Техническая информация
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\net.exe' stop "Printer Control"
Изменения в файловой системе:
Создает следующие файлы:
- %WINDIR%\Wireless Printer\unins000.msg
- %WINDIR%\Wireless Printer\unins000.dat
- <SYSTEM32>\is-9BJH6.tmp
- <SYSTEM32>\is-UG5JU.tmp
- <SYSTEM32>\wordpad.exe
- %TEMP%\is-OVPUU.tmp\DefForms.exe
- %TEMP%\is-9KFDH.tmp\DefForms.tmp
- %TEMP%\is-OVPUU.tmp\PrtSetupX.exe
- %WINDIR%\Wireless Printer\PrtSetupX.exe
- <SYSTEM32>\is-R2QKG.tmp
- %WINDIR%\SAM Printer\is-D26LC.tmp
- %WINDIR%\Fonts\is-IRCAO.tmp
- %WINDIR%\SAM Printer\is-2OELA.tmp
- %WINDIR%\SAM Printer\is-G9SSU.tmp
- %WINDIR%\Fonts\is-1QOTS.tmp
- %WINDIR%\Fonts\is-8EODU.tmp
- %WINDIR%\Fonts\is-S6EGQ.tmp
- %WINDIR%\Fonts\is-3FH6O.tmp
- %WINDIR%\Fonts\is-JVH1D.tmp
- %TEMP%\is-EJDAE.tmp\_isetup\_shfoldr.dll
- %CommonProgramFiles%\ActPrint\is-496T1.tmp
- %CommonProgramFiles%\ActPrint\is-7JAGJ.tmp
- %CommonProgramFiles%\ActPrint\is-93C9A.tmp
- %CommonProgramFiles%\ActPrint\is-G35CI.tmp
- %CommonProgramFiles%\ActPrint\is-1AGOL.tmp
- %CommonProgramFiles%\ActPrint\is-MQLOG.tmp
- %CommonProgramFiles%\ActPrint\is-BA1B7.tmp
- %CommonProgramFiles%\ActPrint\is-E3T05.tmp
- %CommonProgramFiles%\ActPrint\is-B5320.tmp
- %CommonProgramFiles%\ActPrint\is-PPL64.tmp
- %TEMP%\is-N25HG.tmp\_isetup\_iscrypt.dll
- %CommonProgramFiles%\ActPrint\is-1RANC.tmp
- %TEMP%\is-P8J6T.tmp\PrtSetupX.tmp
- %TEMP%\is-N25HG.tmp\_isetup\_shfoldr.dll
- %CommonProgramFiles%\ActPrint\is-1R4T0.tmp
- %CommonProgramFiles%\ActPrint\is-C7T0I.tmp
- %CommonProgramFiles%\ActPrint\is-GAPDU.tmp
- %CommonProgramFiles%\ActPrint\is-0KH2C.tmp
- %CommonProgramFiles%\ActPrint\is-R84BH.tmp
- C:\Sam\PrintControl.exe
- C:\Sam\UnInstall.exe
- C:\Sam\Extract.exe
- C:\Sam\FTPDriverDownload.exe
- C:\Sam\Driver\virtualprinter.exe
- %TEMP%\is-OVPUU.tmp\_isetup\_iscrypt.dll
- %TEMP%\is-OVPUU.tmp\gdiplus.dll
- %TEMP%\is-K9AS8.tmp\virtualprinter.tmp
- %TEMP%\is-OVPUU.tmp\_isetup\_shfoldr.dll
- C:\Sam\clntinfo.ini
- %TEMP%\pft3.tmp\pftw1.pkg
- %ProgramFiles%\Sam\clntinfo.ini
- %TEMP%\ext2.tmp
- %TEMP%\plf1.tmp
- %ProgramFiles%\Sam\Driver\virtualprinter.exe
- %ProgramFiles%\Sam\PrintControl.exe
- %ProgramFiles%\Sam\UnInstall.exe
- %ProgramFiles%\Sam\Extract.exe
- %ProgramFiles%\Sam\FTPDriverDownload.exe
- %TEMP%\is-OVPUU.tmp\FontMap.exe
- %WINDIR%\SAM Printer\is-P0FE6.tmp
- %WINDIR%\SAM Printer\is-O955J.tmp
- %WINDIR%\SAM Printer\is-4NIEK.tmp
- %WINDIR%\SAM Printer\is-VJR8B.tmp
- %WINDIR%\SAM Printer\is-56DTR.tmp
- %WINDIR%\SAM Printer\is-RIV3B.tmp
- %WINDIR%\SAM Printer\is-5GUPK.tmp
- %WINDIR%\SAM Printer\is-BTE7C.tmp
- %WINDIR%\SAM Printer\is-KVU8B.tmp
- %WINDIR%\Wireless Printer\is-72LQB.tmp
- %WINDIR%\Wireless Printer\is-UBVMV.tmp
- %WINDIR%\Wireless Printer\is-2HHRV.tmp
- <SYSTEM32>\FontMap.exe
- %WINDIR%\Wireless Printer\is-RMH8D.tmp
- %WINDIR%\Wireless Printer\is-JL628.tmp
- %WINDIR%\Wireless Printer\is-J70GF.tmp
- %WINDIR%\Wireless Printer\is-E4E7N.tmp
- %WINDIR%\Wireless Printer\is-H3I3S.tmp
- %WINDIR%\Wireless Printer\is-P2PN8.tmp
Удаляет следующие файлы:
- %TEMP%\is-OVPUU.tmp\FontMap.exe
- %TEMP%\is-EJDAE.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-9KFDH.tmp\DefForms.tmp
- %TEMP%\is-OVPUU.tmp\gdiplus.dll
- %TEMP%\ext2.tmp
- %TEMP%\pft3.tmp\pftw1.pkg
- %ProgramFiles%\Sam\Driver\virtualprinter.exe
Перемещает следующие файлы:
- %CommonProgramFiles%\ActPrint\is-1RANC.tmp в %CommonProgramFiles%\ActPrint\ActMask_DPI72.GPD
- <SYSTEM32>\is-UG5JU.tmp в <SYSTEM32>\PrtPass.exe
- %CommonProgramFiles%\ActPrint\is-1R4T0.tmp в %CommonProgramFiles%\ActPrint\ActMask_DPI300.GPD
- %CommonProgramFiles%\ActPrint\is-R84BH.tmp в %CommonProgramFiles%\ActPrint\ActMask_DPI360.GPD
- %CommonProgramFiles%\ActPrint\is-0KH2C.tmp в %CommonProgramFiles%\ActPrint\ActMask_DPI180.GPD
- <SYSTEM32>\is-9BJH6.tmp в <SYSTEM32>\SetPrinter.exe
- %WINDIR%\Fonts\is-JVH1D.tmp в %WINDIR%\Fonts\calibriz_0.ttf
- %WINDIR%\Fonts\is-3FH6O.tmp в %WINDIR%\Fonts\calibrii_0.ttf
- %WINDIR%\Fonts\is-8EODU.tmp в %WINDIR%\Fonts\calibril_0.ttf
- <SYSTEM32>\is-R2QKG.tmp в <SYSTEM32>\PrtClient.exe
- %WINDIR%\Fonts\is-S6EGQ.tmp в %WINDIR%\Fonts\calibrili_0.ttf
- %CommonProgramFiles%\ActPrint\is-C7T0I.tmp в %CommonProgramFiles%\ActPrint\ActMask_DPI204-196.GPD
- %CommonProgramFiles%\ActPrint\is-E3T05.tmp в %CommonProgramFiles%\ActPrint\ActPrintUI.dll
- %CommonProgramFiles%\ActPrint\is-1AGOL.tmp в %CommonProgramFiles%\ActPrint\ActPrintRES.dll
- %CommonProgramFiles%\ActPrint\is-B5320.tmp в %CommonProgramFiles%\ActPrint\unidrv.dll
- %CommonProgramFiles%\ActPrint\is-BA1B7.tmp в %CommonProgramFiles%\ActPrint\unires.dll
- %CommonProgramFiles%\ActPrint\is-MQLOG.tmp в %CommonProgramFiles%\ActPrint\unidrvui.dll
- %CommonProgramFiles%\ActPrint\is-7JAGJ.tmp в %CommonProgramFiles%\ActPrint\ActPrint.dll
- %CommonProgramFiles%\ActPrint\is-PPL64.tmp в %CommonProgramFiles%\ActPrint\StdNames.gpd
- %CommonProgramFiles%\ActPrint\is-GAPDU.tmp в %CommonProgramFiles%\ActPrint\ActMask_DPI300_LitePS.GPD
- %CommonProgramFiles%\ActPrint\is-93C9A.tmp в %CommonProgramFiles%\ActPrint\ActPrintUI.ini
- %CommonProgramFiles%\ActPrint\is-496T1.tmp в %CommonProgramFiles%\ActPrint\PrintCtrl.exe
- %CommonProgramFiles%\ActPrint\is-G35CI.tmp в %CommonProgramFiles%\ActPrint\PrintDisp.exe
- %WINDIR%\Wireless Printer\is-E4E7N.tmp в %WINDIR%\Wireless Printer\Cancel.wav
- %WINDIR%\Wireless Printer\is-J70GF.tmp в %WINDIR%\Wireless Printer\FINISH.WAV
- %WINDIR%\Wireless Printer\is-72LQB.tmp в %WINDIR%\Wireless Printer\EMFReg.exe
- %WINDIR%\SAM Printer\is-VJR8B.tmp в %WINDIR%\SAM Printer\SaveToEx30.dll
- %WINDIR%\SAM Printer\is-4NIEK.tmp в %WINDIR%\SAM Printer\SaveToEx.dll
- %WINDIR%\Wireless Printer\is-P2PN8.tmp в %WINDIR%\Wireless Printer\START.WAV
- %WINDIR%\Wireless Printer\is-UBVMV.tmp в %WINDIR%\Wireless Printer\SaveToEx30.dll
- %WINDIR%\Wireless Printer\is-RMH8D.tmp в %WINDIR%\Wireless Printer\unins000.exe
- %WINDIR%\Wireless Printer\is-2HHRV.tmp в %WINDIR%\Wireless Printer\SaveToEx40.dll
- %WINDIR%\Wireless Printer\is-H3I3S.tmp в %WINDIR%\Wireless Printer\msvcr100.dll
- %WINDIR%\Wireless Printer\is-JL628.tmp в %WINDIR%\Wireless Printer\msvcp100.dll
- %WINDIR%\SAM Printer\is-P0FE6.tmp в %WINDIR%\SAM Printer\msvcr80.dll
- %WINDIR%\SAM Printer\is-G9SSU.tmp в %WINDIR%\SAM Printer\FINISH.WAV
- %WINDIR%\SAM Printer\is-2OELA.tmp в %WINDIR%\SAM Printer\START.WAV
- %WINDIR%\SAM Printer\is-D26LC.tmp в %WINDIR%\SAM Printer\Cancel.wav
- %WINDIR%\Fonts\is-1QOTS.tmp в %WINDIR%\Fonts\calibrib_0.ttf
- %WINDIR%\Fonts\is-IRCAO.tmp в %WINDIR%\Fonts\calibri_0.ttf
- %WINDIR%\SAM Printer\is-5GUPK.tmp в %WINDIR%\SAM Printer\msvcr100.dll
- %WINDIR%\SAM Printer\is-56DTR.tmp в %WINDIR%\SAM Printer\msvcp80.dll
- %WINDIR%\SAM Printer\is-O955J.tmp в %WINDIR%\SAM Printer\msvcm80.dll
- %WINDIR%\SAM Printer\is-BTE7C.tmp в %WINDIR%\SAM Printer\Microsoft.VC80.CRT.manifest
- %WINDIR%\SAM Printer\is-RIV3B.tmp в %WINDIR%\SAM Printer\msvcp100.dll
- %WINDIR%\SAM Printer\is-KVU8B.tmp в %WINDIR%\SAM Printer\SaveToEx40.dll
Другое:
Ищет следующие окна:
- ClassName: 'Button' WindowName: 'OK'
- ClassName: '#32770' WindowName: 'Setup'
Создает и запускает на исполнение:
- '%WINDIR%\Wireless Printer\PrtSetupX.exe' /VERYSILENT /PASSWORD=ActMask_PrtSetupX452193106-tric@comprisetechnologies.com Install ActPrint1234 "ActMask Universe Virtual Printer SDK" ActMask_DPI300 http://www.al##pdf.com disupdate
- '%TEMP%\is-9KFDH.tmp\DefForms.tmp' /SL5="$10116,166149,162816,%TEMP%\is-OVPUU.tmp\DefForms.exe" /VERYSILENT All Init
- '%CommonProgramFiles%\ActPrint\PrintDisp.exe' /uninstall
- '%TEMP%\is-P8J6T.tmp\PrtSetupX.tmp' /SL5="$20116,5901035,121856,%WINDIR%\Wireless Printer\PrtSetupX.exe" /VERYSILENT /PASSWORD=ActMask_PrtSetupX452193106-tric@comprisetechnologies.com Install ActPrint1234 "ActMask Universe Virtua...
- 'C:\Sam\Driver\virtualprinter.exe' /VERYSILENT /PASSWORD=452193106-tric@comprisetechnologies.com
- '%ProgramFiles%\Sam\Extract.exe'
- '%TEMP%\is-OVPUU.tmp\DefForms.exe' /VERYSILENT All Init
- '%TEMP%\is-K9AS8.tmp\virtualprinter.tmp' /SL5="$200EC,16980876,139776,C:\Sam\Driver\virtualprinter.exe" /VERYSILENT /PASSWORD=452193106-tric@comprisetechnologies.com
Запускает на исполнение:
- '<SYSTEM32>\net1.exe' stop "Printer Control"
