Техническая информация
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\net1.exe' /pid=2492
- '<SYSTEM32>\net1.exe' user admin16wd /add
- '<SYSTEM32>\net1.exe' /pid=788
- '<SYSTEM32>\net1.exe' user admin17d /add
- '<SYSTEM32>\net1.exe' /pid=248
- '<SYSTEM32>\net1.exe' user admi14ef /add
- '<SYSTEM32>\net1.exe' /pid=1408
- '<SYSTEM32>\net1.exe' user admin15dwq /add
- '<SYSTEM32>\net1.exe' /pid=1804
- '<SYSTEM32>\net1.exe' user admin225235w /add
- '<SYSTEM32>\net1.exe' user admin223525w /add
- '<SYSTEM32>\net1.exe' user admin246325w /add
- '<SYSTEM32>\net1.exe' user admin262325w /add
- '<SYSTEM32>\net1.exe' user admin19w /add
- '<SYSTEM32>\net1.exe' user admin18w /add
- '<SYSTEM32>\net1.exe' user admin223425w /add
- '<SYSTEM32>\net1.exe' user admin20q /add
- '<SYSTEM32>\net1.exe' /pid=4040
- '<SYSTEM32>\net1.exe' /pid=3652
- '<SYSTEM32>\net1.exe' user admin7e /add
- '<SYSTEM32>\net1.exe' /pid=3720
- '<SYSTEM32>\net1.exe' user admin8wt /add
- '<SYSTEM32>\net1.exe' /pid=2888
- '<SYSTEM32>\net1.exe' user admin5rt /add
- '<SYSTEM32>\net1.exe' /pid=3588
- '<SYSTEM32>\net1.exe' user admin6rt /add
- '<SYSTEM32>\net1.exe' user admin9r /add
- '<SYSTEM32>\net1.exe' user admin12efq /add
- '<SYSTEM32>\net1.exe' /pid=3908
- '<SYSTEM32>\net1.exe' user admin13w /add
- '<SYSTEM32>\net1.exe' /pid=3972
- '<SYSTEM32>\net1.exe' user admin10tg /add
- '<SYSTEM32>\net1.exe' /pid=3780
- '<SYSTEM32>\net1.exe' user admin11efw /add
- '<SYSTEM32>\net1.exe' /pid=3844
- '<SYSTEM32>\net1.exe' /pid=2948
- '<SYSTEM32>\net1.exe' user admin2w365725 /add
- '<SYSTEM32>\net1.exe' user admin25w6425 /add
- '<SYSTEM32>\net1.exe' user admin2w6573425 /add
- '<SYSTEM32>\net1.exe' /pid=2688
- '<SYSTEM32>\net1.exe' user admin22w5675 /add
- '<SYSTEM32>\net1.exe' /pid=2808
- '<SYSTEM32>\net1.exe' user admin2w546325 /add
- '<SYSTEM32>\net1.exe' /pid=3304
- '<SYSTEM32>\net1.exe' /pid=3176
- '<SYSTEM32>\net1.exe' user admin2w53225 /add
- '<SYSTEM32>\net1.exe' user admin2w876825 /add
- '<SYSTEM32>\net1.exe' user adminw22755 /add
- '<SYSTEM32>\net1.exe' /pid=728
- '<SYSTEM32>\net1.exe' user admin2w25725 /add
- '<SYSTEM32>\net1.exe' user admin2w22435 /add
- '<SYSTEM32>\net1.exe' user admin2w2765765 /add
- '<SYSTEM32>\net1.exe' user admin24w77425 /add
- '<SYSTEM32>\net1.exe' user admin24w5225 /add
- '<SYSTEM32>\net1.exe' user admin22w5645 /add
- '<SYSTEM32>\net1.exe' /pid=3696
- '<SYSTEM32>\net1.exe' user admin26w3425 /add
- '<SYSTEM32>\net1.exe' user admin273w425 /add
- '<SYSTEM32>\net1.exe' user admin23462w5 /add
- '<SYSTEM32>\net1.exe' user admin24w3525 /add
- '<SYSTEM32>\net1.exe' user admin224w375 /add
- '<SYSTEM32>\net1.exe' user admin23w5645625 /add
- '<SYSTEM32>\net1.exe' user admin25w464525 /add
- '<SYSTEM32>\net1.exe' user admin22w8975 /add
- '<SYSTEM32>\net1.exe' user admin27w6425 /add
- '<SYSTEM32>\net1.exe' user admin24w655425 /add
- '<SYSTEM32>\net1.exe' user admin28w7825 /add
- '<SYSTEM32>\net1.exe' user admin22w34625 /add
- '<SYSTEM32>\net1.exe' user admin29w625 /add
- '<SYSTEM32>\net1.exe' user admin26w825 /add
- '<SYSTEM32>\net1.exe' user admineyr /add
- '<SYSTEM32>\net1.exe' user admin225235 /add
- '<SYSTEM32>\net1.exe' user admin223525 /add
- '<SYSTEM32>\net1.exe' user admin246325 /add
- '<SYSTEM32>\net1.exe' user admin262325 /add
- '<SYSTEM32>\net1.exe' user admin19 /add
- '<SYSTEM32>\net1.exe' user admin18 /add
- '<SYSTEM32>\net1.exe' user admin223425 /add
- '<SYSTEM32>\net1.exe' user admin20 /add
- '<SYSTEM32>\net1.exe' user admin234625 /add
- '<SYSTEM32>\net1.exe' user admin245225 /add
- '<SYSTEM32>\net1.exe' user admin225645 /add
- '<SYSTEM32>\net1.exe' user admin263425 /add
- '<SYSTEM32>\net1.exe' user admin234525 /add
- '<SYSTEM32>\net1.exe' user admin224375 /add
- '<SYSTEM32>\net1.exe' user admin273425 /add
- '<SYSTEM32>\net1.exe' user admin2256545 /add
- '<SYSTEM32>\net1.exe' user admin243525 /add
- '<SYSTEM32>\net1.exe' user admin17 /add
- '<SYSTEM32>\net1.exe' user admin5 /add
- '<SYSTEM32>\net1.exe' user admin4 /add
- '<SYSTEM32>\net1.exe' user admin7 /add
- '<SYSTEM32>\net1.exe' user admin6 /add
- '<SYSTEM32>\net1.exe' user admin1 /add
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\1.tmp\1.bat" "
- '<SYSTEM32>\net1.exe' user admin3 /add
- '<SYSTEM32>\net1.exe' user admin2 /add
- '<SYSTEM32>\net1.exe' user admin8 /add
- '<SYSTEM32>\net1.exe' user admi14 /add
- '<SYSTEM32>\net1.exe' user admin13 /add
- '<SYSTEM32>\net1.exe' user admin16 /add
- '<SYSTEM32>\net1.exe' user admin15/add
- '<SYSTEM32>\net1.exe' user admin10 /add
- '<SYSTEM32>\net1.exe' user admin9 /add
- '<SYSTEM32>\net1.exe' user admin12 /add
- '<SYSTEM32>\net1.exe' user admin11 /add
- '<SYSTEM32>\net1.exe' user admin245665325 /add
- '<SYSTEM32>\net1.exe' user admin2876825 /add
- '<SYSTEM32>\net1.exe' /pid=3044
- '<SYSTEM32>\net1.exe' user admin245625 /add
- '<SYSTEM32>\net1.exe' user admin253225 /add
- '<SYSTEM32>\net1.exe' user admin222435 /add
- '<SYSTEM32>\net1.exe' user admin22755 /add
- '<SYSTEM32>\net1.exe' user admin2286785 /add
- '<SYSTEM32>\net1.exe' user admin25647925 /add
- '<SYSTEM32>\net1.exe' user admine4t /add
- '<SYSTEM32>\net1.exe' /pid=3236
- '<SYSTEM32>\net1.exe' user adminteye /add
- '<SYSTEM32>\net1.exe' /pid=3332
- '<SYSTEM32>\net1.exe' user admin209725 /add
- '<SYSTEM32>\net1.exe' /pid=3108
- '<SYSTEM32>\net1.exe' user admin229896785 /add
- '<SYSTEM32>\net1.exe' /pid=3172
- '<SYSTEM32>\net1.exe' user admin22765765 /add
- '<SYSTEM32>\net1.exe' user admin228975 /add
- '<SYSTEM32>\net1.exe' user admin29625 /add
- '<SYSTEM32>\net1.exe' user admin24655425 /add
- '<SYSTEM32>\net1.exe' user admin25464525 /add
- '<SYSTEM32>\net1.exe' user admin2234625 /add
- '<SYSTEM32>\net1.exe' user admin235645625 /add
- '<SYSTEM32>\net1.exe' user admin26825 /add
- '<SYSTEM32>\net1.exe' user admin287825 /add
- '<SYSTEM32>\net1.exe' user admin276425 /add
- '<SYSTEM32>\net1.exe' user admin22356355 /add
- '<SYSTEM32>\net1.exe' user admin26573425 /add
- '<SYSTEM32>\net1.exe' user admin225725 /add
- '<SYSTEM32>\net1.exe' user admin256425 /add
- '<SYSTEM32>\net1.exe' user admin225675 /add
- '<SYSTEM32>\net1.exe' user admin2477425 /add
- '<SYSTEM32>\net1.exe' user admin2365725 /add
- '<SYSTEM32>\net1.exe' user admin2546325 /add
Внедряет код в
следующие системные процессы:
- <SYSTEM32>\net.exe
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\1.tmp\1.bat
