Техническая информация
Вредоносные функции:
Создает и запускает на исполнение:
- '%APPDATA%\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VIUNT.exe'
Запускает на исполнение:
- '<SYSTEM32>\DllHost.exe' 0x47c wmpnscfg.exe
- '<SYSTEM32>\conhost.exe' --type=renderer --disable-direct-npapi-requests --lang=en-US --disable-client-side-phishing-detection --with-feature:enhanced-autofill --enable-threaded-compositing --enable-delegated-renderer --disable-accelerated-video-decode --disable-webrtc-hw-encoding --disable-gpu-compositing --channel="2536.3.652278786\496137782" /prefetch:673131151
Ищет следующие окна с целью
обнаружения утилит для анализа:
- ClassName: '' WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'PROCMON_WINDOW_CLASS' WindowName: ''
- ClassName: '' WindowName: 'Registry Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'RegmonClass' WindowName: ''
- ClassName: '' WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'GBDYLLO' WindowName: ''
- ClassName: 'OLLYDBG' WindowName: ''
- ClassName: 'FilemonClass' WindowName: ''
- ClassName: 'pediy06' WindowName: ''
Изменения в файловой системе:
Создает следующие файлы:
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\D3E0.tmp
- %APPDATA%\Roaming\Microsoft\Windows\Recent\CustomDestinations\4PDON7T58DMBA21VGS3D.temp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\MANIFEST-000001
- <Служебный элемент>
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\CF67.tmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\D1D9.tmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\D2F4.tmp
- %TEMP%\etilqs_JyjeH0imu9ne9QR
- %TEMP%\etilqs_egPELGqQECVP4k7
- %APPDATA%\Roaming\Opera Software\Opera Stable\BB23.tmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\LOG
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\000001.dbtmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\MANIFEST-000002
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\000002.dbtmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\000001.dbtmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\MANIFEST-000002
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\000002.dbtmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\MANIFEST-000001
- %TEMP%\~DFBB98F2672B845B48.TMP
- %APPDATA%\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VIUNT.exe
- %TEMP%\~DF64091A2BF4141AA7.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\BF0C.tmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\C6AC.tmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\CC2A.tmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\A082.tmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\LOG
- %TEMP%\etilqs_kgoKKybC9jkyLK3
- %APPDATA%\Roaming\Opera Software\Opera Stable\History Provider Cache
Удаляет следующие файлы:
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\D2E3.tmp~RF6d384.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\D1C8.tmp~RF6d2c8.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\CECA.tmp~RF6d123.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\MANIFEST-000001
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\CURRENT~RF6dc79.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\D3CF.tmp~RF6d6ce.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\MANIFEST-000001
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\CURRENT~RF67be3.TMP
- %TEMP%\~DF64091A2BF4141AA7.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\CB20.tmp~RF6cd1e.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\C544.tmp~RF6c9c4.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\BE21.tmp~RF6c31f.TMP
Перемещает следующие файлы:
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\D2E3.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\D2E3.tmp~RF6d384.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\D3E0.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\D3CF.tmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\D2F4.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\D2E3.tmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\D1D9.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\D1C8.tmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\D1C8.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\D1C8.tmp~RF6d2c8.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\D3CF.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\D3CF.tmp~RF6d6ce.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\CURRENT в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\CURRENT~RF6dc79.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\BB23.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Local State
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\000002.dbtmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\CURRENT
- %APPDATA%\Roaming\Microsoft\Windows\Recent\CustomDestinations\4PDON7T58DMBA21VGS3D.temp в %APPDATA%\Roaming\Microsoft\Windows\Recent\CustomDestinations\8548f632abe97aa3.customDestinations-ms
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\000001.dbtmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\CURRENT
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\CECA.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\CECA.tmp~RF6d123.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\A082.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Preferences
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\BF0C.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\BE21.tmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\CURRENT в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\CURRENT~RF67be3.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\000001.dbtmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\CURRENT
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\000002.dbtmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\CURRENT
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\BE21.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\BE21.tmp~RF6c31f.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\CB20.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\CB20.tmp~RF6cd1e.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\CF67.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\CECA.tmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\CC2A.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\CB20.tmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\C6AC.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\C544.tmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\C544.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\C544.tmp~RF6c9c4.TMP
Сетевая активность:
Подключается к:
- '18#.#5.181.246':21
UDP:
- DNS ASK re###.opera.com
- DNS ASK sl####i.yandex.ru
- DNS ASK bi##.#ikimedia.org
- DNS ASK au######te.geo.opera.com
- DNS ASK en.###ipedia.org
- DNS ASK ap#.###sys.opera.com
- DNS ASK dn#.##ftncsi.com
- DNS ASK go#.gl
- DNS ASK www.ic#.com
- DNS ASK www.google.com
- DNS ASK i.##0.ru
- DNS ASK www.go##le.ru
- DNS ASK si#####ck2.opera.com
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'OleMainThreadWndClass' WindowName: ''
- ClassName: '18467-41' WindowName: ''
- ClassName: 'Opera_MessageWindow' WindowName: '%APPDATA%\Roaming\Opera Software\Opera Stable'
