Техническая информация
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\taskkill.exe' -f -im Farmer_com.exe
- '<SYSTEM32>\taskkill.exe' -f -im EBBox.exe
Изменения в файловой системе:
Создает следующие файлы:
- %ProgramFiles%\farmer_inc\libmysql.dll
- %ProgramFiles%\farmer_inc\pw2\u.bmp
- %ProgramFiles%\farmer_inc\pw2\t.bmp
- %ProgramFiles%\farmer_inc\pw2\s.bmp
- %ProgramFiles%\farmer_inc\pw2\r.bmp
- %ProgramFiles%\farmer_inc\pw2\q.bmp
- %ProgramFiles%\farmer_inc\pw2\p.bmp
- %ProgramFiles%\farmer_inc\pw2\o.bmp
- %ProgramFiles%\farmer_inc\pw2\n.bmp
- %ProgramFiles%\farmer_inc\pw2\m.bmp
- %ProgramFiles%\farmer_inc\pw2\l.bmp
- %ProgramFiles%\farmer_inc\pw2\k.bmp
- %ProgramFiles%\farmer_inc\pw2\j.bmp
- %ProgramFiles%\farmer_inc\pw2\i.bmp
- %ProgramFiles%\farmer_inc\pw2\h.bmp
- %ProgramFiles%\farmer_inc\pw2\f.bmp
- %ProgramFiles%\farmer_inc\pw2\w.bmp
- %ProgramFiles%\farmer_inc\pw2\e.bmp
- %ProgramFiles%\farmer_inc\pw2\d.bmp
- %ProgramFiles%\farmer_inc\pw2\c.bmp
- %ProgramFiles%\farmer_inc\pw2\b.bmp
- %ProgramFiles%\farmer_inc\pw2\a.bmp
- %ProgramFiles%\farmer_inc\pw2\9.bmp
- %ProgramFiles%\farmer_inc\pw2\8.bmp
- %ProgramFiles%\farmer_inc\pw2\7.bmp
- %ProgramFiles%\farmer_inc\pw2\6.bmp
- %ProgramFiles%\farmer_inc\pw2\5.bmp
- %ProgramFiles%\farmer_inc\pw2\4.bmp
- %ProgramFiles%\farmer_inc\pw2\3.bmp
- %ProgramFiles%\farmer_inc\pw2\2.bmp
- %ProgramFiles%\farmer_inc\pw2\g.bmp
- %ProgramFiles%\farmer_inc\apply.bmp
- %ProgramFiles%\farmer_inc\pw2\x.bmp
- %ProgramFiles%\farmer_inc\Violeta\Violeta.exe
- %ProgramFiles%\farmer_inc\lie2.exe
- %ProgramFiles%\farmer_inc\GemCount.exe
- %ProgramFiles%\farmer_inc\EBBox.exe
- %ProgramFiles%\farmer_inc\Farmer_com.exe
- %ProgramFiles%\farmer_inc\kakao.exe
- %ProgramFiles%\farmer_inc\kakao_lie.exe
- %ProgramFiles%\farmer_inc\Stone.exe
- %ProgramFiles%\farmer_inc\LDstop.exe
- %ProgramFiles%\farmer_inc\AMP.exe
- %ProgramFiles%\farmer_inc\AHP.exe
- %ProgramFiles%\farmer_inc\Violeta\head4.bmp
- %ProgramFiles%\farmer_inc\Violeta\head3.bmp
- %ProgramFiles%\farmer_inc\Violeta\head2.bmp
- %ProgramFiles%\farmer_inc\pw2\1.bmp
- %ProgramFiles%\farmer_inc\pw2\v.bmp
- %ProgramFiles%\farmer_inc\detect\screen.bmp
- %ProgramFiles%\farmer_inc\detect\lie.png
- %ProgramFiles%\farmer_inc\rune\space.png
- %ProgramFiles%\farmer_inc\rune\runekey.png
- %ProgramFiles%\farmer_inc\rune\8.png
- %ProgramFiles%\farmer_inc\rune\7.png
- %ProgramFiles%\farmer_inc\rune\6.png
- %ProgramFiles%\farmer_inc\rune\5.png
- %ProgramFiles%\farmer_inc\rune\4.png
- %ProgramFiles%\farmer_inc\rune\3.png
- %ProgramFiles%\farmer_inc\rune\2.png
- %ProgramFiles%\farmer_inc\rune\1.png
- %ProgramFiles%\farmer_inc\pw2\caps.bmp
- %ProgramFiles%\farmer_inc\pw2\z.bmp
- %ProgramFiles%\farmer_inc\Violeta\findme.bmp
- %ProgramFiles%\farmer_inc\pw2\y.bmp
- %ProgramFiles%\farmer_inc\pw2\0.bmp
- %ProgramFiles%\farmer_inc\runewait.bmp
- %ProgramFiles%\farmer_inc\login2.bmp
- %ProgramFiles%\farmer_inc\white.bmp
- %ProgramFiles%\farmer_inc\5.bmp
- %ProgramFiles%\farmer_inc\4.bmp
- %ProgramFiles%\farmer_inc\3.bmp
- %ProgramFiles%\farmer_inc\2.bmp
- %ProgramFiles%\farmer_inc\1.bmp
- %ProgramFiles%\farmer_inc\0.bmp
- %ProgramFiles%\farmer_inc\stone_r.bmp
- %ProgramFiles%\farmer_inc\stone_l.bmp
- %ProgramFiles%\farmer_inc\stone.bmp
- %ProgramFiles%\farmer_inc\eb_min.bmp
- %ProgramFiles%\farmer_inc\eb_clock.bmp
- %ProgramFiles%\farmer_inc\lie_s.bmp
- %ProgramFiles%\farmer_inc\lie.bmp
- %ProgramFiles%\farmer_inc\keyset.ini
- %ProgramFiles%\farmer_inc\7.bmp
- %ProgramFiles%\farmer_inc\red.bmp
- %ProgramFiles%\farmer_inc\mp.bmp
- %ProgramFiles%\farmer_inc\hp.bmp
- %ProgramFiles%\farmer_inc\me.bmp
- %TEMP%\updater.exe
- %ProgramFiles%\farmer_inc\WeifenLuo.WinFormsUI.dll
- %ProgramFiles%\farmer_inc\AForge.Math.dll
- %ProgramFiles%\farmer_inc\AForge.Imaging.dll
- %ProgramFiles%\farmer_inc\AForge.dll
- %ProgramFiles%\farmer_inc\highgui210.dll
- %ProgramFiles%\farmer_inc\cxcore210.dll
- %ProgramFiles%\farmer_inc\cv210.dll
- %ProgramFiles%\farmer_inc\Farmer.dll
- %ProgramFiles%\farmer_inc\AutoSDK.dll
- %ProgramFiles%\farmer_inc\die.bmp
- %ProgramFiles%\farmer_inc\Violeta\head.bmp
- %ProgramFiles%\farmer_inc\8.bmp
- %ProgramFiles%\farmer_inc\hptext.bmp
- %ProgramFiles%\farmer_inc\9.bmp
- %ProgramFiles%\farmer_inc\login1.bmp
- %ProgramFiles%\farmer_inc\login.png
- %ProgramFiles%\farmer_inc\rune.bmp
- %ProgramFiles%\farmer_inc\connect.bmp
- %ProgramFiles%\farmer_inc\reset.bmp
- %ProgramFiles%\farmer_inc\nxlogin.bmp
- %ProgramFiles%\farmer_inc\bydx.bmp
- %ProgramFiles%\farmer_inc\setting.bmp
- %ProgramFiles%\farmer_inc\black.bmp
- %ProgramFiles%\farmer_inc\user4.bmp
- %ProgramFiles%\farmer_inc\user3.bmp
- %ProgramFiles%\farmer_inc\user2.bmp
- %ProgramFiles%\farmer_inc\user.bmp
- %ProgramFiles%\farmer_inc\gem_quick.bmp
- %ProgramFiles%\farmer_inc\exp.bmp
- %ProgramFiles%\farmer_inc\6.bmp
- %ProgramFiles%\farmer_inc\pw2apply.bmp
- %ProgramFiles%\farmer_inc\gamestart.bmp
- %ProgramFiles%\farmer_inc\channel.bmp
- %ProgramFiles%\farmer_inc\scania.bmp
- %ProgramFiles%\farmer_inc\pw.bmp
- %ProgramFiles%\farmer_inc\uotp_f.bmp
- %ProgramFiles%\farmer_inc\uotp.bmp
- %ProgramFiles%\farmer_inc\login.bmp
- %ProgramFiles%\farmer_inc\send.bmp
- %ProgramFiles%\farmer_inc\unread3.bmp
- %ProgramFiles%\farmer_inc\unread2.bmp
- %ProgramFiles%\farmer_inc\unread.bmp
- %ProgramFiles%\farmer_inc\worldmap.bmp
- %ProgramFiles%\farmer_inc\plus.bmp
- %ProgramFiles%\farmer_inc\mac.txt
Другое:
Ищет следующие окна:
- ClassName: 'HsHkey' WindowName: '<Полный путь к файлу>'
- ClassName: '' WindowName: ''
Запускает на исполнение:
- '<SYSTEM32>\cmd.exe' /c ipconfig /all > "%ProgramFiles%\farmer_inc\mac.txt"
- '<SYSTEM32>\ipconfig.exe' /all
