Техническая информация
Вредоносные функции:
Для затруднения выявления своего присутствия в системе
блокирует запуск следующих системных утилит:
- Диспетчера задач (Taskmgr)
изменяет следующие системные настройки:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoClose' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoLogoff' = '00000001'
Читает файлы, отвечающие за хранение паролей сторонними программами:
- %TEMP%\nsg3.tmp\TempProfile\signons.sqlite
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsg2.tmp
- %TEMP%\nsg3.tmp\TempProfile\secmod.db
- %TEMP%\nsg3.tmp\TempProfile\prefs-1.js
- %TEMP%\nsg3.tmp\TempProfile\extensions.sqlite
- %TEMP%\nsg3.tmp\TempProfile\extensions.sqlite-journal
- %TEMP%\nsg3.tmp\TempProfile\permissions.sqlite
- %TEMP%\nsg3.tmp\TempProfile\permissions.sqlite-journal
- %TEMP%\nsg3.tmp\TempProfile\prefs.js
- %TEMP%\nsg3.tmp\TempProfile\compatibility.ini
- %TEMP%\nsg3.tmp\TempProfile\Chrome\userContent-example.css
- %TEMP%\nsg3.tmp\TempProfile\Chrome\userChrome.css
- %TEMP%\nsg3.tmp\TempProfile\Chrome\userChrome-example.css
- %TEMP%\nsg3.tmp\webapprt\webapprt.ini
- %TEMP%\nsg3.tmp\webapprt\omni.ja
- %TEMP%\nsg3.tmp\uninstall\helper.exe
- %TEMP%\nsg3.tmp\searchplugins\yahoo.xml
- %TEMP%\nsg3.tmp\searchplugins\wikipedia.xml
- %TEMP%\nsg3.tmp\searchplugins\twitter.xml
- %TEMP%\nsg3.tmp\searchplugins\google.xml
- %TEMP%\nsg3.tmp\searchplugins\eBay.xml
- %TEMP%\nsg3.tmp\searchplugins\bing.xml
- %TEMP%\nsg3.tmp\searchplugins\amazondotcom.xml
- %TEMP%\nsg3.tmp\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}\install.rdf
- %TEMP%\nsg3.tmp\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}\icon.png
- %TEMP%\nsg3.tmp\dictionaries\en-US.dic
- %TEMP%\nsg3.tmp\dictionaries\en-US.aff
- %TEMP%\nsg3.tmp\defaults\profile\chrome\userContent-example.css
- %TEMP%\nsg3.tmp\defaults\profile\chrome\userChrome.css
- %TEMP%\nsg3.tmp\defaults\profile\chrome\userChrome-example.css
- %TEMP%\nsg3.tmp\defaults\profile\prefs.js
- %TEMP%\nsg3.tmp\TempProfile\cert8.db
- %TEMP%\nsg3.tmp\TempProfile\key3.db
- %TEMP%\nsg3.tmp\TempProfile\extensions.ini.tmp
- %TEMP%\nsg3.tmp\TempProfile\localstore.rdf
- %TEMP%\nsg3.tmp\TempProfile\safebrowsing\test-phish-simple.pset
- %TEMP%\nsg3.tmp\TempProfile\safebrowsing\test-phish-simple.cache
- %TEMP%\nsg3.tmp\TempProfile\safebrowsing\test-phish-simple.sbstore
- %TEMP%\nsg3.tmp\TempProfile\safebrowsing\test-malware-simple.pset
- %TEMP%\nsg3.tmp\TempProfile\safebrowsing\test-malware-simple.cache
- %TEMP%\nsg3.tmp\TempProfile\safebrowsing\test-malware-simple.sbstore
- %TEMP%\nsg3.tmp\TempProfile\safebrowsing\classifier.hashkey
- %TEMP%\nsg3.tmp\TempProfile\_CACHE_CLEAN_
- %TEMP%\nsg3.tmp\TempProfile\content-prefs.sqlite
- %TEMP%\nsg3.tmp\TempProfile\content-prefs.sqlite-journal
- %TEMP%\nsg3.tmp\TempProfile\cookies.sqlite-wal
- %TEMP%\nsg3.tmp\TempProfile\webappsstore.sqlite
- %TEMP%\nsg3.tmp\TempProfile\webappsstore.sqlite-journal
- %TEMP%\nsg3.tmp\TempProfile\cookies.sqlite-shm
- %TEMP%\nsg3.tmp\TempProfile\cookies.sqlite-journal
- %TEMP%\nsg3.tmp\TempProfile\cookies.sqlite
- %TEMP%\nsg3.tmp\TempProfile\signons.sqlite
- %TEMP%\nsg3.tmp\TempProfile\signons.sqlite-journal
- %TEMP%\nsg3.tmp\TempProfile\Cache\_CACHE_MAP_
- %TEMP%\nsg3.tmp\TempProfile\Cache\_CACHE_003_
- %TEMP%\nsg3.tmp\TempProfile\Cache\_CACHE_002_
- %TEMP%\nsg3.tmp\TempProfile\Cache\_CACHE_001_
- %TEMP%\nsg3.tmp\TempProfile\search.json
- %TEMP%\nsg3.tmp\TempProfile\mimeTypes-1.rdf
- %TEMP%\nsg3.tmp\TempProfile\mimeTypes.rdf
- %TEMP%\nsg3.tmp\TempProfile\webapps\webapps.json
- %TEMP%\nsg3.tmp\TempProfile\places.sqlite-wal
- %TEMP%\nsg3.tmp\TempProfile\places.sqlite-shm
- %TEMP%\nsg3.tmp\TempProfile\places.sqlite
- %TEMP%\nsg3.tmp\TempProfile\places.sqlite-journal
- %TEMP%\nsg3.tmp\TempProfile\downloads.sqlite-journal
- %TEMP%\nsg3.tmp\defaults\profile\mimeTypes.rdf
- %TEMP%\nsg3.tmp\defaults\profile\localstore.rdf
- %TEMP%\nsg3.tmp\defaults\profile\bookmarks.html
- %TEMP%\nsg3.tmp\nspr4.dll
- %TEMP%\nsg3.tmp\mozsqlite3.dll
- %TEMP%\nsg3.tmp\mozjs.dll
- %TEMP%\nsg3.tmp\mozglue.dll
- %TEMP%\nsg3.tmp\mozalloc.dll
- %TEMP%\nsg3.tmp\mist7.exe
- %TEMP%\nsg3.tmp\maintenanceservice_installer.exe
- %TEMP%\nsg3.tmp\maintenanceservice.exe
- %TEMP%\nsg3.tmp\libGLESv2.dll
- %TEMP%\nsg3.tmp\libEGL.dll
- %TEMP%\nsg3.tmp\gkmedias.dll
- %TEMP%\nsg3.tmp\freebl3.dll
- %TEMP%\nsg3.tmp\freebl3.chk
- %TEMP%\nsg3.tmp\dependentlibs.list
- %TEMP%\nsg3.tmp\d3dx9_43.dll
- %TEMP%\nsg3.tmp\chrome.manifest
- %TEMP%\nsg3.tmp\blocklist.xml
- %TEMP%\nsg3.tmp\application.ini
- %TEMP%\nsg3.tmp\D3DCompiler_43.dll
- %TEMP%\nsg3.tmp\AccessibleMarshal.dll
- %TEMP%\nsg3.tmp\AnimGif.dll
- %TEMP%\nsg3.tmp\newadvsplash.dll
- %TEMP%\nsg3.tmp\msvcr100.dll
- %TEMP%\nsg3.tmp\msvcp100.dll
- %TEMP%\nsg3.tmp\splash.gif
- %TEMP%\nsg3.tmp\kiosk.ico
- %TEMP%\MISTKiosk.log
- %TEMP%\nsg3.tmp\LogEx.dll
- %TEMP%\nsg3.tmp\System.dll
- %TEMP%\nsg3.tmp\nss3.dll
- %TEMP%\nsg3.tmp\nssckbi.dll
- %TEMP%\nsg3.tmp\nssdbm3.chk
- %TEMP%\nsg3.tmp\nssdbm3.dll
- %TEMP%\nsg3.tmp\defaults\preferences\services-notifications.js
- %TEMP%\nsg3.tmp\defaults\preferences\services-common.js
- %TEMP%\nsg3.tmp\defaults\preferences\services-aitc.js
- %TEMP%\nsg3.tmp\defaults\preferences\openkiosk.js
- %TEMP%\nsg3.tmp\defaults\preferences\openkiosk-branding.js
- %TEMP%\nsg3.tmp\defaults\preferences\firefox-l10n.js
- %TEMP%\nsg3.tmp\defaults\pref\channel-prefs.js
- %TEMP%\nsg3.tmp\defaults\autoconfig\prefcalls.js
- %TEMP%\nsg3.tmp\defaults\autoconfig\platform.js
- %TEMP%\nsg3.tmp\components\browsercomps.dll
- %TEMP%\nsg3.tmp\components\binary.manifest
- %TEMP%\nsg3.tmp\xul.dll
- %TEMP%\nsg3.tmp\xpcom.dll
- %TEMP%\nsg3.tmp\webapprt-stub.exe
- %TEMP%\nsg3.tmp\updater.ini
- %TEMP%\nsg3.tmp\webapp-uninstaller.exe
- %TEMP%\nsg3.tmp\updater.exe
- %TEMP%\nsg3.tmp\update-settings.ini
- %TEMP%\nsg3.tmp\ssl3.dll
- %TEMP%\nsg3.tmp\softokn3.dll
- %TEMP%\nsg3.tmp\softokn3.chk
- %TEMP%\nsg3.tmp\smime3.dll
- %TEMP%\nsg3.tmp\removed-files
- %TEMP%\nsg3.tmp\precomplete
- %TEMP%\nsg3.tmp\plugin-container.exe
- %TEMP%\nsg3.tmp\plds4.dll
- %TEMP%\nsg3.tmp\plc4.dll
- %TEMP%\nsg3.tmp\platform.ini
- %TEMP%\nsg3.tmp\omni.ja
- %TEMP%\nsg3.tmp\nssutil3.dll
- %TEMP%\nsg3.tmp\defaults\preferences\services-sync.js
- %TEMP%\nsg3.tmp\TempProfile\downloads.sqlite
Удаляет следующие файлы:
- %TEMP%\nsg3.tmp\TempProfile\permissions.sqlite-journal
- %TEMP%\nsg3.tmp\TempProfile\places.sqlite-journal
- %TEMP%\nsg3.tmp\TempProfile\signons.sqlite-journal
- %TEMP%\nsg3.tmp\TempProfile\cookies.sqlite-journal
- %TEMP%\nsg3.tmp\TempProfile\webappsstore.sqlite-journal
- %TEMP%\nsg3.tmp\TempProfile\content-prefs.sqlite-journal
- %TEMP%\nsg3.tmp\TempProfile\downloads.sqlite-journal
Перемещает следующие файлы:
- %TEMP%\nsg3.tmp\TempProfile\prefs-1.js в %TEMP%\nsg3.tmp\TempProfile\prefs.js
- %TEMP%\nsg3.tmp\TempProfile\extensions.ini.tmp в %TEMP%\nsg3.tmp\TempProfile\extensions.ini
- %TEMP%\nsg3.tmp\TempProfile\mimeTypes-1.rdf в %TEMP%\nsg3.tmp\TempProfile\mimeTypes.rdf
Подменяет следующие файлы:
- %TEMP%\nsg3.tmp\TempProfile\permissions.sqlite-journal
- %TEMP%\nsg3.tmp\TempProfile\mimeTypes-1.rdf
- %TEMP%\nsg3.tmp\TempProfile\mimeTypes.rdf
- %TEMP%\nsg3.tmp\TempProfile\prefs-1.js
- %TEMP%\nsg3.tmp\TempProfile\signons.sqlite-journal
- %TEMP%\nsg3.tmp\TempProfile\cookies.sqlite-journal
- %TEMP%\nsg3.tmp\TempProfile\content-prefs.sqlite-journal
- %TEMP%\nsg3.tmp\TempProfile\downloads.sqlite-journal
- %TEMP%\nsg3.tmp\TempProfile\prefs.js
Сетевая активность:
Подключается к:
- 'localhost':1037
- 'mi###est.com':443
- '74.##5.232.51':443
UDP:
- DNS ASK mi###est.com
- DNS ASK sb-ssl.google.com
Другое:
Ищет следующие окна:
- ClassName: 'MIST7MessageWindow' WindowName: ''
- ClassName: 'Shell_traywnd' WindowName: ''
- ClassName: 'Button' WindowName: ''
Создает и запускает на исполнение:
- '%TEMP%\nsg3.tmp\mist7.exe' -Profile "%TEMP%\nsg3.tmp\TempProfile"
