Per il corretto funzionamento del sito, è necessario attivare il supporto di JavaScript nel browser.
Win32.HLLW.Autoruner2.28794
Aggiunto al database dei virus Dr.Web:
2017-07-24
La descrizione è stata aggiunta:
2017-07-24
Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
%WINDIR%\Tasks\UpdateService.job
Malicious functions:
Executes the following:
'<SYSTEM32>\schtasks.exe' /Run /TN "UpdateService"
'%ALLUSERSPROFILE%\Application Data\UpdateService\UpdateService.exe' -t
'%ALLUSERSPROFILE%\Application Data\UpdateService\UpdateService.exe'
'<SYSTEM32>\schtasks.exe' /Create /RU SYSTEM /SC ONSTART /TN "UpdateService" /TR "\"%ALLUSERSPROFILE%\Application Data\UpdateService\UpdateService.exe\" -t"
'%TEMP%\tmp19161\setup.exe' -i "<Full path to file>"
'%ALLUSERSPROFILE%\Application Data\UpdateService\UpdateService.exe' -r "%TEMP%\tmp19161\setup.exe"
'<SYSTEM32>\schtasks.exe' /Delete /TN "UpdateService" /F
Modifies file system:
Creates the following files:
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\UN6J834Z\desktop.ini
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\A7UP6XG9\desktop.ini
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\BUUDGX4E\desktop.ini
C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat
C:\Documents and Settings\NetworkService\Cookies\index.dat
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\S54RGZOL\desktop.ini
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\index.dat
%ALLUSERSPROFILE%\Application Data\UpdateService\UpdateService.exe
%TEMP%\tmp19161\setup.exe.config
%TEMP%\tmp19161\setup.exe
%ALLUSERSPROFILE%\Application Data\UpdateService\settings.dat
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\S-1-5-18\b559b644001c5046f43347e1242ad7d7_23ef5514-3059-436f-a4a7-4cefaab20eb1
%ALLUSERSPROFILE%\Application Data\UpdateService\UpdateService.exe.config
Sets the 'hidden' attribute to the following files:
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\UN6J834Z\desktop.ini
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\S54RGZOL\desktop.ini
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\BUUDGX4E\desktop.ini
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\A7UP6XG9\desktop.ini
Deletes the following files:
%TEMP%\tmp19161\setup.exe
Deletes itself.
Network activity:
Connects to:
'ua###.com.ua':80
'po###enie62.ru':80
'wp#d':80
'me####proxy.com.ua':80
TCP:
HTTP GET requests:
http://11#.#11.111.1/wpad.dat via wp#d
HTTP POST requests:
http://po###enie62.ru/wp-content/plugins/revslider/admin/assets/images/sources/info.php?ur###############
http://ua###.com.ua/sass/ie/style.php?ur###############
http://me####proxy.com.ua/wp-admin/wp-info.php?ur###############
UDP:
DNS ASK ua###.com.ua
DNS ASK po###enie62.ru
DNS ASK wp#d
DNS ASK me####proxy.com.ua
Miscellaneous:
Searches for the following windows:
ClassName: '' WindowName: '57bf1adeba3ddsd90cca40530636c6'
Scaricate Dr.Web per Android
Gratis per 3 mesi
Tutti i componenti di protezione
Rinnovo versione di prova tramite AppGallery/Google Pay
Continuando a utilizzare questo sito, l'utente acconsente al nostro utilizzo di file Cookie e di altre tecnologie per la raccolta di informazioni statistiche sui visitatori. Per maggiori informazioni
OK