Техническая информация
Вредоносные функции:
Создает и запускает на исполнение:
- %PROGRAM_FILES%\mircaLemi\MircALemi 6.35\mIRC.exe
Запускает на исполнение:
- %WINDIR%\msagent\agentsvr.exe -Embedding
Изменения в файловой системе:
Создает следующие файлы:
- %PROGRAM_FILES%\mircaLemi\MircALemi 6.35\Sohbet.url
- %PROGRAM_FILES%\mircaLemi\MircALemi 6.35\sys\1.mrc
- %PROGRAM_FILES%\mircaLemi\MircALemi 6.35\sifre.txt
- %PROGRAM_FILES%\mircaLemi\MircALemi 6.35\popups.ini
- %PROGRAM_FILES%\mircaLemi\MircALemi 6.35\servers.ini
- %PROGRAM_FILES%\mircaLemi\MircALemi 6.35\sys\1.ttf
- %PROGRAM_FILES%\mircaLemi\MircALemi 6.35\sys\2.txt
- %PROGRAM_FILES%\mircaLemi\MircALemi 6.35\sys\3.ttf
- %PROGRAM_FILES%\mircaLemi\MircALemi 6.35\sys\2.ttf
- %PROGRAM_FILES%\mircaLemi\MircALemi 6.35\sys\10.ttf
- %PROGRAM_FILES%\mircaLemi\MircALemi 6.35\sys\2.mrc
- %PROGRAM_FILES%\mircaLemi\MircALemi 6.35\Playlist.txt
- %PROGRAM_FILES%\mircaLemi\MircALemi 6.35\notify\icons\offline.ico
- %PROGRAM_FILES%\mircaLemi\MircALemi 6.35\notify\icons\online.ico
- %PROGRAM_FILES%\mircaLemi\MircALemi 6.35\notify\icons\Notify.ico
- %PROGRAM_FILES%\mircaLemi\MircALemi 6.35\notify\icons\MSN.icl
- %PROGRAM_FILES%\mircaLemi\MircALemi 6.35\notify\icons\msn.ico
- %PROGRAM_FILES%\mircaLemi\MircALemi 6.35\notify\icons\Query.ico
- %PROGRAM_FILES%\mircaLemi\MircALemi 6.35\notify\SETTINGS.INI
- %PROGRAM_FILES%\mircaLemi\MircALemi 6.35\notify\sounds\online.wav
- %PROGRAM_FILES%\mircaLemi\MircALemi 6.35\notify\notify.mrc
- %PROGRAM_FILES%\mircaLemi\MircALemi 6.35\notify\icons\refresh.ico
- %PROGRAM_FILES%\mircaLemi\MircALemi 6.35\notify\icons\whois.ICO
- %PROGRAM_FILES%\mircaLemi\MircALemi 6.35\sys\4.ttf
- %PROGRAM_FILES%\mircaLemi\MircALemi 6.35\sys\script3.ttf
- %PROGRAM_FILES%\mircaLemi\MircALemi 6.35\sys\veriables.ttf
- %PROGRAM_FILES%\mircaLemi\MircALemi 6.35\sys\script1.txt
- %PROGRAM_FILES%\mircaLemi\MircALemi 6.35\sys\POPQ.TTF
- %PROGRAM_FILES%\mircaLemi\MircALemi 6.35\sys\POPS.TTF
- %PROGRAM_FILES%\mircaLemi\MircALemi 6.35\sys\x1.ttf
- %HOMEPATH%\Desktop\MircALemi 6.35.lnk
- %PROGRAM_FILES%\mircaLemi\MircALemi 6.35\Uninstall.ini
- %PROGRAM_FILES%\mircaLemi\MircALemi 6.35\Uninstall.exe
- %PROGRAM_FILES%\mircaLemi\MircALemi 6.35\Turkish.lng
- %PROGRAM_FILES%\mircaLemi\MircALemi 6.35\urls.ini
- %PROGRAM_FILES%\mircaLemi\MircALemi 6.35\sys\POPN.TTF
- %PROGRAM_FILES%\mircaLemi\MircALemi 6.35\sys\7.ttf
- %PROGRAM_FILES%\mircaLemi\MircALemi 6.35\sys\8.ttf
- %PROGRAM_FILES%\mircaLemi\MircALemi 6.35\sys\6.ttf
- %PROGRAM_FILES%\mircaLemi\MircALemi 6.35\sys\4.txt
- %PROGRAM_FILES%\mircaLemi\MircALemi 6.35\sys\5.ttf
- %PROGRAM_FILES%\mircaLemi\MircALemi 6.35\sys\9.ttf
- %PROGRAM_FILES%\mircaLemi\MircALemi 6.35\sys\POPC.TTF
- %PROGRAM_FILES%\mircaLemi\MircALemi 6.35\sys\POPM.TTF
- %PROGRAM_FILES%\mircaLemi\MircALemi 6.35\sys\ping.txt
- %PROGRAM_FILES%\mircaLemi\MircALemi 6.35\sys\mp3.ini
- %PROGRAM_FILES%\mircaLemi\MircALemi 6.35\sys\optnx.ini
- %PROGRAM_FILES%\mircaLemi\MircALemi 6.35\Help.html
- %PROGRAM_FILES%\mircaLemi\MircALemi 6.35\img\2.ico
- %PROGRAM_FILES%\mircaLemi\MircALemi 6.35\dlls\views.mdx
- %PROGRAM_FILES%\mircaLemi\MircALemi 6.35\dlls\out_wave.dll
- %PROGRAM_FILES%\mircaLemi\MircALemi 6.35\dlls\RebaR.dll
- %PROGRAM_FILES%\mircaLemi\MircALemi 6.35\img\Sohbet.ico
- %PROGRAM_FILES%\mircaLemi\MircALemi 6.35\img\team\galatasaray.jpg
- %PROGRAM_FILES%\mircaLemi\MircALemi 6.35\img\team\mirc.jpg
- %PROGRAM_FILES%\mircaLemi\MircALemi 6.35\img\team\fenerbahce.jpg
- %PROGRAM_FILES%\mircaLemi\MircALemi 6.35\img\team\ask.jpg
- %PROGRAM_FILES%\mircaLemi\MircALemi 6.35\img\team\besiktas.jpg
- %PROGRAM_FILES%\mircaLemi\MircALemi 6.35\dlls\mOTFv3.dll
- %PROGRAM_FILES%\mircaLemi\MircALemi 6.35\aliases1.ini
- %PROGRAM_FILES%\mircaLemi\MircALemi 6.35\channels\channels.txt
- %PROGRAM_FILES%\mircaLemi\MircALemi 6.35\aliases.ini
- %TEMP%\$inst\2.tmp
- %TEMP%\$inst\temp_0.tmp
- %PROGRAM_FILES%\mircaLemi\MircALemi 6.35\control.ini
- %PROGRAM_FILES%\mircaLemi\MircALemi 6.35\dlls\in_mp3.dll
- %PROGRAM_FILES%\mircaLemi\MircALemi 6.35\dlls\mdx.dll
- %PROGRAM_FILES%\mircaLemi\MircALemi 6.35\dlls\hdock.dll
- %PROGRAM_FILES%\mircaLemi\MircALemi 6.35\dlls\amp_in.dll
- %PROGRAM_FILES%\mircaLemi\MircALemi 6.35\dlls\bars.mdx
- %PROGRAM_FILES%\mircaLemi\MircALemi 6.35\img\team\MircALemi.jpg
- %PROGRAM_FILES%\mircaLemi\MircALemi 6.35\notify\dll\dialog.mdx
- %PROGRAM_FILES%\mircaLemi\MircALemi 6.35\notify\dll\mdx.dll
- %PROGRAM_FILES%\mircaLemi\MircALemi 6.35\nHTMLn_2.95.dll
- %PROGRAM_FILES%\mircaLemi\MircALemi 6.35\mirc.ini
- %PROGRAM_FILES%\mircaLemi\MircALemi 6.35\mircalem.dll
- %PROGRAM_FILES%\mircaLemi\MircALemi 6.35\notify\dll\POPUPS.DLL
- %PROGRAM_FILES%\mircaLemi\MircALemi 6.35\notify\icons\chat.ICO
- %PROGRAM_FILES%\mircaLemi\MircALemi 6.35\notify\icons\del.ICO
- %PROGRAM_FILES%\mircaLemi\MircALemi 6.35\notify\icons\add.ICO
- %PROGRAM_FILES%\mircaLemi\MircALemi 6.35\notify\dll\VIEWS.MDX
- %PROGRAM_FILES%\mircaLemi\MircALemi 6.35\notify\icons\about.ico
- %PROGRAM_FILES%\mircaLemi\MircALemi 6.35\mIRC.exe
- %PROGRAM_FILES%\mircaLemi\MircALemi 6.35\img\team\sex kopyala.jpg
- %PROGRAM_FILES%\mircaLemi\MircALemi 6.35\img\team\sex.jpg
- %PROGRAM_FILES%\mircaLemi\MircALemi 6.35\img\team\radyo.jpg
- %PROGRAM_FILES%\mircaLemi\MircALemi 6.35\img\team\mircalemi2.jpg
- %PROGRAM_FILES%\mircaLemi\MircALemi 6.35\img\team\oyun.jpg
- %PROGRAM_FILES%\mircaLemi\MircALemi 6.35\img\team\seydican.jpg
- %PROGRAM_FILES%\mircaLemi\MircALemi 6.35\img\team\Thumbs.db
- %PROGRAM_FILES%\mircaLemi\MircALemi 6.35\img\team\yardim.jpg
- %PROGRAM_FILES%\mircaLemi\MircALemi 6.35\img\team\TeqMeN.jpg
- %PROGRAM_FILES%\mircaLemi\MircALemi 6.35\img\team\Skills.jpg
- %PROGRAM_FILES%\mircaLemi\MircALemi 6.35\img\team\Skills[1].jpg
Присваивает атрибут 'скрытый' для следующих файлов:
- %PROGRAM_FILES%\mircaLemi\MircALemi 6.35\img\team\Thumbs.db
Удаляет следующие файлы:
- %TEMP%\$inst\2.tmp
- %TEMP%\$inst\temp_0.tmp
Сетевая активность:
Подключается к:
- 'www.mi##.com':80
TCP:
Запросы HTTP GET:
- www.mi##.com/update.html
UDP:
- DNS ASK www.mi##.com
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
