Техническая информация
Вредоносные функции
Внедряет код в
следующие пользовательские процессы:
- gamerbot.exe
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\nswa40d.tmp\system.dll
- %TEMP%\nswa40d.tmp\stdutils.dll
- %TEMP%\nswa40d.tmp\spiderbanner.dll
- %TEMP%\nswa40d.tmp\nsexec.dll
- %TEMP%\nswa40d.tmp\app-64.7z
- %TEMP%\nswa40d.tmp\nsis7z.dll
- %TEMP%\nswa40d.tmp\7z-out\chrome_100_percent.pak
- %TEMP%\nswa40d.tmp\7z-out\chrome_200_percent.pak
- %TEMP%\nswa40d.tmp\7z-out\icudtl.dat
- %TEMP%\nswa40d.tmp\7z-out\license.electron.txt
- %TEMP%\nswa40d.tmp\7z-out\licenses.chromium.html
- %TEMP%\nswa40d.tmp\7z-out\locales\en-us.pak
- %TEMP%\nswa40d.tmp\7z-out\resources\app.asar
- %TEMP%\nswa40d.tmp\7z-out\resources\app.asar.unpacked\node_modules\@primno\dpapi\bin\win32-x64-133\dpapi.node
- %TEMP%\nswa40d.tmp\7z-out\resources\app.asar.unpacked\node_modules\@primno\dpapi\build\release\dpapi.node
- %TEMP%\nswa40d.tmp\7z-out\resources\app.asar.unpacked\node_modules\@primno\dpapi\dist\index.js
- %TEMP%\nswa40d.tmp\7z-out\resources\app.asar.unpacked\node_modules\@primno\dpapi\package.json
- %TEMP%\nswa40d.tmp\7z-out\resources\app.asar.unpacked\node_modules\@primno\dpapi\prebuilds\win32-arm64\@primno+dpapi.node
- %TEMP%\nswa40d.tmp\7z-out\resources\app.asar.unpacked\node_modules\@primno\dpapi\prebuilds\win32-x64\@primno+dpapi.node
- %TEMP%\nswa40d.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\build\release\better_sqlite3.node
- %TEMP%\nswa40d.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\deps\copy.js
- %TEMP%\nswa40d.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\database.js
- %TEMP%\nswa40d.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\index.js
- %TEMP%\nswa40d.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\aggregate.js
- %TEMP%\nswa40d.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\backup.js
- %TEMP%\nswa40d.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\function.js
- %TEMP%\nswa40d.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\inspect.js
- %TEMP%\nswa40d.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\pragma.js
- %TEMP%\nswa40d.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\serialize.js
- %TEMP%\nswa40d.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\table.js
- %TEMP%\nswa40d.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\transaction.js
- %TEMP%\nswa40d.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\wrappers.js
- %TEMP%\nswa40d.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\sqlite-error.js
- %TEMP%\nswa40d.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\util.js
- %TEMP%\nswa40d.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\package.json
- %TEMP%\nswa40d.tmp\7z-out\resources\app.asar.unpacked\node_modules\registry-js\.prettierignore
- %TEMP%\nswa40d.tmp\7z-out\resources\app.asar.unpacked\node_modules\registry-js\build\release\registry.node
- %TEMP%\nswa40d.tmp\7z-out\resources\app.asar.unpacked\node_modules\registry-js\dist\lib\index.js
- %TEMP%\nswa40d.tmp\7z-out\resources\app.asar.unpacked\node_modules\registry-js\dist\lib\registry.js
- %TEMP%\nswa40d.tmp\7z-out\resources\app.asar.unpacked\node_modules\registry-js\package.json
- %TEMP%\nswa40d.tmp\7z-out\resources\app.asar.unpacked\node_modules\robotjs\bin\win32-x64-133\robotjs.node
- %TEMP%\nswa40d.tmp\7z-out\resources\app.asar.unpacked\node_modules\robotjs\build\release\robotjs.node
- %TEMP%\nswa40d.tmp\7z-out\resources\app.asar.unpacked\node_modules\robotjs\index.js
- %TEMP%\nswa40d.tmp\7z-out\resources\app.asar.unpacked\node_modules\robotjs\package.json
- %TEMP%\nswa40d.tmp\7z-out\resources\screenshot\lspqlaujpn8x9rlc.bin
- %TEMP%\nswa40d.tmp\7z-out\resources\screenshot\lspqlaujpn8x9rlc.enc
- %TEMP%\nswa40d.tmp\7z-out\resources\shortcut\boolean.enc
- %TEMP%\nswa40d.tmp\7z-out\resources\shortcut\scs.enc
- %TEMP%\nswa40d.tmp\7z-out\resources.pak
- %TEMP%\nswa40d.tmp\7z-out\snapshot_blob.bin
- %TEMP%\nswa40d.tmp\7z-out\v8_context_snapshot.bin
- %TEMP%\nswa40d.tmp\7z-out\vk_swiftshader_icd.json
- %TEMP%\nswa40d.tmp\7z-out\d3dcompiler_47.dll
- %TEMP%\nswa40d.tmp\7z-out\ffmpeg.dll
- %TEMP%\nswa40d.tmp\7z-out\gamerbot.exe
- %TEMP%\nswa40d.tmp\7z-out\libegl.dll
- %TEMP%\nswa40d.tmp\7z-out\libglesv2.dll
- %TEMP%\nswa40d.tmp\7z-out\resources\elevate.exe
- %TEMP%\nswa40d.tmp\7z-out\vk_swiftshader.dll
- %TEMP%\nswa40d.tmp\7z-out\vulkan-1.dll
- %LOCALAPPDATA%\programs\gamerbot\chrome_100_percent.pak
- %LOCALAPPDATA%\programs\gamerbot\chrome_200_percent.pak
- %LOCALAPPDATA%\programs\gamerbot\d3dcompiler_47.dll
- %LOCALAPPDATA%\programs\gamerbot\ffmpeg.dll
- %LOCALAPPDATA%\programs\gamerbot\gamerbot.exe
- %LOCALAPPDATA%\programs\gamerbot\icudtl.dat
- %LOCALAPPDATA%\programs\gamerbot\libegl.dll
- %LOCALAPPDATA%\programs\gamerbot\libglesv2.dll
- %LOCALAPPDATA%\programs\gamerbot\license.electron.txt
- %LOCALAPPDATA%\programs\gamerbot\licenses.chromium.html
- %LOCALAPPDATA%\programs\gamerbot\resources.pak
- %LOCALAPPDATA%\programs\gamerbot\snapshot_blob.bin
- %LOCALAPPDATA%\programs\gamerbot\v8_context_snapshot.bin
- %LOCALAPPDATA%\programs\gamerbot\vk_swiftshader.dll
- %LOCALAPPDATA%\programs\gamerbot\vk_swiftshader_icd.json
- %LOCALAPPDATA%\programs\gamerbot\vulkan-1.dll
- %LOCALAPPDATA%\programs\gamerbot\locales\en-us.pak
- %LOCALAPPDATA%\programs\gamerbot\resources\app.asar
- %LOCALAPPDATA%\programs\gamerbot\resources\elevate.exe
- %LOCALAPPDATA%\programs\gamerbot\resources\app.asar.unpacked\node_modules\@primno\dpapi\package.json
- %LOCALAPPDATA%\programs\gamerbot\resources\app.asar.unpacked\node_modules\@primno\dpapi\bin\win32-x64-133\dpapi.node
- %LOCALAPPDATA%\programs\gamerbot\resources\app.asar.unpacked\node_modules\@primno\dpapi\build\release\dpapi.node
- %LOCALAPPDATA%\programs\gamerbot\resources\app.asar.unpacked\node_modules\@primno\dpapi\dist\index.js
- %LOCALAPPDATA%\programs\gamerbot\resources\app.asar.unpacked\node_modules\@primno\dpapi\prebuilds\win32-arm64\@primno+dpapi.node
- %LOCALAPPDATA%\programs\gamerbot\resources\app.asar.unpacked\node_modules\@primno\dpapi\prebuilds\win32-x64\@primno+dpapi.node
- %LOCALAPPDATA%\programs\gamerbot\resources\app.asar.unpacked\node_modules\better-sqlite3\package.json
- %LOCALAPPDATA%\programs\gamerbot\resources\app.asar.unpacked\node_modules\better-sqlite3\build\release\better_sqlite3.node
- %LOCALAPPDATA%\programs\gamerbot\resources\app.asar.unpacked\node_modules\better-sqlite3\deps\copy.js
- %LOCALAPPDATA%\programs\gamerbot\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\database.js
- %LOCALAPPDATA%\programs\gamerbot\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\index.js
- %LOCALAPPDATA%\programs\gamerbot\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\sqlite-error.js
- %LOCALAPPDATA%\programs\gamerbot\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\util.js
- %LOCALAPPDATA%\programs\gamerbot\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\aggregate.js
- %LOCALAPPDATA%\programs\gamerbot\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\backup.js
- %LOCALAPPDATA%\programs\gamerbot\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\function.js
- %LOCALAPPDATA%\programs\gamerbot\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\inspect.js
- %LOCALAPPDATA%\programs\gamerbot\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\pragma.js
- %LOCALAPPDATA%\programs\gamerbot\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\serialize.js
- %LOCALAPPDATA%\programs\gamerbot\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\table.js
- %LOCALAPPDATA%\programs\gamerbot\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\transaction.js
- %LOCALAPPDATA%\programs\gamerbot\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\wrappers.js
- %LOCALAPPDATA%\programs\gamerbot\resources\app.asar.unpacked\node_modules\registry-js\.prettierignore
- %LOCALAPPDATA%\programs\gamerbot\resources\app.asar.unpacked\node_modules\registry-js\package.json
- %LOCALAPPDATA%\programs\gamerbot\resources\app.asar.unpacked\node_modules\registry-js\build\release\registry.node
- %LOCALAPPDATA%\programs\gamerbot\resources\app.asar.unpacked\node_modules\registry-js\dist\lib\index.js
- %LOCALAPPDATA%\programs\gamerbot\resources\app.asar.unpacked\node_modules\registry-js\dist\lib\registry.js
- %LOCALAPPDATA%\programs\gamerbot\resources\app.asar.unpacked\node_modules\robotjs\index.js
- %LOCALAPPDATA%\programs\gamerbot\resources\app.asar.unpacked\node_modules\robotjs\package.json
- %LOCALAPPDATA%\programs\gamerbot\resources\app.asar.unpacked\node_modules\robotjs\bin\win32-x64-133\robotjs.node
- %LOCALAPPDATA%\programs\gamerbot\resources\app.asar.unpacked\node_modules\robotjs\build\release\robotjs.node
- %LOCALAPPDATA%\programs\gamerbot\resources\screenshot\lspqlaujpn8x9rlc.bin
- %LOCALAPPDATA%\programs\gamerbot\resources\screenshot\lspqlaujpn8x9rlc.enc
- %LOCALAPPDATA%\programs\gamerbot\resources\shortcut\boolean.enc
- %LOCALAPPDATA%\programs\gamerbot\resources\shortcut\scs.enc
- %LOCALAPPDATA%\gamerbot-updater\installer.exe
- %LOCALAPPDATA%\programs\gamerbot\uninstall gamerbot.exe
- nul
Удаляет файлы, которые сам же создал
- %TEMP%\nswa40d.tmp\7z-out\chrome_100_percent.pak
- %TEMP%\nswa40d.tmp\7z-out\chrome_200_percent.pak
- %TEMP%\nswa40d.tmp\7z-out\d3dcompiler_47.dll
- %TEMP%\nswa40d.tmp\7z-out\ffmpeg.dll
- %TEMP%\nswa40d.tmp\7z-out\gamerbot.exe
- %TEMP%\nswa40d.tmp\7z-out\icudtl.dat
- %TEMP%\nswa40d.tmp\7z-out\libegl.dll
- %TEMP%\nswa40d.tmp\7z-out\libglesv2.dll
- %TEMP%\nswa40d.tmp\7z-out\license.electron.txt
- %TEMP%\nswa40d.tmp\7z-out\licenses.chromium.html
- %TEMP%\nswa40d.tmp\7z-out\locales\en-us.pak
- %TEMP%\nswa40d.tmp\7z-out\resources\app.asar
- %TEMP%\nswa40d.tmp\7z-out\resources\app.asar.unpacked\node_modules\@primno\dpapi\bin\win32-x64-133\dpapi.node
- %TEMP%\nswa40d.tmp\7z-out\resources\app.asar.unpacked\node_modules\@primno\dpapi\build\release\dpapi.node
- %TEMP%\nswa40d.tmp\7z-out\resources\app.asar.unpacked\node_modules\@primno\dpapi\dist\index.js
- %TEMP%\nswa40d.tmp\7z-out\resources\app.asar.unpacked\node_modules\@primno\dpapi\package.json
- %TEMP%\nswa40d.tmp\7z-out\resources\app.asar.unpacked\node_modules\@primno\dpapi\prebuilds\win32-arm64\@primno+dpapi.node
- %TEMP%\nswa40d.tmp\7z-out\resources\app.asar.unpacked\node_modules\@primno\dpapi\prebuilds\win32-x64\@primno+dpapi.node
- %TEMP%\nswa40d.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\build\release\better_sqlite3.node
- %TEMP%\nswa40d.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\deps\copy.js
- %TEMP%\nswa40d.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\database.js
- %TEMP%\nswa40d.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\index.js
- %TEMP%\nswa40d.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\aggregate.js
- %TEMP%\nswa40d.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\backup.js
- %TEMP%\nswa40d.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\function.js
- %TEMP%\nswa40d.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\inspect.js
- %TEMP%\nswa40d.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\pragma.js
- %TEMP%\nswa40d.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\serialize.js
- %TEMP%\nswa40d.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\table.js
- %TEMP%\nswa40d.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\transaction.js
- %TEMP%\nswa40d.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\wrappers.js
- %TEMP%\nswa40d.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\sqlite-error.js
- %TEMP%\nswa40d.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\util.js
- %TEMP%\nswa40d.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\package.json
- %TEMP%\nswa40d.tmp\7z-out\resources\app.asar.unpacked\node_modules\registry-js\.prettierignore
- %TEMP%\nswa40d.tmp\7z-out\resources\app.asar.unpacked\node_modules\registry-js\build\release\registry.node
- %TEMP%\nswa40d.tmp\7z-out\resources\app.asar.unpacked\node_modules\registry-js\dist\lib\index.js
- %TEMP%\nswa40d.tmp\7z-out\resources\app.asar.unpacked\node_modules\registry-js\dist\lib\registry.js
- %TEMP%\nswa40d.tmp\7z-out\resources\app.asar.unpacked\node_modules\registry-js\package.json
- %TEMP%\nswa40d.tmp\7z-out\resources\app.asar.unpacked\node_modules\robotjs\bin\win32-x64-133\robotjs.node
- %TEMP%\nswa40d.tmp\7z-out\resources\app.asar.unpacked\node_modules\robotjs\build\release\robotjs.node
- %TEMP%\nswa40d.tmp\7z-out\resources\app.asar.unpacked\node_modules\robotjs\index.js
- %TEMP%\nswa40d.tmp\7z-out\resources\app.asar.unpacked\node_modules\robotjs\package.json
- %TEMP%\nswa40d.tmp\7z-out\resources\elevate.exe
- %TEMP%\nswa40d.tmp\7z-out\resources\screenshot\lspqlaujpn8x9rlc.bin
- %TEMP%\nswa40d.tmp\7z-out\resources\screenshot\lspqlaujpn8x9rlc.enc
- %TEMP%\nswa40d.tmp\7z-out\resources\shortcut\boolean.enc
- %TEMP%\nswa40d.tmp\7z-out\resources\shortcut\scs.enc
- %TEMP%\nswa40d.tmp\7z-out\resources.pak
- %TEMP%\nswa40d.tmp\7z-out\snapshot_blob.bin
- %TEMP%\nswa40d.tmp\7z-out\v8_context_snapshot.bin
- %TEMP%\nswa40d.tmp\7z-out\vk_swiftshader.dll
- %TEMP%\nswa40d.tmp\7z-out\vk_swiftshader_icd.json
- %TEMP%\nswa40d.tmp\7z-out\vulkan-1.dll
- %TEMP%\nswa40d.tmp\app-64.7z
- %TEMP%\nswa40d.tmp\nsexec.dll
- %TEMP%\nswa40d.tmp\nsis7z.dll
- %TEMP%\nswa40d.tmp\spiderbanner.dll
- %TEMP%\nswa40d.tmp\stdutils.dll
- %TEMP%\nswa40d.tmp\system.dll
Сетевая активность
Подключается к
- 'cl###flare.com':443
- 'gs##tic.com':443
UDP
- DNS ASK cl###flare.com
- DNS ASK gs##tic.com
- DNS ASK google.com
Другое
Ищет следующие окна
- ClassName: '#32770' WindowName: ''
- ClassName: 'SysListView32' WindowName: ''
Создает и запускает на исполнение
- '%LOCALAPPDATA%\programs\gamerbot\gamerbot.exe'
Запускает на исполнение
- '%WINDIR%\syswow64\cmd.exe' /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq GamerBot.exe" /FO csv | "<SYSTEM32>\find.exe" "GamerBot.exe" (со скрытым окном)
- '%WINDIR%\syswow64\tasklist.exe' /FI "USERNAME eq user" /FI "IMAGENAME eq GamerBot.exe" /FO csv
- '%WINDIR%\syswow64\find.exe' "GamerBot.exe"
- '<SYSTEM32>\cmd.exe' /d /s /c "chcp" (со скрытым окном)
- '<SYSTEM32>\chcp.com'
- '<SYSTEM32>\cmd.exe' /d /s /c "WHERE smartctl 2>nul" (со скрытым окном)
- '<SYSTEM32>\where.exe' smartctl
- '<SYSTEM32>\cmd.exe' /d /s /c "echo %COMPUTERNAME%.%USERDNSDOMAIN%" (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "$OutputEncoding = [System.Console]::OutputEncoding = [System.Console]::InputEncoding = [System.Text.Encoding]::UTF8 ... (со скрытым окном)
