Tool.SSEncrypt.1

Техническая информация

Вредоносные функции:

Создает и запускает на исполнение:

'C:\tmp\del.exe' /pid=3332
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "C:\Documents and Settings\Default User\Templates\winword2.doc.RaR" "C:\Documents and Settings\Default User\Templates\winword2.doc"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%APPDATA%\Microsoft\Internet Explorer\brndlog.txt.RaR" "%APPDATA%\Microsoft\Internet Explorer\brndlog.txt"
'C:\tmp\Rar.exe'
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "C:\Documents and Settings\Default User\Templates\excel4.xls.RaR" "C:\Documents and Settings\Default User\Templates\excel4.xls"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "C:\Documents and Settings\Default User\Templates\powerpnt.ppt.RaR" "C:\Documents and Settings\Default User\Templates\powerpnt.ppt"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "C:\Documents and Settings\Default User\Templates\winword.doc.RaR" "C:\Documents and Settings\Default User\Templates\winword.doc"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "<LS_APPDATA>\Microsoft\Windows Media\9.0\WMSDKNS.XML.RaR" "<LS_APPDATA>\Microsoft\Windows Media\9.0\WMSDKNS.XML"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "C:\Far2\Addons\README.TXT.RaR" "C:\Far2\Addons\README.TXT"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "C:\Far2\Documentation\eng\Arc.Support.txt.RaR" "C:\Far2\Documentation\eng\Arc.Support.txt"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "C:\Far2\Documentation\eng\Bug.Report.txt.RaR" "C:\Far2\Documentation\eng\Bug.Report.txt"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%HOMEPATH%\Templates\winword.doc.RaR" "%HOMEPATH%\Templates\winword.doc"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%HOMEPATH%\Templates\excel.xls.RaR" "%HOMEPATH%\Templates\excel.xls"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%HOMEPATH%\Templates\excel4.xls.RaR" "%HOMEPATH%\Templates\excel4.xls"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%HOMEPATH%\Templates\powerpnt.ppt.RaR" "%HOMEPATH%\Templates\powerpnt.ppt"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "C:\Documents and Settings\Default User\Templates\excel.xls.RaR" "C:\Documents and Settings\Default User\Templates\excel.xls"
'C:\tmp\ss.exe'
'C:\tmp\moar.exe'
'C:\tmp\ssencrypt.exe' public.key kii.hiew
'C:\tmp\mouse.exe'
'C:\tmp\push.exe'
'C:\tmp\error.exe'
'C:\tmp\bbs.exe'
'C:\tmp\fidonet.exe'
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Winter.jpg.RaR" "%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Winter.jpg"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\brndlog.txt.RaR" "C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\brndlog.txt"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\WMSDKNS.XML.RaR" "C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\WMSDKNS.XML"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Water lilies.jpg.RaR" "%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Water lilies.jpg"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Blue hills.jpg.RaR" "%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Blue hills.jpg"
'C:\tmp\del.exe'
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Sunset.jpg.RaR" "%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Sunset.jpg"

Запускает на исполнение:

'<SYSTEM32>\cmd.exe' /c del.bat
'<SYSTEM32>\cmd.exe' /c rename.bat
'<SYSTEM32>\cmd.exe' /c rocket.bat

Внедряет код в

следующие системные процессы:

<SYSTEM32>\cmd.exe

Изменения в файловой системе:

Создает следующие файлы:

C:\Documents and Settings\Default User\Templates\_Фaйлы зaшифpoванны.Txt
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\_4pass_%USERNAME%.pwd
%APPDATA%\Microsoft\Internet Explorer\_Фaйлы зaшифpoванны.Txt
C:\Documents and Settings\Default User\Templates\_4pass_%USERNAME%.pwd
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\_Фaйлы зaшифpoванны.Txt
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\_4pass_%USERNAME%.pwd
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\_4pass_.pwd
C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\_4pass_%USERNAME%.pwd
C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\_Фaйлы зaшифpoванны.Txt
C:\Far2\Addons\_4pass_%USERNAME%.pwd
C:\Far2\Addons\_Фaйлы зaшифpoванны.Txt
C:\Far2\Documentation\eng\_4pass_%USERNAME%.pwd
C:\Far2\Documentation\eng\_Фaйлы зaшифpoванны.Txt
%HOMEPATH%\Templates\_4pass_%USERNAME%.pwd
<LS_APPDATA>\Microsoft\Windows Media\9.0\_Фaйлы зaшифpoванны.Txt
%APPDATA%\Microsoft\Internet Explorer\_4pass_%USERNAME%.pwd
%HOMEPATH%\Templates\_Фaйлы зaшифpoванны.Txt
<LS_APPDATA>\Microsoft\Windows Media\9.0\_4pass_%USERNAME%.pwd
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\_Фaйлы зaшифpoванны.Txt
C:\tmp\mouse.exe
C:\tmp\moar.exe
C:\tmp\push.exe
C:\tmp\public.key
C:\tmp\fidonet.exe
C:\tmp\del.bat
C:\tmp\bbs.exe
C:\tmp\error.exe
C:\tmp\del.exe
C:\tmp\kii.hiew
C:\tmp\names.hiew
C:\wintmp\29195
C:\tmp\29195
C:\tmp\ssencrypt.exe
C:\tmp\rename.bat
C:\tmp\Rar.exe
C:\tmp\ss.exe
C:\tmp\rocket.bat