Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Google Update' = 'C:\Users\Humberto\AppData\Local\Google\Update\GoogleUpdateCore.exe'
Вредоносные функции:
Создает и запускает на исполнение:
- '<SYSTEM32>\wscript.exe' "%HOMEPATH%\AppData\Local\Google\Update\install.vbs"
Запускает на исполнение:
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v "Google Update" /t REG_SZ /d "C:\Users\Humberto\AppData\Local\Google\Update\GoogleUpdateCore.exe"
- '<SYSTEM32>\cmd.exe' /c ""%HOMEPATH%\AppData\Local\Google\Update\install.bat" "
Изменения в файловой системе:
Создает следующие файлы:
- %HOMEPATH%\AppData\Local\Google\Update\bin\tar.exe
- %HOMEPATH%\AppData\Local\Google\Update\bin\log\unins000.exe
- %HOMEPATH%\AppData\Local\Google\Update\bin\log\voice.exe
- %HOMEPATH%\AppData\Local\Google\Update\bin\srvstart.exe
- %HOMEPATH%\AppData\Local\Google\Update\bin\svc.exe
- %HOMEPATH%\AppData\Local\Google\Update\bin\svchost.exe
- %HOMEPATH%\AppData\Local\Google\Update\bin\zip\Far\7-ZipFar.dll
- %HOMEPATH%\AppData\Local\Google\Update\bin\zip\Far\7-ZipFar64.dll
- %HOMEPATH%\AppData\Local\Google\Update\bin\zip\7za.dll
- %HOMEPATH%\AppData\Local\Google\Update\bin\ftp\WinSCP.exe
- %HOMEPATH%\AppData\Local\Google\Update\bin\log\wuapp.exe
- %HOMEPATH%\AppData\Local\Google\Update\bin\log\wupdate__.exe
- %HOMEPATH%\AppData\Local\Google\Update\bin\ps\pspasswd.exe
- %HOMEPATH%\AppData\Local\Google\Update\bin\ps\pspasswd64.exe
- %HOMEPATH%\AppData\Local\Google\Update\bin\ps\psping.exe
- %HOMEPATH%\AppData\Local\Google\Update\bin\ps\PsLoggedon.exe
- %HOMEPATH%\AppData\Local\Google\Update\bin\ps\PsLoggedon64.exe
- %HOMEPATH%\AppData\Local\Google\Update\bin\ps\psloglist.exe
- %HOMEPATH%\AppData\Local\Google\Update\bin\ps\psshutdown.exe
- %HOMEPATH%\AppData\Local\Google\Update\bin\ps\pssuspend.exe
- %HOMEPATH%\AppData\Local\Google\Update\bin\ps\pssuspend64.exe
- %HOMEPATH%\AppData\Local\Google\Update\bin\ps\psping64.exe
- %HOMEPATH%\AppData\Local\Google\Update\bin\ps\PsService.exe
- %HOMEPATH%\AppData\Local\Google\Update\bin\ps\PsService64.exe
- %HOMEPATH%\AppData\Local\Google\Update\bin\abe.jar
- %HOMEPATH%\AppData\Local\Google\Update\bin\zip\Far\7-ZipEng.lng
- %HOMEPATH%\AppData\Local\Google\Update\bin\zip\Far\7-ZipRus.lng
- %HOMEPATH%\AppData\Local\Google\Update\bin\log\unins000.dat
- %HOMEPATH%\AppData\Local\Google\Update\bin\zip\Far\7-ZipEng.hlf
- %HOMEPATH%\AppData\Local\Google\Update\bin\zip\Far\7-ZipRus.hlf
- %HOMEPATH%\AppData\Local\Google\Update\wupdate.vbs
- %HOMEPATH%\AppData\Local\Google\Update\bin\log\wait26trans.gif
- %HOMEPATH%\AppData\Local\Google\Update\bin\log\SourceCode.zip\KidLogger PRO source.zip
- %HOMEPATH%\AppData\Local\Google\Update\bin\log\unins000.msg
- %HOMEPATH%\AppData\Local\Google\Update\bin\zip\Far\far7z.reg
- %HOMEPATH%\AppData\Local\Google\Update\install.vbs
- %HOMEPATH%\AppData\Local\Google\Update\bin\AdbWinApi.dll
- %HOMEPATH%\AppData\Local\Google\Update\bin\AdbWinUsbApi.dll
- %HOMEPATH%\AppData\Local\Google\Update\bin\log\lame_enc.dll
- %HOMEPATH%\AppData\Local\Google\Update\bin\zip\x64\7za.dll
- %HOMEPATH%\AppData\Local\Google\Update\bin\zip\7zxa.dll
- %HOMEPATH%\AppData\Local\Google\Update\bin\zip\x64\7zxa.dll
- %HOMEPATH%\AppData\Local\Google\Update\bin\pcre3.dll
- %HOMEPATH%\AppData\Local\Google\Update\bin\regex2.dll
- %HOMEPATH%\AppData\Local\Google\Update\bin\srvstart.dll
- %HOMEPATH%\AppData\Local\Google\Update\bin\libiconv2.dll
- %HOMEPATH%\AppData\Local\Google\Update\bin\libintl3.dll
- %HOMEPATH%\AppData\Local\Google\Update\bin\logger.dll
- %HOMEPATH%\AppData\Local\Google\Update\bin\ps\pslist64.exe
- %HOMEPATH%\AppData\Local\Google\Update\bin\log\languages\portuguese.txt
- %HOMEPATH%\AppData\Local\Google\Update\bin\log\languages\russian.txt
- %HOMEPATH%\AppData\Local\Google\Update\bin\log\languages\spanish.txt
- %HOMEPATH%\AppData\Local\Google\Update\bin\log\license.txt
- %HOMEPATH%\AppData\Local\Google\Update\bin\ftp\myscript.txt
- %HOMEPATH%\AppData\Local\Google\Update\bin\log\languages\polish.txt
- %HOMEPATH%\AppData\Local\Google\Update\bin\log\logs\file.js
- %HOMEPATH%\AppData\Local\Google\Update\bin\zip\Far\7zToFar.ini
- %HOMEPATH%\AppData\Local\Google\Update\bin\ftp\WinSCP.ini
- %HOMEPATH%\AppData\Local\Google\Update\bin\log\languages\turkish.txt
- %HOMEPATH%\AppData\Local\Google\Update\bin\log\test_upload.htm
- %HOMEPATH%\AppData\Local\Google\Update\bin\log\logs\style.css
- %HOMEPATH%\AppData\Local\Google\Update\bin\log\languages\deutsch.txt
- %HOMEPATH%\AppData\Local\Google\Update\bin\log\languages\english.txt
- %HOMEPATH%\AppData\Local\Google\Update\bin\zip\Far\far7z.txt
- %HOMEPATH%\AppData\Local\Google\Update\bin\log\readme.txt
- %HOMEPATH%\AppData\Local\Google\Update\bin\zip\readme.txt
- %HOMEPATH%\AppData\Local\Google\Update\bin\log\languages\chinese.txt
- %HOMEPATH%\AppData\Local\Google\Update\bin\log\languages\italian.txt
- %HOMEPATH%\AppData\Local\Google\Update\bin\log\languages\italian_orig.txt
- %HOMEPATH%\AppData\Local\Google\Update\bin\zip\License.txt
- %HOMEPATH%\AppData\Local\Google\Update\bin\log\languages\french.txt
- %HOMEPATH%\AppData\Local\Google\Update\bin\zip\history.txt
- %HOMEPATH%\AppData\Local\Google\Update\bin\log\languages\indonesian.txt
- %HOMEPATH%\AppData\Local\Google\Update\bin\ps\psfile.exe
- %HOMEPATH%\AppData\Local\Google\Update\bin\ps\psfile64.exe
- %HOMEPATH%\AppData\Local\Google\Update\bin\ps\PsGetsid.exe
- %HOMEPATH%\AppData\Local\Google\Update\bin\grep.exe
- %HOMEPATH%\AppData\Local\Google\Update\bin\ps\PsExec.exe
- %HOMEPATH%\AppData\Local\Google\Update\bin\ps\PsExec64.exe
- %HOMEPATH%\AppData\Local\Google\Update\bin\ps\pskill.exe
- %HOMEPATH%\AppData\Local\Google\Update\bin\ps\pskill64.exe
- %HOMEPATH%\AppData\Local\Google\Update\bin\ps\pslist.exe
- %HOMEPATH%\AppData\Local\Google\Update\bin\ps\PsGetsid64.exe
- %HOMEPATH%\AppData\Local\Google\Update\bin\ps\PsInfo.exe
- %HOMEPATH%\AppData\Local\Google\Update\bin\ps\PsInfo64.exe
- %HOMEPATH%\AppData\Local\Google\Update\update.bat
- %HOMEPATH%\AppData\Local\Google\Update\upload.bat
- %HOMEPATH%\AppData\Local\Google\Update\bin\log\Autorun.inf
- %HOMEPATH%\AppData\Local\Google\Update\db.bat
- %HOMEPATH%\AppData\Local\Google\Update\install.bat
- %HOMEPATH%\AppData\Local\Google\Update\run.bat
- %HOMEPATH%\AppData\Local\Google\Update\bin\log\cam-shot.exe
- %HOMEPATH%\AppData\Local\Google\Update\bin\curl.exe
- %HOMEPATH%\AppData\Local\Google\Update\GoogleUpdateCore.exe
- %HOMEPATH%\AppData\Local\Google\Update\bin\ftp\WinSCP.com
- %HOMEPATH%\AppData\Local\Google\Update\bin\zip\7za.exe
- %HOMEPATH%\AppData\Local\Google\Update\bin\zip\x64\7za.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- %HOMEPATH%\AppData\Local\Google\Update\upload.bat
- %HOMEPATH%\AppData\Local\Google\Update\install.vbs
- %HOMEPATH%\AppData\Local\Google\Update\wupdate.vbs
- %HOMEPATH%\AppData\Local\Google\Update\update.bat
- %HOMEPATH%\AppData\Local\Google\Update\db.bat
- %HOMEPATH%\AppData\Local\Google\Update\install.bat
- %HOMEPATH%\AppData\Local\Google\Update\run.bat
Другое:
Ищет следующие окна:
- ClassName: 'EDIT' WindowName: ''
