Техническая информация
Вредоносные функции:
Создает и запускает на исполнение:
- '%TEMP%\nsn935A.tmp\nsDFE6.tmp' schtasks /Run /TN "Idle-Crawler Runner"
- '<LS_APPDATA>\Idle-Crawler\Idle-Crawler.exe'
- '<LS_APPDATA>\Idle-Crawler\Idle-Crawler.exe' --UpNav YwBkAG4ALgBJAGQAbABlAEMAcgBhAHcAbABlAHIALgBjAG8AbQAvAFMAdQBwAHAAUwByAHYAMgAuAHAAaABwAD8AcAA9ADAAJgBzAD0AMgA= --DownNav QwA6AFwAVQBzAGUAcgBzAFwARgBGAFAAWABPAE0ARQBWAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEkAZABsAGUALQBDAHIAYQB3AGwAZQByAFwAVQBwAGQAYQB0AGUAXABSAGUAcwBEAGEAdABhADAA
- '%TEMP%\nsn935A.tmp\nsDB92.tmp' schtasks /Create /TN "Microsoft\Windows\Maintenance\Idle-Crawler Update" /XML "%TEMP%\21B92C81-B1B4-CE91-B200-000000C900\Update.xml" /F
- '%TEMP%\21B92C81-B1B4-CE91-B200-000000C900\HelpRunnner.exe' --InstSupp --Supp 173 --Ver 67
- '%TEMP%\21B92C81-B1B4-CE91-B200-000000C900\HelpRunnner.exe' --PreCheck 173
- '%TEMP%\nsn935A.tmp\nsD5B7.tmp' schtasks /Create /TN "Idle-Crawler Runner" /XML "%TEMP%\21B92C81-B1B4-CE91-B200-000000C900\Runner.xml" /F
Запускает на исполнение:
- '<SYSTEM32>\DllHost.exe' /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}
- '<SYSTEM32>\taskeng.exe' {506F4D61-4E52-4B79-A293-45A3F98FC294} S-1-5-21-3525224950-2885160813-905547259-1000:BVNSEUHJ\FFPXOMEV:S4U:LUA
- '<SYSTEM32>\schtasks.exe' --UpNav YwBkAG4ALgBJAGQAbABlAEMAcgBhAHcAbABlAHIALgBjAG8AbQAvAFMAdQBwAHAAUwByAHYAMgAuAHAAaABwAD8AcAA9ADAAJgBzAD0AMgA= --DownNav QwA6AFwAVQBzAGUAcgBzAFwARgBGAFAAWABPAE0ARQBWAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEkAZABsAGUALQBDAHIAYQB3AGwAZQByAFwAVQBwAGQAYQB0AGUAXABSAGUAcwBEAGEAdABhADAA
- '<SYSTEM32>\schtasks.exe' /Run /TN "Idle-Crawler Runner"
- '<SYSTEM32>\rundll32.exe' dfdts.dll,DfdGetDefaultPolicyAndSMART
- '<SYSTEM32>\schtasks.exe' /Create /TN "Idle-Crawler Runner" /XML "%TEMP%\21B92C81-B1B4-CE91-B200-000000C900\Runner.xml" /F
- '<SYSTEM32>\schtasks.exe' /Create /TN "Microsoft\Windows\Maintenance\Idle-Crawler Update" /XML "%TEMP%\21B92C81-B1B4-CE91-B200-000000C900\Update.xml" /F
Изменения в файловой системе:
Создает следующие файлы:
- <LS_APPDATA>\Idle-Crawler\Modules\CmnUtls.dll
- <LS_APPDATA>\Idle-Crawler\Modules\WdcMan.dll
- %TEMP%\nsn935A.tmp\nsExec.dll
- <LS_APPDATA>\Idle-Crawler\msvcp110.dll
- <LS_APPDATA>\Idle-Crawler\msvcr110.dll
- <LS_APPDATA>\Idle-Crawler\Modules\WblSupp.dll
- <SYSTEM32>\Tasks\Microsoft\Windows\Maintenance\Idle-Crawler Update
- %TEMP%\nsn935A.tmp\nsDFE6.tmp
- <LS_APPDATA>\Idle-Crawler\Update\ResData0
- %TEMP%\nsn935A.tmp\nsD5B7.tmp
- <SYSTEM32>\Tasks\Idle-Crawler Runner
- %TEMP%\nsn935A.tmp\nsDB92.tmp
- <LS_APPDATA>\Idle-Crawler\Modules\NavSupp.dll
- %TEMP%\21B92C81-B1B4-CE91-B200-000000C900\Runner.xml
- %TEMP%\21B92C81-B1B4-CE91-B200-000000C900\Update.xml
- %TEMP%\21B92C81-B1B4-CE91-B200-000000C900\msvcp110.dll
- %TEMP%\nsn935A.tmp\System.dll
- %TEMP%\21B92C81-B1B4-CE91-B200-000000C900\Modules\InSes.dll
- %TEMP%\21B92C81-B1B4-CE91-B200-000000C900\HelpRunnner.exe
- <LS_APPDATA>\Idle-Crawler\Modules\InSes.dll
- <LS_APPDATA>\Idle-Crawler\Modules\WbSes.dll
- <LS_APPDATA>\Idle-Crawler\Modules\7z.dll
- %TEMP%\21B92C81-B1B4-CE91-B200-000000C900\msvcr110.dll
- <LS_APPDATA>\Idle-Crawler\Idle-Crawler.exe
- <LS_APPDATA>\Idle-Crawler\FireProfile.exe
Удаляет следующие файлы:
- %TEMP%\nsn935A.tmp\nsDFE6.tmp
- <LS_APPDATA>\Idle-Crawler\Update\ResData0
- %TEMP%\nsn935A.tmp\nsD5B7.tmp
- %TEMP%\nsn935A.tmp\nsDB92.tmp
Сетевая активность:
Подключается к:
- 'cd#.##lecrawler.com':80
- 'su##.##lecrawler.com':80
TCP:
Запросы HTTP GET:
- cd#.##lecrawler.com/SuppSrv2.php?p=#####
- cd#.##lecrawler.com/precheck/?su######
- su##.##lecrawler.com/DataInfo/ver/67/sid/173/
UDP:
- DNS ASK cd#.##lecrawler.com
- DNS ASK su##.##lecrawler.com
