Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '' = '%TEMP%\Awpn4WOsS.EXE'
Вредоносные функции:
Создает и запускает на исполнение:
- '%TEMP%\Awpn4WOsS.exe'
Запускает на исполнение:
- '<SYSTEM32>\conhost.exe'
- '<SYSTEM32>\wscript.exe' AG01Z551K.vbs
Внедряет код в
следующие системные процессы:
- <SYSTEM32>\conhost.exe
Ищет ветки реестра, отвечающие за хранение паролей сторонними программами:
- [Software\Far2\Plugins\FTP\Hosts]
- [Software\Far\Plugins\FTP\Hosts]
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\Copy#43300.exee.62.plaha
- %TEMP%\Copy#43300.exee.63.plaha
- %TEMP%\Copy#43300.exee.64.plaha
- %TEMP%\Copy#43300.exee.61.plaha
- %TEMP%\Copy#43300.exee.59.plaha
- %TEMP%\Copy#43300.exee.6.plaha
- %TEMP%\Copy#43300.exee.60.plaha
- %TEMP%\Copy#43300.exee.65.plaha
- %TEMP%\Copy#43300.exee.7.plaha
- %TEMP%\Copy#43300.exee.70.plaha
- %TEMP%\Copy#43300.exee.71.plaha
- %TEMP%\Copy#43300.exee.69.plaha
- %TEMP%\Copy#43300.exee.66.plaha
- %TEMP%\Copy#43300.exee.67.plaha
- %TEMP%\Copy#43300.exee.68.plaha
- %TEMP%\Copy#43300.exee.49.plaha
- %TEMP%\Copy#43300.exee.5.plaha
- %TEMP%\Copy#43300.exee.50.plaha
- %TEMP%\Copy#43300.exee.48.plaha
- %TEMP%\Copy#43300.exee.45.plaha
- %TEMP%\Copy#43300.exee.46.plaha
- %TEMP%\Copy#43300.exee.47.plaha
- %TEMP%\Copy#43300.exee.51.plaha
- %TEMP%\Copy#43300.exee.56.plaha
- %TEMP%\Copy#43300.exee.57.plaha
- %TEMP%\Copy#43300.exee.58.plaha
- %TEMP%\Copy#43300.exee.55.plaha
- %TEMP%\Copy#43300.exee.52.plaha
- %TEMP%\Copy#43300.exee.53.plaha
- %TEMP%\Copy#43300.exee.54.plaha
- %TEMP%\Copy#43300.exee.9.plaha
- %TEMP%\Copy#43300.exee.90.plaha
- %TEMP%\Copy#43300.exee.91.plaha
- %TEMP%\Copy#43300.exee.89.plaha
- %TEMP%\Copy#43300.exee.86.plaha
- %TEMP%\Copy#43300.exee.87.plaha
- %TEMP%\Copy#43300.exee.88.plaha
- %TEMP%\Copy#43300.exee.92.plaha
- %TEMP%\Copy#43300.exee.97.plaha
- %TEMP%\Copy#43300.exee.98.plaha
- %TEMP%\Copy#43300.exee.99.plaha
- %TEMP%\Copy#43300.exee.96.plaha
- %TEMP%\Copy#43300.exee.93.plaha
- %TEMP%\Copy#43300.exee.94.plaha
- %TEMP%\Copy#43300.exee.95.plaha
- %TEMP%\Copy#43300.exee.76.plaha
- %TEMP%\Copy#43300.exee.77.plaha
- %TEMP%\Copy#43300.exee.78.plaha
- %TEMP%\Copy#43300.exee.75.plaha
- %TEMP%\Copy#43300.exee.72.plaha
- %TEMP%\Copy#43300.exee.73.plaha
- %TEMP%\Copy#43300.exee.74.plaha
- %TEMP%\Copy#43300.exee.79.plaha
- %TEMP%\Copy#43300.exee.83.plaha
- %TEMP%\Copy#43300.exee.84.plaha
- %TEMP%\Copy#43300.exee.85.plaha
- %TEMP%\Copy#43300.exee.82.plaha
- %TEMP%\Copy#43300.exee.8.plaha
- %TEMP%\Copy#43300.exee.80.plaha
- %TEMP%\Copy#43300.exee.81.plaha
- %TEMP%\Copy#43300.exee.113.plaha
- %TEMP%\Copy#43300.exee.114.plaha
- %TEMP%\Copy#43300.exee.115.plaha
- %TEMP%\Copy#43300.exee.112.plaha
- %TEMP%\Copy#43300.exee.11.plaha
- %TEMP%\Copy#43300.exee.110.plaha
- %TEMP%\Copy#43300.exee.111.plaha
- %TEMP%\Copy#43300.exee.116.plaha
- %TEMP%\Copy#43300.exee.15.plaha
- %TEMP%\Copy#43300.exee.16.plaha
- %TEMP%\Copy#43300.exee.17.plaha
- %TEMP%\Copy#43300.exee.14.plaha
- %TEMP%\Copy#43300.exee.117.plaha
- %TEMP%\Copy#43300.exee.12.plaha
- %TEMP%\Copy#43300.exee.13.plaha
- %TEMP%\Copy#43300.exee.10.plaha
- %TEMP%\Copy#43300.exee.100.plaha
- %TEMP%\Copy#43300.exee.101.plaha
- %TEMP%\Copy#43300.exee.1.plaha
- %TEMP%\AA3uo432.bat
- %TEMP%\AG01Z551K.vbs
- %TEMP%\Ai10nopGE.bat
- %TEMP%\Copy#43300.exee.102.plaha
- %TEMP%\Copy#43300.exee.107.plaha
- %TEMP%\Copy#43300.exee.108.plaha
- %TEMP%\Copy#43300.exee.109.plaha
- %TEMP%\Copy#43300.exee.106.plaha
- %TEMP%\Copy#43300.exee.103.plaha
- %TEMP%\Copy#43300.exee.104.plaha
- %TEMP%\Copy#43300.exee.105.plaha
- %TEMP%\Copy#43300.exee.35.plaha
- %TEMP%\Copy#43300.exee.36.plaha
- %TEMP%\Copy#43300.exee.37.plaha
- %TEMP%\Copy#43300.exee.34.plaha
- %TEMP%\Copy#43300.exee.31.plaha
- %TEMP%\Copy#43300.exee.32.plaha
- %TEMP%\Copy#43300.exee.33.plaha
- %TEMP%\Copy#43300.exee.38.plaha
- %TEMP%\Copy#43300.exee.42.plaha
- %TEMP%\Copy#43300.exee.43.plaha
- %TEMP%\Copy#43300.exee.44.plaha
- %TEMP%\Copy#43300.exee.41.plaha
- %TEMP%\Copy#43300.exee.39.plaha
- %TEMP%\Copy#43300.exee.4.plaha
- %TEMP%\Copy#43300.exee.40.plaha
- %TEMP%\Copy#43300.exee.21.plaha
- %TEMP%\Copy#43300.exee.22.plaha
- %TEMP%\Copy#43300.exee.23.plaha
- %TEMP%\Copy#43300.exee.20.plaha
- %TEMP%\Copy#43300.exee.18.plaha
- %TEMP%\Copy#43300.exee.19.plaha
- %TEMP%\Copy#43300.exee.2.plaha
- %TEMP%\Copy#43300.exee.24.plaha
- %TEMP%\Copy#43300.exee.29.plaha
- %TEMP%\Copy#43300.exee.3.plaha
- %TEMP%\Copy#43300.exee.30.plaha
- %TEMP%\Copy#43300.exee.28.plaha
- %TEMP%\Copy#43300.exee.25.plaha
- %TEMP%\Copy#43300.exee.26.plaha
- %TEMP%\Copy#43300.exee.27.plaha
Перемещает следующие файлы:
- %TEMP%\Copy#43300.exee.1.plaha в %TEMP%\Awpn4WOsS.exe
Сетевая активность:
UDP:
- DNS ASK dn#.##ftncsi.com
- DNS ASK el####d.comule.com
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'Indicator' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
