Техническая информация
Вредоносные функции:
Создает и запускает на исполнение:
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager2.exe' /pid=5680
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager3.exe' /pid=5656
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager1.exe' /pid=5648
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager1.exe' /pid=5696
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager.exe' /pid=5744
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager.exe' /pid=5728
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager1.exe' /pid=5712
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager1.exe' /pid=5528
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager1.exe' /pid=5512
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager3.exe' /pid=2328
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager1.exe' /pid=5544
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager1.exe' /pid=5632
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager1.exe' /pid=5616
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager1.exe' /pid=5560
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager.exe' /pid=5912
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager2.exe' /pid=5900
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager.exe' /pid=5888
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager3.exe' /pid=5928
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager1.exe' /pid=6048
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager3.exe' /pid=5960
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager1.exe' /pid=5944
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager1.exe' /pid=5784
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager3.exe' /pid=5768
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager.exe' /pid=5752
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager2.exe' /pid=5800
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager2.exe' /pid=5872
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager.exe' /pid=5856
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager1.exe' /pid=5816
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager1.exe' /pid=4008
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager2.exe' /pid=3144
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager2.exe' /pid=3112
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager.exe' /pid=3056
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager3.exe' /pid=3320
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager.exe' /pid=3256
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager.exe' /pid=3200
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager2.exe'
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager1.exe'
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager.exe'
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager2.exe' /pid=2996
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager.exe' /pid=2936
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager3.exe'
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager1.exe' /pid=3780
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager2.exe' /pid=3752
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager3.exe' /pid=3696
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager.exe' /pid=3940
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager3.exe' /pid=3884
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager2.exe' /pid=3840
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager.exe' /pid=3376
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager3.exe' /pid=3488
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager2.exe' /pid=3432
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager.exe' /pid=3520
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager2.exe' /pid=3632
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager2.exe' /pid=3576
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager2.exe' (загружен из сети Интернет)
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager.exe' (загружен из сети Интернет)
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager3.exe' (загружен из сети Интернет)
- 'C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager1.exe' (загружен из сети Интернет)
Изменения в файловой системе:
Создает следующие файлы:
- C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager2.exe
- C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager3.exe
- C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager.exe
- C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antidevicemanager1.exe
Сетевая активность:
Подключается к:
- 'ki#####303.bplaced.net':80
- 'wp#d':80
TCP:
Запросы HTTP GET:
- ki#####303.bplaced.net/Servi/kazy.exe
- ki#####303.bplaced.net/Servi/razorcrypter1.1.3.exe
- ki#####303.bplaced.net/Servi/grievecrypter.exe
- wp#d/wpad.dat
- ki#####303.bplaced.net/Servi/Razorcrypter1.6.1.exe
UDP:
- DNS ASK ki#####303.bplaced.net
- DNS ASK wp#d
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
