Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'eSafeRegisterCert' = '%ProgramFiles%\eSafe\eSafeRegisterCert.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'eSafe_monitorIE' = '%ProgramFiles%\eSafe\eSafe_monitorIE.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\ScDeviceEnum] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\SCardSvr] 'Start' = '00000002'
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\scardsvr.exe'
- '%ProgramFiles%\eSafe\ServiceTool.exe' enable scardsvr
- '%ProgramFiles%\eSafe\ServiceTool.exe' start SCardSvr
- '<SYSTEM32>\sc.exe' start SCardSvr
- '<SYSTEM32>\cmd.exe' /c sc config scardsvr start= auto
- '<SYSTEM32>\sc.exe' config scardsvr start= auto
- '<SYSTEM32>\cmd.exe' /c sc start SCardSvr
Изменения в файловой системе:
Создает следующие файлы:
- %ProgramFiles%\eSafe\eSafeSC.sys
- %ProgramFiles%\eSafe\Install_Driver.exe
- %ProgramFiles%\eSafe\esafesc.cat
- %ProgramFiles%\eSafe\eSafeSc.inf
- %ProgramFiles%\eSafe\uninstall_driver.exe
- <SYSTEM32>\ESCCSP.dll
- <SYSTEM32>\esccsp.sig
- %ProgramFiles%\eSafe\ServiceTool.exe
- <SYSTEM32>\ESCCAPI.dll
- %ProgramFiles%\eSafe\Esafe.sys
- %ProgramFiles%\eSafe\CADer\TLCA.cer
- %ProgramFiles%\eSafe\CADer\XJCA.cer
- %ProgramFiles%\eSafe\CADer\SXCA.cer
- %ProgramFiles%\eSafe\CADer\TJCA.cer
- %ProgramFiles%\eSafe\CADer\XZCA.cer
- %ProgramFiles%\eSafe\esafe.cat
- %ProgramFiles%\eSafe\Esafe.inf
- %ProgramFiles%\eSafe\CADer\YNCA.cer
- %ProgramFiles%\eSafe\CADer\ZJCA.cer
- <SYSTEM32>\ESCPKCS11.dll
- <SYSTEM32>\simpleExt.dll
- <SYSTEM32>\eSafe_E_Folder.ICO
- <SYSTEM32>\ReadCardName.dll
- <SYSTEM32>\RelateApp.rac
- <SYSTEM32>\ga.ico
- %HOMEPATH%\Desktop\eSafeУГ»§№¤ѕЯ.lnk
- %ProgramFiles%\eSafe\uninst.exe
- %HOMEPATH%\Start Menu\Programs\ЦЗДЬФїіЧ№ЬАнЖЅМЁ\eSafeУГ»§№¤ѕЯ.lnk
- %HOMEPATH%\Start Menu\Programs\ЦЗДЬФїіЧ№ЬАнЖЅМЁ\Р¶ФШУГ»§ФЛРР»·ѕі.lnk
- <SYSTEM32>\PolicKey.ini
- <SYSTEM32>\eSafeDisCon.edc
- <SYSTEM32>\eSafeEncrypt.exe
- <SYSTEM32>\eSafeC.dll
- <SYSTEM32>\eSafeCF.exe
- <SYSTEM32>\eSUI.dll
- <SYSTEM32>\JIT_USBKey.dll
- <SYSTEM32>\PesUnit.lvl
- <SYSTEM32>\GAKeyDMWZeSafeC.dll
- <SYSTEM32>\GAKeyPub.dll
- %ProgramFiles%\eSafe\CADer\BJCA.cer
- %ProgramFiles%\eSafe\CADer\BTCA.cer
- %ProgramFiles%\eSafe\Service.exe
- %ProgramFiles%\eSafe\CADer\AHCA.cer
- %ProgramFiles%\eSafe\CADer\CQCA.cer
- %ProgramFiles%\eSafe\CADer\FJCA.cer
- %ProgramFiles%\eSafe\CADer\GDCA.cer
- %ProgramFiles%\eSafe\CADer\EBCA.cer
- %ProgramFiles%\eSafe\CADer\ENCA.cer
- %ProgramFiles%\eSafe\eSafe_monitorIE.exe
- %ProgramFiles%\eSafe\eSafins.dll
- %ProgramFiles%\eSafe\DrvVerifier.dll
- %TEMP%\nso2.tmp
- %TEMP%\nsp3.tmp\System.dll
- %ProgramFiles%\eSafe\eSafeУГ»§КЦІб.pdf
- %ProgramFiles%\eSafe\eSafeStoreInit.exe
- %ProgramFiles%\eSafe\eSafeRegisterCert.exe
- %ProgramFiles%\eSafe\eSImRoot.exe
- %ProgramFiles%\eSafe\eSafeУГ»§№¤ѕЯ.exe
- %ProgramFiles%\eSafe\CADer\GSCA.cer
- %ProgramFiles%\eSafe\CADer\NXCA.cer
- %ProgramFiles%\eSafe\CADer\QHCA.cer
- %ProgramFiles%\eSafe\CADer\LNCA.cer
- %ProgramFiles%\eSafe\CADer\NMCA.cer
- %ProgramFiles%\eSafe\CADer\RootCA.cer
- %ProgramFiles%\eSafe\CADer\SHCA.cer
- %ProgramFiles%\eSafe\CADer\SNCA.cer
- %ProgramFiles%\eSafe\CADer\SCCA.cer
- %ProgramFiles%\eSafe\CADer\SDCA.cer
- %ProgramFiles%\eSafe\CADer\JXCA.cer
- %ProgramFiles%\eSafe\CADer\HBCA.cer
- %ProgramFiles%\eSafe\CADer\HLCA.cer
- %ProgramFiles%\eSafe\CADer\GXCA.cer
- %ProgramFiles%\eSafe\CADer\GZCA.cer
- %ProgramFiles%\eSafe\CADer\HNCA.cer
- %ProgramFiles%\eSafe\CADer\JLCA.cer
- %ProgramFiles%\eSafe\CADer\JSCA.cer
- %ProgramFiles%\eSafe\CADer\HuNCA.cer
- %ProgramFiles%\eSafe\CADer\JGCA.cer
