Техническая информация
Вредоносные функции:
Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%TEMP%\KMSnano\qemu-system-i386.exe' = '%TEMP%\KMSnano\qemu-system-i38...
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\KMSnano\Bios\keymaps\ar
- %TEMP%\KMSnano\kmscert2013\visio\Licenses.sl.ISSUANCE.CLIENT_UL.xrm-ms
- %TEMP%\KMSnano\kmscert2013\project\Licenses.sl.ISSUANCE.CLIENT_UL_OOB.xrm-ms
- %TEMP%\KMSnano\kmscert2013\proplus\Licenses.sl.ISSUANCE.CLIENT_UL_OOB.xrm-ms
- %TEMP%\KMSnano\kmscert2013\visio\Licenses.sl.ISSUANCE.CLIENT_UL_OOB.xrm-ms
- %TEMP%\KMSnano\kmscert2013\project\Licenses.sl.PKEYCONFIG.SIGNED.xrm-ms
- %TEMP%\KMSnano\kmscert2013\proplus\Licenses.sl.PKEYCONFIG.SIGNED.xrm-ms
- %TEMP%\KMSnano\kmscert2013\proplus\LicenseSetData._2B88C4F2_EA8F_43CD_805E_4D41346E18A7.OOB.xrm-ms
- %TEMP%\KMSnano\kmscert2013\project\Licenses.sl.ISSUANCE.CLIENT_UL.xrm-ms
- %TEMP%\KMSnano\kmscert2013\proplus\LicenseSetData._2B88C4F2_EA8F_43CD_805E_4D41346E18A7.PHN.xrm-ms
- %TEMP%\KMSnano\kmscert2013\proplus\LicenseSetData._2B88C4F2_EA8F_43CD_805E_4D41346E18A7.PL.xrm-ms
- %TEMP%\KMSnano\kmscert2013\proplus\LicenseSetData._2B88C4F2_EA8F_43CD_805E_4D41346E18A7.PPDLIC.xrm-ms
- %TEMP%\KMSnano\kmscert2013\visio\LicenseSetData._3E4294DD_A765_49BC_8DBD_CF8B62A4BD3D.OOB.xrm-ms
- %TEMP%\KMSnano\kmscert2013\visio\LicenseSetData._3E4294DD_A765_49BC_8DBD_CF8B62A4BD3D.PHN.xrm-ms
- %TEMP%\KMSnano\kmscert2013\visio\LicenseSetData._3E4294DD_A765_49BC_8DBD_CF8B62A4BD3D.PL.xrm-ms
- %TEMP%\KMSnano\kmscert2013\proplus\Licenses.sl.ISSUANCE.CLIENT_UL.xrm-ms
- %TEMP%\KMSnano\kmscert2013\visio\Licenses.sl.ISSUANCE.CLIENT_STIL.xrm-ms
- %TEMP%\KMSnano\kmscert2013\project\LicenseSetData._4A5D124A_E620_44BA_B6FF_658961B33B9A.OOB.xrm-ms
- %TEMP%\KMSnano\Bios\s390-zipl.rom
- %TEMP%\KMSnano\kmscert2013\project\Licenses.sl.ISSUANCE.CLIENT_BRIDGE_OFFICE.xrm-ms
- %TEMP%\KMSnano\kmscert2013\proplus\Licenses.sl.ISSUANCE.CLIENT_BRIDGE_OFFICE.xrm-ms
- %TEMP%\KMSnano\kmscert2013\visio\Licenses.sl.ISSUANCE.CLIENT_BRIDGE_OFFICE.xrm-ms
- %TEMP%\KMSnano\kmscert2013\visio\LicenseSetData._3E4294DD_A765_49BC_8DBD_CF8B62A4BD3D.PPDLIC.xrm-ms
- %TEMP%\KMSnano\Bios\pxe-rtl8139.rom
- %TEMP%\KMSnano\kmscert2013\visio\Licenses.sl.PKEYCONFIG.SIGNED.xrm-ms
- %TEMP%\KMSnano\kmscert2013\project\Licenses.sl.ISSUANCE.CLIENT_ROOT.xrm-ms
- %TEMP%\KMSnano\kmscert2013\proplus\Licenses.sl.ISSUANCE.CLIENT_ROOT_BRIDGE_TEST.xrm-ms
- %TEMP%\KMSnano\kmscert2013\visio\Licenses.sl.ISSUANCE.CLIENT_ROOT_BRIDGE_TEST.xrm-ms
- %TEMP%\KMSnano\kmscert2013\project\Licenses.sl.ISSUANCE.CLIENT_STIL.xrm-ms
- %TEMP%\KMSnano\kmscert2013\proplus\Licenses.sl.ISSUANCE.CLIENT_STIL.xrm-ms
- %TEMP%\KMSnano\kmscert2013\proplus\Licenses.sl.ISSUANCE.CLIENT_ROOT.xrm-ms
- %TEMP%\KMSnano\kmscert2013\visio\Licenses.sl.ISSUANCE.CLIENT_ROOT.xrm-ms
- %TEMP%\KMSnano\kmscert2013\project\Licenses.sl.ISSUANCE.CLIENT_ROOT_BRIDGE_TEST.xrm-ms
- %TEMP%\KMSnano\Bios\kvmvapic.bin
- %TEMP%\KMSnano\kmscert2013\project\LicenseSetData._4A5D124A_E620_44BA_B6FF_658961B33B9A.PL.xrm-ms
- %TEMP%\KMSnano\libgcc_s_dw2-1.dll
- %TEMP%\KMSnano\libglib-2.0-0.dll
- %TEMP%\KMSnano\libgthread-2.0-0.dll
- %TEMP%\KMSnano\libpng12.dll
- %TEMP%\KMSnano\libpng14-14.dll
- %TEMP%\KMSnano\libssp-0.dll
- %TEMP%\KMSnano\libcurl-4.dll
- %TEMP%\KMSnano\Bios\pxe-pcnet.rom
- %TEMP%\KMSnano\jpeg62.dll
- %TEMP%\KMSnano\msvcr71.dll
- %TEMP%\KMSnano\SDL.dll
- %TEMP%\KMSnano\zlib1.dll
- %TEMP%\KMSnano\KMSELDI.exe
- %TEMP%\KMSnano\stdout.txt
- %TEMP%\KMSnano\mgwz.dll
- %TEMP%\KMSnano\libusb0.dll
- %TEMP%\KMSnano\Bios\pxe-virtio.rom
- %TEMP%\KMSnano\intl.dll
- %TEMP%\KMSnano\kmscert2013\project\LicenseSetData._ED34DC89_1C27_4ECD_8B2F_63D0F4CEDC32.PL.xrm-ms
- %TEMP%\KMSnano\kmscert2013\proplus\LicenseSetData._B322DA9C_A2E2_4058_9E4E_F59A6970BD69.PL.xrm-ms
- %TEMP%\KMSnano\kmscert2013\proplus\LicenseSetData._B322DA9C_A2E2_4058_9E4E_F59A6970BD69.PPDLIC.xrm-ms
- %TEMP%\KMSnano\kmscert2013\visio\LicenseSetData._E13AC10E_75D0_4AFF_A0CD_764982CF541C.OOB.xrm-ms
- %TEMP%\KMSnano\kmscert2013\visio\LicenseSetData._E13AC10E_75D0_4AFF_A0CD_764982CF541C.PL.xrm-ms
- %TEMP%\KMSnano\kmscert2013\visio\LicenseSetData._E13AC10E_75D0_4AFF_A0CD_764982CF541C.PPDLIC.xrm-ms
- %TEMP%\KMSnano\IPAddressControlLib.dll
- %TEMP%\KMSnano\kmscert2013\project\LicenseSetData._4A5D124A_E620_44BA_B6FF_658961B33B9A.PPDLIC.xrm-ms
- %TEMP%\KMSnano\kmscert2013\proplus\LicenseSetData._B322DA9C_A2E2_4058_9E4E_F59A6970BD69.OOB.xrm-ms
- %TEMP%\KMSnano\kmscert2013\project\LicenseSetData._ED34DC89_1C27_4ECD_8B2F_63D0F4CEDC32.PPDLIC.xrm-ms
- %TEMP%\KMSnano\KMS Client.exe
- %TEMP%\KMSnano\qemu-system-i386.exe
- %TEMP%\KMSnano\timesync.exe
- %TEMP%\KMSnano\fmod.dll
- %TEMP%\KMSnano\kmscert2013\project\LicenseSetData._ED34DC89_1C27_4ECD_8B2F_63D0F4CEDC32.PHN.xrm-ms
- %TEMP%\KMSnano\kmscert2013\project\LicenseSetData._ED34DC89_1C27_4ECD_8B2F_63D0F4CEDC32.OOB.xrm-ms
- %TEMP%\KMSnano\Bios\pxe-ne2k_pci.rom
- %TEMP%\KMSnano\Bios\pxe-eepro100.rom
- %TEMP%\KMSnano\Bios\pxe-e1000.rom
- %TEMP%\KMSnano\Bios\keymaps\lt
- %TEMP%\KMSnano\Bios\keymaps\lv
- %TEMP%\KMSnano\Bios\keymaps\mk
- %TEMP%\KMSnano\Bios\keymaps\modifiers
- %TEMP%\KMSnano\Bios\keymaps\is
- %TEMP%\KMSnano\Bios\keymaps\es
- %TEMP%\KMSnano\Bios\keymaps\ja
- %TEMP%\KMSnano\Bios\keymaps\nl
- %TEMP%\KMSnano\Bios\openbios-sparc32
- %TEMP%\KMSnano\Bios\openbios-sparc64
- %TEMP%\KMSnano\Bios\palcode-clipper
- %TEMP%\KMSnano\Bios\keymaps\pl
- %TEMP%\KMSnano\Bios\keymaps\nl-be
- %TEMP%\KMSnano\Bios\keymaps\no
- %TEMP%\KMSnano\Bios\openbios-ppc
- %TEMP%\KMSnano\stderr.txt
- %TEMP%\KMSnano\Bios\keymaps\pt
- %TEMP%\KMSnano\Bios\keymaps\fr-ch
- %TEMP%\KMSnano\Bios\keymaps\fr-ca
- %TEMP%\KMSnano\Bios\keymaps\fr-be
- %TEMP%\KMSnano\Bios\keymaps\fr
- %TEMP%\KMSnano\Bios\keymaps\fo
- %TEMP%\KMSnano\Bios\keymaps\fi
- %TEMP%\KMSnano\Bios\keymaps\et
- %TEMP%\KMSnano\Bios\keymaps\hu
- %TEMP%\KMSnano\Bios\keymaps\en-us
- %TEMP%\KMSnano\Bios\keymaps\en-gb
- %TEMP%\KMSnano\Bios\keymaps\de-ch
- %TEMP%\KMSnano\Bios\keymaps\de
- %TEMP%\KMSnano\Bios\keymaps\da
- %TEMP%\KMSnano\Bios\keymaps\common
- %TEMP%\KMSnano\Bios\keymaps\bepo
- %TEMP%\KMSnano\Bios\keymaps\hr
- %TEMP%\KMSnano\mingwm10.dll
- %TEMP%\KMSnano\Bios\keymaps\pt-br
- %TEMP%\KMSnano\Bios\keymaps\sv
- %TEMP%\KMSnano\disco.vmdk
- %TEMP%\KMSnano\00-Start_Qemu_Manual.cmd
- %TEMP%\KMSnano\Manual.cmd
- %TEMP%\KMSnano\office2010vl\Office14RegInfo.reg
- %TEMP%\KMSnano\kmscert2013\project\project.reg
- %TEMP%\KMSnano\Bios\keymaps\ru
- %TEMP%\KMSnano\Bios\vgabios.bin
- %TEMP%\KMSnano\Bios\vgabios-vmware.bin
- %TEMP%\KMSnano\Bios\cpus-x86_64.conf
- %TEMP%\KMSnano\office2010vl\tokens.dat
- %TEMP%\KMSnano\Bios\bamboo.dtb
- %TEMP%\KMSnano\Bios\petalogix-ml605.dtb
- %TEMP%\KMSnano\Bios\petalogix-s3adsp1800.dtb
- %TEMP%\KMSnano\kmscert2013\proplus\proplus.reg
- %TEMP%\KMSnano\timesync.ini
- %TEMP%\KMSnano\Bios\keymaps\sl
- %TEMP%\KMSnano\kmscert2013\visio\visio.reg
- %TEMP%\KMSnano\Bios\keymaps\it
- %TEMP%\KMSnano\Bios\keymaps\th
- %TEMP%\KMSnano\Bios\keymaps\tr
- %TEMP%\KMSnano\Bios\bootsplash.bmp
- %TEMP%\KMSnano\Bios\qemu-icon.bmp
- %TEMP%\KMSnano\Bios\qemu.ico
- %TEMP%\KMSnano\Bios\vgabios-cirrus.bin
- %TEMP%\KMSnano\Bios\vgabios-stdvga.bin
- %TEMP%\KMSnano\Bios\vgabios-qxl.bin
- %TEMP%\KMSnano\Bios\multiboot.bin
- %TEMP%\KMSnano\Bios\ppc_rom.bin
- %TEMP%\KMSnano\Bios\sgabios.bin
- %TEMP%\KMSnano\Bios\slof.bin
- %TEMP%\KMSnano\Bios\spapr-rtas.bin
- %TEMP%\KMSnano\Bios\bios.bin
- %TEMP%\KMSnano\Bios\linuxboot.bin
- %TEMP%\KmsNano.log
Другое:
Создает и запускает на исполнение:
- '%TEMP%\KMSnano\KMSELDI.exe' /qemu /silent /log
- '%TEMP%\KMSnano\qemu-system-i386.exe' -smbios type=1,manufacturer=Intel,version=1.01234,uuid=564d81c6-cd3a-d8e4-db29-756df139acb9 -uuid 564d81c6-cd3a-d8e4-db29-756df139acb9 -net nic -net user,hostfwd=tcp:0.0.0.0:1688-:1688 -hda dis...
