Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'StartCatMr' = '"%ProgramFiles%\MOTEX\LanScope Cat MR\Startmr.exe"'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\LSPSERVICE_MR] 'ImagePath' = '%ProgramFiles%\MOTEX\LanScope Cat MR\LspSrvAny.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\LSPSERVICE_MR] 'Start' = '00000002'
Вредоносные функции:
Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%WINDIR%\TEMPLSPCATMR\SETMR.exe' = '%WINDIR%\TEMPLSPCATMR\SETMR.exe:*:...
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] '%WINDIR%\TEMPLSPCATMR\SETMR.exe' = '%WINDIR%\TEMPLSPCATMR\SETMR.exe:*:En...
Создает и запускает на исполнение:
- '%ProgramFiles%\MOTEX\LanScope Cat MR\LspSrvAny.exe' -Install /silent
- '%WINDIR%\TEMPLSPCATMR\SETMR.exe' i t
Запускает на исполнение:
- '<SYSTEM32>\ping.exe' localhost -n 2
- '<SYSTEM32>\netsh.exe' firewall add allowedprogram program = "%WINDIR%\TEMPLSPCATMR\Setmr.exe" name = "LanScope Cat" profile = ALL
- '<SYSTEM32>\cmd.exe' /c %WINDIR%\TEMPLSPCATMR\_netsh.bat
- '<SYSTEM32>\chcp.com' 65001
Изменения в файловой системе:
Создает следующие файлы:
- %WINDIR%\mru.ini
- %WINDIR%\TEMPLSPCATMR\_netsh.bat
- %TEMP%\MrInst_Decmp_Utf8.log
- %TEMP%\MrInst_Set_Utf8.log
Присваивает атрибут 'скрытый' для следующих файлов:
- %WINDIR%\mru.ini
Удаляет следующие файлы:
- %WINDIR%\TEMPLSPCATMR\_netsh.bat
Перемещает следующие файлы:
- %WINDIR%\TEMPLSPCATMR\LspcUninst.exe в %ProgramFiles%\MOTEX\LanScope Cat MR\LspcUninst.exe
- %WINDIR%\TEMPLSPCATMR\LspCfm.exe в %ProgramFiles%\MOTEX\LanScope Cat MR\LspCfm.exe
- %WINDIR%\TEMPLSPCATMR\LspDevConf.exe в %ProgramFiles%\MOTEX\LanScope Cat MR\LspDevConf.exe
- %WINDIR%\TEMPLSPCATMR\LspcUninst.exe.manifest в %ProgramFiles%\MOTEX\LanScope Cat MR\LspcUninst.exe.manifest
- %WINDIR%\TEMPLSPCATMR\LspBho64.dll в %ProgramFiles%\MOTEX\LanScope Cat MR\LspBho64.dll
- %WINDIR%\TEMPLSPCATMR\LspBho.dll в %ProgramFiles%\MOTEX\LanScope Cat MR\LspBho.dll
- %WINDIR%\TEMPLSPCATMR\Lspcdw.dll в %ProgramFiles%\MOTEX\LanScope Cat MR\Lspcdw.dll
- %WINDIR%\TEMPLSPCATMR\LspBits.exe в %ProgramFiles%\MOTEX\LanScope Cat MR\LspBits.exe
- %WINDIR%\TEMPLSPCATMR\LspFilter_2k3.sys в %ProgramFiles%\MOTEX\LanScope Cat MR\LspFilter_2k3.sys
- %WINDIR%\TEMPLSPCATMR\LspFilter_2k.sys в %ProgramFiles%\MOTEX\LanScope Cat MR\LspFilter_2k.sys
- %WINDIR%\TEMPLSPCATMR\LspFilter_vista.sys в %ProgramFiles%\MOTEX\LanScope Cat MR\LspFilter_vista.sys
- %WINDIR%\TEMPLSPCATMR\LspFilter_2k3_x64.sys в %ProgramFiles%\MOTEX\LanScope Cat MR\LspFilter_2k3_x64.sys
- %WINDIR%\TEMPLSPCATMR\LspDnD64.dll в %ProgramFiles%\MOTEX\LanScope Cat MR\LspDnD64.dll
- %WINDIR%\TEMPLSPCATMR\LspDnD.dll в %ProgramFiles%\MOTEX\LanScope Cat MR\LspDnD.dll
- %WINDIR%\TEMPLSPCATMR\LspEvmon64.exe в %ProgramFiles%\MOTEX\LanScope Cat MR\LspEvmon64.exe
- %WINDIR%\TEMPLSPCATMR\LspEvMon.exe в %ProgramFiles%\MOTEX\LanScope Cat MR\LspEvMon.exe
- %WINDIR%\TEMPLSPCATMR\DWPD6891_x86.sys в %ProgramFiles%\MOTEX\LanScope Cat MR\DWPD6891_x86.sys
- %WINDIR%\TEMPLSPCATMR\DWCO6891_1607_x64.sys в %ProgramFiles%\MOTEX\LanScope Cat MR\DWCO6891_1607_x64.sys
- %WINDIR%\TEMPLSPCATMR\dsofile.dll в %ProgramFiles%\MOTEX\LanScope Cat MR\dsofile.dll
- %WINDIR%\TEMPLSPCATMR\DWCO6891_x64.sys в %ProgramFiles%\MOTEX\LanScope Cat MR\DWCO6891_x64.sys
- %WINDIR%\TEMPLSPCATMR\DWCO6891_1607_x86.sys в %ProgramFiles%\MOTEX\LanScope Cat MR\DWCO6891_1607_x86.sys
- %TEMP%\TEMPLSPCAT\Startmr.exe в %WINDIR%\TEMPLSPCATMR\Startmr.exe
- %TEMP%\TEMPLSPCAT\spflog.dll в %WINDIR%\TEMPLSPCATMR\spflog.dll
- %WINDIR%\TEMPLSPCATMR\cmr.exe в %ProgramFiles%\MOTEX\LanScope Cat MR\cmr.exe
- %WINDIR%\TEMPLSPCATMR\4THEYESDK6891.dll в %ProgramFiles%\MOTEX\LanScope Cat MR\4THEYESDK6891.dll
- %WINDIR%\TEMPLSPCATMR\DWPD6891_1607_x64.sys в %ProgramFiles%\MOTEX\LanScope Cat MR\DWPD6891_1607_x64.sys
- %WINDIR%\TEMPLSPCATMR\DWFI6891_x86.sys в %ProgramFiles%\MOTEX\LanScope Cat MR\DWFI6891_x86.sys
- %WINDIR%\TEMPLSPCATMR\DWPD6891_x64.sys в %ProgramFiles%\MOTEX\LanScope Cat MR\DWPD6891_x64.sys
- %WINDIR%\TEMPLSPCATMR\DWPD6891_1607_x86.sys в %ProgramFiles%\MOTEX\LanScope Cat MR\DWPD6891_1607_x86.sys
- %WINDIR%\TEMPLSPCATMR\DWFI6891_1607_x64.sys в %ProgramFiles%\MOTEX\LanScope Cat MR\DWFI6891_1607_x64.sys
- %WINDIR%\TEMPLSPCATMR\DWCO6891_x86.sys в %ProgramFiles%\MOTEX\LanScope Cat MR\DWCO6891_x86.sys
- %WINDIR%\TEMPLSPCATMR\DWFI6891_x64.sys в %ProgramFiles%\MOTEX\LanScope Cat MR\DWFI6891_x64.sys
- %WINDIR%\TEMPLSPCATMR\DWFI6891_1607_x86.sys в %ProgramFiles%\MOTEX\LanScope Cat MR\DWFI6891_1607_x86.sys
- %WINDIR%\TEMPLSPCATMR\LspFilter_vista_x64.sys в %ProgramFiles%\MOTEX\LanScope Cat MR\LspFilter_vista_x64.sys
- %WINDIR%\TEMPLSPCATMR\LspWaoicon48.png в %ProgramFiles%\MOTEX\LanScope Cat MR\LspWaoicon48.png
- %WINDIR%\TEMPLSPCATMR\LspWaoGcToMR.json в %ProgramFiles%\MOTEX\LanScope Cat MR\LspWaoGcToMR.json
- %WINDIR%\TEMPLSPCATMR\LspWaoIe.dll в %ProgramFiles%\MOTEX\LanScope Cat MR\LspWaoIe.dll
- %WINDIR%\TEMPLSPCATMR\LspWaoicon64.png в %ProgramFiles%\MOTEX\LanScope Cat MR\LspWaoicon64.png
- %WINDIR%\TEMPLSPCATMR\LspWaoFf.js в %ProgramFiles%\MOTEX\LanScope Cat MR\LspWaoFf.js
- %WINDIR%\TEMPLSPCATMR\LspWaoconfig.cfg в %ProgramFiles%\MOTEX\LanScope Cat MR\LspWaoconfig.cfg
- %WINDIR%\TEMPLSPCATMR\LspWaoGcToMR.exe в %ProgramFiles%\MOTEX\LanScope Cat MR\LspWaoGcToMR.exe
- %WINDIR%\TEMPLSPCATMR\LspWaoFf.xul в %ProgramFiles%\MOTEX\LanScope Cat MR\LspWaoFf.xul
- %WINDIR%\TEMPLSPCATMR\LspWeb64.dll в %ProgramFiles%\MOTEX\LanScope Cat MR\LspWeb64.dll
- %WINDIR%\TEMPLSPCATMR\LspWeb.dll в %ProgramFiles%\MOTEX\LanScope Cat MR\LspWeb.dll
- %WINDIR%\TEMPLSPCATMR\Startmr.exe в %ProgramFiles%\MOTEX\LanScope Cat MR\Startmr.exe
- %WINDIR%\TEMPLSPCATMR\spflog.dll в %ProgramFiles%\MOTEX\LanScope Cat MR\spflog.dll
- %WINDIR%\TEMPLSPCATMR\LspWaomanifest.mf в %ProgramFiles%\MOTEX\LanScope Cat MR\LspWaomanifest.mf
- %WINDIR%\TEMPLSPCATMR\LspWaoinstall.rdf в %ProgramFiles%\MOTEX\LanScope Cat MR\LspWaoinstall.rdf
- %WINDIR%\TEMPLSPCATMR\LspWaomozilla.sf в %ProgramFiles%\MOTEX\LanScope Cat MR\LspWaomozilla.sf
- %WINDIR%\TEMPLSPCATMR\LspWaomozilla.rsa в %ProgramFiles%\MOTEX\LanScope Cat MR\LspWaomozilla.rsa
- %WINDIR%\TEMPLSPCATMR\LspWaochrome.manifest в %ProgramFiles%\MOTEX\LanScope Cat MR\LspWaochrome.manifest
- %WINDIR%\TEMPLSPCATMR\LspMLAddin2x64.msi в %ProgramFiles%\MOTEX\LanScope Cat MR\LspMLAddin2x64.msi
- %WINDIR%\TEMPLSPCATMR\LspHook64.dll в %ProgramFiles%\MOTEX\LanScope Cat MR\LspHook64.dll
- %WINDIR%\TEMPLSPCATMR\LspMLAddin4x64.msi в %ProgramFiles%\MOTEX\LanScope Cat MR\LspMLAddin4x64.msi
- %WINDIR%\TEMPLSPCATMR\LspMLAddin2x86.msi в %ProgramFiles%\MOTEX\LanScope Cat MR\LspMLAddin2x86.msi
- %WINDIR%\TEMPLSPCATMR\LspFilter_win7_x64.sys в %ProgramFiles%\MOTEX\LanScope Cat MR\LspFilter_win7_x64.sys
- %WINDIR%\TEMPLSPCATMR\LspFilter_win7.sys в %ProgramFiles%\MOTEX\LanScope Cat MR\LspFilter_win7.sys
- %WINDIR%\TEMPLSPCATMR\LspHook.dll в %ProgramFiles%\MOTEX\LanScope Cat MR\LspHook.dll
- %WINDIR%\TEMPLSPCATMR\LspFilter_xp.sys в %ProgramFiles%\MOTEX\LanScope Cat MR\LspFilter_xp.sys
- %WINDIR%\TEMPLSPCATMR\LspSrvAny.exe в %ProgramFiles%\MOTEX\LanScope Cat MR\LspSrvAny.exe
- %WINDIR%\TEMPLSPCATMR\LspRelay.exe в %ProgramFiles%\MOTEX\LanScope Cat MR\LspRelay.exe
- %WINDIR%\TEMPLSPCATMR\LspUtil.dll в %ProgramFiles%\MOTEX\LanScope Cat MR\LspUtil.dll
- %WINDIR%\TEMPLSPCATMR\LspStop.exe в %ProgramFiles%\MOTEX\LanScope Cat MR\LspStop.exe
- %WINDIR%\TEMPLSPCATMR\LspOffDev.exe в %ProgramFiles%\MOTEX\LanScope Cat MR\LspOffDev.exe
- %WINDIR%\TEMPLSPCATMR\LspMLAddin4x86.msi в %ProgramFiles%\MOTEX\LanScope Cat MR\LspMLAddin4x86.msi
- %WINDIR%\TEMPLSPCATMR\LspQuest.exe в %ProgramFiles%\MOTEX\LanScope Cat MR\LspQuest.exe
- %WINDIR%\TEMPLSPCATMR\LspOffDevq.exe в %ProgramFiles%\MOTEX\LanScope Cat MR\LspOffDevq.exe
- %TEMP%\TEMPLSPCAT\LspcUninst.exe.manifest в %WINDIR%\TEMPLSPCATMR\LspcUninst.exe.manifest
- %TEMP%\TEMPLSPCAT\LspcUninst.exe в %WINDIR%\TEMPLSPCATMR\LspcUninst.exe
- %TEMP%\TEMPLSPCAT\LspDnD.dll в %WINDIR%\TEMPLSPCATMR\LspDnD.dll
- %TEMP%\TEMPLSPCAT\LspDevConf.exe в %WINDIR%\TEMPLSPCATMR\LspDevConf.exe
- %TEMP%\TEMPLSPCAT\LspBits.exe в %WINDIR%\TEMPLSPCATMR\LspBits.exe
- %TEMP%\TEMPLSPCAT\LspBho64.dll в %WINDIR%\TEMPLSPCATMR\LspBho64.dll
- %TEMP%\TEMPLSPCAT\LspCfm.exe в %WINDIR%\TEMPLSPCATMR\LspCfm.exe
- %TEMP%\TEMPLSPCAT\Lspcdw.dll в %WINDIR%\TEMPLSPCATMR\Lspcdw.dll
- %TEMP%\TEMPLSPCAT\LspFilter_2k3_x64.sys в %WINDIR%\TEMPLSPCATMR\LspFilter_2k3_x64.sys
- %TEMP%\TEMPLSPCAT\LspFilter_2k3.sys в %WINDIR%\TEMPLSPCATMR\LspFilter_2k3.sys
- %TEMP%\TEMPLSPCAT\LspFilter_vista_x64.sys в %WINDIR%\TEMPLSPCATMR\LspFilter_vista_x64.sys
- %TEMP%\TEMPLSPCAT\LspFilter_vista.sys в %WINDIR%\TEMPLSPCATMR\LspFilter_vista.sys
- %TEMP%\TEMPLSPCAT\LspEvMon.exe в %WINDIR%\TEMPLSPCATMR\LspEvMon.exe
- %TEMP%\TEMPLSPCAT\LspDnD64.dll в %WINDIR%\TEMPLSPCATMR\LspDnD64.dll
- %TEMP%\TEMPLSPCAT\LspFilter_2k.sys в %WINDIR%\TEMPLSPCATMR\LspFilter_2k.sys
- %TEMP%\TEMPLSPCAT\LspEvmon64.exe в %WINDIR%\TEMPLSPCATMR\LspEvmon64.exe
- %TEMP%\TEMPLSPCAT\LspBho.dll в %WINDIR%\TEMPLSPCATMR\LspBho.dll
- %TEMP%\TEMPLSPCAT\DWCO6891_1607_x86.sys в %WINDIR%\TEMPLSPCATMR\DWCO6891_1607_x86.sys
- %TEMP%\TEMPLSPCAT\DWCO6891_1607_x64.sys в %WINDIR%\TEMPLSPCATMR\DWCO6891_1607_x64.sys
- %TEMP%\TEMPLSPCAT\DWCO6891_x86.sys в %WINDIR%\TEMPLSPCATMR\DWCO6891_x86.sys
- %TEMP%\TEMPLSPCAT\DWCO6891_x64.sys в %WINDIR%\TEMPLSPCATMR\DWCO6891_x64.sys
- %TEMP%\TEMPLSPCAT\4THEYESDK6891.dll в %WINDIR%\TEMPLSPCATMR\4THEYESDK6891.dll
- %TEMP%\TEMPLSPCAT\$ в %WINDIR%\TEMPLSPCATMR\$
- %TEMP%\TEMPLSPCAT\dsofile.dll в %WINDIR%\TEMPLSPCATMR\dsofile.dll
- %TEMP%\TEMPLSPCAT\cmr.exe в %WINDIR%\TEMPLSPCATMR\cmr.exe
- %TEMP%\TEMPLSPCAT\DWPD6891_1607_x86.sys в %WINDIR%\TEMPLSPCATMR\DWPD6891_1607_x86.sys
- %TEMP%\TEMPLSPCAT\DWPD6891_1607_x64.sys в %WINDIR%\TEMPLSPCATMR\DWPD6891_1607_x64.sys
- %TEMP%\TEMPLSPCAT\DWPD6891_x86.sys в %WINDIR%\TEMPLSPCATMR\DWPD6891_x86.sys
- %TEMP%\TEMPLSPCAT\DWPD6891_x64.sys в %WINDIR%\TEMPLSPCATMR\DWPD6891_x64.sys
- %TEMP%\TEMPLSPCAT\DWFI6891_1607_x86.sys в %WINDIR%\TEMPLSPCATMR\DWFI6891_1607_x86.sys
- %TEMP%\TEMPLSPCAT\DWFI6891_1607_x64.sys в %WINDIR%\TEMPLSPCATMR\DWFI6891_1607_x64.sys
- %TEMP%\TEMPLSPCAT\DWFI6891_x86.sys в %WINDIR%\TEMPLSPCATMR\DWFI6891_x86.sys
- %TEMP%\TEMPLSPCAT\DWFI6891_x64.sys в %WINDIR%\TEMPLSPCATMR\DWFI6891_x64.sys
- %TEMP%\TEMPLSPCAT\LspFilter_win7.sys в %WINDIR%\TEMPLSPCATMR\LspFilter_win7.sys
- %TEMP%\TEMPLSPCAT\LspWaoicon64.png в %WINDIR%\TEMPLSPCATMR\LspWaoicon64.png
- %TEMP%\TEMPLSPCAT\LspWaoicon48.png в %WINDIR%\TEMPLSPCATMR\LspWaoicon48.png
- %TEMP%\TEMPLSPCAT\LspWaoinstall.rdf в %WINDIR%\TEMPLSPCATMR\LspWaoinstall.rdf
- %TEMP%\TEMPLSPCAT\LspWaoIe.dll в %WINDIR%\TEMPLSPCATMR\LspWaoIe.dll
- %TEMP%\TEMPLSPCAT\LspWaoFf.xul в %WINDIR%\TEMPLSPCATMR\LspWaoFf.xul
- %TEMP%\TEMPLSPCAT\LspWaoFf.js в %WINDIR%\TEMPLSPCATMR\LspWaoFf.js
- %TEMP%\TEMPLSPCAT\LspWaoGcToMR.json в %WINDIR%\TEMPLSPCATMR\LspWaoGcToMR.json
- %TEMP%\TEMPLSPCAT\LspWaoGcToMR.exe в %WINDIR%\TEMPLSPCATMR\LspWaoGcToMR.exe
- %TEMP%\TEMPLSPCAT\Mr.ini в %WINDIR%\TEMPLSPCATMR\Mr.ini
- %TEMP%\TEMPLSPCAT\LspWeb64.dll в %WINDIR%\TEMPLSPCATMR\LspWeb64.dll
- %TEMP%\TEMPLSPCAT\SETMR.exe в %WINDIR%\TEMPLSPCATMR\SETMR.exe
- %TEMP%\TEMPLSPCAT\Msg в %WINDIR%\TEMPLSPCATMR\Msg
- %TEMP%\TEMPLSPCAT\LspWaomozilla.rsa в %WINDIR%\TEMPLSPCATMR\LspWaomozilla.rsa
- %TEMP%\TEMPLSPCAT\LspWaomanifest.mf в %WINDIR%\TEMPLSPCATMR\LspWaomanifest.mf
- %TEMP%\TEMPLSPCAT\LspWeb.dll в %WINDIR%\TEMPLSPCATMR\LspWeb.dll
- %TEMP%\TEMPLSPCAT\LspWaomozilla.sf в %WINDIR%\TEMPLSPCATMR\LspWaomozilla.sf
- %TEMP%\TEMPLSPCAT\LspWaoconfig.cfg в %WINDIR%\TEMPLSPCATMR\LspWaoconfig.cfg
- %TEMP%\TEMPLSPCAT\LspMLAddin2x86.msi в %WINDIR%\TEMPLSPCATMR\LspMLAddin2x86.msi
- %TEMP%\TEMPLSPCAT\LspMLAddin2x64.msi в %WINDIR%\TEMPLSPCATMR\LspMLAddin2x64.msi
- %TEMP%\TEMPLSPCAT\LspMLAddin4x86.msi в %WINDIR%\TEMPLSPCATMR\LspMLAddin4x86.msi
- %TEMP%\TEMPLSPCAT\LspMLAddin4x64.msi в %WINDIR%\TEMPLSPCATMR\LspMLAddin4x64.msi
- %TEMP%\TEMPLSPCAT\LspFilter_xp.sys в %WINDIR%\TEMPLSPCATMR\LspFilter_xp.sys
- %TEMP%\TEMPLSPCAT\LspFilter_win7_x64.sys в %WINDIR%\TEMPLSPCATMR\LspFilter_win7_x64.sys
- %TEMP%\TEMPLSPCAT\LspHook64.dll в %WINDIR%\TEMPLSPCATMR\LspHook64.dll
- %TEMP%\TEMPLSPCAT\LspHook.dll в %WINDIR%\TEMPLSPCATMR\LspHook.dll
- %TEMP%\TEMPLSPCAT\LspStop.exe в %WINDIR%\TEMPLSPCATMR\LspStop.exe
- %TEMP%\TEMPLSPCAT\LspSrvAny.exe в %WINDIR%\TEMPLSPCATMR\LspSrvAny.exe
- %TEMP%\TEMPLSPCAT\LspWaochrome.manifest в %WINDIR%\TEMPLSPCATMR\LspWaochrome.manifest
- %TEMP%\TEMPLSPCAT\LspUtil.dll в %WINDIR%\TEMPLSPCATMR\LspUtil.dll
- %TEMP%\TEMPLSPCAT\LspOffDevq.exe в %WINDIR%\TEMPLSPCATMR\LspOffDevq.exe
- %TEMP%\TEMPLSPCAT\LspOffDev.exe в %WINDIR%\TEMPLSPCATMR\LspOffDev.exe
- %TEMP%\TEMPLSPCAT\LspRelay.exe в %WINDIR%\TEMPLSPCATMR\LspRelay.exe
- %TEMP%\TEMPLSPCAT\LspQuest.exe в %WINDIR%\TEMPLSPCATMR\LspQuest.exe
Другое:
Ищет следующие окна:
- ClassName: 'TMainForm' WindowName: 'LanScope Cat'
- ClassName: 'LanScopeCat3 SWITCH USER' WindowName: ''
