Техническая информация
Вредоносные функции:
Создает и запускает на исполнение:
- '%TEMP%\utmp\u.exe' -L="127.0.0.1:9666" -CID="518a92a2", -ProgPath="%TEMP%\\" -TmpPath="%TEMP%\utmp\\" -C="CN"
- '%TEMP%\piolo_killer.vmp.exe'
- '%TEMP%\U1403_їшє».exe'
Запускает на исполнение:
- '<SYSTEM32>\wbem\wmiadap.exe' /R /T
Ищет следующие окна с целью
обнаружения утилит для анализа:
- ClassName: 'FilemonClass' WindowName: ''
- ClassName: 'PROCMON_WINDOW_CLASS' WindowName: ''
- ClassName: 'RegmonClass' WindowName: ''
- ClassName: 'OLLYDBG' WindowName: ''
- ClassName: 'GBDYLLO' WindowName: ''
- ClassName: 'pediy06' WindowName: ''
Изменяет следующие настройки браузера Windows Internet Explorer:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'ProxyServer' = '127.0.0.1:9666'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'ProxyOverride' = '127.0.0.1'
- [<HKLM>\SYSTEM\ControlSet001\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings] 'ProxyEnable' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1C00' = '{00,00,00,00}'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] 'CurrentLevel' = '{00,00,00,00}'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'ProxyEnable' = '00000001'
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\utmp\~hvnhrmjua0z5z4p
- %TEMP%\utmp\~gccbnmtwm7z4a4f
- %TEMP%\utmp\u.exe
- %TEMP%\utmp\~qbooxiwys5g2k2w
- %TEMP%\U1403_їшє».exe
- %TEMP%\piolo_killer.vmp.exe
- %TEMP%\utmp\~jayslgiou6o8z8y
Сетевая активность:
Подключается к:
- '54.##0.108.243':443
- '17#.#94.79.115':443
- '74.##5.28.115':443
- '54.##0.136.89':443
- '54.##0.108.129':443
- '74.##5.25.115':443
- 's1.##static.com':443
- 'ad#.##stmedia.com':443
- 'fl##.atdmt.com':443
- '74.##5.232.51':80
- 'd5#######tt6i.cloudfront.net':443
- 'fo###.#oogleapis.com':443
- 'st#.##azonaws.com':443
TCP:
Запросы HTTP GET:
- 74.##5.232.51/
UDP:
- DNS ASK ge##.adobe.com
- DNS ASK ar.###cefive.com
- DNS ASK ss####.adobe.com
- DNS ASK ge#.#dobe.com
- DNS ASK d2#######tfzji.cloudfront.net
- DNS ASK ww##.amazon.com
- DNS ASK d2#######3n2jj.cloudfront.net
- DNS ASK fl#.##ubleclick.net
- DNS ASK ch####ut.google.com
- DNS ASK d3#######fv46c.cloudfront.net
- DNS ASK i1.##img.com
- DNS ASK lh#.#oogle.com
- DNS ASK tr######e.googleapis.com
- DNS ASK cd#.###bleverify.com
- DNS ASK yt#.#gpht.com
- DNS ASK st####.#ebtrendslive.com
- DNS ASK vi###.google.com
- DNS ASK ca####a.demdex.net
- DNS ASK fp#####oad.adobe.com
- DNS ASK sk####ve.live.com
- DNS ASK s4.##static.com
- DNS ASK gm#.#gpht.com
- DNS ASK gm###.google.com
- DNS ASK fo###.#oogleapis.com
- DNS ASK www.uz##gg.info
- DNS ASK d5#######tt6i.cloudfront.net
- DNS ASK d1#######y2udg.cloudfront.net
- DNS ASK s1.##static.com
- DNS ASK st#.##azonaws.com
- DNS ASK www.jm###pi.info
- DNS ASK www.google.com
- DNS ASK fl##.atdmt.com
- DNS ASK www.ir###mmb.info
- DNS ASK ad#.##stmedia.com
- DNS ASK s3.##static.com
- DNS ASK gg.##ogle.com
- DNS ASK d2#######9806j.cloudfront.net
- DNS ASK ch###.#oogleapis.com
- DNS ASK d2#######8f4wt.cloudfront.net
- DNS ASK s3.###zonaws.com
- DNS ASK pi#####eb.google.com
- DNS ASK d5#######uw4z.cloudfront.net
- DNS ASK rt####.doubleverify.com
- DNS ASK yq#.##hooapis.com
- DNS ASK s1.###bleclick.net
- DNS ASK d3#######g8jdx.cloudfront.net
Другое:
Ищет следующие окна:
- ClassName: '18467-41' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: '' WindowName: 'Registry Monitor - Sysinternals: www.sysinternals.com'
- ClassName: '' WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
- ClassName: '' WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'
