Trojan.AVKill.25112

Technical Information

To ensure autorun and distribution:

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\winmgmt] 'Start' = '00000002'

Malicious functions:

Executes the following:

<SYSTEM32>\attrib.exe <SYSTEM32>\SicentLdrPkt_110331.exe +s +h +r
<SYSTEM32>\attrib.exe <SYSTEM32>\GHome_110330.exe +s +h +r
<SYSTEM32>\attrib.exe %WINDIR%\sicentldrbho\WXBHO.dll +s +h +r
<SYSTEM32>\attrib.exe %WINDIR%\IEHelp\IEHelpBHO.dll +s +h +r
<SYSTEM32>\cacls.exe <SYSTEM32>\HttpRequest.exe /p everyone:n
<SYSTEM32>\cacls.exe <SYSTEM32>\Pack.exe /p everyone:n
<SYSTEM32>\cacls.exe <SYSTEM32>\wxplus_08.wxe /p everyone:n
<SYSTEM32>\cacls.exe <SYSTEM32>\wxplus_09.wxe /p everyone:n
<SYSTEM32>\attrib.exe <SYSTEM32>\Ghome.exe +s +h +r
<SYSTEM32>\attrib.exe <SYSTEM32>\IsPush.exe +s +h +r
<SYSTEM32>\attrib.exe <SYSTEM32>\TtlGmRCnt.exe +s +h +r
<SYSTEM32>\attrib.exe <SYSTEM32>\ieextend.dll +s +h +r
<SYSTEM32>\attrib.exe <SYSTEM32>\bbns.dll +s +h +r
<SYSTEM32>\attrib.exe %WINDIR%\system\sch.exe +s +h +r
<SYSTEM32>\attrib.exe %WINDIR%\icrsicent\icafebrige.exe +s +h +r
<SYSTEM32>\attrib.exe <SYSTEM32>\CallIE.exe +s +h +r
<SYSTEM32>\attrib.exe <SYSTEM32>\wxcltim.exe +s +h +r
<SYSTEM32>\cacls.exe %WINDIR%\sicentldrbho\WXBHO.dll /p everyone:n
<SYSTEM32>\cacls.exe %WINDIR%\IEHelp\IEHelpBHO.dll /p everyone:n
<SYSTEM32>\cacls.exe %WINDIR%\icrsicent\icafebrige.exe /p everyone:n
<SYSTEM32>\cacls.exe <SYSTEM32>\Ghome.exe /p everyone:n
<SYSTEM32>\sc.exe stop winmgmt
<SYSTEM32>\sc.exe config winmgmt start= disabled
<SYSTEM32>\cacls.exe <SYSTEM32>\SicentLdrPkt_110331.exe /p everyone:n
<SYSTEM32>\cacls.exe <SYSTEM32>\GHome_110330.exe /p everyone:n
<SYSTEM32>\cacls.exe %WINDIR%\system\sch.exe /p everyone:n
<SYSTEM32>\cacls.exe <SYSTEM32>\ieextend.dll /p everyone:n
<SYSTEM32>\cacls.exe <SYSTEM32>\bbns.dll /p everyone:n
<SYSTEM32>\cacls.exe <SYSTEM32>\ExecIEInfo.exe /p everyone:n
<SYSTEM32>\cacls.exe <SYSTEM32>\wxprolife.wxe /p everyone:n
<SYSTEM32>\cacls.exe <SYSTEM32>\CallIE.exe /p everyone:n
<SYSTEM32>\cacls.exe <SYSTEM32>\wxcltim.exe /p everyone:n
<SYSTEM32>\cacls.exe <SYSTEM32>\IsPush.exe /p everyone:n
<SYSTEM32>\cacls.exe <SYSTEM32>\TtlGmRCnt.exe /p everyone:n
<SYSTEM32>\attrib.exe <SYSTEM32>\wxprolife.wxe +s +h +r
<SYSTEM32>\taskkill.exe /f /im wxprolife.wxe
<SYSTEM32>\taskkill.exe /f /im IsPush.exe
<SYSTEM32>\taskkill.exe /f /im Pack.exe
<SYSTEM32>\taskkill.exe /f /im ExecIEInfo.exe
<SYSTEM32>\taskkill.exe /f /im CallIE.exe
<SYSTEM32>\taskkill.exe /f /im sch.exe
<SYSTEM32>\taskkill.exe /f /im TtlGmRCnt.exe
<SYSTEM32>\taskkill.exe /f /im IEXPLORE.exe
<SYSTEM32>\taskkill.exe /f /im HttpRequest.exe
<SYSTEM32>\sc.exe config winmgmt start= auto
<SYSTEM32>\sc.exe start winmgmt
<SYSTEM32>\svchost.exe
<SYSTEM32>\ping.exe 127.0.0.1 -n 5
<SYSTEM32>\taskkill.exe /f /im wxplus_08.wxe
<SYSTEM32>\taskkill.exe /f /im wxplus_09.wxe
<SYSTEM32>\taskkill.exe /f /im sohubho.exe
<SYSTEM32>\taskkill.exe /f /im WindowsPatch.exe
<SYSTEM32>\regsvr32.exe /u /s %WINDIR%\IEHelp\IEHelpBHO.dll
<SYSTEM32>\attrib.exe <SYSTEM32>\wxplus_08.wxe +s +h +r
<SYSTEM32>\regsvr32.exe /u /s <SYSTEM32>\easybar.dll
<SYSTEM32>\regsvr32.exe /u /s %WINDIR%\sicentldrbho\WXBHO.dll
<SYSTEM32>\attrib.exe <SYSTEM32>\Pack.exe +s +h +r
<SYSTEM32>\attrib.exe <SYSTEM32>\ExecIEInfo.exe +s +h +r
<SYSTEM32>\attrib.exe <SYSTEM32>\wxplus_09.wxe +s +h +r
<SYSTEM32>\attrib.exe <SYSTEM32>\HttpRequest.exe +s +h +r
<SYSTEM32>\regsvr32.exe /u /s <SYSTEM32>\IEHELPER.dll
<SYSTEM32>\taskkill.exe /f /im Ghome.exe
<SYSTEM32>\taskkill.exe /f /im SicentLdrPkt_110331.exe
<SYSTEM32>\taskkill.exe /f /im wxcltim.exe
<SYSTEM32>\taskkill.exe /f /im icafebrige.exe
<SYSTEM32>\regsvr32.exe /u /s <SYSTEM32>\bbns.dll
<SYSTEM32>\regsvr32.exe /u /s <SYSTEM32>\so.dll
<SYSTEM32>\taskkill.exe /f /im GHome_110330.exe
<SYSTEM32>\regsvr32.exe /u /s <SYSTEM32>\IEExtend.dll

Terminates or attempts to terminate

the following user processes:

iexplore.exe

Modifies file system :

Creates the following files:

%TEMP%\2891.bat

Sets the 'hidden' attribute to the following files:

%TEMP%\2891.bat

Deletes the following files:

%TEMP%\2891.bat

Miscellaneous:

Searches for the following windows:

ClassName: '' WindowName: ''

Демо бесплатно на 14 дней

Выдаётся при установке

Скачать с сайта

Скачать с Google Play

Скачайте
Dr.Web для Android

Бесплатно на 3 месяца
Все компоненты защиты
Продление демо через
AppGallery/Google Pay

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней