Техническая информация
Вредоносные функции:
Создает и запускает на исполнение:
- '%TEMP%\RarSFX0\M.exe'
- 'C:\programdata\microsoft\intel\R8.exe'
- 'C:\programdata\microsoft\intel\MOS.exe'
- '%APPDATA%\1337\dwm.exe'
- 'C:\Log\Rar.exe' e -p40564203 db.exe
- '<SYSTEM32>\wscript.exe' "c:\programdata\microsoft\rootsystem\P.vbs"
- 'C:\programdata\microsoft\rootsystem\1.exe' /LoadPasswordsIE=1 /LoadPasswordsFirefox=1 /LoadPasswordsChrome=1 /LoadPasswordsOpera=1 /LoadPasswordsSafari=1 /LoadPasswordsSeaMonkey=1 /LoadPasswordsYandex=1 /stext passwords.txt
- 'C:\programdata\microsoft\rootsystem\P.exe'
- '<SYSTEM32>\wscript.exe' "C:\rdp\run.vbs"
- 'C:\programdata\microsoft\intel\P.exe'
- '<SYSTEM32>\wscript.exe' "C:\Log\run.vbs"
- 'C:\programdata\microsoft\intel\R.exe'
- '<SYSTEM32>\wscript.exe' "c:\programdata\microsoft\temp\Clean.vbs"
- 'C:\programdata\microsoft\intel\Temp.exe'
- '<SYSTEM32>\wscript.exe' "c:\programdata\microsoft\intel\1.vbs"
- 'C:\programdata\microsoft\intel\cheat.exe' -p123 -dc:\Programdata\microsoft\intel\
- '%APPDATA%\1337\winit.exe'
- '<SYSTEM32>\wscript.exe' "c:\Programdata\microsoft\intel\fake.vbs"
- 'C:\programdata\microsoft\intel\svchost.exe'
- 'C:\programdata\microsoft\intel\smss.exe'
- 'C:\programdata\microsoft\intel\winlogon.exe'
Запускает на исполнение:
- '<SYSTEM32>\taskkill.exe' /f /im Rar.exe
- '<SYSTEM32>\cmd.exe' /c ""C:\rdp\pause.bat" "
- '<SYSTEM32>\sc.exe' delete swprv
- '<SYSTEM32>\cmd.exe' /c C:\programdata\microsoft\temp\H.bat
- '<SYSTEM32>\taskkill.exe' /IM svchost.exe.exe /T /F
- '<SYSTEM32>\cmd.exe' /c C:\programdata\microsoft\temp\Temp.bat
- '<SYSTEM32>\cmd.exe' /c c:\programdata\microsoft\rootsystem\1.exe /LoadPasswordsIE=1 /LoadPasswordsFirefox=1 /LoadPasswordsChrome=1 /LoadPasswordsOpera=1 /LoadPasswordsSafari=1 /LoadPasswordsSeaMonkey=1 /LoadPasswo...
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\5.tmp\6.bat" "%APPDATA%\1337\winit.exe""
- '<SYSTEM32>\cmd.exe' /c ""c:\Programdata\microsoft\intel\L.bat" "
- '<SYSTEM32>\cmd.exe' /c ""c:\ProgramData\microsoft\intel\st.bat" "
- '<SYSTEM32>\cmd.exe' /c ""C:\Log\pause.bat" "
- '<SYSTEM32>\taskkill.exe' /IM winhost.exe /T /F
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\A.tmp\B.bat" "%APPDATA%\1337\dwm.exe""
- '<SYSTEM32>\cmd.exe' /c ""c:\ProgramData\microsoft\Temp\Clean.bat" "
Изменения в файловой системе:
Создает следующие файлы:
- C:\Log\install.vbs
- C:\Log\vp8encoder.dll
- C:\Log\svnhost.exe
- C:\Log\svcservice.exe
- C:\programdata\microsoft\intel\Cheat64.exe
- %APPDATA%\1337\csrss.exe
- C:\Log\Rar.exe
- C:\Log\db.exe
- C:\Log\pause.bat
- %APPDATA%\1337\dwm.exe
- %TEMP%\nsz8.tmp
- C:\programdata\microsoft\intel\Cheat32.exe
- C:\programdata\microsoft\rootsystem\P.exe
- C:\rdp\pause.bat
- C:\programdata\microsoft\rootsystem\P.vbs
- C:\programdata\microsoft\rootsystem\passwords.txt
- C:\programdata\microsoft\rootsystem\1.exe
- C:\rdp\db.rar
- C:\Log\install.bat
- C:\programdata\microsoft\intel\OS.bat
- C:\Log\regedit.reg
- C:\rdp\Rar.exe
- C:\rdp\run.vbs
- %APPDATA%\1337\winit.exe
- C:\programdata\microsoft\intel\L.bat
- C:\programdata\microsoft\intel\fake.vbs
- C:\programdata\microsoft\intel\MOS.exe
- C:\programdata\microsoft\intel\R.exe
- C:\programdata\microsoft\intel\P.exe
- C:\programdata\microsoft\intel\winlogon.exe
- C:\programdata\microsoft\intel\cheat.exe
- C:\programdata\microsoft\intel\1.vbs
- C:\programdata\microsoft\intel\st.bat
- C:\programdata\microsoft\intel\Temp.exe
- C:\programdata\microsoft\intel\svchost.exe
- C:\programdata\microsoft\intel\R8.exe
- C:\programdata\microsoft\temp\H.bat
- C:\programdata\microsoft\temp\Clean.vbs
- %TEMP%\nsw2.tmp
- %APPDATA%\1337\sihost.exe
- C:\Log\run.vbs
- C:\programdata\microsoft\temp\Clean.bat
- C:\programdata\microsoft\temp\Polices.bat
- C:\programdata\microsoft\intel\smss.exe
- C:\programdata\microsoft\temp\Polices.vbs
- C:\programdata\microsoft\temp\5.xml
- C:\programdata\microsoft\temp\Temp.bat
Удаляет следующие файлы:
- C:\programdata\microsoft\intel\st.bat
- C:\programdata\microsoft\intel\svchost.exe
- C:\programdata\microsoft\intel\smss.exe
- C:\programdata\microsoft\intel\R.exe
- C:\programdata\microsoft\intel\R8.exe
- C:\programdata\microsoft\intel\Temp.exe
- C:\programdata\microsoft\rootsystem\P.vbs
- %TEMP%\5.tmp\6.bat
- C:\programdata\microsoft\rootsystem\P.exe
- C:\programdata\microsoft\intel\winlogon.exe
- C:\programdata\microsoft\rootsystem\1.exe
- C:\programdata\microsoft\intel\cheat.exe
- C:\programdata\microsoft\intel\Cheat32.exe
- C:\programdata\microsoft\intel\1.vbs
- %TEMP%\nsr3.tmp\System.dll
- %TEMP%\nsz9.tmp\System.dll
- C:\programdata\microsoft\intel\Cheat64.exe
- C:\programdata\microsoft\intel\OS.bat
- C:\programdata\microsoft\intel\P.exe
- C:\programdata\microsoft\intel\MOS.exe
- C:\programdata\microsoft\intel\fake.vbs
- C:\programdata\microsoft\intel\L.bat
Изменяет файл HOSTS.
Другое:
Ищет следующие окна:
- ClassName: '' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
