%\sibsfx.f5048698\startallbackcfg.exe' /install /elevated /silent (со скрытым окном)
- '<SYSTEM32>\taskkill.exe' /F /IM explorer.exe (со скрытым окном)
- '<SYSTEM32>\taskkill.exe' /F /IM sndvol.exe (со скрытым окном)
- '<SYSTEM32>\taskkill.exe' /F /IM shellhost.exe (со скрытым окном)
- '<SYSTEM32>\taskkill.exe' /F /IM prevhost.exe (со скрытым окном)
