Техническая информация
Вредоносные функции:
Создает и запускает на исполнение:
- '%TEMP%\7zS1.tmp\xtvjhhT.exe'
Запускает на исполнение:
- '<SYSTEM32>\regsvr32.exe' /s "%PROGRAM_FILES%\CostMin\ePkqFs.x64.dll"
Завершает или пытается завершить
следующие пользовательские процессы:
- iexplore.exe
- firefox.exe
- chrome.exe
Изменения в файловой системе:
Создает следующие файлы:
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\staged\l.x8yya@vt-svuyeau.edu\content\bg.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\staged\l.x8yya@vt-svuyeau.edu\install.rdf
- %PROGRAM_FILES%\CostMin\ePkqFs.dll
- %TEMP%\7zS1.tmp\l.x8yya@vt-svuyeau.edu\install.rdf
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\staged\l.x8yya@vt-svuyeau.edu\bootstrap.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\staged\l.x8yya@vt-svuyeau.edu\chrome.manifest
- %PROGRAM_FILES%\CostMin\ePkqFs.tlb
- %ALLUSERSPROFILE%\Application Data\CostMin\xtvjhhT.exe
- %ALLUSERSPROFILE%\Application Data\CostMin\xtvjhhT.dat
- %ALLUSERSPROFILE%\Application Data\6e958a80feb239af\{2F5F003B-C71B-72E3-42B4-DE51AB079EB2}
- %PROGRAM_FILES%\CostMin\ePkqFs.dat
- %HOMEPATH%\AppData\LocalLow\{E903246A-2BC1-1371-67CD-547EC0D7C2A7}\CostMin.2.5.dat
- %PROGRAM_FILES%\CostMin\ePkqFs.x64.dll
- %TEMP%\7zS1.tmp\genhmbadgkjpfflekobekpignjlhmjen\manifest.json
- %TEMP%\7zS1.tmp\genhmbadgkjpfflekobekpignjlhmjen\bmZLxD5.js
- %TEMP%\7zS1.tmp\l.x8yya@vt-svuyeau.edu\bootstrap.js
- %TEMP%\7zS1.tmp\genhmbadgkjpfflekobekpignjlhmjen\content.js
- %TEMP%\7zS1.tmp\l.x8yya@vt-svuyeau.edu\chrome.manifest
- %TEMP%\7zS1.tmp\genhmbadgkjpfflekobekpignjlhmjen\background.html
- %TEMP%\7zS1.tmp\l.x8yya@vt-svuyeau.edu\content\bg.js
- %TEMP%\7zS1.tmp\genhmbadgkjpfflekobekpignjlhmjen\lsdb.js
- %TEMP%\7zS1.tmp\ePkqFs.x64.dll
- %TEMP%\7zS1.tmp\ePkqFs.tlb
- %TEMP%\7zS1.tmp\xtvjhhT.dat
- %TEMP%\7zS1.tmp\genhmbadgkjpfflekobekpignjlhmjen\sqlite.js
- %TEMP%\7zS1.tmp\xtvjhhT.exe
- %TEMP%\7zS1.tmp\ePkqFs.dll
Удаляет следующие файлы:
- %TEMP%\7zS1.tmp\l.x8yya@vt-svuyeau.edu\chrome.manifest
- %TEMP%\7zS1.tmp\l.x8yya@vt-svuyeau.edu\bootstrap.js
- %TEMP%\7zS1.tmp\genhmbadgkjpfflekobekpignjlhmjen\sqlite.js
- %TEMP%\7zS1.tmp\l.x8yya@vt-svuyeau.edu\content\bg.js
- %TEMP%\7zS1.tmp\xtvjhhT.exe
- %TEMP%\7zS1.tmp\xtvjhhT.dat
- %TEMP%\7zS1.tmp\l.x8yya@vt-svuyeau.edu\install.rdf
- %TEMP%\7zS1.tmp\genhmbadgkjpfflekobekpignjlhmjen\manifest.json
- %TEMP%\7zS1.tmp\ePkqFs.x64.dll
- %TEMP%\7zS1.tmp\ePkqFs.tlb
- %TEMP%\7zS1.tmp\ePkqFs.dll
- %TEMP%\7zS1.tmp\genhmbadgkjpfflekobekpignjlhmjen\background.html
- %TEMP%\7zS1.tmp\genhmbadgkjpfflekobekpignjlhmjen\lsdb.js
- %TEMP%\7zS1.tmp\genhmbadgkjpfflekobekpignjlhmjen\content.js
- %TEMP%\7zS1.tmp\genhmbadgkjpfflekobekpignjlhmjen\bmZLxD5.js
