Техническая информация
Вредоносные функции
Запускает на исполнение
- '<SYSTEM32>\taskkill.exe' /F /IM "powershell.exe"
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\342b.tmp\343c.tmp\343d.bat
- %TEMP%\342b.tmp\cheathashes.txt
- %TEMP%\342b.tmp\cleanhashes.txt
- %TEMP%\342b.tmp\curl.exe
- %TEMP%\342b.tmp\curl-ca-bundle.crt
- %TEMP%\342b.tmp\extensions.txt
- %TEMP%\342b.tmp\grep.exe
- %TEMP%\342b.tmp\isps.txt
- %TEMP%\342b.tmp\java-filter.txt
- %TEMP%\342b.tmp\libcurl.dll
- %TEMP%\342b.tmp\libcurl-x64.dll
- %TEMP%\342b.tmp\libiconv2.dll
- %TEMP%\342b.tmp\libintl3.dll
- %TEMP%\342b.tmp\pcre3.dll
- %TEMP%\342b.tmp\regex2.dll
- %TEMP%\342b.tmp\savanthashes.txt
- %TEMP%\342b.tmp\signtool.exe
- %TEMP%\342b.tmp\strings.txt
- %TEMP%\342b.tmp\strings2.exe
- %TEMP%\342b.tmp\winprefetchview.exe
- %TEMP%\342b.tmp\savant-26570.log
- %TEMP%\342b.tmp\explorer.txt
- %TEMP%\342b.tmp\explorer-stage1.txt
- %TEMP%\342b.tmp\explorer-stage2.txt
- %TEMP%\342b.tmp\explorer-stage3.txt
- %TEMP%\342b.tmp\explorer-stage4.txt
- %TEMP%\342b.tmp\explorer-stage5.txt
- %TEMP%\342b.tmp\explorer-stage6.txt
- %TEMP%\342b.tmp\explorer-stage7.txt
- nul
- %TEMP%\342b.tmp\unverified-windows.txt
- %TEMP%\342b.tmp\md5.txt
- %TEMP%\342b.tmp\totalmd5.txt
- %TEMP%\342b.tmp\signed-windows.txt
- %TEMP%\342b.tmp\debug-26570.zip
Перемещает следующие файлы
- %TEMP%\342b.tmp\savant-26570.log в %HOMEPATH%\desktop\savant\savant-26570.log
- %TEMP%\342b.tmp\debug-26570.zip в %HOMEPATH%\desktop\savant\debug-26570.zip
Сетевая активность
UDP
- DNS ASK ip##fo.io
Другое
Ищет следующие окна
- ClassName: '' WindowName: ''
Создает и запускает на исполнение
- '%TEMP%\342b.tmp\curl.exe' -s ipinfo.io
- '%TEMP%\342b.tmp\strings2.exe' -pid 3324 -nh
- '%TEMP%\342b.tmp\grep.exe' -F -e "file:///" explorer.txt
- '%TEMP%\342b.tmp\grep.exe' -F -e "." Explorer-Stage1.txt
- '%TEMP%\342b.tmp\grep.exe' -i -v -e "CodeBase: " -e ":\\Users\\.*\\AppData\\Local\\Temp\\.*.tmp\\strings2\.exe" -e "\.exe\.xml" -e "?VolumeId" -e "backgroundColor.*contentUri" -e "microsoft-edge:" -e "activationUri" -e "...
- '%TEMP%\342b.tmp\grep.exe' -i -f Extensions.txt Explorer-Stage3.txt
- '%TEMP%\342b.tmp\grep.exe' -i -e ".*:/Windows/.*" Explorer-Stage6.txt
- '%TEMP%\342b.tmp\grep.exe' -i -v -e ".*:/Windows/.*" Explorer-Stage6.txt
- '%TEMP%\342b.tmp\grep.exe' -i -v -e ".*:/Users/.*/AppData/Local/Temp/.*.tmp/curl.exe" -e ".*:/Users/.*/AppData/Local/Temp/.*.tmp/signtool.exe" -e ".*:/Users/.*/AppData/Local/Temp/.*.tmp/strings2.exe" Explorer-Stage8.txt
- '%TEMP%\342b.tmp\grep.exe' --max-count=1 -i -F -f MD5.txt CheatHashes.txt
- '%TEMP%\342b.tmp\signtool.exe' verify /a /pa "%WINDIR%\explorer.exe"
- '%TEMP%\342b.tmp\signtool.exe' verify /a /pa "<SYSTEM32>\cmd.exe"
- '%TEMP%\342b.tmp\signtool.exe' verify /a /pa "<SYSTEM32>\SecurityHealthSystray.exe"
- '%TEMP%\342b.tmp\signtool.exe' verify /a /pa "<SYSTEM32>\shell32.dll"
- '%TEMP%\342b.tmp\signtool.exe' verify /a /pa "<SYSTEM32>\WindowsPowerShell\v1.0\powershell.exe"
Запускает на исполнение
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\342B.tmp\343C.tmp\343D.bat <Полный путь к файлу>" (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c powershell -NoP -C "Get-Date -Format 'MMMM d, yyyy, hh:mm tt'"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoP -C "Get-Date -Format 'MMMM d, yyyy, hh:mm tt'"
- '<SYSTEM32>\cmd.exe' /c ver
- '<SYSTEM32>\cmd.exe' /c tasklist | find /I /C "explorer.exe"
- '<SYSTEM32>\tasklist.exe'
- '<SYSTEM32>\find.exe' /I /C "explorer.exe"
- '<SYSTEM32>\cmd.exe' /c tasklist /FI "IMAGENAME eq explorer.exe" /Fo table /nh
- '<SYSTEM32>\tasklist.exe' /FI "IMAGENAME eq explorer.exe" /Fo table /nh
- '<SYSTEM32>\cmd.exe' /c tasklist /FI "MODULES eq OPENGL32.dll" /FI "IMAGENAME eq javaw.exe" /Fo table /nh | find /I /C "javaw.exe"
- '<SYSTEM32>\tasklist.exe' /FI "MODULES eq OPENGL32.dll" /FI "IMAGENAME eq javaw.exe" /Fo table /nh
- '<SYSTEM32>\find.exe' /I /C "javaw.exe"
- '<SYSTEM32>\cmd.exe' /c tasklist /FI "IMAGENAME eq Pactify.exe" /Fo table /nh | find /I /C "Pactify.exe"
- '<SYSTEM32>\tasklist.exe' /FI "IMAGENAME eq Pactify.exe" /Fo table /nh
- '<SYSTEM32>\find.exe' /I /C "Pactify.exe"
- '<SYSTEM32>\cmd.exe' /c tasklist /FI "IMAGENAME eq Lunar Client.exe" /Fo table /nh | find /I /C "Lunar Client.exe"
- '<SYSTEM32>\tasklist.exe' /FI "IMAGENAME eq Lunar Client.exe" /Fo table /nh
- '<SYSTEM32>\find.exe' /I /C "Lunar Client.exe"
- '<SYSTEM32>\cmd.exe' /c tasklist | find /I /C "sihost.exe"
- '<SYSTEM32>\find.exe' /I /C "sihost.exe"
- '<SYSTEM32>\cmd.exe' /c tasklist /FI "MODULES eq ucrtbase.dll" /FI "IMAGENAME eq sihost.exe" /Fo table /nh
- '<SYSTEM32>\tasklist.exe' /FI "MODULES eq ucrtbase.dll" /FI "IMAGENAME eq sihost.exe" /Fo table /nh
- '<SYSTEM32>\cmd.exe' /c powershell -NoP -C "Get-Process -ID 2632 | ForEach-Object {[int]([datetime]::Now - $_.StartTime).TotalMinutes}"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoP -C "Get-Process -ID 2632 | ForEach-Object {[int]([datetime]::Now - $_.StartTime).TotalMinutes}"
- '<SYSTEM32>\cmd.exe' /c powershell -NoP -C "Get-Process -Name explorer | ForEach-Object {[int]([datetime]::Now - $_.StartTime).TotalMinutes}"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoP -C "Get-Process -Name explorer | ForEach-Object {[int]([datetime]::Now - $_.StartTime).TotalMinutes}"
- '<SYSTEM32>\cmd.exe' /c powershell -NoP -C "[int]([datetime]::Now - (Get-ChildItem '%WINDIR%\Prefetch\JAVAW.EXE*.*' -Force).LastWriteTime).TotalMinutes"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoP -C "[int]([datetime]::Now - (Get-ChildItem '%WINDIR%\Prefetch\JAVAW.EXE*.*' -Force).LastWriteTime).TotalMinutes"
- '<SYSTEM32>\cmd.exe' /c dir /b /o-d "%WINDIR%\Prefetch\JAVA.EXE*.*" 2> nul
- '<SYSTEM32>\cmd.exe' /c dir /b /o-d "%WINDIR%\Prefetch\JAVAW.EXE*.*" 2> nul
- '<SYSTEM32>\cmd.exe' /c dir /b /o-d "%WINDIR%\Prefetch\CONHOST.EXE*.*" 2> nul
- '<SYSTEM32>\cmd.exe' /c powershell -NoP -C "[int]([datetime]::Now - (Get-ChildItem '%WINDIR%\Prefetch\CONHOST.EXE*.*' -Force).LastWriteTime).TotalMinutes"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoP -C "[int]([datetime]::Now - (Get-ChildItem '%WINDIR%\Prefetch\CONHOST.EXE*.*' -Force).LastWriteTime).TotalMinutes"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoP -C "(Get-Content $env:b2eincfilepath\Explorer-Stage4.txt) | ForEach-Object { $_ -replace 'file:///', '' ` -replace '%20', ' ' ` -replace '%7B', '{' ` -replace '%7D', '}' ` -replace '.EXE',...
- '<SYSTEM32>\findstr.exe' /V /C:"user@" Explorer-Stage5.txt
- '<SYSTEM32>\cmd.exe' /S /D /c" type Explorer-Stage7.txt "
- '<SYSTEM32>\find.exe' /V ""
- '<SYSTEM32>\cmd.exe' /S /D /c" type Explorer-Stage8.txt "
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoP -C "Get-Content $env:b2eincfilepath\Explorer-Stage7.txt | ForEach-Object {$_ -Replace '/', '\'} | Sort-Object -Unique | Set-Content $env:b2eincfilepath\Explorer-Stage7.txt"
- '<SYSTEM32>\certutil.exe' -hashfile "%WINDIR%\explorer.exe" MD5
- '<SYSTEM32>\certutil.exe' -hashfile "<SYSTEM32>\cmd.exe" MD5
- '<SYSTEM32>\certutil.exe' -hashfile "<SYSTEM32>\SecurityHealthSystray.exe" MD5
- '<SYSTEM32>\certutil.exe' -hashfile "<SYSTEM32>\shell32.dll" MD5
- '<SYSTEM32>\certutil.exe' -hashfile "<SYSTEM32>\WindowsPowerShell\v1.0\powershell.exe" MD5
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoP -C "Compress-Archive -Path $env:b2eincfilepath\*.txt -DestinationPath Debug-26570.zip"
- '<SYSTEM32>\notepad.exe' %HOMEPATH%\Desktop\Savant\Savant-26570.log
