Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'yNgFiXdcLYKjV' = '%APPDATA%\system32.exe'
Создает или изменяет следующие файлы:
- %HOMEPATH%\Start Menu\Programs\Startup\я
- %HOMEPATH%\Start Menu\Programs\Startup\desktop.ini
- %HOMEPATH%\Start Menu\Programs\Startup\HOW TO RECOVER ENCRYPTED FILES-fastsupport@airmail.cc.TXT
- %HOMEPATH%\Start Menu\Programs\Startup\Shortcut to startup_local.lnk
Заражает следующие исполняемые файлы:
- C:\Far2\Far.exe
- C:\Far2\Plugins\Network\Network.dll
- C:\Far2\Plugins\MacroView\MacroView.dll
- C:\Far2\Plugins\HlfViewer\HlfViewer.dll
- C:\Far2\Plugins\FTP\lib\ftpProgress.fll
- C:\Far2\Plugins\FTP\lib\ftpDirList.fll
- C:\Far2\Plugins\FTP\FarFtp.dll
- C:\Far2\Plugins\FileCase\FileCase.dll
- C:\Far2\Plugins\FarCmds\FARCmds.dll
- C:\Far2\Plugins\ExtSearch\esearch.dll
- C:\Far2\Plugins\EMenu\EMenu.dll
- C:\Far2\Plugins\EditCase\EditCase.dll
- C:\Far2\Plugins\DrawLine\DrawLine.dll
- C:\Far2\Plugins\Compare\Compare.dll
- C:\Far2\Plugins\Colorer\bin\colorer.dll
- C:\Far2\Plugins\ProcList\Proclist.dll
- C:\Far2\Plugins\Brackets\Brackets.dll
- C:\Far2\Plugins\arclite\arclite.dll
- C:\Far2\Plugins\arclite\7zSD.sfx
- C:\Far2\Plugins\arclite\7zS2con.sfx
- C:\Far2\Plugins\arclite\7zS2.sfx
- C:\Far2\Plugins\arclite\7zCon.sfx
- C:\Far2\Plugins\arclite\7z.sfx
- C:\Far2\Plugins\arclite\7z.dll
- C:\Far2\Plugins\Align\Align.dll
- C:\Far2\Plugins\7-Zip\7z.dll
- C:\Far2\Plugins\7-Zip\7-ZipFar64.dll
- C:\Far2\Plugins\7-Zip\7-ZipFar.dll
- C:\Far2\FExcept\FExcept.dll
- C:\Far2\FExcept\ExcDump.dll
- C:\Far2\FExcept\demangle32.dll
- C:\Far2\Plugins\AutoWrap\AutoWrap.dll
- C:\Far2\Plugins\TmpPanel\TmpPanel.dll
Вредоносные функции:
Завершает или пытается завершить
следующие системные процессы:
- <SYSTEM32>\cscript.exe
Изменения в файловой системе:
Создает следующие файлы:
- %APPDATA%\system32.exe
- C:\Far2\Plugins\EditCase\HOW TO RECOVER ENCRYPTED FILES-fastsupport@airmail.cc.TXT
- C:\Far2\Plugins\EditCase\я
- C:\Far2\Plugins\DrawLine\HOW TO RECOVER ENCRYPTED FILES-fastsupport@airmail.cc.TXT
- C:\Far2\Plugins\DrawLine\я
- C:\Far2\Plugins\Compare\HOW TO RECOVER ENCRYPTED FILES-fastsupport@airmail.cc.TXT
- C:\Far2\Plugins\Compare\я
- C:\Far2\Plugins\Colorer\hrd\console\contrib\HOW TO RECOVER ENCRYPTED FILES-fastsupport@airmail.cc.TXT
- C:\Far2\Plugins\Colorer\hrd\console\contrib\я
- C:\Far2\Plugins\Colorer\hrd\console\HOW TO RECOVER ENCRYPTED FILES-fastsupport@airmail.cc.TXT
- C:\Far2\Plugins\Colorer\hrd\console\я
- C:\Far2\Plugins\Colorer\hrd\HOW TO RECOVER ENCRYPTED FILES-fastsupport@airmail.cc.TXT
- C:\Far2\Plugins\Colorer\hrd\я
- C:\Far2\Plugins\EMenu\я
- C:\Far2\Plugins\Colorer\hrc\auto\types\HOW TO RECOVER ENCRYPTED FILES-fastsupport@airmail.cc.TXT
- C:\Far2\Plugins\Colorer\hrc\auto\HOW TO RECOVER ENCRYPTED FILES-fastsupport@airmail.cc.TXT
- C:\Far2\Plugins\Colorer\hrc\auto\я
- C:\Far2\Plugins\Colorer\hrc\HOW TO RECOVER ENCRYPTED FILES-fastsupport@airmail.cc.TXT
- C:\Far2\Plugins\Colorer\hrc\я
- C:\Far2\Plugins\Colorer\bin\HOW TO RECOVER ENCRYPTED FILES-fastsupport@airmail.cc.TXT
- C:\Far2\Plugins\Colorer\bin\я
- C:\Far2\Plugins\Colorer\HOW TO RECOVER ENCRYPTED FILES-fastsupport@airmail.cc.TXT
- C:\Far2\Plugins\Colorer\я
- C:\Far2\Plugins\Brackets\HOW TO RECOVER ENCRYPTED FILES-fastsupport@airmail.cc.TXT
- C:\Far2\Plugins\Brackets\я
- C:\Far2\Plugins\AutoWrap\HOW TO RECOVER ENCRYPTED FILES-fastsupport@airmail.cc.TXT
- C:\Far2\Plugins\AutoWrap\я
- C:\Far2\Plugins\Colorer\hrc\auto\types\я
- C:\Far2\Plugins\FTP\я
- C:\Far2\Plugins\WinSCP\я
- C:\Far2\Plugins\ExtSearch\HOW TO RECOVER ENCRYPTED FILES-fastsupport@airmail.cc.TXT
- C:\Far2\Plugins\TmpPanel\HOW TO RECOVER ENCRYPTED FILES-fastsupport@airmail.cc.TXT
- C:\Far2\Plugins\TmpPanel\я
- C:\Far2\Plugins\ProcList\HOW TO RECOVER ENCRYPTED FILES-fastsupport@airmail.cc.TXT
- C:\Far2\Plugins\ProcList\я
- C:\Far2\Plugins\Network\HOW TO RECOVER ENCRYPTED FILES-fastsupport@airmail.cc.TXT
- C:\Far2\Plugins\Network\я
- C:\Far2\Plugins\MacroView\HOW TO RECOVER ENCRYPTED FILES-fastsupport@airmail.cc.TXT
- C:\Far2\Plugins\MacroView\я
- C:\Far2\Plugins\HlfViewer\HOW TO RECOVER ENCRYPTED FILES-fastsupport@airmail.cc.TXT
- C:\Far2\Plugins\HlfViewer\я
- C:\Far2\Plugins\FTP\lib\HOW TO RECOVER ENCRYPTED FILES-fastsupport@airmail.cc.TXT
- C:\Far2\Plugins\FTP\lib\я
- C:\Far2\Plugins\arclite\HOW TO RECOVER ENCRYPTED FILES-fastsupport@airmail.cc.TXT
- C:\Far2\Plugins\FTP\HOW TO RECOVER ENCRYPTED FILES-fastsupport@airmail.cc.TXT
- C:\Far2\Plugins\FileCase\HOW TO RECOVER ENCRYPTED FILES-fastsupport@airmail.cc.TXT
- C:\Far2\Plugins\FileCase\я
- C:\Far2\Plugins\FarCmds\HOW TO RECOVER ENCRYPTED FILES-fastsupport@airmail.cc.TXT
- C:\Far2\Plugins\FarCmds\я
- C:\Far2\Plugins\ExtSearch\sources\RegExp\HOW TO RECOVER ENCRYPTED FILES-fastsupport@airmail.cc.TXT
- C:\Far2\Plugins\ExtSearch\sources\RegExp\я
- C:\Far2\Plugins\ExtSearch\sources\HOW TO RECOVER ENCRYPTED FILES-fastsupport@airmail.cc.TXT
- C:\Far2\Plugins\ExtSearch\sources\я
- C:\Far2\Plugins\ExtSearch\keys\HOW TO RECOVER ENCRYPTED FILES-fastsupport@airmail.cc.TXT
- C:\Far2\Plugins\ExtSearch\keys\я
- C:\Far2\Plugins\ExtSearch\doc\HOW TO RECOVER ENCRYPTED FILES-fastsupport@airmail.cc.TXT
- C:\Far2\Plugins\ExtSearch\doc\я
- C:\Far2\Plugins\EMenu\HOW TO RECOVER ENCRYPTED FILES-fastsupport@airmail.cc.TXT
- C:\Far2\Plugins\ExtSearch\я
- C:\Far2\Plugins\arclite\я
- C:\Far2\Addons\я
- <Текущая директория>\HOW TO RECOVER ENCRYPTED FILES-fastsupport@airmail.cc.TXT
- <Текущая директория>\я
- C:\HOW TO RECOVER ENCRYPTED FILES-fastsupport@airmail.cc.TXT
- C:\я
- %HOMEPATH%\Start Menu\Programs\Accessories\Entertainment\HOW TO RECOVER ENCRYPTED FILES-fastsupport@airmail.cc.TXT
- %HOMEPATH%\Start Menu\Programs\Accessories\Entertainment\я
- %HOMEPATH%\Start Menu\Programs\Accessories\Accessibility\HOW TO RECOVER ENCRYPTED FILES-fastsupport@airmail.cc.TXT
- %HOMEPATH%\Start Menu\Programs\Accessories\Accessibility\я
- %HOMEPATH%\Start Menu\Programs\Accessories\HOW TO RECOVER ENCRYPTED FILES-fastsupport@airmail.cc.TXT
- %HOMEPATH%\Start Menu\Programs\Accessories\я
- %HOMEPATH%\Start Menu\Programs\HOW TO RECOVER ENCRYPTED FILES-fastsupport@airmail.cc.TXT
- %HOMEPATH%\Start Menu\Programs\я
- C:\Far2\я
- %HOMEPATH%\Start Menu\HOW TO RECOVER ENCRYPTED FILES-fastsupport@airmail.cc.TXT
- %HOMEPATH%\My Documents\My Pictures\HOW TO RECOVER ENCRYPTED FILES-fastsupport@airmail.cc.TXT
- %HOMEPATH%\My Documents\My Pictures\я
- %HOMEPATH%\My Documents\My Music\HOW TO RECOVER ENCRYPTED FILES-fastsupport@airmail.cc.TXT
- %HOMEPATH%\My Documents\My Music\я
- %HOMEPATH%\My Documents\HOW TO RECOVER ENCRYPTED FILES-fastsupport@airmail.cc.TXT
- %HOMEPATH%\My Documents\я
- %HOMEPATH%\Favorites\Links\HOW TO RECOVER ENCRYPTED FILES-fastsupport@airmail.cc.TXT
- %HOMEPATH%\Favorites\Links\я
- %HOMEPATH%\Favorites\HOW TO RECOVER ENCRYPTED FILES-fastsupport@airmail.cc.TXT
- %HOMEPATH%\Favorites\я
- %HOMEPATH%\HOW TO RECOVER ENCRYPTED FILES-fastsupport@airmail.cc.TXT
- %HOMEPATH%\я
- %HOMEPATH%\Start Menu\я
- C:\Far2\Addons\XLat\я
- C:\Far2\Plugins\Align\я
- C:\Far2\Addons\HOW TO RECOVER ENCRYPTED FILES-fastsupport@airmail.cc.TXT
- C:\Far2\Plugins\7-Zip\HOW TO RECOVER ENCRYPTED FILES-fastsupport@airmail.cc.TXT
- C:\Far2\Plugins\7-Zip\я
- C:\Far2\FExcept\HOW TO RECOVER ENCRYPTED FILES-fastsupport@airmail.cc.TXT
- C:\Far2\FExcept\я
- C:\Far2\Encyclopedia\HOW TO RECOVER ENCRYPTED FILES-fastsupport@airmail.cc.TXT
- C:\Far2\Encyclopedia\я
- C:\Far2\Documentation\rus\HOW TO RECOVER ENCRYPTED FILES-fastsupport@airmail.cc.TXT
- C:\Far2\Documentation\rus\я
- C:\Far2\Documentation\eng\HOW TO RECOVER ENCRYPTED FILES-fastsupport@airmail.cc.TXT
- C:\Far2\Documentation\eng\я
- C:\Far2\Addons\XLat\Russian\HOW TO RECOVER ENCRYPTED FILES-fastsupport@airmail.cc.TXT
- C:\Far2\Addons\XLat\Russian\я
- C:\Far2\Plugins\Align\HOW TO RECOVER ENCRYPTED FILES-fastsupport@airmail.cc.TXT
- C:\Far2\Addons\XLat\HOW TO RECOVER ENCRYPTED FILES-fastsupport@airmail.cc.TXT
- C:\Far2\Addons\Shell\HOW TO RECOVER ENCRYPTED FILES-fastsupport@airmail.cc.TXT
- C:\Far2\Addons\Shell\я
- C:\Far2\Addons\SetUp\HOW TO RECOVER ENCRYPTED FILES-fastsupport@airmail.cc.TXT
- C:\Far2\Addons\SetUp\я
- C:\Far2\Addons\Macros\HOW TO RECOVER ENCRYPTED FILES-fastsupport@airmail.cc.TXT
- C:\Far2\Addons\Macros\я
- C:\Far2\Addons\Colors\Default Highlighting\HOW TO RECOVER ENCRYPTED FILES-fastsupport@airmail.cc.TXT
- C:\Far2\Addons\Colors\Default Highlighting\я
- C:\Far2\Addons\Colors\Custom Highlighting\HOW TO RECOVER ENCRYPTED FILES-fastsupport@airmail.cc.TXT
- C:\Far2\Addons\Colors\Custom Highlighting\я
- C:\Far2\Addons\Colors\HOW TO RECOVER ENCRYPTED FILES-fastsupport@airmail.cc.TXT
- C:\Far2\Addons\Colors\я
- C:\Far2\HOW TO RECOVER ENCRYPTED FILES-fastsupport@airmail.cc.TXT
- C:\Far2\Plugins\WinSCP\HOW TO RECOVER ENCRYPTED FILES-fastsupport@airmail.cc.TXT
Удаляет следующие файлы:
- %APPDATA%\system32.exe
- C:\Far2\Plugins\Brackets\я
- C:\Far2\Plugins\Colorer\я
- C:\Far2\Plugins\Colorer\bin\я
- C:\Far2\Plugins\Colorer\hrc\я
- C:\Far2\Plugins\Colorer\hrc\auto\я
- C:\Far2\Plugins\Colorer\hrc\auto\types\я
- C:\Far2\Plugins\Colorer\hrd\я
- C:\Far2\Plugins\Colorer\hrd\console\я
- C:\Far2\Plugins\Colorer\hrd\console\contrib\я
- C:\Far2\Plugins\Compare\я
- C:\Far2\Plugins\DrawLine\я
- C:\Far2\Plugins\EditCase\я
- <Текущая директория>\я
- C:\Far2\Plugins\EMenu\я
- C:\Far2\Plugins\ExtSearch\doc\я
- C:\Far2\Plugins\ExtSearch\keys\я
- C:\Far2\Plugins\ExtSearch\sources\я
- C:\Far2\Plugins\ExtSearch\sources\RegExp\я
- C:\Far2\Plugins\FarCmds\я
- C:\Far2\Plugins\FileCase\я
- C:\Far2\Plugins\FTP\я
- C:\Far2\Plugins\FTP\lib\я
- C:\Far2\Plugins\HlfViewer\я
- C:\Far2\Plugins\MacroView\я
- C:\Far2\Plugins\Network\я
- C:\Far2\Plugins\ProcList\я
- C:\Far2\Plugins\arclite\я
- C:\Far2\Plugins\AutoWrap\я
- C:\Far2\Plugins\Align\я
- C:\Far2\Plugins\7-Zip\я
- C:\Far2\FExcept\я
- %HOMEPATH%\Favorites\я
- %HOMEPATH%\Favorites\Links\я
- %HOMEPATH%\My Documents\я
- %HOMEPATH%\My Documents\My Music\я
- %HOMEPATH%\My Documents\My Pictures\я
- %HOMEPATH%\Start Menu\я
- <Полный путь к файлу>
- %HOMEPATH%\Start Menu\Programs\я
- %HOMEPATH%\Start Menu\Programs\Accessories\я
- %HOMEPATH%\Start Menu\Programs\Accessories\Accessibility\я
- %HOMEPATH%\Start Menu\Programs\Accessories\Entertainment\я
- %HOMEPATH%\Start Menu\Programs\Startup\я
- C:\Far2\Plugins\TmpPanel\я
- C:\Far2\Plugins\ExtSearch\я
- C:\я
- C:\Far2\Addons\я
- C:\Far2\Addons\Colors\я
- C:\Far2\Addons\Colors\Custom Highlighting\я
- C:\Far2\Addons\Colors\Default Highlighting\я
- C:\Far2\Addons\Macros\я
- C:\Far2\Addons\SetUp\я
- C:\Far2\Addons\Shell\я
- C:\Far2\Addons\XLat\я
- C:\Far2\Addons\XLat\Russian\я
- C:\Far2\Documentation\eng\я
- C:\Far2\Documentation\rus\я
- C:\Far2\Encyclopedia\я
- %HOMEPATH%\я
- C:\Far2\я
- C:\Far2\Plugins\WinSCP\я
Подменяет следующие файлы:
- %HOMEPATH%\я
Другое:
Ищет следующие окна:
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
Создает и запускает на исполнение:
- '%APPDATA%\system32.exe'
Запускает на исполнение:
- '<SYSTEM32>\cmd.exe' /c copy /y "<Полный путь к файлу>" "%APPDATA%\system32.exe"
- '<SYSTEM32>\mshta.exe' "javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('<Имя файла>.exe');close()}catch(e){}},10);"
- '<SYSTEM32>\mshta.exe' "javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('system32.exe').Path;o.RegWrite('HKCU\\Software\\Micros...
