Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe,'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'lacMcYws.exe' = '%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'SSIkQYgQ.exe' = '%HOMEPATH%\gOEYMkgs\SSIkQYgQ.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\vwYgEQEb] 'ImagePath' = '%ALLUSERSPROFILE%\tuIMYcEM\ZgMYMIIE.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\vwYgEQEb] 'Start' = '00000002'
Заражает следующие исполняемые файлы:
- C:\Far2\Far.exe
Вредоносные функции:
Для затруднения выявления своего присутствия в системе
блокирует отображение:
- скрытых файлов
- расширений файлов
блокирует:
- Средство контроля пользовательских учетных записей (UAC)
Запускает на исполнение:
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
- '<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
- '<SYSTEM32>\cmd.exe' /c "<Текущая директория>\<Имя файла>"
- '%HOMEPATH%\gOEYMkgs\SSIkQYgQ.exe'
- '%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe'
- '%ALLUSERSPROFILE%\tuIMYcEM\ZgMYMIIE.exe'
Изменения в файловой системе:
Создает следующие файлы:
- %HOMEPATH%\gOEYMkgs\ncMG.exe
- %HOMEPATH%\gOEYMkgs\oAIO.exe
- %HOMEPATH%\gOEYMkgs\kYge.exe
- %HOMEPATH%\gOEYMkgs\hgYS.exe
- %HOMEPATH%\gOEYMkgs\BEYU.exe
- %HOMEPATH%\gOEYMkgs\xcIu.exe
- %HOMEPATH%\gOEYMkgs\zMQq.exe
- %HOMEPATH%\gOEYMkgs\GYIY.exe
- %HOMEPATH%\gOEYMkgs\iUQe.exe
- %HOMEPATH%\gOEYMkgs\ascE.exe
- %HOMEPATH%\gOEYMkgs\voQm.exe
- %HOMEPATH%\gOEYMkgs\zkEY.exe
- %HOMEPATH%\gOEYMkgs\aQsW.exe
- %HOMEPATH%\gOEYMkgs\DMAU.exe
- %HOMEPATH%\gOEYMkgs\nkUS.exe
- %HOMEPATH%\gOEYMkgs\ZAIa.exe
- %HOMEPATH%\gOEYMkgs\KgUq.exe
- %HOMEPATH%\gOEYMkgs\jUIO.exe
- %HOMEPATH%\gOEYMkgs\OsoW.exe
- %HOMEPATH%\gOEYMkgs\csEe.exe
- %HOMEPATH%\gOEYMkgs\cIkU.exe
- %HOMEPATH%\gOEYMkgs\RIQe.exe
- %HOMEPATH%\gOEYMkgs\NQQg.exe
- %HOMEPATH%\gOEYMkgs\tkcM.exe
- %HOMEPATH%\gOEYMkgs\pgMU.exe
- %HOMEPATH%\gOEYMkgs\doEc.exe
- %TEMP%\WER3d52.dir00\appcompat.txt
- %HOMEPATH%\gOEYMkgs\vYEi.exe
- %TEMP%\WER3d52.dir00\manifest.txt
- %HOMEPATH%\gOEYMkgs\QwEY.exe
- %HOMEPATH%\gOEYMkgs\wAEI.exe
- %HOMEPATH%\gOEYMkgs\kQUc.exe
- %HOMEPATH%\gOEYMkgs\KoUi.exe
- %HOMEPATH%\gOEYMkgs\ScMu.exe
- %HOMEPATH%\gOEYMkgs\fgEo.exe
- %HOMEPATH%\gOEYMkgs\wcIU.exe
- %HOMEPATH%\gOEYMkgs\AAMa.exe
- %HOMEPATH%\gOEYMkgs\jgQg.exe
- %HOMEPATH%\gOEYMkgs\xwcc.exe
- %HOMEPATH%\gOEYMkgs\XAsw.exe
- %HOMEPATH%\gOEYMkgs\DQwS.exe
- %HOMEPATH%\gOEYMkgs\rcEk.exe
- %HOMEPATH%\gOEYMkgs\PksC.exe
- %HOMEPATH%\gOEYMkgs\YEwc.exe
- %HOMEPATH%\gOEYMkgs\xIYi.exe
- %TEMP%\WERcbc5.dir00\ZgMYMIIE.exe.hdmp
- %HOMEPATH%\gOEYMkgs\IQso.exe
- %HOMEPATH%\gOEYMkgs\HksC.exe
- %HOMEPATH%\gOEYMkgs\GEAw.exe
- %HOMEPATH%\gOEYMkgs\JYsC.exe
- %TEMP%\WERcbc5.dir00\ZgMYMIIE.exe.mdmp
- %HOMEPATH%\gOEYMkgs\aIoM.exe
- %HOMEPATH%\gOEYMkgs\kIoW.exe
- %HOMEPATH%\gOEYMkgs\VgkS.exe
- %HOMEPATH%\gOEYMkgs\wYAu.exe
- %HOMEPATH%\gOEYMkgs\eoEe.exe
- %HOMEPATH%\gOEYMkgs\usAe.exe
- %HOMEPATH%\gOEYMkgs\eAIM.exe
- %TEMP%\WERcbc5.dir00\manifest.txt
- %TEMP%\WERcbc5.dir00\appcompat.txt
- %HOMEPATH%\gOEYMkgs\TIci.exe
- %HOMEPATH%\gOEYMkgs\awwy.exe
- %HOMEPATH%\gOEYMkgs\kogo.exe
- %HOMEPATH%\gOEYMkgs\ZgsG.exe
- %HOMEPATH%\gOEYMkgs\RcUY.exe
- %HOMEPATH%\gOEYMkgs\RUQS.exe
- %HOMEPATH%\gOEYMkgs\pIAw.exe
- %HOMEPATH%\gOEYMkgs\yAEW.exe
- %HOMEPATH%\gOEYMkgs\SsUK.exe
- %HOMEPATH%\gOEYMkgs\IcQy.exe
- %HOMEPATH%\gOEYMkgs\TEIi.exe
- %HOMEPATH%\gOEYMkgs\jwwI.exe
- %HOMEPATH%\gOEYMkgs\ZgAE.exe
- %HOMEPATH%\gOEYMkgs\QwYI.exe
- %HOMEPATH%\gOEYMkgs\MwMc.exe
- %HOMEPATH%\gOEYMkgs\rwUK.exe
- %HOMEPATH%\gOEYMkgs\JMYC.exe
- %HOMEPATH%\gOEYMkgs\Ooos.exe
- %HOMEPATH%\gOEYMkgs\uMIM.exe
- %HOMEPATH%\gOEYMkgs\NYsQ.exe
- %HOMEPATH%\gOEYMkgs\EgEO.exe
- %HOMEPATH%\gOEYMkgs\gwYi.exe
- %HOMEPATH%\gOEYMkgs\DsQk.exe
- %HOMEPATH%\gOEYMkgs\WUsu.exe
- %HOMEPATH%\gOEYMkgs\boUm.exe
- %HOMEPATH%\gOEYMkgs\pooK.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp.exe
- %HOMEPATH%\gOEYMkgs\vYoS.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp.exe
- %HOMEPATH%\gOEYMkgs\mcsw.exe
- %HOMEPATH%\gOEYMkgs\tIYY.exe
- %HOMEPATH%\gOEYMkgs\LIgY.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp.exe
- %HOMEPATH%\gOEYMkgs\tQwi.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp.exe
- %HOMEPATH%\gOEYMkgs\EQwg.exe
- %HOMEPATH%\gOEYMkgs\YAcO.exe
- %HOMEPATH%\gOEYMkgs\hkom.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp.exe
- %HOMEPATH%\gOEYMkgs\kAwY.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp.exe
- %HOMEPATH%\gOEYMkgs\VQsa.exe
- %TEMP%\WER4ad2.dir00\ZgMYMIIE.exe.mdmp
- %ALLUSERSPROFILE%\caQc.txt
- %TEMP%\WER4ad2.dir00\ZgMYMIIE.exe.hdmp
- %TEMP%\WER4ad2.dir00\manifest.txt
- %TEMP%\WER4ad2.dir00\appcompat.txt
- %ALLUSERSPROFILE%\WuIEgAsU\lacMcYws
- %HOMEPATH%\gOEYMkgs\SSIkQYgQ
- %HOMEPATH%\gOEYMkgs\SSIkQYgQ.exe
- %ALLUSERSPROFILE%\tuIMYcEM\ZgMYMIIE.exe
- %ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe
- <Текущая директория>\<Имя файла>
- %HOMEPATH%\gOEYMkgs\gUMs.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp.exe
- %HOMEPATH%\gOEYMkgs\lQYI.exe
- %TEMP%\WERc36f.dir00\ZgMYMIIE.exe.hdmp
- %TEMP%\WERc36f.dir00\ZgMYMIIE.exe.mdmp
- %TEMP%\WERc36f.dir00\appcompat.txt
- %HOMEPATH%\gOEYMkgs\FAAa.exe
- %TEMP%\WERc36f.dir00\manifest.txt
- %HOMEPATH%\gOEYMkgs\ngIQ.exe
- %ALLUSERSPROFILE%\Documents\My Music\Sample Music\New Stories (Highway Blues).wma.exe
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Blue hills.jpg.exe
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Sunset.jpg.exe
- %HOMEPATH%\gOEYMkgs\FkEy.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\%USERNAME%.bmp.exe
- %HOMEPATH%\gOEYMkgs\kAom.exe
- %HOMEPATH%\gOEYMkgs\BUUg.exe
- %HOMEPATH%\gOEYMkgs\YYIg.exe
- %ALLUSERSPROFILE%\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma.exe
- %HOMEPATH%\gOEYMkgs\vEIO.exe
- %HOMEPATH%\gOEYMkgs\WYsi.exe
- %HOMEPATH%\gOEYMkgs\eYEE.exe
- %TEMP%\WER3d52.dir00\ZgMYMIIE.exe.hdmp
- %HOMEPATH%\gOEYMkgs\tUgS.exe
- %HOMEPATH%\gOEYMkgs\jsoc.exe
- %HOMEPATH%\gOEYMkgs\BkQg.exe
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Water lilies.jpg.exe
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Winter.jpg.exe
- %HOMEPATH%\gOEYMkgs\jEko.exe
- %TEMP%\WER3d52.dir00\ZgMYMIIE.exe.mdmp
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp.exe
- %HOMEPATH%\gOEYMkgs\dEsc.exe
- %HOMEPATH%\gOEYMkgs\QUYi.exe
- %HOMEPATH%\gOEYMkgs\AsYC.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp.exe
- %HOMEPATH%\gOEYMkgs\GEUK.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp.exe
- %HOMEPATH%\gOEYMkgs\uosM.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp.exe
- %HOMEPATH%\gOEYMkgs\MUwu.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\guest.bmp.exe
- %HOMEPATH%\gOEYMkgs\eAAM.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp.exe
- %HOMEPATH%\gOEYMkgs\koYq.exe
- %HOMEPATH%\gOEYMkgs\EMoc.exe
- %HOMEPATH%\gOEYMkgs\Locg.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp.exe
Удаляет следующие файлы:
- %HOMEPATH%\gOEYMkgs\nkUS.exe
- %HOMEPATH%\gOEYMkgs\IcQy.exe
- %HOMEPATH%\gOEYMkgs\SsUK.exe
- %HOMEPATH%\gOEYMkgs\ZAIa.exe
- %HOMEPATH%\gOEYMkgs\aQsW.exe
- %HOMEPATH%\gOEYMkgs\zkEY.exe
- %HOMEPATH%\gOEYMkgs\DMAU.exe
- %HOMEPATH%\gOEYMkgs\ZgsG.exe
- %HOMEPATH%\gOEYMkgs\RUQS.exe
- %HOMEPATH%\gOEYMkgs\yAEW.exe
- %HOMEPATH%\gOEYMkgs\RcUY.exe
- %HOMEPATH%\gOEYMkgs\TEIi.exe
- %HOMEPATH%\gOEYMkgs\ZgAE.exe
- %HOMEPATH%\gOEYMkgs\jwwI.exe
- %HOMEPATH%\gOEYMkgs\csEe.exe
- %HOMEPATH%\gOEYMkgs\oAIO.exe
- %HOMEPATH%\gOEYMkgs\ncMG.exe
- %HOMEPATH%\gOEYMkgs\kYge.exe
- %HOMEPATH%\gOEYMkgs\iUQe.exe
- %HOMEPATH%\gOEYMkgs\xcIu.exe
- %HOMEPATH%\gOEYMkgs\GYIY.exe
- %HOMEPATH%\gOEYMkgs\ascE.exe
- %HOMEPATH%\gOEYMkgs\KgUq.exe
- %HOMEPATH%\gOEYMkgs\OsoW.exe
- %HOMEPATH%\gOEYMkgs\cIkU.exe
- %HOMEPATH%\gOEYMkgs\jUIO.exe
- %HOMEPATH%\gOEYMkgs\BEYU.exe
- %HOMEPATH%\gOEYMkgs\hgYS.exe
- %HOMEPATH%\gOEYMkgs\voQm.exe
- %HOMEPATH%\gOEYMkgs\IQso.exe
- %HOMEPATH%\gOEYMkgs\kIoW.exe
- %HOMEPATH%\gOEYMkgs\TIci.exe
- %HOMEPATH%\gOEYMkgs\xIYi.exe
- %HOMEPATH%\gOEYMkgs\aIoM.exe
- %HOMEPATH%\gOEYMkgs\YEwc.exe
- %HOMEPATH%\gOEYMkgs\PksC.exe
- %HOMEPATH%\gOEYMkgs\eoEe.exe
- %HOMEPATH%\gOEYMkgs\eAIM.exe
- %HOMEPATH%\gOEYMkgs\usAe.exe
- %HOMEPATH%\gOEYMkgs\VgkS.exe
- %HOMEPATH%\gOEYMkgs\kogo.exe
- %HOMEPATH%\gOEYMkgs\awwy.exe
- %HOMEPATH%\gOEYMkgs\wYAu.exe
- %HOMEPATH%\gOEYMkgs\JYsC.exe
- %HOMEPATH%\gOEYMkgs\gwYi.exe
- %HOMEPATH%\gOEYMkgs\WUsu.exe
- %HOMEPATH%\gOEYMkgs\DsQk.exe
- %HOMEPATH%\gOEYMkgs\NYsQ.exe
- %HOMEPATH%\gOEYMkgs\pIAw.exe
- %HOMEPATH%\gOEYMkgs\QwYI.exe
- %HOMEPATH%\gOEYMkgs\EgEO.exe
- %HOMEPATH%\gOEYMkgs\Ooos.exe
- %HOMEPATH%\gOEYMkgs\GEAw.exe
- %HOMEPATH%\gOEYMkgs\HksC.exe
- %HOMEPATH%\gOEYMkgs\uMIM.exe
- %HOMEPATH%\gOEYMkgs\rwUK.exe
- %HOMEPATH%\gOEYMkgs\MwMc.exe
- %HOMEPATH%\gOEYMkgs\JMYC.exe
- %HOMEPATH%\gOEYMkgs\AsYC.exe
- %HOMEPATH%\gOEYMkgs\koYq.exe
- %HOMEPATH%\gOEYMkgs\EMoc.exe
- %HOMEPATH%\gOEYMkgs\QUYi.exe
- %HOMEPATH%\gOEYMkgs\GEUK.exe
- %HOMEPATH%\gOEYMkgs\uosM.exe
- %HOMEPATH%\gOEYMkgs\dEsc.exe
- %HOMEPATH%\gOEYMkgs\BUUg.exe
- %HOMEPATH%\gOEYMkgs\YYIg.exe
- %HOMEPATH%\gOEYMkgs\ngIQ.exe
- %HOMEPATH%\gOEYMkgs\kAom.exe
- %HOMEPATH%\gOEYMkgs\Locg.exe
- %HOMEPATH%\gOEYMkgs\MUwu.exe
- %HOMEPATH%\gOEYMkgs\eAAM.exe
- %HOMEPATH%\gOEYMkgs\hkom.exe
- %HOMEPATH%\gOEYMkgs\mcsw.exe
- %HOMEPATH%\gOEYMkgs\tIYY.exe
- %HOMEPATH%\gOEYMkgs\LIgY.exe
- %HOMEPATH%\gOEYMkgs\lQYI.exe
- %TEMP%\VYccYkUI.bat
- %HOMEPATH%\gOEYMkgs\FAAa.exe
- %HOMEPATH%\gOEYMkgs\gUMs.exe
- %HOMEPATH%\gOEYMkgs\VQsa.exe
- %HOMEPATH%\gOEYMkgs\EQwg.exe
- %HOMEPATH%\gOEYMkgs\YAcO.exe
- %HOMEPATH%\gOEYMkgs\kAwY.exe
- %HOMEPATH%\gOEYMkgs\pooK.exe
- %HOMEPATH%\gOEYMkgs\vYoS.exe
- %HOMEPATH%\gOEYMkgs\tQwi.exe
- %HOMEPATH%\gOEYMkgs\jgQg.exe
- %HOMEPATH%\gOEYMkgs\XAsw.exe
- %HOMEPATH%\gOEYMkgs\rcEk.exe
- %HOMEPATH%\gOEYMkgs\xwcc.exe
- %HOMEPATH%\gOEYMkgs\doEc.exe
- %HOMEPATH%\gOEYMkgs\pgMU.exe
- %HOMEPATH%\gOEYMkgs\kQUc.exe
- %HOMEPATH%\gOEYMkgs\AAMa.exe
- %HOMEPATH%\gOEYMkgs\wcIU.exe
- %HOMEPATH%\gOEYMkgs\zMQq.exe
- %HOMEPATH%\gOEYMkgs\fgEo.exe
- %HOMEPATH%\gOEYMkgs\DQwS.exe
- %HOMEPATH%\gOEYMkgs\ScMu.exe
- %HOMEPATH%\gOEYMkgs\KoUi.exe
- %HOMEPATH%\gOEYMkgs\tkcM.exe
- %HOMEPATH%\gOEYMkgs\eYEE.exe
- %HOMEPATH%\gOEYMkgs\WYsi.exe
- %HOMEPATH%\gOEYMkgs\jsoc.exe
- %HOMEPATH%\gOEYMkgs\jEko.exe
- %HOMEPATH%\gOEYMkgs\FkEy.exe
- %HOMEPATH%\gOEYMkgs\vEIO.exe
- %HOMEPATH%\gOEYMkgs\BkQg.exe
- %HOMEPATH%\gOEYMkgs\QwEY.exe
- %HOMEPATH%\gOEYMkgs\NQQg.exe
- %HOMEPATH%\gOEYMkgs\RIQe.exe
- %HOMEPATH%\gOEYMkgs\wAEI.exe
- %HOMEPATH%\gOEYMkgs\tUgS.exe
- %HOMEPATH%\gOEYMkgs\boUm.exe
- %HOMEPATH%\gOEYMkgs\vYEi.exe
Самоудаляется.
Сетевая активность:
Подключается к:
- '74.##5.232.51':80
TCP:
Запросы HTTP GET:
- http://google.com/ via 74.##5.232.51
- http:/// via 74.##5.232.51
UDP:
- DNS ASK google.com
Другое:
Ищет следующие окна:
- ClassName: '' WindowName: 'lacMcYws.exe'
- ClassName: '' WindowName: 'Microsoft Windows'
- ClassName: '' WindowName: 'SSIkQYgQ.exe'
