Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'WiseManager' = '"%APPDATA%\WiseManager\WiseManager.exe"'
Вредоносные функции:
Создает и запускает на исполнение:
- '%APPDATA%\WiseManager\SmartManager.exe'
- '%APPDATA%\WiseManager\WiseManager.exe' 10 20 30 40 50
- '%APPDATA%\WiseManager\pfs.exe' CGMInerDLLs "%APPDATA%\WiseManager" E
Запускает на исполнение:
- '<SYSTEM32>\attrib.exe' +s +h "%APPDATA%\WiseManager"
Изменения в файловой системе:
Создает следующие файлы:
- %APPDATA%\WiseManager\CGMInerDLLs\stubiesfx.stm
- %APPDATA%\WiseManager\CGMInerDLLs\stamp-h1
- %APPDATA%\WiseManager\CGMInerDLLs\ssleay32.dll
- %APPDATA%\WiseManager\CGMInerDLLs\usbtest.py
- %APPDATA%\WiseManager\CGMInerDLLs\OpenClIntel\IntelOpenCL64.dll
- %APPDATA%\WiseManager\CGMInerDLLs\OpenClAMD\OpenCL.dll
- %APPDATA%\WiseManager\CGMInerDLLs\zlib1.dll
- %APPDATA%\WiseManager\CGMInerDLLs\sgminer.exe
- %APPDATA%\WiseManager\CGMInerDLLs\pthreadGC2.dll
- %APPDATA%\WiseManager\CGMInerDLLs\poclbm130302.cl
- %APPDATA%\WiseManager\CGMInerDLLs\poclbm121016.cl
- %APPDATA%\WiseManager\CGMInerDLLs\pthreadGCE2.dll
- %APPDATA%\WiseManager\CGMInerDLLs\scrypt130511.cl
- %APPDATA%\WiseManager\CGMInerDLLs\scrypt121016.cl
- %APPDATA%\WiseManager\CGMInerDLLs\pthreadVC2.dll
- %APPDATA%\WiseManager\CGMInerDLLs\OpenClIntel\Intel_OpenCL_ICD64.dll
- %APPDATA%\WiseManager\SmartManager.exe
- %APPDATA%\WiseManager\uninst.exe
- %APPDATA%\WiseManager\CGMInerDLLs\kernel\zuikkis.cl
- %APPDATA%\WiseManager\Cmd.dat
- %APPDATA%\WiseManager\WiseMinerConfig_Id_1244032.xml
- %APPDATA%\WiseManager\PCConfig.xml
- %APPDATA%\WiseManager\WiseManager.log
- %APPDATA%\WiseManager\CGMInerDLLs\kernel\psw.cl
- %APPDATA%\WiseManager\CGMInerDLLs\OpenClIntel\opengl32.dll
- %APPDATA%\WiseManager\CGMInerDLLs\OpenClIntel\intelopencl32.dll
- %APPDATA%\WiseManager\CGMInerDLLs\OpenClIntel\OpenCL.dll
- %APPDATA%\WiseManager\CGMInerDLLs\OpenClNvidia\OpenCL.dll
- %APPDATA%\WiseManager\CGMInerDLLs\kernel\ckolivas.cl
- %APPDATA%\WiseManager\CGMInerDLLs\kernel\alexkarold.cl
- %APPDATA%\WiseManager\CGMInerDLLs\kernel\alexkarnew.cl
- %APPDATA%\WiseManager\CGMInerDLLs\phatk121016.cl
- %APPDATA%\WiseManager\CGMInerDLLs\README
- %APPDATA%\WiseManager\CGMInerDLLs\OpenCL.dll
- %APPDATA%\WiseManager\CGMInerDLLs\Intel_OpenCL_ICD64.dll
- %APPDATA%\WiseManager\CGMInerDLLs\README-SDL.txt
- %APPDATA%\WiseManager\CGMInerDLLs\cudaminer.exe
- %APPDATA%\WiseManager\CGMInerDLLs\cgminer.exe
- %APPDATA%\WiseManager\CGMInerDLLs\SCRYPT-README
- %APPDATA%\WiseManager\CGMInerDLLs\IntelOpenCL64.dll
- %APPDATA%\WiseManager\pfs.exe
- %APPDATA%\WiseManager\Wise.dat
- %APPDATA%\WiseManager\WiseManager.exe
- %APPDATA%\WiseManager\CGMInerDLLs\CPU.dat
- %APPDATA%\WiseManager\CGMInerDLLs\GfjdkPfhrU.exe
- %APPDATA%\WiseManager\CGMInerDLLs\GPU.dat
- %APPDATA%\WiseManager\CGMInerDLLs\CfjdkPfhrU.exe
- %APPDATA%\WiseManager\CGMInerDLLs\cudart32_60.dll
- %APPDATA%\WiseManager\CGMInerDLLs\librtmp.dll
- %APPDATA%\WiseManager\CGMInerDLLs\libpdcurses.dll
- %APPDATA%\WiseManager\CGMInerDLLs\libidn-11.dll
- %APPDATA%\WiseManager\CGMInerDLLs\libssh2.dll
- %APPDATA%\WiseManager\CGMInerDLLs\opengl32.dll
- %APPDATA%\WiseManager\CGMInerDLLs\minerd.exe
- %APPDATA%\WiseManager\CGMInerDLLs\libwinpthread-1.dll
- %APPDATA%\WiseManager\CGMInerDLLs\libgcc_s_dw2-1.dll
- %APPDATA%\WiseManager\CGMInerDLLs\diakgcn121016.cl
- %APPDATA%\WiseManager\CGMInerDLLs\diablo130302.cl
- %APPDATA%\WiseManager\CGMInerDLLs\diablo121016.cl
- %APPDATA%\WiseManager\CGMInerDLLs\intelopencl32.dll
- %APPDATA%\WiseManager\CGMInerDLLs\libeay32.dll
- %APPDATA%\WiseManager\CGMInerDLLs\libcurl.dll
- %APPDATA%\WiseManager\CGMInerDLLs\libcurl-4.dll
Удаляет следующие файлы:
- %APPDATA%\WiseManager\uninst.exe
- %APPDATA%\WiseManager\pfs.exe
Сетевая активность:
Подключается к:
- 'www.go#####analytics.com':443
- 'sa#####safe-click.com':80
- 'ap#.#pify.org':80
TCP:
Запросы HTTP GET:
- ap#.#pify.org/?fo#########
Запросы HTTP POST:
- sa#####safe-click.com/api/miners/get
- sa#####safe-click.com/api/pcs/register
UDP:
- DNS ASK www.go#####analytics.com
- DNS ASK sa#####safe-click.com
- DNS ASK ap#.#pify.org
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
