Техническая информация
Вредоносные функции:
Запускает на исполнение:
- <SYSTEM32>\cmd.exe /c %TEMP%\1.bat
Изменения в файловой системе:
Создает следующие файлы:
- %PROGRAM_FILES%\altcmd\uninstall.bat
- %TEMP%\1.bat
- %PROGRAM_FILES%\altcmd\altcmd32.dll
- %PROGRAM_FILES%\altcmd\altcmd.inf
Самоперемещается:
- из <Полный путь к вирусу> в <SYSTEM32>\<Имя вируса>.exe
Другое:
Ищет следующие окна:
- ClassName: 'sjrnykbvdsppwyk' WindowName: 'sczxhxyve'
- ClassName: 'vhkjvinbzpgxd' WindowName: 'wuowclaixlid'
- ClassName: 'ryyswdyemoqumb' WindowName: 'qdmj'
- ClassName: 'lvnadukczd' WindowName: 'nsuxbakkkmyp'
- ClassName: 'oukfeivj' WindowName: 'uimxachnogrjvz'
- ClassName: '' WindowName: 'yhiqhgrweb'
- ClassName: 'vxtbbjx' WindowName: 'rpbgjgkdyebtz'
- ClassName: 'g' WindowName: 'w'
- ClassName: 'lpdftbtjjyvl' WindowName: 'wra'
- ClassName: 'qglcfqof' WindowName: 'wrwi'
- ClassName: 'qwoqyouuheek' WindowName: 'yklpszioh'
- ClassName: 'cmyap' WindowName: 'dwjwxshvcjzaiii'
- ClassName: 'jooiaqjawckfmo' WindowName: 'tfqugz'
- ClassName: 'zoqeapaustkmif' WindowName: ''
- ClassName: 'xexzu' WindowName: 'ibkeehhfnwdiz'
- ClassName: 'jazxianxwi' WindowName: 'xcwwxykft'
- ClassName: 'gwhnikhr' WindowName: 'ecutkpjr'
- ClassName: 'qvrislxfaed' WindowName: ''
- ClassName: '' WindowName: 'qugavenb'
- ClassName: 'ysbk' WindowName: 'qktjzjewuu'
- ClassName: 'n' WindowName: 'mzse'
- ClassName: 'hgkxzmm' WindowName: ''
- ClassName: 'lqujfz' WindowName: 'gckdmp'
- ClassName: 'uumv' WindowName: 'xifzqjaiz'
- ClassName: 'aumxoof' WindowName: 'spkql'
- ClassName: 'lgtdnyvw' WindowName: 'aeilhiclxeiz'
- ClassName: 'xpf' WindowName: 'sttdausnlgbsome'
- ClassName: '' WindowName: 'rlphdivcyj'
- ClassName: 'au' WindowName: 'awwowh'
- ClassName: 'ltq' WindowName: 'wk'
- ClassName: 'hyzjav' WindowName: 'yieepyaux'
- ClassName: 'hm' WindowName: 'tesfbmqrcmnata'
- ClassName: '' WindowName: 'igc'
- ClassName: 'lvtlqdvvz' WindowName: 'dgvmuzme'
- ClassName: 'lbozbpkmbbr' WindowName: 'pktakktyl'
- ClassName: 'mfzgsvdltenggj' WindowName: 'djmi'
- ClassName: 'cwkexamkdurzbn' WindowName: 'pgczltxtnyiq'
- ClassName: 'lbyj' WindowName: 'hilbykle'
- ClassName: 'ky' WindowName: 'wmmwrdpxdk'
- ClassName: 'mjgveyjiscx' WindowName: 'gkppcbkhstz'
- ClassName: '' WindowName: 'vhlx'
- ClassName: 'yiggnnoxlx' WindowName: 'rnd'
- ClassName: 'unewllexnp' WindowName: 'ja'
- ClassName: 'hzkongahyjv' WindowName: 'dmhisak'
- ClassName: 'almkgitxqm' WindowName: 'drjvd'
- ClassName: '' WindowName: 'tmqvawroltgkwu'
- ClassName: '' WindowName: ''
- ClassName: 'icmclxzbdlwic' WindowName: 'ljqx'
- ClassName: 'q' WindowName: 'vuqaa'
- ClassName: 'vxrmhkjecf' WindowName: 'zoeqbevwklbtnbh'
- ClassName: 'pk' WindowName: 'hiapjnkhydqscwu'
- ClassName: 'yebmpxzsio' WindowName: 'gvttogo'
- ClassName: 'duydejohq' WindowName: ''
- ClassName: 'ggninqirn' WindowName: 'aisrwfo'
- ClassName: '' WindowName: 'wu'
- ClassName: 'wngtr' WindowName: 'kwbkhsnootak'
- ClassName: 'vyrwqnehwqrpi' WindowName: 'nd'
- ClassName: 'ijybgvgohuql' WindowName: 'tibdpgddxgrarsm'
- ClassName: 'bikvru' WindowName: 'l'
- ClassName: 'ycrbnignljaq' WindowName: 'dcrsgmcobsyrg'
- ClassName: 'xfarazoz' WindowName: 'ypndjdmweywqg'
- ClassName: 'khjbmqirlbsau' WindowName: ''
- ClassName: 'gfcezret' WindowName: 'vtak'
- ClassName: 'nctkzuxcipj' WindowName: 'fxg'
- ClassName: '' WindowName: 'mgqxrbyxlnvnhgc'
- ClassName: '' WindowName: 'jktexhv'
- ClassName: 'bpashaeo' WindowName: ''
- ClassName: 'oagzmzputfzdric' WindowName: 'ialxzu'
- ClassName: 'hjhxftbui' WindowName: 'aet'
- ClassName: 'bnvhnavigaus' WindowName: 'gwsztsldufk'
- ClassName: 'pfirbcdtteyg' WindowName: 'zwvmshgmyefcnf'
- ClassName: 'tl' WindowName: 'rvxntply'
- ClassName: 'rlvoqs' WindowName: 'nyyqhkpquscp'
- ClassName: 'ngysdpgb' WindowName: 'fhbzybklqva'
- ClassName: 'oiyuryxhrchppt' WindowName: 'eqkoecupuaczzi'
- ClassName: 'ih' WindowName: 'jzhlmusttjgi'
- ClassName: 'evkfahlgqnru' WindowName: 'maiubxly'
- ClassName: 'oiepaj' WindowName: ''
- ClassName: 'lohotfdmizfg' WindowName: 'lfy'
- ClassName: 'ifkbjdnlvbzol' WindowName: 'dmreukuth'
- ClassName: 'jveucuccoji' WindowName: ''
- ClassName: 'fnqm' WindowName: 'ypgycwmgt'
- ClassName: '' WindowName: 'fkug'
- ClassName: 'l' WindowName: 'kpaxauvyya'
- ClassName: 'smeopwnve' WindowName: 'oyyxlcsh'
- ClassName: 'jbpish' WindowName: 'ritppneclnbn'
- ClassName: 'kxesa' WindowName: 'corchyedavorvz'
- ClassName: 'qxgwslsu' WindowName: 'eg'
- ClassName: 'igzyvxwuey' WindowName: 'zgnsfhpcqrqwqe'
- ClassName: 'qwcrdtaxlfeq' WindowName: 'tomkrxgfifcbj'
- ClassName: '' WindowName: 'kdtqzsja'
- ClassName: 'xikegjv' WindowName: 'npp'
- ClassName: '' WindowName: 'ksjbpe'
- ClassName: 'netqxwvnq' WindowName: 'vjxgeck'
- ClassName: 'dwexmpoqiy' WindowName: 'jfwocwylomictm'
- ClassName: 'kjbcnq' WindowName: 'sndsazl'
