Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'shzyjlbl' = '%TEMP%\!satana!.txt'
Создает или изменяет следующие файлы:
- %ALLUSERSPROFILE%\Start Menu\Programs\Startup\!satana!.txt
Модифицирует главную загрузочную запись (MBR).
Вредоносные функции:
Для затруднения выявления своего присутствия в системе
удаляет теневые копии разделов.
Создает и запускает на исполнение:
- '%TEMP%\kigfm.exe' {06407fc0-0b13-11e1-9859-806d6172696f} "<Полный путь к файлу>"
Запускает на исполнение:
- '<SYSTEM32>\notepad.exe' %TEMP%\!satana!.txt
Изменения в файловой системе:
Создает следующие файлы:
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\!satana!.txt
- %APPDATA%\Microsoft\Internet Explorer\!satana!.txt
- %APPDATA%\Microsoft\Credentials\S-1-5-21-2052111302-484763869-725345543-1003\!satana!.txt
- %APPDATA%\Microsoft\SystemCertificates\!satana!.txt
- %APPDATA%\Microsoft\MMC\!satana!.txt
- %APPDATA%\Microsoft\Media Player\!satana!.txt
- %APPDATA%\Microsoft\Credentials\!satana!.txt
- %APPDATA%\Identities\!satana!.txt
- %APPDATA%\!satana!.txt
- %HOMEPATH%\!satana!.txt
- %APPDATA%\Microsoft\Address Book\!satana!.txt
- %APPDATA%\Microsoft\!satana!.txt
- %APPDATA%\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\!satana!.txt
- %APPDATA%\Microsoft\SystemCertificates\My\!satana!.txt
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\!satana!.txt
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\bookmarkbackups\!satana!.txt
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\!satana!.txt
- %HOMEPATH%\Favorites\!satana!.txt
- %HOMEPATH%\Desktop\!satana!.txt
- %HOMEPATH%\Cookies\!satana!.txt
- %APPDATA%\Mozilla\Firefox\Profiles\!satana!.txt
- %APPDATA%\Microsoft\SystemCertificates\My\CTLs\!satana!.txt
- %APPDATA%\Microsoft\SystemCertificates\My\CRLs\!satana!.txt
- %APPDATA%\Microsoft\SystemCertificates\My\Certificates\!satana!.txt
- %APPDATA%\Mozilla\Firefox\!satana!.txt
- %APPDATA%\Mozilla\Extensions\!satana!.txt
- %APPDATA%\Mozilla\!satana!.txt
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\Certificates\!satana!.txt
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\!satana!.txt
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\!satana!.txt
- C:\Documents and Settings\NetworkService\Cookies\!satana!.txt
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CTLs\!satana!.txt
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CRLs\!satana!.txt
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\Media Player\!satana!.txt
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\!satana!.txt
- C:\Documents and Settings\NetworkService\Application Data\!satana!.txt
- C:\Documents and Settings\NetworkService\!satana!.txt
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\Internet Explorer\!satana!.txt
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\Credentials\S-1-5-20\!satana!.txt
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\Credentials\!satana!.txt
- C:\Documents and Settings\NetworkService\Local Settings\!satana!.txt
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\!satana!.txt
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\!satana!.txt
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\!satana!.txt
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\!satana!.txt
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\!satana!.txt
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\!satana!.txt
- C:\Documents and Settings\NetworkService\Local Settings\Temp\!satana!.txt
- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Credentials\!satana!.txt
- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\!satana!.txt
- C:\Documents and Settings\NetworkService\Local Settings\Application Data\!satana!.txt
- C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\!satana!.txt
- C:\Documents and Settings\NetworkService\Local Settings\History\!satana!.txt
- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-20\!satana!.txt
- %HOMEPATH%\Favorites\Links\!satana!.txt
- %HOMEPATH%\Local Settings\History\History.IE5\MSHist012011111020111111\!satana!.txt
- %HOMEPATH%\Local Settings\History\History.IE5\!satana!.txt
- %HOMEPATH%\Local Settings\History\!satana!.txt
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\!satana!.txt
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\!satana!.txt
- %HOMEPATH%\Local Settings\<INETFILES>\!satana!.txt
- <LS_APPDATA>\VMware\!satana!.txt
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\D\!satana!.txt
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\C\!satana!.txt
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\B\!satana!.txt
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\startupCache\!satana!.txt
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\F\!satana!.txt
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\E\!satana!.txt
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\!satana!.txt
- %HOMEPATH%\Recent\!satana!.txt
- %HOMEPATH%\PrintHood\!satana!.txt
- %HOMEPATH%\NetHood\!satana!.txt
- %HOMEPATH%\Start Menu\Programs\!satana!.txt
- %HOMEPATH%\Start Menu\!satana!.txt
- %HOMEPATH%\SendTo\!satana!.txt
- %HOMEPATH%\My Documents\My Received Files\!satana!.txt
- %HOMEPATH%\My Documents\!satana!.txt
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\!satana!.txt
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\!satana!.txt
- %HOMEPATH%\My Documents\My Pictures\!satana!.txt
- %HOMEPATH%\My Documents\My Music\!satana!.txt
- %HOMEPATH%\My Documents\Downloads\!satana!.txt
- <LS_APPDATA>\Microsoft\Credentials\S-1-5-21-2052111302-484763869-725345543-1003\!satana!.txt
- <LS_APPDATA>\Microsoft\Credentials\!satana!.txt
- <LS_APPDATA>\Microsoft\CD Burning\!satana!.txt
- <LS_APPDATA>\Mozilla\Firefox\!satana!.txt
- <LS_APPDATA>\Mozilla\!satana!.txt
- <LS_APPDATA>\Microsoft\Media Player\!satana!.txt
- <LS_APPDATA>\Microsoft\!satana!.txt
- <LS_APPDATA>\Identities\!satana!.txt
- <LS_APPDATA>\!satana!.txt
- %HOMEPATH%\Local Settings\!satana!.txt
- <LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\Outlook Express\!satana!.txt
- <LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\!satana!.txt
- <LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\!satana!.txt
- <LS_APPDATA>\Mozilla\Firefox\Profiles\!satana!.txt
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\7\!satana!.txt
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\6\!satana!.txt
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\5\!satana!.txt
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\A\!satana!.txt
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\9\!satana!.txt
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\8\!satana!.txt
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\4\!satana!.txt
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\0\!satana!.txt
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\!satana!.txt
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\!satana!.txt
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\3\!satana!.txt
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\2\!satana!.txt
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\1\!satana!.txt
- C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\MOE00UY1\!satana!.txt
- %ALLUSERSPROFILE%\Start Menu\Programs\!satana!.txt
- %ALLUSERSPROFILE%\Start Menu\!satana!.txt
- %ALLUSERSPROFILE%\Favorites\!satana!.txt
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Communications\!satana!.txt
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Accessibility\!satana!.txt
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\!satana!.txt
- %ALLUSERSPROFILE%\DRM\!satana!.txt
- %ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\!satana!.txt
- %ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\!satana!.txt
- %ALLUSERSPROFILE%\Documents\My Music\Sample Music\!satana!.txt
- %ALLUSERSPROFILE%\Documents\My Videos\!satana!.txt
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\!satana!.txt
- %ALLUSERSPROFILE%\Documents\My Pictures\!satana!.txt
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Entertainment\!satana!.txt
- C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\!satana!.txt
- C:\Documents and Settings\Default User\Application Data\Microsoft\Media Player\!satana!.txt
- C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\!satana!.txt
- C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CRLs\!satana!.txt
- C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\Certificates\!satana!.txt
- C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\!satana!.txt
- C:\Documents and Settings\Default User\Application Data\Microsoft\!satana!.txt
- %ALLUSERSPROFILE%\Start Menu\Programs\Games\!satana!.txt
- %ALLUSERSPROFILE%\Start Menu\Programs\Administrative Tools\!satana!.txt
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\System Tools\!satana!.txt
- C:\Documents and Settings\Default User\Application Data\!satana!.txt
- C:\Documents and Settings\Default User\!satana!.txt
- %ALLUSERSPROFILE%\Templates\!satana!.txt
- %ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\DSS\MachineKeys\!satana!.txt
- %ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\DSS\!satana!.txt
- %ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\!satana!.txt
- %ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\S-1-5-18\!satana!.txt
- %ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\MachineKeys\!satana!.txt
- %ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\!satana!.txt
- %ALLUSERSPROFILE%\Application Data\Microsoft\!satana!.txt
- <Текущая директория>\!satana!.txt
- %TEMP%\kigfm.exe
- %TEMP%\!satana!.txt
- %ALLUSERSPROFILE%\Application Data\!satana!.txt
- %ALLUSERSPROFILE%\!satana!.txt
- C:\Documents and Settings\!satana!.txt
- %ALLUSERSPROFILE%\Application Data\Microsoft\Dr Watson\!satana!.txt
- %ALLUSERSPROFILE%\Desktop\!satana!.txt
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\!satana!.txt
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\!satana!.txt
- %ALLUSERSPROFILE%\Documents\My Music\My Playlists\!satana!.txt
- %ALLUSERSPROFILE%\Documents\My Music\!satana!.txt
- %ALLUSERSPROFILE%\Documents\!satana!.txt
- %ALLUSERSPROFILE%\Application Data\Microsoft\Network\Connections\Pbk\!satana!.txt
- %ALLUSERSPROFILE%\Application Data\Microsoft\Media Player\!satana!.txt
- %ALLUSERSPROFILE%\Application Data\Microsoft\Media Index\!satana!.txt
- %ALLUSERSPROFILE%\Application Data\Microsoft\HTML Help\!satana!.txt
- %ALLUSERSPROFILE%\Application Data\Microsoft\Network\Connections\Cm\!satana!.txt
- %ALLUSERSPROFILE%\Application Data\Microsoft\Network\Connections\!satana!.txt
- %ALLUSERSPROFILE%\Application Data\Microsoft\Network\!satana!.txt
- C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CTLs\!satana!.txt
- C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\!satana!.txt
- C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\!satana!.txt
- C:\Documents and Settings\LocalService\Application Data\Microsoft\Media Player\!satana!.txt
- C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CTLs\!satana!.txt
- C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CRLs\!satana!.txt
- C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\Certificates\!satana!.txt
- C:\Documents and Settings\LocalService\Application Data\Microsoft\Internet Explorer\!satana!.txt
- C:\Documents and Settings\LocalService\Application Data\!satana!.txt
- C:\Documents and Settings\LocalService\!satana!.txt
- C:\Documents and Settings\Default User\Templates\!satana!.txt
- C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\S-1-5-19\!satana!.txt
- C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\!satana!.txt
- C:\Documents and Settings\LocalService\Application Data\Microsoft\!satana!.txt
- C:\Documents and Settings\LocalService\Cookies\!satana!.txt
- C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\!satana!.txt
- C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\!satana!.txt
- C:\Documents and Settings\LocalService\Local Settings\Temp\!satana!.txt
- C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\LBMMC3H3\!satana!.txt
- C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\CJCTQ25G\!satana!.txt
- C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\BGGTYMH1\!satana!.txt
- C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\!satana!.txt
- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\!satana!.txt
- C:\Documents and Settings\LocalService\Local Settings\Application Data\!satana!.txt
- C:\Documents and Settings\LocalService\Local Settings\!satana!.txt
- C:\Documents and Settings\LocalService\Local Settings\History\!satana!.txt
- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-19\!satana!.txt
- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\!satana!.txt
- C:\Documents and Settings\Default User\Local Settings\Temp\!satana!.txt
- C:\Documents and Settings\Default User\Local Settings\History\History.IE5\!satana!.txt
- C:\Documents and Settings\Default User\Local Settings\History\!satana!.txt
- C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\!satana!.txt
- C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\!satana!.txt
- C:\Documents and Settings\Default User\Local Settings\<INETFILES>\!satana!.txt
- C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Media Player\!satana!.txt
- C:\Documents and Settings\Default User\Favorites\!satana!.txt
- C:\Documents and Settings\Default User\Desktop\!satana!.txt
- C:\Documents and Settings\Default User\Cookies\!satana!.txt
- C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\!satana!.txt
- C:\Documents and Settings\Default User\Local Settings\Application Data\!satana!.txt
- C:\Documents and Settings\Default User\Local Settings\!satana!.txt
- C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\!satana!.txt
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\!satana!.txt
- C:\Documents and Settings\Default User\Start Menu\Programs\!satana!.txt
- C:\Documents and Settings\Default User\Start Menu\!satana!.txt
- C:\Documents and Settings\Default User\Start Menu\Programs\Startup\!satana!.txt
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Entertainment\!satana!.txt
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Accessibility\!satana!.txt
- C:\Documents and Settings\Default User\SendTo\!satana!.txt
- C:\Documents and Settings\Default User\My Documents\!satana!.txt
- C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\!satana!.txt
- C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\!satana!.txt
- C:\Documents and Settings\Default User\Recent\!satana!.txt
- C:\Documents and Settings\Default User\PrintHood\!satana!.txt
- C:\Documents and Settings\Default User\NetHood\!satana!.txt
Удаляет следующие файлы:
- <Полный путь к файлу>
Перемещает следующие файлы:
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\sessionstore.bak в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\nuk60@yandex.ru___sessionstore.bak
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\key3.db в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\nuk60@yandex.ru___key3.db
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\secmod.db в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\nuk60@yandex.ru___secmod.db
- %APPDATA%\Microsoft\Internet Explorer\brndlog.bak в %APPDATA%\Microsoft\Internet Explorer\nuk60@yandex.ru___brndlog.bak
- %APPDATA%\Microsoft\Internet Explorer\brndlog.txt в %APPDATA%\Microsoft\Internet Explorer\nuk60@yandex.ru___brndlog.txt
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\cert8.db в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\nuk60@yandex.ru___cert8.db
Изменяет множество файлов пользовательских данных (Trojan.Encoder).
Сетевая активность:
Подключается к:
- 'cl###flares.pw':80
TCP:
Запросы HTTP POST:
- http://cl###flares.pw/add.php
UDP:
- DNS ASK cl###flares.pw
