Trojan.PWS.Steam.36438

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

<SYSTEM32>\tasks\firefox default browser agent 6e38b05297f2c919

Sets the following service settings

[HKLM\System\CurrentControlSet\Services\WinDefend] 'Start' = '00000002'

Malicious functions

To complicate detection of its presence in the operating system,

blocks execution of the following system utilities:

Windows Defender

adds antivirus exclusion with following registry keys:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{C286B2F2-5E4F-4BB6-A7DF-E23D859FC798}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions] 'exe' = ''
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions] 'exe' = ''
[HKCU\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{20E5416D-2133-4450-87A3-B36A52B7E59B}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions] 'exe' = ''
[HKCU\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{0A733504-4BA8-43AC-BF9B-4B195CDFD94B}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions] 'exe' = ''

adds antivirus exclusion:

'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force

Injects code into

the following system processes:

%WINDIR%\microsoft.net\framework\v4.0.30319\applaunch.exe

Modifies file system

Creates the following files

<SYSTEM32>\grouppolicy\gpt.ini
%HOMEPATH%\pictures\minor policy\2s9heububzvp6amfxnqem7pq.exe
%HOMEPATH%\pictures\minor policy\o0eev9cntphy2evndvggfogp.exe
%HOMEPATH%\pictures\minor policy\p9ftk2ichi0rlx1behvtqeig.exe
%HOMEPATH%\pictures\minor policy\2x7izffe3sbatqepvlavnizf.exe
%WINDIR%\syswow64\grouppolicy\gpt.ini
%APPDATA%\fgcscge
%HOMEPATH%\pictures\minor policy\wefcsabpjm0gvhsitoxppmdw.exe
%HOMEPATH%\pictures\minor policy\s_7qnv5vzigsti55aaiw_r2x.exe
%HOMEPATH%\pictures\minor policy\5hphewqoepuaiei17vfxq9ph.exe
%HOMEPATH%\pictures\minor policy\ecopht_aix_iucdkevex3taa.exe
%HOMEPATH%\pictures\minor policy\m_o0vxk8fqhzkjnxl2tw7dul.exe
%HOMEPATH%\pictures\minor policy\knqnxulz6u2oeclzwkytz_3w.exe
%HOMEPATH%\pictures\minor policy\veprkxdwfww47a_vyxy4tyvg.exe
%HOMEPATH%\pictures\minor policy\eylsazuix1shcgjhevubn4q1.exe
%HOMEPATH%\pictures\minor policy\wjxkpn78bcxbvtgy5gnzg0vd.exe
%HOMEPATH%\pictures\minor policy\ourulescdzkkva5h7kwsk26t.exe
%HOMEPATH%\pictures\minor policy\fjaqis6gesu_i4rjixise_qg.exe
%HOMEPATH%\pictures\minor policy\vmfe61kfp1voufrnifnomcza.exe
%HOMEPATH%\pictures\minor policy\t88zfxerqmrcxdti4nadgpdu.exe
%HOMEPATH%\pictures\minor policy\d76cfjmjtai4azos2blcsndi.exe
%HOMEPATH%\pictures\minor policy\bk851xjq8jkk2ra6yiqltct0.exe
%HOMEPATH%\pictures\minor policy\1ccnighrf3gzndbwvjak_dk7.exe
%HOMEPATH%\pictures\minor policy\orfi8cnf_8wajlwcxbhgt_59.exe
%ALLUSERSPROFILE%\ntuser.pol
<SYSTEM32>\grouppolicy\machine\registry.pol
%HOMEPATH%\pictures\minor policy\slufbmscha7enim8bm_j4ivj.exe
%TEMP%\207aa4515d\oneetx.exe

Sets the 'hidden' attribute to the following files

%ALLUSERSPROFILE%\tempntuser.pol
%APPDATA%\fgcscge

Deletes the following files

%ALLUSERSPROFILE%\tempntuser.pol
%HOMEPATH%\pictures\minor policy\t88zfxerqmrcxdti4nadgpdu.exe
<SYSTEM32>\tasks\microsoft\windows defender\mpidletask

Moves the following files

from %ALLUSERSPROFILE%\ntuser.pol to %ALLUSERSPROFILE%\tempntuser.pol

Substitutes the following files

%ALLUSERSPROFILE%\ntuser.pol
%ALLUSERSPROFILE%\tempntuser.pol

Network activity

Connects to

'94.##2.138.113':80
'yandex.ru':443
'ip##s.ru':443
'ip###ger.org':443
'dz#n.ru':443
'po###ulit.org':80
't.#e':443
'hu###lior.net':80
'94.##2.138.131':80
'wi####campbell.top':80
'19#.#2.32.118':80
'bu###u55t.net':80
'db##p.com':443
'ap#.#b-ip.com':443
'so###tlic4.net':80
'ir##host.io':443
'45.#.74.80':80
'ma##ind.com':80
'ma##ind.com':443
'ch####sjones.top':80
'tw##ter.com':443
'45.##.156.229':80
'te###ram.org':443
'x2.#.lencr.org':80
'ip##fo.io':443
'vk.com':80
'vk.com':443
'94.##6.253.187':80
'87.##1.221.58':80
'19#.#69.175.232':80
'hu##rsi.com':80
'bi###cket.org':80
'no####sa5org.org':80
'st####ommunity.com':443
'pr###ncert.pw':80
'pr###ncert.pw':443
'bi###cket.org':443
'ag##v.com':443
'su####3.userapi.com':443
'ps##.#serapi.com':443
'su####8.userapi.com':443
'ap#.#yip.com':80
'x1.#.lencr.org':80
'ap#.#yip.com':443
'ag##v.com':80
'to###olihul.net':80

TCP

HTTP GET requests

http://hu##rsi.com/dl/6523.exe
http://94.##6.253.187/download/Services.exe
http://87.##1.221.58/g.exe
http://wi####campbell.top/calc2.exe
http://19#.#69.175.232/autorun.exe
http://x1.#.lencr.org/
http://x2.#.lencr.org/
http://94.##2.138.113/api/tracemap.php
http://94.##2.138.131/api/tracemap.php
http://19#.#2.32.118/api/tracemap.php
http://www.ma##ind.com/geoip/v2.1/city/me
http://45.#.74.80/ummaa.exe
http://45.#.74.80/super.exe
http://45.##.156.229/api/tracemap.php

HTTP POST requests

http://po###ulit.org/
http://hu###lior.net/
http://bu###u55t.net/
http://so###tlic4.net/
http://no####sa5org.org/

Other

'ap#.#yip.com':443
'st####ommunity.com':443
'sso.passport.yandex.ru':443
'dz#n.ru':443
'ip###ger.org':443
'ip##s.ru':443
'yandex.ru':443
'tw##ter.com':443
'te###ram.org':443
'su####8.userapi.com':443
'ir##host.io':443
'ps##.#serapi.com':443
'bi###cket.org':443
'su####3.userapi.com':443
'pr###ncert.pw':443
'ag##v.com':80
'bi###cket.org':80
'pr###ncert.pw':80
'vk.com':443
'vk.com':80
'ip##fo.io':443
'ag##v.com':443
'ma##ind.com':443

UDP

DNS ASK ap#.#yip.com
DNS ASK po###ulit.org
DNS ASK dz#n.ru
DNS ASK t.#e
DNS ASK sso.passport.yandex.ru
DNS ASK hu###lior.net
DNS ASK st####ommunity.com
DNS ASK db##p.com
DNS ASK nu###jnuli.org
DNS ASK so###tlic4.net
DNS ASK ap#.#b-ip.com
DNS ASK ir##host.io
DNS ASK no####sa5org.org
DNS ASK ma##ind.com
DNS ASK 23#######721824.bal.ala48.top
DNS ASK ip###ger.org
DNS ASK bu###u55t.net
DNS ASK ip##s.ru
DNS ASK ag##v.com
DNS ASK ip##fo.io
DNS ASK vk.com
DNS ASK pr###ncert.pw
DNS ASK wi####campbell.top
DNS ASK hu##rsi.com
DNS ASK bi###cket.org
DNS ASK su####3.userapi.com
DNS ASK tw##ter.com
DNS ASK ps##.#serapi.com
DNS ASK su####8.userapi.com
DNS ASK x1.#.lencr.org
DNS ASK x2.#.lencr.org
DNS ASK te###ram.org
DNS ASK ch####sjones.top
DNS ASK yandex.ru
DNS ASK to###olihul.net

Miscellaneous

Searches for the following windows

ClassName: 'EDIT' WindowName: ''

Creates and executes the following

'%HOMEPATH%\pictures\minor policy\wefcsabpjm0gvhsitoxppmdw.exe'
'%HOMEPATH%\pictures\minor policy\5hphewqoepuaiei17vfxq9ph.exe'
'%TEMP%\207aa4515d\oneetx.exe'
'%HOMEPATH%\pictures\minor policy\slufbmscha7enim8bm_j4ivj.exe'
'%HOMEPATH%\pictures\minor policy\2s9heububzvp6amfxnqem7pq.exe'
'%HOMEPATH%\pictures\minor policy\eylsazuix1shcgjhevubn4q1.exe'
'%HOMEPATH%\pictures\minor policy\m_o0vxk8fqhzkjnxl2tw7dul.exe'
'%HOMEPATH%\pictures\minor policy\ourulescdzkkva5h7kwsk26t.exe'
'%HOMEPATH%\pictures\minor policy\bk851xjq8jkk2ra6yiqltct0.exe'
'%HOMEPATH%\pictures\minor policy\o0eev9cntphy2evndvggfogp.exe'
'%HOMEPATH%\pictures\minor policy\s_7qnv5vzigsti55aaiw_r2x.exe'
'%HOMEPATH%\pictures\minor policy\ecopht_aix_iucdkevex3taa.exe'
'%HOMEPATH%\pictures\minor policy\veprkxdwfww47a_vyxy4tyvg.exe'
'%HOMEPATH%\pictures\minor policy\d76cfjmjtai4azos2blcsndi.exe'
'%HOMEPATH%\pictures\minor policy\t88zfxerqmrcxdti4nadgpdu.exe'
'%HOMEPATH%\pictures\minor policy\vmfe61kfp1voufrnifnomcza.exe'
'%HOMEPATH%\pictures\minor policy\fjaqis6gesu_i4rjixise_qg.exe'
'%HOMEPATH%\pictures\minor policy\1ccnighrf3gzndbwvjak_dk7.exe'
'%HOMEPATH%\pictures\minor policy\o0eev9cntphy2evndvggfogp.exe' ' (with hidden window)
'%HOMEPATH%\pictures\minor policy\d76cfjmjtai4azos2blcsndi.exe' ' (with hidden window)
'%HOMEPATH%\pictures\minor policy\2s9heububzvp6amfxnqem7pq.exe' ' (with hidden window)
'%HOMEPATH%\pictures\minor policy\vmfe61kfp1voufrnifnomcza.exe' ' (with hidden window)
'%HOMEPATH%\pictures\minor policy\wefcsabpjm0gvhsitoxppmdw.exe' ' (with hidden window)
'%TEMP%\207aa4515d\oneetx.exe' ' (with hidden window)
'%HOMEPATH%\pictures\minor policy\eylsazuix1shcgjhevubn4q1.exe' ' (with hidden window)
'%HOMEPATH%\pictures\minor policy\slufbmscha7enim8bm_j4ivj.exe' ' (with hidden window)
'%HOMEPATH%\pictures\minor policy\ecopht_aix_iucdkevex3taa.exe' ' (with hidden window)
'%HOMEPATH%\pictures\minor policy\fjaqis6gesu_i4rjixise_qg.exe' ' (with hidden window)
'%WINDIR%\syswow64\schtasks.exe' /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "%TEMP%\207aa4515d\oneetx.exe" /F' (with hidden window)
'%HOMEPATH%\pictures\minor policy\ourulescdzkkva5h7kwsk26t.exe' ' (with hidden window)
'%HOMEPATH%\pictures\minor policy\t88zfxerqmrcxdti4nadgpdu.exe' ' (with hidden window)
'%HOMEPATH%\pictures\minor policy\1ccnighrf3gzndbwvjak_dk7.exe' ' (with hidden window)
'%HOMEPATH%\pictures\minor policy\s_7qnv5vzigsti55aaiw_r2x.exe' ' (with hidden window)
'%HOMEPATH%\pictures\minor policy\veprkxdwfww47a_vyxy4tyvg.exe' ' (with hidden window)
'%HOMEPATH%\pictures\minor policy\5hphewqoepuaiei17vfxq9ph.exe' ' (with hidden window)
'%HOMEPATH%\pictures\minor policy\m_o0vxk8fqhzkjnxl2tw7dul.exe' ' (with hidden window)
'%HOMEPATH%\pictures\minor policy\bk851xjq8jkk2ra6yiqltct0.exe' ' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /k echo Y|CACLS "oneetx.exe" /P "user:N"&&CACLS "oneetx.exe" /P "user:R" /E&&echo Y|CACLS "..\207aa4515d" /P "user:N"&&CACLS "..\207aa4515d" /P "user:R" /E&&Exit' (with hidden window)

Executes the following

'<SYSTEM32>\svchost.exe' -k secsvcs
'<SYSTEM32>\raserver.exe' /offerraupdate
'%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe'
'%WINDIR%\microsoft.net\framework\v4.0.30319\applaunch.exe'
'%WINDIR%\syswow64\schtasks.exe' /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "%TEMP%\207aa4515d\oneetx.exe" /F
'%WINDIR%\syswow64\cmd.exe' /k echo Y|CACLS "oneetx.exe" /P "user:N"&&CACLS "oneetx.exe" /P "user:R" /E&&echo Y|CACLS "..\207aa4515d" /P "user:N"&&CACLS "..\207aa4515d" /P "user:R" /E&&Exit
'%WINDIR%\syswow64\regsvr32.exe' -S .\9XxKyCG.Y /u
'%WINDIR%\syswow64\cmd.exe' /S /D /c" echo Y"
'%WINDIR%\syswow64\cacls.exe' "oneetx.exe" /P "user:N"
'%WINDIR%\syswow64\cacls.exe' "oneetx.exe" /P "user:R" /E
'<SYSTEM32>\cmd.exe' /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
'%WINDIR%\syswow64\cacls.exe' "..\207aa4515d" /P "user:N"
'%WINDIR%\syswow64\cacls.exe' "..\207aa4515d" /P "user:R" /E

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней