Техническая информация
Для обеспечения автозапуска и распространения:
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\EVENTSERVICE] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\EVENTSERVICE] 'ImagePath' = 'C:\STGManager\bin\SGSDelete.exe'
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\net.exe' stop SACSLPDriver
- '<SYSTEM32>\net.exe' stop SGSDrv
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\{C2249BF7-7F33-45B8-9B50-F8FEBAACD7E5}\Disk1\0x0409.ini
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SAM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\ComDb.Dat
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\domain.txt
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\$WinMgmt.CFG
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.BTR
- %ProgramFiles%\InstallShield Installation Information\{363E753B-4C96-4B0A-8B4A-894A39EA411A}\layo9f72.rra
- %ProgramFiles%\InstallShield Installation Information\{363E753B-4C96-4B0A-8B4A-894A39EA411A}\data9f91.rra
- %ProgramFiles%\InstallShield Installation Information\{363E753B-4C96-4B0A-8B4A-894A39EA411A}\data9fb1.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING.VER
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING1.MAP
- %ProgramFiles%\InstallShield Installation Information\{363E753B-4C96-4B0A-8B4A-894A39EA411A}\setu9fff.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING2.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.DATA
- %ProgramFiles%\InstallShield Installation Information\{363E753B-4C96-4B0A-8B4A-894A39EA411A}\ISSea06c.rra
- %ProgramFiles%\InstallShield Installation Information\{363E753B-4C96-4B0A-8B4A-894A39EA411A}\0x04a0e9.rra
- %ProgramFiles%\InstallShield Installation Information\{363E753B-4C96-4B0A-8B4A-894A39EA411A}\setua108.rra
- %ProgramFiles%\InstallShield Installation Information\{363E753B-4C96-4B0A-8B4A-894A39EA411A}\setua166.rra
- %ProgramFiles%\InstallShield Installation Information\{363E753B-4C96-4B0A-8B4A-894A39EA411A}\setup.ini
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.MAP
- C:\STGManager\Bin\svrDa1e3.rra
- C:\STGManager\Bin\SGSDa1f3.rra
- C:\STGManager\Bin\SGSSa222.rra
- %ALLUSERSPROFILE%\Start Menu\Programs\NetandHI\SGSDriver\Uninstall SGSDriver.lnk
- <DRIVERS>\Serva399.rra
- <DRIVERS>\Buila3b8.rra
- <DRIVERS>\Delea3e7.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SYSTEM
- <DRIVERS>\Serva416.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SOFTWARE
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_.DEFAULT
- %TEMP%\{C2249BF7-7F33-45B8-9B50-F8FEBAACD7E5}\Disk1\data1.cab
- %TEMP%\{C2249BF7-7F33-45B8-9B50-F8FEBAACD7E5}\Disk1\data1.hdr
- %TEMP%\{C2249BF7-7F33-45B8-9B50-F8FEBAACD7E5}\Disk1\ISSetup.dll
- %TEMP%\{C2249BF7-7F33-45B8-9B50-F8FEBAACD7E5}\Disk1\layout.bin
- %TEMP%\{C2249BF7-7F33-45B8-9B50-F8FEBAACD7E5}\Disk1\setup.exe
- %TEMP%\{C2249BF7-7F33-45B8-9B50-F8FEBAACD7E5}\Disk1\setup.ini
- %TEMP%\{C2249BF7-7F33-45B8-9B50-F8FEBAACD7E5}\Disk1\setup.inx
- %TEMP%\{C2249BF7-7F33-45B8-9B50-F8FEBAACD7E5}\setup.ini
- %TEMP%\{C2249BF7-7F33-45B8-9B50-F8FEBAACD7E5}\0x0409.ini
- %TEMP%\4905.rra
- %TEMP%\{970B995A-18B7-48EC-A3ED-4CCC07F8EE4E}\{363E753B-4C96-4B0A-8B4A-894A39EA411A}\setu5133.rra
- %TEMP%\{970B995A-18B7-48EC-A3ED-4CCC07F8EE4E}\{363E753B-4C96-4B0A-8B4A-894A39EA411A}\lice520e.rra
- %TEMP%\{970B995A-18B7-48EC-A3ED-4CCC07F8EE4E}\{363E753B-4C96-4B0A-8B4A-894A39EA411A}\Font52aa.rra
- %TEMP%\{970B995A-18B7-48EC-A3ED-4CCC07F8EE4E}\{363E753B-4C96-4B0A-8B4A-894A39EA411A}\DIFx5308.rra
- %TEMP%\{970B995A-18B7-48EC-A3ED-4CCC07F8EE4E}\core5385.rra
- %TEMP%\{970B995A-18B7-48EC-A3ED-4CCC07F8EE4E}\dotn5411.rra
- %TEMP%\{970B995A-18B7-48EC-A3ED-4CCC07F8EE4E}\{363E753B-4C96-4B0A-8B4A-894A39EA411A}\Stri548e.rra
- %TEMP%\{970B995A-18B7-48EC-A3ED-4CCC07F8EE4E}\{363E753B-4C96-4B0A-8B4A-894A39EA411A}\isrt550b.rra
- %TEMP%\{970B995A-18B7-48EC-A3ED-4CCC07F8EE4E}\{363E753B-4C96-4B0A-8B4A-894A39EA411A}\defa5605.rra
- %TEMP%\{970B995A-18B7-48EC-A3ED-4CCC07F8EE4E}\{363E753B-4C96-4B0A-8B4A-894A39EA411A}\_isr5682.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SECURITY
- <DRIVERS>\SGSDa435.rra
Перемещает следующие файлы:
- %TEMP%\{970B995A-18B7-48EC-A3ED-4CCC07F8EE4E}\{363E753B-4C96-4B0A-8B4A-894A39EA411A}\setu5133.rra в %TEMP%\{970B995A-18B7-48EC-A3ED-4CCC07F8EE4E}\{363E753B-4C96-4B0A-8B4A-894A39EA411A}\setup.inx
- <DRIVERS>\Delea3e7.rra в <DRIVERS>\DeleteSvc.exe
- <DRIVERS>\Buila3b8.rra в <DRIVERS>\BuildSvc.exe
- <DRIVERS>\Serva399.rra в <DRIVERS>\Service_UnRegisterbat.bat
- C:\STGManager\Bin\SGSSa222.rra в C:\STGManager\Bin\SGSServiceMng.exe
- C:\STGManager\Bin\SGSDa1f3.rra в C:\STGManager\Bin\SGSDelete.exe
- C:\STGManager\Bin\svrDa1e3.rra в C:\STGManager\Bin\svrDelReg.xml
- %ProgramFiles%\InstallShield Installation Information\{363E753B-4C96-4B0A-8B4A-894A39EA411A}\setua166.rra в %ProgramFiles%\InstallShield Installation Information\{363E753B-4C96-4B0A-8B4A-894A39EA411A}\setup.ini
- %ProgramFiles%\InstallShield Installation Information\{363E753B-4C96-4B0A-8B4A-894A39EA411A}\setua108.rra в %ProgramFiles%\InstallShield Installation Information\{363E753B-4C96-4B0A-8B4A-894A39EA411A}\setup.inx
- %ProgramFiles%\InstallShield Installation Information\{363E753B-4C96-4B0A-8B4A-894A39EA411A}\0x04a0e9.rra в %ProgramFiles%\InstallShield Installation Information\{363E753B-4C96-4B0A-8B4A-894A39EA411A}\0x0409.ini
- %ProgramFiles%\InstallShield Installation Information\{363E753B-4C96-4B0A-8B4A-894A39EA411A}\ISSea06c.rra в %ProgramFiles%\InstallShield Installation Information\{363E753B-4C96-4B0A-8B4A-894A39EA411A}\ISSetup.dll
- %ProgramFiles%\InstallShield Installation Information\{363E753B-4C96-4B0A-8B4A-894A39EA411A}\setu9fff.rra в %ProgramFiles%\InstallShield Installation Information\{363E753B-4C96-4B0A-8B4A-894A39EA411A}\setup.exe
- %ProgramFiles%\InstallShield Installation Information\{363E753B-4C96-4B0A-8B4A-894A39EA411A}\data9fb1.rra в %ProgramFiles%\InstallShield Installation Information\{363E753B-4C96-4B0A-8B4A-894A39EA411A}\data1.cab
- %ProgramFiles%\InstallShield Installation Information\{363E753B-4C96-4B0A-8B4A-894A39EA411A}\data9f91.rra в %ProgramFiles%\InstallShield Installation Information\{363E753B-4C96-4B0A-8B4A-894A39EA411A}\data1.hdr
- %ProgramFiles%\InstallShield Installation Information\{363E753B-4C96-4B0A-8B4A-894A39EA411A}\layo9f72.rra в %ProgramFiles%\InstallShield Installation Information\{363E753B-4C96-4B0A-8B4A-894A39EA411A}\layout.bin
- %TEMP%\{970B995A-18B7-48EC-A3ED-4CCC07F8EE4E}\{363E753B-4C96-4B0A-8B4A-894A39EA411A}\_isr5682.rra в %TEMP%\{970B995A-18B7-48EC-A3ED-4CCC07F8EE4E}\{363E753B-4C96-4B0A-8B4A-894A39EA411A}\_isres_0x0409.dll
- %TEMP%\{970B995A-18B7-48EC-A3ED-4CCC07F8EE4E}\{363E753B-4C96-4B0A-8B4A-894A39EA411A}\defa5605.rra в %TEMP%\{970B995A-18B7-48EC-A3ED-4CCC07F8EE4E}\{363E753B-4C96-4B0A-8B4A-894A39EA411A}\default.pal
- %TEMP%\{970B995A-18B7-48EC-A3ED-4CCC07F8EE4E}\{363E753B-4C96-4B0A-8B4A-894A39EA411A}\isrt550b.rra в %TEMP%\{970B995A-18B7-48EC-A3ED-4CCC07F8EE4E}\{363E753B-4C96-4B0A-8B4A-894A39EA411A}\isrt.dll
- %TEMP%\{970B995A-18B7-48EC-A3ED-4CCC07F8EE4E}\{363E753B-4C96-4B0A-8B4A-894A39EA411A}\Stri548e.rra в %TEMP%\{970B995A-18B7-48EC-A3ED-4CCC07F8EE4E}\{363E753B-4C96-4B0A-8B4A-894A39EA411A}\StringTable_0x0409.ips
- %TEMP%\{970B995A-18B7-48EC-A3ED-4CCC07F8EE4E}\dotn5411.rra в %TEMP%\{970B995A-18B7-48EC-A3ED-4CCC07F8EE4E}\dotnetinstaller.exe
- %TEMP%\{970B995A-18B7-48EC-A3ED-4CCC07F8EE4E}\core5385.rra в %TEMP%\{970B995A-18B7-48EC-A3ED-4CCC07F8EE4E}\corecomp.ini
- %TEMP%\{970B995A-18B7-48EC-A3ED-4CCC07F8EE4E}\{363E753B-4C96-4B0A-8B4A-894A39EA411A}\DIFx5308.rra в %TEMP%\{970B995A-18B7-48EC-A3ED-4CCC07F8EE4E}\{363E753B-4C96-4B0A-8B4A-894A39EA411A}\DIFxData.ini
- %TEMP%\{970B995A-18B7-48EC-A3ED-4CCC07F8EE4E}\{363E753B-4C96-4B0A-8B4A-894A39EA411A}\Font52aa.rra в %TEMP%\{970B995A-18B7-48EC-A3ED-4CCC07F8EE4E}\{363E753B-4C96-4B0A-8B4A-894A39EA411A}\FontData.ini
- %TEMP%\{970B995A-18B7-48EC-A3ED-4CCC07F8EE4E}\{363E753B-4C96-4B0A-8B4A-894A39EA411A}\lice520e.rra в %TEMP%\{970B995A-18B7-48EC-A3ED-4CCC07F8EE4E}\{363E753B-4C96-4B0A-8B4A-894A39EA411A}\license.rtf
- <DRIVERS>\Serva416.rra в <DRIVERS>\Service_Register.bat
- <DRIVERS>\SGSDa435.rra в <DRIVERS>\SGSDriver.sys
Другое:
Создает и запускает на исполнение:
- 'C:\STGManager\Bin\SGSServiceMng.exe'
- 'C:\STGManager\Bin\SGSDelete.exe' i
- 'C:\STGManager\Bin\SGSDelete.exe' s
- 'C:\STGManager\Bin\SGSDelete.exe'
- 'C:\STGManager\Bin\SGSDelete.exe' t
- 'C:\STGManager\Bin\SGSDelete.exe' u
Запускает на исполнение:
- '<SYSTEM32>\cmd.exe' /c <DRIVERS>\Service_UnRegisterbat.bat <DRIVERS>\Service_UnRegisterbat.bat
- '<SYSTEM32>\cmd.exe' /c <DRIVERS>\Service_Register.bat <DRIVERS>\Service_Register.bat
- '<SYSTEM32>\net1.exe' stop SACSLPDriver
- '<SYSTEM32>\net1.exe' stop SGSDrv
