Техническая информация
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\ping.exe' -n 1 127.0.0.1
- '<SYSTEM32>\taskkill.exe' /f /im "<Имя файла>.exe"
- '<SYSTEM32>\cmd.exe'
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\feed69128376.rss+xml
- %TEMP%\utilities.MG
- %TEMP%\feed418202911.rss+xml
- %TEMP%\nsl2.tmp
- %TEMP%\ourdisclaimer.gif
Самоудаляется.
Другое:
Ищет следующие окна:
- ClassName: 'noise' WindowName: ''
- ClassName: 'powder' WindowName: ''
- ClassName: 'advantage' WindowName: ''
- ClassName: 'window' WindowName: ''
- ClassName: 'cheeks' WindowName: ''
- ClassName: 'scratch' WindowName: ''
- ClassName: 'rides' WindowName: ''
- ClassName: 'eves' WindowName: ''
- ClassName: 'breach' WindowName: ''
- ClassName: 'directive' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'threes' WindowName: ''
- ClassName: 'overvoltage' WindowName: ''
- ClassName: 'doors' WindowName: ''
- ClassName: 'feet' WindowName: ''
- ClassName: 'messengers' WindowName: ''
- ClassName: 'court' WindowName: ''
- ClassName: 'grasps' WindowName: ''
- ClassName: 'satellites' WindowName: ''
- ClassName: 'troubleshooters' WindowName: ''
- ClassName: 'shops' WindowName: ''
- ClassName: 'affiant' WindowName: ''
- ClassName: 'feed' WindowName: ''
- ClassName: 'breaths' WindowName: ''
- ClassName: 'sills' WindowName: ''
- ClassName: 'riding' WindowName: ''
- ClassName: 'delimiter' WindowName: ''
- ClassName: 'difficulty' WindowName: ''
- ClassName: 'snap' WindowName: ''
- ClassName: 'mops' WindowName: ''
- ClassName: 'oxide' WindowName: ''
- ClassName: 'surveys' WindowName: ''
- ClassName: 'passwords' WindowName: ''
