Техническая информация
Вредоносные функции:
Запускает на исполнение:
- <SYSTEM32>\ntvdm.exe -f -i1 -w -a <SYSTEM32>\krnl386.exe
- <SYSTEM32>\cmd.exe /c ""%TEMP%\RarSFX0\AuthorsW Install.bat" "
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\RarSFX0\Inst1\A1IEA_60.ekb
- %TEMP%\RarSFX0\Inst1\A1HSYS52.ekb
- %TEMP%\RarSFX0\Inst1\A1LOGS10.ekb
- %TEMP%\RarSFX0\Inst1\A1P7P250.EKB
- %TEMP%\RarSFX0\Inst1\A1P7P150.EKB
- %TEMP%\RarSFX0\Inst1\A1HSYS05.EKB
- %TEMP%\RarSFX0\Inst1\A1DSUP03.EKB
- %TEMP%\RarSFX0\Inst1\A1DRVB52.EKB
- %TEMP%\RarSFX0\Inst1\A1ESIG10.ekb
- %TEMP%\RarSFX0\Inst1\A1G5II70.EKB
- %TEMP%\RarSFX0\Inst1\A1FSYS05.EKB
- %TEMP%\RarSFX0\Inst1\A1P7P350.EKB
- %TEMP%\RarSFX0\Inst1\A1plcs05.ekb
- %TEMP%\RarSFX0\Inst1\A1PLCS04.EKB
- %TEMP%\RarSFX0\Inst1\A1PLCS51.ekb
- %TEMP%\RarSFX0\Inst1\A1S5BP70.EKB
- %TEMP%\RarSFX0\Inst1\A1S5BP66.EKB
- %TEMP%\RarSFX0\Inst1\A1PLCS01.EKB
- %TEMP%\RarSFX0\Inst1\A1PDIA03.EKB
- %TEMP%\RarSFX0\Inst1\A1PCS704.EKB
- %TEMP%\RarSFX0\Inst1\A1PDIA04.EKB
- %TEMP%\RarSFX0\Inst1\A1PIDT51.EKB
- %TEMP%\RarSFX0\Inst1\A1PDIA05.EKB
- %TEMP%\RarSFX0\Inst1\A1DRVB51.EKB
- %TEMP%\RarSFX0\Inst1\A1BFOR60.ekb
- %TEMP%\RarSFX0\Inst1\A1BFCV03.EKB
- %TEMP%\RarSFX0\Inst1\A1BFRS03.EKB
- %TEMP%\RarSFX0\Inst1\A1BPLA60.ekb
- %TEMP%\RarSFX0\Inst1\A1BHIE60.ekb
- %TEMP%\RarSFX0\Inst1\A1BFCS03.EKB
- %TEMP%\RarSFX0\Inst1\A1ADMT10.ekb
- %TEMP%\RarSFX0\Inst1\A1731002.EKB
- %TEMP%\RarSFX0\Inst1\A1BAPI60.ekb
- %TEMP%\RarSFX0\Inst1\A1BFCP03.EKB
- %TEMP%\RarSFX0\Inst1\A1BBCC60.ekb
- %TEMP%\RarSFX0\Inst1\A1BREC60.ekb
- %TEMP%\RarSFX0\Inst1\A1CFCA52.EKB
- %TEMP%\RarSFX0\Inst1\A1CFCA51.EKB
- %TEMP%\RarSFX0\Inst1\A1DOCP03.EKB
- %TEMP%\RarSFX0\Inst1\A1DOCP51.ekb
- %TEMP%\RarSFX0\Inst1\A1DOCP05.EKB
- %TEMP%\RarSFX0\Inst1\A1CFCA05.EKB
- %TEMP%\RarSFX0\Inst1\A1BSP060.ekb
- %TEMP%\RarSFX0\Inst1\A1BROP60.ekb
- %TEMP%\RarSFX0\Inst1\A1CFC360.ekb
- %TEMP%\RarSFX0\Inst1\A1CFCA04.EKB
- %TEMP%\RarSFX0\Inst1\A1CFCA03.EKB
- %TEMP%\RarSFX0\Inst1\A1WPC512.EKB
- %TEMP%\RarSFX0\Inst1\A1WPC412.EKB
- %TEMP%\RarSFX0\Inst1\A1WRTX30.EKB
- %TEMP%\RarSFX0\INSTALL.exe
- %TEMP%\RarSFX0\BWCC.DLL
- %TEMP%\RarSFX0\Inst1\A1WPC312.EKB
- %TEMP%\RarSFX0\Inst1\A1WINA10.EKB
- %TEMP%\RarSFX0\Inst1\A1WARC12.ekb
- %TEMP%\RarSFX0\Inst1\A1wina30.ekb
- %TEMP%\RarSFX0\Inst1\A1WPC230.EKB
- %TEMP%\RarSFX0\Inst1\A1WPC112.EKB
- %TEMP%\RarSFX0\INSTALL.HRD
- %TEMP%\RarSFX0\Inst2\INSTALL.ico
- %TEMP%\RarSFX0\Inst2\INSTALL.HRD
- %TEMP%\RarSFX0\Inst2\BWCC.DLL
- %WINDIR%\Temp\scs2.tmp
- %WINDIR%\Temp\scs1.tmp
- %TEMP%\RarSFX0\Inst2\INSTALL.exe
- %TEMP%\RarSFX0\Inst1\INSTALL.exe
- %TEMP%\RarSFX0\null
- %TEMP%\RarSFX0\Inst1\INSTALL.HRD
- %TEMP%\RarSFX0\Inst1\BWCC.DLL
- %TEMP%\RarSFX0\Inst1\INSTALL.ico
- %TEMP%\RarSFX0\Inst1\A1VCCH60.ekb
- %TEMP%\RarSFX0\Inst1\A1S7TS03.EKB
- %TEMP%\RarSFX0\Inst1\A1S7M703.EKB
- %TEMP%\RarSFX0\Inst1\A1S7TS05.EKB
- %TEMP%\RarSFX0\Inst1\A1S7ZG05.EKB
- %TEMP%\RarSFX0\Inst1\A1S7TS51.EKB
- %TEMP%\RarSFX0\Inst1\A1S7GR53.ekb
- %TEMP%\RarSFX0\Inst1\A1S7GR04.EKB
- %TEMP%\RarSFX0\Inst1\A1S7GR03.EKB
- %TEMP%\RarSFX0\Inst1\A1S7GR05.EKB
- %TEMP%\RarSFX0\Inst1\A1S7GR52.ekb
- %TEMP%\RarSFX0\Inst1\A1S7GR51.EKB
- %TEMP%\RarSFX0\Inst1\A1S7ZG40.EKB
- %TEMP%\RarSFX0\Inst1\A1SFC_04.EKB
- %TEMP%\RarSFX0\Inst1\A1SFCV60.ekb
- %TEMP%\RarSFX0\Inst1\A1SFC_05.EKB
- %TEMP%\RarSFX0\Inst1\A1STDC05.EKB
- %TEMP%\RarSFX0\Inst1\A1SFC_60.ekb
- %TEMP%\RarSFX0\Inst1\A1SFCV05.EKB
- %TEMP%\RarSFX0\Inst1\A1SCL_04.EKB
- %TEMP%\RarSFX0\Inst1\A1SCL_03.EKB
- %TEMP%\RarSFX0\Inst1\A1SCL_05.EKB
- %TEMP%\RarSFX0\Inst1\A1SFCV03.EKB
- %TEMP%\RarSFX0\Inst1\A1SCL_51.EKB
- %TEMP%\RarSFX0\Inst1\A1730202.EKB
- %TEMP%\RarSFX0\Inst2\A9SS13N0.EKB
- %TEMP%\RarSFX0\Inst2\A9SS1390.EKB
- %TEMP%\RarSFX0\Inst2\A9SS5290.EKB
- %TEMP%\RarSFX0\Inst2\A9WARC12.EKB
- %TEMP%\RarSFX0\Inst2\A9SS52N0.EKB
- %TEMP%\RarSFX0\Inst2\A9SOP7N0.EKB
- %TEMP%\RarSFX0\Inst2\A9SHLA90.EKB
- %TEMP%\RarSFX0\Inst2\A9SD52N0.EKB
- %TEMP%\RarSFX0\Inst2\A9SNEM90.ekb
- %TEMP%\RarSFX0\Inst2\A9SNEX90.EKB
- %TEMP%\RarSFX0\Inst2\A9SNEP90.EKB
- %TEMP%\RarSFX0\Inst2\A9WC1012.EKB
- %TEMP%\RarSFX0\Inst2\A9WC1812.EKB
- %TEMP%\RarSFX0\Inst2\A9WC1712.EKB
- %TEMP%\RarSFX0\Inst2\A9WC1912.EKB
- %TEMP%\RarSFX0\Inst2\A9WC2130.EKB
- %TEMP%\RarSFX0\Inst2\A9WC2030.EKB
- %TEMP%\RarSFX0\Inst2\A9WC1612.EKB
- %TEMP%\RarSFX0\Inst2\A9WC1212.EKB
- %TEMP%\RarSFX0\Inst2\A9WC1112.EKB
- %TEMP%\RarSFX0\Inst2\A9WC1312.EKB
- %TEMP%\RarSFX0\Inst2\A9WC1512.EKB
- %TEMP%\RarSFX0\Inst2\A9WC1412.EKB
- %TEMP%\RarSFX0\Inst2\A9SD5290.EKB
- %TEMP%\RarSFX0\Inst2\A3SPDP01.EKB
- %TEMP%\RarSFX0\Inst2\A3SPBS04.ekb
- %TEMP%\RarSFX0\Inst2\A3SPHB01.EKB
- %TEMP%\RarSFX0\Inst2\A3SPHX01.EKB
- %TEMP%\RarSFX0\Inst2\A3SPHM01.EKB
- %TEMP%\RarSFX0\Inst2\A3SPBS02.EKB
- %TEMP%\RarSFX0\Inst2\A3SI0002.EKB
- %TEMP%\RarSFX0\INSTALL.ico
- %TEMP%\RarSFX0\Inst2\A3SPBE01.EKB
- %TEMP%\RarSFX0\Inst2\A3SPBS01.EKB
- %TEMP%\RarSFX0\Inst2\A3SPBI01.EKB
- %TEMP%\RarSFX0\Inst2\A3SPIE01.EKB
- %TEMP%\RarSFX0\Inst2\A9PRO250.EKB
- %TEMP%\RarSFX0\Inst2\A9PRO150.EKB
- %TEMP%\RarSFX0\Inst2\A9PRO450.EKB
- %TEMP%\RarSFX0\Inst2\A9SC7P93.EKB
- %TEMP%\RarSFX0\Inst2\A9sc7e93.ekb
- %TEMP%\RarSFX0\Inst2\A3WCL112.EKB
- %TEMP%\RarSFX0\Inst2\A3SPR401.EKB
- %TEMP%\RarSFX0\Inst2\A3SPR201.EKB
- %TEMP%\RarSFX0\Inst2\A3SPT101.EKB
- %TEMP%\RarSFX0\Inst2\A3SPT901.EKB
- %TEMP%\RarSFX0\Inst2\A3SPT301.EKB
- %TEMP%\RarSFX0\Inst2\A9WSP251.EKB
- %TEMP%\RarSFX0\Inst2\A9WSP151.EKB
- %TEMP%\RarSFX0\Inst2\A9WSP351.EKB
- %TEMP%\RarSFX0\Inst2\A9WSRD40.EKB
- %TEMP%\RarSFX0\Inst2\A9WSPA40.EKB
- %TEMP%\RarSFX0\Inst2\A9WSN410.EKB
- %TEMP%\RarSFX0\Inst2\A9WSEC30.EKB
- %TEMP%\RarSFX0\Inst2\A9WRT430.EKB
- %TEMP%\RarSFX0\Inst2\A9WSN110.EKB
- %TEMP%\RarSFX0\Inst2\A9WSN310.EKB
- %TEMP%\RarSFX0\Inst2\A9WSN210.EKB
- %TEMP%\RarSFX0\Inst2\X1710451.ekb
- %TEMP%\RarSFX0\Inst1\A1710451.EKB
- %TEMP%\RarSFX0\Inst1\A1710405.EKB
- %TEMP%\RarSFX0\Inst1\A1710452.ekb
- %TEMP%\RarSFX0\Inst1\A1730103.EKB
- %TEMP%\RarSFX0\Inst1\A1710453.ekb
- %TEMP%\RarSFX0\Inst1\A1710404.EKB
- %TEMP%\RarSFX0\AuthorsW Install.bat
- %TEMP%\RarSFX0\Inst2\X1S5BP70.ekb
- %TEMP%\RarSFX0\Inst1\A1581A03.EKB
- %TEMP%\RarSFX0\Inst1\A1710403.EKB
- %TEMP%\RarSFX0\Inst1\A170405.EKB
- %TEMP%\RarSFX0\Inst2\A9WRT330.EKB
- %TEMP%\RarSFX0\Inst2\A9WCL812.EKB
- %TEMP%\RarSFX0\Inst2\A9WCL730.EKB
- %TEMP%\RarSFX0\Inst2\A9WCL912.EKB
- %TEMP%\RarSFX0\Inst2\A9WOIC40.EKB
- %TEMP%\RarSFX0\Inst2\A9WNC160.ekb
- %TEMP%\RarSFX0\Inst2\A9WCL612.EKB
- %TEMP%\RarSFX0\Inst2\A9WC2340.EKB
- %TEMP%\RarSFX0\Inst2\A9WC2230.EKB
- %TEMP%\RarSFX0\Inst2\A9WC2440.EKB
- %TEMP%\RarSFX0\Inst2\A9WCL512.EKB
- %TEMP%\RarSFX0\Inst2\A9WC2540.EKB
- %TEMP%\RarSFX0\Inst2\A9WRC130.EKB
- %TEMP%\RarSFX0\Inst2\A9WRC530.EKB
- %TEMP%\RarSFX0\Inst2\A9WRC460.ekb
- %TEMP%\RarSFX0\Inst2\A9WRC830.EKB
- %TEMP%\RarSFX0\Inst2\A9WRT230.EKB
- %TEMP%\RarSFX0\Inst2\A9WRT130.EKB
- %TEMP%\RarSFX0\Inst2\A9WRC430.EKB
- %TEMP%\RarSFX0\Inst2\A9WRC230.EKB
- %TEMP%\RarSFX0\Inst2\A9WRC160.ekb
- %TEMP%\RarSFX0\Inst2\A9WRC260.ekb
- %TEMP%\RarSFX0\Inst2\A9WRC360.ekb
- %TEMP%\RarSFX0\Inst2\A9WRC330.EKB
Присваивает атрибут 'скрытый' для следующих файлов:
- %TEMP%\RarSFX0\Inst1\A1IEA_60.ekb
- %TEMP%\RarSFX0\Inst1\A1LOGS10.ekb
- %TEMP%\RarSFX0\Inst1\A1PLCS51.ekb
- %TEMP%\RarSFX0\Inst1\A1HSYS52.ekb
- %TEMP%\RarSFX0\Inst1\A1CFC360.ekb
- %TEMP%\RarSFX0\Inst1\A1DOCP51.ekb
- %TEMP%\RarSFX0\Inst1\A1ESIG10.ekb
- %TEMP%\RarSFX0\Inst1\A1SFC_60.ekb
- %TEMP%\RarSFX0\Inst1\A1VCCH60.ekb
- %TEMP%\RarSFX0\Inst1\A1WRTX30.EKB
- %TEMP%\RarSFX0\Inst1\A1SFCV60.ekb
- %TEMP%\RarSFX0\Inst1\A1S7GR52.ekb
- %TEMP%\RarSFX0\Inst1\A1S7GR53.ekb
- %TEMP%\RarSFX0\Inst1\A1S7TS51.EKB
- %TEMP%\RarSFX0\Inst1\A1BSP060.ekb
- %TEMP%\RarSFX0\Inst2\A9WRT430.EKB
- %TEMP%\RarSFX0\Inst1\A1710453.ekb
- %TEMP%\RarSFX0\Inst1\A1ADMT10.ekb
- %TEMP%\RarSFX0\Inst2\A9WRC830.EKB
- %TEMP%\RarSFX0\Inst2\A3SPBS04.ekb
- %TEMP%\RarSFX0\Inst2\A9SNEM90.ekb
- %TEMP%\RarSFX0\Inst2\A9WNC160.ekb
- %TEMP%\RarSFX0\Inst1\A1BPLA60.ekb
- %TEMP%\RarSFX0\Inst1\A1BREC60.ekb
- %TEMP%\RarSFX0\Inst1\A1BROP60.ekb
- %TEMP%\RarSFX0\Inst1\A1BHIE60.ekb
- %TEMP%\RarSFX0\Inst1\A1BAPI60.ekb
- %TEMP%\RarSFX0\Inst1\A1BBCC60.ekb
- %TEMP%\RarSFX0\Inst1\A1BFOR60.ekb
Удаляет следующие файлы:
- %TEMP%\RarSFX0\BWCC.DLL
- %WINDIR%\Temp\scs1.tmp
- %WINDIR%\Temp\scs2.tmp
- %TEMP%\RarSFX0\INSTALL.exe
- %TEMP%\RarSFX0\INSTALL.HRD
- %TEMP%\RarSFX0\INSTALL.ico
Другое:
Ищет следующие окна:
- ClassName: 'WOWFaxClass' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
