Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe,'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\vwYgEQEb] 'ImagePath' = '%ALLUSERSPROFILE%\tuIMYcEM\ZgMYMIIE.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\vwYgEQEb] 'Start' = '00000002'
Заражает следующие исполняемые файлы:
- C:\Far2\Far.exe
Вредоносные функции:
Для затруднения выявления своего присутствия в системе
блокирует отображение:
- скрытых файлов
- расширений файлов
блокирует:
- Средство контроля пользовательских учетных записей (UAC)
Запускает на исполнение:
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
- '<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
- '<SYSTEM32>\cmd.exe' /c "<Текущая директория>\<Имя файла>"
- '%HOMEPATH%\gOEYMkgs\SSIkQYgQ.exe'
- '%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe'
- '%ALLUSERSPROFILE%\tuIMYcEM\ZgMYMIIE.exe'
Изменения в файловой системе:
Создает следующие файлы:
- %HOMEPATH%\gOEYMkgs\MQce.exe
- %HOMEPATH%\gOEYMkgs\eMoC.exe
- %HOMEPATH%\gOEYMkgs\TswS.exe
- %HOMEPATH%\gOEYMkgs\IwIO.exe
- %HOMEPATH%\gOEYMkgs\iEgy.exe
- %HOMEPATH%\gOEYMkgs\kMYU.exe
- %HOMEPATH%\gOEYMkgs\fYoo.exe
- %HOMEPATH%\gOEYMkgs\KcEm.exe
- %HOMEPATH%\gOEYMkgs\ccEO.exe
- %HOMEPATH%\gOEYMkgs\WosW.exe
- %HOMEPATH%\gOEYMkgs\BIgc.exe
- %HOMEPATH%\gOEYMkgs\zoEY.exe
- %HOMEPATH%\gOEYMkgs\fwAa.exe
- %HOMEPATH%\gOEYMkgs\gYkK.exe
- %HOMEPATH%\gOEYMkgs\wMow.exe
- %HOMEPATH%\gOEYMkgs\agom.exe
- %HOMEPATH%\gOEYMkgs\mkIk.exe
- %HOMEPATH%\gOEYMkgs\ZgEe.exe
- %HOMEPATH%\gOEYMkgs\xYIk.exe
- %TEMP%\WER5a25.dir00\appcompat.txt
- %HOMEPATH%\gOEYMkgs\hYQu.exe
- %HOMEPATH%\gOEYMkgs\ukYC.exe
- %TEMP%\WER5a25.dir00\manifest.txt
- %HOMEPATH%\gOEYMkgs\fEcK.exe
- %TEMP%\WER5a25.dir00\ZgMYMIIE.exe.mdmp
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Winter.jpg.exe
- %TEMP%\WER5a25.dir00\ZgMYMIIE.exe.hdmp
- %HOMEPATH%\gOEYMkgs\CUsI.exe
- %HOMEPATH%\gOEYMkgs\aoEk.exe
- %HOMEPATH%\gOEYMkgs\Fcci.exe
- %HOMEPATH%\gOEYMkgs\CMIK.exe
- %HOMEPATH%\gOEYMkgs\iEYc.exe
- %HOMEPATH%\gOEYMkgs\ZgAy.exe
- %HOMEPATH%\gOEYMkgs\jYEw.exe
- %HOMEPATH%\gOEYMkgs\LwEG.exe
- %HOMEPATH%\gOEYMkgs\dYca.exe
- %HOMEPATH%\gOEYMkgs\SYoS.exe
- %HOMEPATH%\gOEYMkgs\OAQi.exe
- %HOMEPATH%\gOEYMkgs\hMMg.exe
- %HOMEPATH%\gOEYMkgs\rIkO.exe
- %HOMEPATH%\gOEYMkgs\AMkU.exe
- %HOMEPATH%\gOEYMkgs\BIMO.exe
- %HOMEPATH%\gOEYMkgs\KcEq.exe
- %HOMEPATH%\gOEYMkgs\SggK.exe
- %HOMEPATH%\gOEYMkgs\RUcm.exe
- %HOMEPATH%\gOEYMkgs\WMYs.exe
- %HOMEPATH%\gOEYMkgs\RkQw.exe
- %HOMEPATH%\gOEYMkgs\VYcA.exe
- %HOMEPATH%\gOEYMkgs\mIYq.exe
- %HOMEPATH%\gOEYMkgs\JgYO.exe
- %TEMP%\WERd214.dir00\ZgMYMIIE.exe.mdmp
- %HOMEPATH%\gOEYMkgs\YUcm.exe
- %HOMEPATH%\gOEYMkgs\BwUQ.exe
- %HOMEPATH%\gOEYMkgs\YQkc.exe
- %HOMEPATH%\gOEYMkgs\TMAy.exe
- %HOMEPATH%\gOEYMkgs\rksa.exe
- %HOMEPATH%\gOEYMkgs\hAoc.exe
- %HOMEPATH%\gOEYMkgs\QgYu.exe
- %HOMEPATH%\gOEYMkgs\HkMM.exe
- %HOMEPATH%\gOEYMkgs\kccc.exe
- %HOMEPATH%\gOEYMkgs\vgoq.exe
- %HOMEPATH%\gOEYMkgs\QIEu.exe
- %HOMEPATH%\gOEYMkgs\Essc.exe
- %HOMEPATH%\gOEYMkgs\FIIC.exe
- %HOMEPATH%\gOEYMkgs\sEQq.exe
- %HOMEPATH%\gOEYMkgs\zUse.exe
- %HOMEPATH%\gOEYMkgs\zsgW.exe
- %HOMEPATH%\gOEYMkgs\SAkK.exe
- %HOMEPATH%\gOEYMkgs\JcAy.exe
- %HOMEPATH%\gOEYMkgs\nYQS.exe
- %HOMEPATH%\gOEYMkgs\lUUO.exe
- %HOMEPATH%\gOEYMkgs\Sskw.exe
- %HOMEPATH%\gOEYMkgs\XQwQ.exe
- %HOMEPATH%\gOEYMkgs\EkcU.exe
- %HOMEPATH%\gOEYMkgs\TocE.exe
- %HOMEPATH%\gOEYMkgs\ogEK.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp.exe
- %HOMEPATH%\gOEYMkgs\kgkC.exe
- <Текущая директория>\<Имя файла>
- %HOMEPATH%\gOEYMkgs\KIgM.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp.exe
- %HOMEPATH%\gOEYMkgs\KIgQ.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp.exe
- %HOMEPATH%\gOEYMkgs\Zkke.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp.exe
- %HOMEPATH%\gOEYMkgs\NMEE.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp.exe
- %HOMEPATH%\gOEYMkgs\IkwK.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp.exe
- %HOMEPATH%\gOEYMkgs\VgkC.exe
- %HOMEPATH%\gOEYMkgs\Gkgq.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp.exe
- %TEMP%\WERecd9.dir00\ZgMYMIIE.exe.mdmp
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp.exe
- %HOMEPATH%\gOEYMkgs\qEIq.exe
- %ALLUSERSPROFILE%\caQc.txt
- %TEMP%\WER7064.dir00\ZgMYMIIE.exe.mdmp
- %TEMP%\WER7064.dir00\appcompat.txt
- %TEMP%\WER7064.dir00\ZgMYMIIE.exe.hdmp
- %ALLUSERSPROFILE%\tuIMYcEM\ZgMYMIIE.exe
- %ALLUSERSPROFILE%\WuIEgAsU\lacMcYws
- %HOMEPATH%\gOEYMkgs\SSIkQYgQ
- %ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe
- %HOMEPATH%\gOEYMkgs\SSIkQYgQ.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp.exe
- %HOMEPATH%\gOEYMkgs\McIQ.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp.exe
- %HOMEPATH%\gOEYMkgs\MAkS.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp.exe
- %HOMEPATH%\gOEYMkgs\Eokw.exe
- %TEMP%\WER7064.dir00\manifest.txt
- %HOMEPATH%\gOEYMkgs\UEIA.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp.exe
- %TEMP%\WERecd9.dir00\ZgMYMIIE.exe.hdmp
- %HOMEPATH%\gOEYMkgs\wUkK.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\guest.bmp.exe
- %HOMEPATH%\gOEYMkgs\hoce.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\%USERNAME%.bmp.exe
- %HOMEPATH%\gOEYMkgs\xQEM.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp.exe
- %HOMEPATH%\gOEYMkgs\wUgC.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp.exe
- %HOMEPATH%\gOEYMkgs\sAMw.exe
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Sunset.jpg.exe
- %HOMEPATH%\gOEYMkgs\SAoI.exe
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Water lilies.jpg.exe
- %HOMEPATH%\gOEYMkgs\oQcQ.exe
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Blue hills.jpg.exe
- %HOMEPATH%\gOEYMkgs\uwQW.exe
- %ALLUSERSPROFILE%\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma.exe
- %HOMEPATH%\gOEYMkgs\zYgi.exe
- %ALLUSERSPROFILE%\Documents\My Music\Sample Music\New Stories (Highway Blues).wma.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp.exe
- %HOMEPATH%\gOEYMkgs\ucYQ.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp.exe
- %HOMEPATH%\gOEYMkgs\bUgc.exe
- %TEMP%\WERecd9.dir00\manifest.txt
- %HOMEPATH%\gOEYMkgs\xscy.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp.exe
- %TEMP%\WERecd9.dir00\appcompat.txt
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp.exe
- %HOMEPATH%\gOEYMkgs\DMok.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp.exe
- %HOMEPATH%\gOEYMkgs\lokm.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp.exe
- %HOMEPATH%\gOEYMkgs\KMYE.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp.exe
- %HOMEPATH%\gOEYMkgs\DQQA.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp.exe
- %HOMEPATH%\gOEYMkgs\vcMW.exe
Удаляет следующие файлы:
- %HOMEPATH%\gOEYMkgs\Essc.exe
- %HOMEPATH%\gOEYMkgs\zUse.exe
- %HOMEPATH%\gOEYMkgs\sEQq.exe
- %HOMEPATH%\gOEYMkgs\zoEY.exe
- %HOMEPATH%\gOEYMkgs\OAQi.exe
- %HOMEPATH%\gOEYMkgs\FIIC.exe
- %HOMEPATH%\gOEYMkgs\vgoq.exe
- %HOMEPATH%\gOEYMkgs\kccc.exe
- %HOMEPATH%\gOEYMkgs\XQwQ.exe
- %HOMEPATH%\gOEYMkgs\QIEu.exe
- %HOMEPATH%\gOEYMkgs\HkMM.exe
- %HOMEPATH%\gOEYMkgs\QgYu.exe
- %HOMEPATH%\gOEYMkgs\fwAa.exe
- %HOMEPATH%\gOEYMkgs\IwIO.exe
- %HOMEPATH%\gOEYMkgs\TswS.exe
- %HOMEPATH%\gOEYMkgs\agom.exe
- %HOMEPATH%\gOEYMkgs\iEgy.exe
- %HOMEPATH%\gOEYMkgs\eMoC.exe
- %HOMEPATH%\gOEYMkgs\MQce.exe
- %HOMEPATH%\gOEYMkgs\gYkK.exe
- %HOMEPATH%\gOEYMkgs\BIgc.exe
- %HOMEPATH%\gOEYMkgs\WosW.exe
- %HOMEPATH%\gOEYMkgs\wMow.exe
- %HOMEPATH%\gOEYMkgs\ZgEe.exe
- %HOMEPATH%\gOEYMkgs\mkIk.exe
- %HOMEPATH%\gOEYMkgs\BIMO.exe
- %HOMEPATH%\gOEYMkgs\AMkU.exe
- %HOMEPATH%\gOEYMkgs\YQkc.exe
- %HOMEPATH%\gOEYMkgs\KcEq.exe
- %HOMEPATH%\gOEYMkgs\rIkO.exe
- %HOMEPATH%\gOEYMkgs\hMMg.exe
- %HOMEPATH%\gOEYMkgs\YUcm.exe
- %HOMEPATH%\gOEYMkgs\mIYq.exe
- %HOMEPATH%\gOEYMkgs\VYcA.exe
- %HOMEPATH%\gOEYMkgs\BwUQ.exe
- %HOMEPATH%\gOEYMkgs\rksa.exe
- %HOMEPATH%\gOEYMkgs\TMAy.exe
- %HOMEPATH%\gOEYMkgs\WMYs.exe
- %HOMEPATH%\gOEYMkgs\lUUO.exe
- %HOMEPATH%\gOEYMkgs\SAkK.exe
- %HOMEPATH%\gOEYMkgs\zsgW.exe
- %HOMEPATH%\gOEYMkgs\Sskw.exe
- %HOMEPATH%\gOEYMkgs\TocE.exe
- %HOMEPATH%\gOEYMkgs\EkcU.exe
- %HOMEPATH%\gOEYMkgs\RUcm.exe
- %HOMEPATH%\gOEYMkgs\SggK.exe
- %HOMEPATH%\gOEYMkgs\RkQw.exe
- %HOMEPATH%\gOEYMkgs\nYQS.exe
- %HOMEPATH%\gOEYMkgs\JcAy.exe
- %HOMEPATH%\gOEYMkgs\hAoc.exe
- %HOMEPATH%\gOEYMkgs\bUgc.exe
- %HOMEPATH%\gOEYMkgs\DQQA.exe
- %HOMEPATH%\gOEYMkgs\vcMW.exe
- %HOMEPATH%\gOEYMkgs\IkwK.exe
- %HOMEPATH%\gOEYMkgs\xscy.exe
- %HOMEPATH%\gOEYMkgs\ucYQ.exe
- %HOMEPATH%\gOEYMkgs\wUgC.exe
- %HOMEPATH%\gOEYMkgs\sAMw.exe
- %HOMEPATH%\gOEYMkgs\xQEM.exe
- %HOMEPATH%\gOEYMkgs\KMYE.exe
- %HOMEPATH%\gOEYMkgs\DMok.exe
- %HOMEPATH%\gOEYMkgs\lokm.exe
- %HOMEPATH%\gOEYMkgs\NMEE.exe
- %HOMEPATH%\gOEYMkgs\MAkS.exe
- %HOMEPATH%\gOEYMkgs\qEIq.exe
- %HOMEPATH%\gOEYMkgs\KIgQ.exe
- %HOMEPATH%\gOEYMkgs\Eokw.exe
- %HOMEPATH%\gOEYMkgs\UEIA.exe
- %HOMEPATH%\gOEYMkgs\McIQ.exe
- %HOMEPATH%\gOEYMkgs\KIgM.exe
- %HOMEPATH%\gOEYMkgs\Gkgq.exe
- %HOMEPATH%\gOEYMkgs\VgkC.exe
- %HOMEPATH%\gOEYMkgs\Zkke.exe
- %HOMEPATH%\gOEYMkgs\kgkC.exe
- %TEMP%\NgswccMw.bat
- %HOMEPATH%\gOEYMkgs\Fcci.exe
- %HOMEPATH%\gOEYMkgs\aoEk.exe
- %HOMEPATH%\gOEYMkgs\iEYc.exe
- %HOMEPATH%\gOEYMkgs\SYoS.exe
- %HOMEPATH%\gOEYMkgs\dYca.exe
- %HOMEPATH%\gOEYMkgs\ZgAy.exe
- %HOMEPATH%\gOEYMkgs\kMYU.exe
- %HOMEPATH%\gOEYMkgs\ccEO.exe
- %HOMEPATH%\gOEYMkgs\KcEm.exe
- %HOMEPATH%\gOEYMkgs\CMIK.exe
- %HOMEPATH%\gOEYMkgs\xYIk.exe
- %HOMEPATH%\gOEYMkgs\fYoo.exe
- %HOMEPATH%\gOEYMkgs\jYEw.exe
- %HOMEPATH%\gOEYMkgs\zYgi.exe
- %HOMEPATH%\gOEYMkgs\SAoI.exe
- %HOMEPATH%\gOEYMkgs\oQcQ.exe
- %HOMEPATH%\gOEYMkgs\wUkK.exe
- %HOMEPATH%\gOEYMkgs\hoce.exe
- %HOMEPATH%\gOEYMkgs\uwQW.exe
- %HOMEPATH%\gOEYMkgs\hYQu.exe
- %HOMEPATH%\gOEYMkgs\ukYC.exe
- %HOMEPATH%\gOEYMkgs\LwEG.exe
- %HOMEPATH%\gOEYMkgs\ogEK.exe
- %HOMEPATH%\gOEYMkgs\CUsI.exe
- %HOMEPATH%\gOEYMkgs\fEcK.exe
Самоудаляется.
Сетевая активность:
Подключается к:
- '74.##5.232.51':80
TCP:
Запросы HTTP GET:
- http://google.com/ via 74.##5.232.51
- http:/// via 74.##5.232.51
UDP:
- DNS ASK google.com
Другое:
Ищет следующие окна:
- ClassName: '' WindowName: 'lacMcYws.exe'
- ClassName: '' WindowName: 'Microsoft Windows'
- ClassName: '' WindowName: 'SSIkQYgQ.exe'
