Техническая информация
Для обеспечения автозапуска и распространения
Модифицирует следующие ключи реестра
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'Flotilla' = '"%LOCALAPPDATA%\Flotilla\current\warden.exe"'
Вредоносные функции
Для затруднения выявления своего присутствия в системе
добавляет исключения антивируса:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath '%LOCALAPPDATA%\Flotilla' -ErrorAction Stop; Add-MpPreference -ExclusionPath '%TEMP%\flotilla-profiles' -ErrorActi...
Запускает на исполнение
- '<SYSTEM32>\taskkill.exe' /F /T /IM warden.exe
- '<SYSTEM32>\taskkill.exe' /F /T /IM pilot.exe
Изменения в файловой системе
Создает следующие файлы
- nul
- %LOCALAPPDATA%\flotilla\state\install.id
- %LOCALAPPDATA%\flotilla\versions\1.6.9\warden.exe.part
- %LOCALAPPDATA%\flotilla\versions\1.6.9\pilot.exe.part
- %LOCALAPPDATA%\flotilla\state\manifest.json.tmp
- %LOCALAPPDATA%\flotilla\state\agent.conf.tmp
- %LOCALAPPDATA%\flotilla\state\warden.pid.tmp
- %LOCALAPPDATA%\flotilla\logs\warden.log
- %LOCALAPPDATA%\flotilla\state\pilot.pid.tmp
- %LOCALAPPDATA%\flotilla\state\last-healthy.json.tmp
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\default\readme
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\default\web data-journal
- %TEMP%\etilqs_e5x6m1wa4v5iag6
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\default\history-journal
- %TEMP%\etilqs_4ltc6t6w56m9cjg
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\default\data_reduction_proxy_leveldb\manifest-000001
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\default\data_reduction_proxy_leveldb\000001.dbtmp
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\default\web data
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\default\history
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\default\data_reduction_proxy_leveldb\log
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\default\extension cookies-journal
- %TEMP%\etilqs_itvawaixf89lvdr
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\default\favicons-journal
- %TEMP%\etilqs_zxjhgynqbhzpny6
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\default\top sites-journal
- %TEMP%\etilqs_ccvw4exuavuannf
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\default\extension cookies
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\default\favicons
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\default\top sites
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\default\databases\databases.db-journal
- %TEMP%\etilqs_vzre1ltlwvxf9sn
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\default\databases\databases.db
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\default\quotamanager-journal
- %TEMP%\etilqs_oegxrz7cf3iendl
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\devtoolsactiveport
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\default\quotamanager
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\default\6df3.tmp
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\default\shortcuts-journal
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\default\shortcuts
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\default\network action predictor-journal
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\default\network action predictor
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\default\login data-journal
- %TEMP%\etilqs_bkwke9q8ujkugix
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\default\login data
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\default\visited links
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\default\current session
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\default\extension state\manifest-000001
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\default\extension state\000001.dbtmp
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\default\extension state\log
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\default\extension state\000003.log
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\9216.tmp
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\default\93dc.tmp
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\default\9489.tmp
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\default\bd52.tmp
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\ccf3.tmp
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\default\f991.tmp
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\3287.tmp
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ybnquan\default\readme
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ybnquan\default\web data-journal
- %TEMP%\etilqs_dbfz8m4ebk14oeg
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ybnquan\default\data_reduction_proxy_leveldb\manifest-000001
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ybnquan\default\history-journal
- %TEMP%\etilqs_nz9jci3foxry7nz
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ybnquan\default\data_reduction_proxy_leveldb\000001.dbtmp
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ybnquan\default\web data
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ybnquan\default\data_reduction_proxy_leveldb\log
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ybnquan\default\extension cookies-journal
- %TEMP%\etilqs_eqvwmkfgt7kdwpv
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ybnquan\devtoolsactiveport
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ybnquan\default\extension cookies
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ybnquan\default\top sites-journal
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ybnquan\default\history
- %TEMP%\etilqs_pmq8mzv280agopv
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ybnquan\default\661e.tmp
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ybnquan\default\top sites
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ybnquan\default\favicons-journal
- %TEMP%\etilqs_n0a8s1a3lo9h0ds
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ybnquan\default\favicons
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ybnquan\default\databases\databases.db-journal
- %TEMP%\etilqs_i0yqe4e5fjm2zyn
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ybnquan\default\databases\databases.db
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ybnquan\default\quotamanager-journal
- %TEMP%\etilqs_yxcs6c0etelplcy
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ybnquan\default\quotamanager
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ybnquan\default\shortcuts-journal
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ybnquan\default\shortcuts
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ybnquan\default\network action predictor-journal
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ybnquan\default\network action predictor
Удаляет файлы, которые сам же создал
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\default\6df3.tmp
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ybnquan\default\661e.tmp
Перемещает следующие файлы
- %LOCALAPPDATA%\flotilla\versions\1.6.9\warden.exe.part в %LOCALAPPDATA%\flotilla\versions\1.6.9\warden.exe
- %LOCALAPPDATA%\flotilla\versions\1.6.9\pilot.exe.part в %LOCALAPPDATA%\flotilla\versions\1.6.9\pilot.exe
- %LOCALAPPDATA%\flotilla\state\manifest.json.tmp в %LOCALAPPDATA%\flotilla\state\manifest.json
- %LOCALAPPDATA%\flotilla\state\agent.conf.tmp в %LOCALAPPDATA%\flotilla\state\agent.conf
- %LOCALAPPDATA%\flotilla\state\warden.pid.tmp в %LOCALAPPDATA%\flotilla\state\warden.pid
- %LOCALAPPDATA%\flotilla\state\pilot.pid.tmp в %LOCALAPPDATA%\flotilla\state\pilot.pid
- %LOCALAPPDATA%\flotilla\state\last-healthy.json.tmp в %LOCALAPPDATA%\flotilla\state\last-healthy.json
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\default\data_reduction_proxy_leveldb\000001.dbtmp в %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\default\data_reduction_proxy_leveldb\current
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\default\extension state\000001.dbtmp в %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\default\extension state\current
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\9216.tmp в %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\local state
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\default\93dc.tmp в %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\default\secure preferences
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\default\9489.tmp в %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\default\preferences
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\default\bd52.tmp в %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\default\secure preferences
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\ccf3.tmp в %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\local state
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\default\f991.tmp в %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\default\secure preferences
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\3287.tmp в %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\local state
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ybnquan\default\data_reduction_proxy_leveldb\000001.dbtmp в %LOCALAPPDATA%\flotilla\profiles\kick.com-ybnquan\default\data_reduction_proxy_leveldb\current
Подменяет следующие файлы
- %LOCALAPPDATA%\flotilla\state\last-healthy.json.tmp
- %LOCALAPPDATA%\flotilla\state\last-healthy.json
Сетевая активность
Подключается к
- 'fl######.45-94-31-71.sslip.io':443
- 'x1.#.lencr.org':80
- '8c##############11d936352cd65e13.r2.cloudflarestorage.com':443
TCP
Запросы HTTP GET
- http://x1.#.lencr.org/
Другие
- 'fl######.45-94-31-71.sslip.io':443
- '8c##############11d936352cd65e13.r2.cloudflarestorage.com':443
UDP
- DNS ASK fl######.45-94-31-71.sslip.io
- DNS ASK x1.#.lencr.org
- DNS ASK 8c##############11d936352cd65e13.r2.cloudflarestorage.com
- DNS ASK google.com
Другое
Ищет следующие окна
- ClassName: '' WindowName: ''
- ClassName: 'Chrome_MessageWindow' WindowName: '%LOCALAPPDATA%\Flotilla\profiles\kick.com-ragee'
- ClassName: 'Chrome_MessageWindow' WindowName: '%LOCALAPPDATA%\Flotilla\profiles\kick.com-ybnquan'
Запускает на исполнение
- '<SYSTEM32>\tasklist.exe' /FI "IMAGENAME eq warden.exe" /NH /FO CSV (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c mklink /J %LOCALAPPDATA%\Flotilla\current %LOCALAPPDATA%\Flotilla\versions\1.6.9 (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath '%LOCALAPPDATA%\Flotilla' -ErrorAction Stop; Add-MpPreference -ExclusionPath '%TEMP%\flotilla-profiles' -ErrorActi... (со скрытым окном)
- '<SYSTEM32>\taskkill.exe' /F /T /IM warden.exe (со скрытым окном)
- '<SYSTEM32>\taskkill.exe' /F /T /IM pilot.exe (со скрытым окном)
- '%LOCALAPPDATA%\flotilla\current\warden.exe' --root %LOCALAPPDATA%\Flotilla (со скрытым окном)
- '%LOCALAPPDATA%\flotilla\current\pilot.exe' (со скрытым окном)
- '%LOCALAPPDATA%\google\chrome\application\chrome.exe' --headless=new --hide-scrollbars --disable-background-timer-throttling --disable-backgrounding-occluded-windows --disable-hang-monitor --disable-sync --no-first-run --mute-audio --disable-promp... (со скрытым окном)
- '%LOCALAPPDATA%\google\chrome\application\chrome.exe' --mute-audio --enable-features=NetworkService,NetworkServiceInProcess --disable-background-timer-throttling --disable-default-apps --metrics-recording-only --enable-gpu-rasterization --disable-... (со скрытым окном)
