Пакер: Нет
Дата компиляции и SHA1-хэши:
- 89dfc713cdfd4a8cd958f5f744ca7c6af219e4a4 (wmcodecs.dll, x64) - 13.09.2017 22:35:49
- 93fe587a5a60a380d9a2d5f335d3e17a86c2c0d8 (wmcodecs.dll, x86) - 13.09.2017 22:36:17
Описание
Является одним из компонентов троянца Belonard. Оригинальное имя - patcher32.dll(x86), patcher.dll(x64). Имеет экспорты "x", "y". Скачивается троянцем Trojan.Belonard.6 и устанавливается в систему с именем wmcodecs.dll. Устанавливает Trojan.Belonard.3 на незараженные клиенты.
Принцип действия
В экспорте «y» инициализирует контейнер, содержащий информацию об именах файлов клиента Counter-Strike 1.6 и их SHA256-хэшах. С помощью этого контейнера Trojan.Belonard.6 принимает решение о необходимости заражения найденного запущенного клиента Counter-Strike. Если какой-либо из файлов списка отсутствует или его хэш не совпадает с эталонным, троянец заражает найденный клиент игры. В контейнере хранится информация о 77 файлах и их хэшах.
f05b2eeb851b174ef2b39c4728687915648ae33780a65cdf7f0c7ce99e6a67af a3dapi.dll
f5522d2c936de8d53f97a6ec439d8f8391cb50a0bc6008a399f9454c00929d35 avcodec-53.dll
ac1f83180e07ac2b3d1e6f80f94aee0b2591be13e8a1fe63998cf7f0a9f18f1e avformat-53.dll
84e6875f1869b8cfd73525f0c04f1bf2cf0d0d08b1226f62cfd44ff14fe0345d avutil-51.dll
1aba951f3d3de59aec6c3a77133241dac6949dd4b1d158a77b646ad1ec7c5371 binkawin.asi
b2b88a7555e598d5d84957de6e60c66260bd1683e2ef7a0008d17f55ce5bd790 chromehtml.dll
2cb7b6dadf94c8c952a08be2878e2d5c330926d61f608b78525e95170ef396d1 core.dll
f5ee1224852b8c1b9e4c38945e3d3743993bda59288ac0cde0b919f679a74dea demoplayer.dll
16a7c53ab0b4c94f571f09be4fb5d785fd1d17df439c4baa5eddcbd71e68d54a filesystem_stdio.dll
0ca8225b455a9e08645be8d1310d915e4c9fca2461df2ead611be5c32e13a277 hlds.exe
b44838580117f0bd3eac79c91aae2c6580d95e84d9457b72123c1098fdb9406b hl.exe
ee04c27570505ed4dfeb24f4f39e9cdd01edcf720c3078b5791b3ea691494a09 hltv.exe
86e589074547b5fb2c84dc7e9fd56672890fe476bbebe8718be595845141e52e hw.dll
a20010e097e5a4ae7f7065da7b290cb535d1ef98a6a7cc299a343e26d688aa5d icudt.dll
391b7e66004d7845f5caa7d70f106dac7d0b49538954c55601ed7b5985c3d699 libcef.dll
3231d251c8aa4003b3b23196fe849b97c5ea3ac2d3549980e83bceb9078b4cf7 mss32.dll
dd69f9509a50db36ea6f69f5f572c300dead7f0054801a255feb556e00a453ec mssmp3.asi
3364002f997fb7c85333d7c54dfaa1f8cf9ae043c3106b6aacf3f3ff4931f484 mssv36.asi
e99de0f5e95a70b84596a66aa1af8eb7f20cb9816e1fc67dbdd8f0feab1b26ac mssvoice.asi
c0760a679d822ebbd13eced140e727b945dac132314eb39974fe2995d61961d4 proxy.dll
f1be4b46ac46bc9a26ae017c95711e5aedc11ed602908b62eface4e8d2b28aba sdl2.dll
8c073e0d2ca39d1e986bec348f988303357be5c495ccf6e0415802b86eae3534 steam_api.dll
daf2b23e840616099d0399d58fb44dac473e5236ee835c7966f5f4144441ad07 steamclient.dll
74c27291539d79a53e036b3d0d8e5028dd04bf2990b1bee097b94fc8f65d491b steam.dll
6c1246111a683f2238528d91368a27d4bec85b550c35a759d1b769c08d12859a sw.dll
2e3a84b93864fba67dd9f50db21e138151e7b17d75134227e35db38ed15d2588 swds.dll
55e64559ba6acc4c0efc3bef92382714a6b9b8a4bd4696e8c920e709c803b250 tier0.dll
4b40a5254c69391299d0c066d0f5bfc01c75c390d8aded20b63460f8796d7049 vgui2.dll
3027c2a92a50b8892a82c01a25ef093752810f36b93b26bef101cb89d2f98a3b vgui.dll
7af60ff835b8069bc184eca4d24992b1b48f98e877a5ff097c6d1a7cbdd1c2aa voice_speex.dll
f8ce56ba4d4a0a8c1192d31736b4420efe0b8efcdb39805203e0344f290b3b04 vstdlib.dll
5b56eab3f0ec35b59f1e801dbab38315955fa2601105615e5b81bc1f28383fb2 cstrike\\addons\\metamod\\metamod.dll
77475c65730751a4380caba197b7b467f273c35390887e585bbb6974b2b3c52e cstrike\\addons\\voicetranscoder\\voicetranscoder.dll
5b56eab3f0ec35b59f1e801dbab38315955fa2601105615e5b81bc1f28383fb2 valve\\addons\\metamod\\metamod.dll
77475c65730751a4380caba197b7b467f273c35390887e585bbb6974b2b3c52e valve\\addons\\voicetranscoder\\voicetranscoder.dll
2dad31c59dabbddfaae5c9df0577899fda5f3f68bce6b492ef3d280faf34e5e7 cstrike\\cl_dlls\\client.dll
132b956c745c9637eaaab9c618b056741341ef2b90c7d4d25764e9a280a372ba cstrike\\dlls\\mp.dll
cc4bef3bc834fd0b1f69377b0717c2c501d320162375f1eba578f33fa1d29ae3 platform\\admin\\adminserver.dll
b1ebeb8a360a2d107cdde3ebdeb136dceda422c4218477fbe2f5cc03a3a93389 platform\\servers\\serverbrowser.dll
97ffcb0252ea9feaca00c5cc5067c822943e5106069b6df7e17fbcf638cc01f7 valve\\cl_dlls\\client.dll
4dcf44bb9340e872006cba47188e6c7ea98a3489a16caab279e2b107d1d1ce25 valve\\cl_dlls\\gameui.dll
efe9673812f2603612679327ac2312cdca68317821d977f8986174e6dd062bdf valve\\cl_dlls\\particleman.dll
25db5dae3912d3aadb281dc6223173c25ef1bca689793410d4c0ea9b25d3b532 valve\\dlls\\director.dll
2b230585d6c082bc1352be4c69329a92da78947d1728504f87d6456f60f2468d valve\\dlls\\hl.dll
a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb valve\\hw\\opengl.cfg
a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb valve\\hw\\V2200.cfg
a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb cstrike\\autoexec.cfg
a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb cstrike\\banned.cfg
a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb cstrike\\bin
a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb cstrike\\default.cfg
a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb cstrike\\game.cfg
a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb cstrike\\hw
a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb cstrike\\joystick.cfg
a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb cstrike\\language.cfg
170f619f59c9bc731ae7a812a4d904ed031c498242a8fba30b5a9c2ff6e5fcac cstrike\\liblist.gam
150be452b0dba80415798c02bf000be708dd408e8a19aea4801504e0566748a2 cstrike\\listenserver.cfg
a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb cstrike\\listip.cfg
a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb cstrike\\save
79021599b915b1bf9523cc58f38da84218abe64d55e09ec158f1545313da3d71 cstrike\\server.cfg
a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb cstrike\\servers
ddef4cb7c8abc2d6d127a9a1721e44d23071551aae43f1b1df83f94ef5b1ec93 cstrike\\userconfig.cfg
a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb cstrike\\valve.rc
a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb cstrike\\violence.cfg
3ccd896d8c4d0937c94ff4c8e019bdcabd26edaa9fe83d7f5677f7b22e8963bf valve\\autoexec.cfg
a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb valve\\banned.cfg
a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb valve\\bin
b625391874c7beca74b9d2f643dfbc5343062bd52c7d5c8780289fee2072666b valve\\default.cfg
e8ed3b661460080de4c36cbd1b66a16542a3f6c9f74278bae893cb80df134232 valve\\game.cfg
a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb valve\\joystick.cfg
6db675ec7689b119ab9550f4bcc732ff8ca80f29743dd41228b25849514385d7 valve\\language.cfg
b9031a99ea263f6337a53a93fbf95fb11d86739f6b2988deed9a2f87f85c15c4 valve\\listenserver.cfg
a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb valve\\listip.cfg
54f9cc96ba96bde6c727c8185ff3ae95edf0efe78f7c15d97a343ca6e3ae1795 valve\\server.cfg
a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb valve\\servers
ddef4cb7c8abc2d6d127a9a1721e44d23071551aae43f1b1df83f94ef5b1ec93 valve\\userconfig.cfg
5b1b2dd68c2ff1fc6cda3f415cfa7087884ca075c371574aa19c1e4474c4d540 valve\\valve.rc
a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb valve\\violence.cfg
Экспорт «x» принимает аргументом путь до исполняемого файла, который был определен троянцем как файл клиента Counter-Strike 1.6. Троянец ищет процессы, у которых исполняемые файлы расположены в одном каталоге (далее <path>) с переданным аргументом путем, и завершает их.
Троянец также удаляет файлы в корне каталога <path>, после чего сохраняет по этому пути файл hl.exe (64a8fd73af7a99695ba37cdab79b6cdac67b696e) запакованный VMProtect. Этот hl.exe является временной заглушкой. Он создает мьютекс "Counter-Strike 1.6" и выводит сообщение об ошибке при загрузке игры: "Could not load game. Please try again at a later time." Затем удаляет следующие файлы:
<path>\\valve\\dlls\\*
<path>\\cstrike\\dlls\\*
<path>\\valve\\cl_dlls\\*
<path>\\cstrike\\cl_dlls\\*
<path>\\cstrike\\resource\\*.res
<path>\\valve\\resource\\*.res
<path>\\valve\\motd.txt
<path>\\cstrike\\resource\\gameui_english.txt
<path>\\cstrike\\resource\\icon_steam.tga
<path>\\valve\\resource\\icon_steam.tga
<path>\\cstrike\\resource\\icon_steam_disabled.tga
<path>\\valve\\resource\\icon_steam_disabled.tga
<path>\\cstrike\\sound\\weapons\\fiveseven_reload_clipin_sliderelease.dll
<path>\\cstrike_russian\\sound\\weapons\\fiveseven_reload_clipin_sliderelease.dll
<path>\\cstrike_romanian\\sound\\weapons\\fiveseven_reload_clipin_sliderelease.dll
После чего извлекает из своего тела файлы клиента Counter-Strike 1.6 по относительному пути в каталог <path>:
a3dapi.dll
avcodec-53.dll
avformat-53.dll
avutil-51.dll
binkawin.asi
chromehtml.dll
Core.dll
DemoPlayer.dll
FileSystem_Stdio.dll
hlds.exe
hltv.exe
hw.dll
icudt.dll
libcef.dll
Mss32.dll
mssmp3.asi
Mssv36.asi
mssvoice.asi
proxy.dll
SDL2.dll
Start Counter-Strike Game.bat
Start Counter-Strike Server.bat
Start Half-Life Game.bat
Start Half-Life Server.bat
steam_api.dll
steam_appid.txt
steamclient.dll
Steam.dll
sw.dll
swds.dll
tier0.dll
vgui2.dll
vgui.dll
voice_speex.dll
vstdlib.dll
cstrike\\autoexec.cfg
cstrike\\banned.cfg
cstrike\\bin
cstrike\\config.cfg
cstrike\\cstrike.ico
cstrike\\default.cfg
cstrike\\game.cfg
cstrike\\game.ico
cstrike\\game.tga
cstrike\\hw
cstrike\\joystick.cfg
cstrike\\language.cfg
cstrike\\liblist.gam
cstrike\\listenserver.cfg
cstrike\\listip.cfg
cstrike\\motd.txt
cstrike\\save
cstrike\\server.cfg
cstrike\\servers
cstrike\\settings.scr
cstrike\\userconfig.cfg
cstrike\\user.scr
cstrike\\valve.rc
cstrike\\violence.cfg
valve\\autoexec.cfg
valve\\banned.cfg
valve\\bin
valve\\config.cfg
valve\\default.cfg
valve\\game.cfg
valve\\joystick.cfg
valve\\language.cfg
valve\\listenserver.cfg
valve\\listip.cfg
valve\\server.cfg
valve\\servers
valve\\settings.scr
valve\\userconfig.cfg
valve\\user.scr
valve\\valve.rc
valve\\violence.cfg
cstrike\\cl_dlls\\client.dll
cstrike\\dlls\\mp.dll
cstrike\\motd\\protector.txt
cstrike\\resource\\ClientScheme.res
cstrike\\resource\\CreateMultiplayerGameGameplayPage.res
cstrike\\resource\\CreateMultiplayerGameServerPage.res
cstrike\\resource\\cstrike_english.txt
cstrike\\resource\\OptionsSubMultiplayer.res
platform\\admin\\admin_english.txt
platform\\admin\\admin_russian.txt
platform\\admin\\AdminServer.dll
platform\\admin\\BanPanel.res
platform\\admin\\ChatPanel.res
platform\\admin\\ConfigPanel.res
platform\\admin\\CreateMultiplayerGameServerPage.res
platform\\admin\\DialogAddBan.res
platform\\admin\\DialogAddServer.res
platform\\admin\\DialogAdminServer.res
platform\\admin\\DialogCvarChange.res
platform\\admin\\DialogGamePanelInfo.res
platform\\admin\\DialogKickPlayer.res
platform\\admin\\DialogServerPassword.res
platform\\admin\\GamePanelInfo.res
platform\\admin\\game_ready.wav
platform\\admin\\GraphPanel.res
platform\\admin\\HelpFile_adminmod.vdf
platform\\admin\\HelpFile_cstrike.vdf
platform\\admin\\HelpFile.vdf
platform\\admin\\hlds_logo.tga
platform\\admin\\MainServerConfig.vdf
platform\\admin\\MapCycleEditDialog.res
platform\\admin\\MOTDPanel.res
platform\\admin\\PasswordPanel.res
platform\\admin\\PlayerPanel.res
platform\\admin\\RawLogPanel.res
platform\\admin\\RulesPanel.res
platform\\admin\\ServerConfigPanel_cstrike.res
platform\\admin\\ServerConfigPanel_dod.res
platform\\admin\\ServerConfigPanel.res
platform\\admin\\ServerConfigPanel_valve.res
platform\\admin\\server_english.txt
platform\\admin\\server_russian.txt
platform\\admin\\VarEditDialog_ComboBox.res
platform\\admin\\VarEditDialog_String.res
platform\\config\\ServerBrowser.vdf
platform\\resource\\CreateTokenDialog.res
platform\\resource\\EditTokenDialog.res
platform\\resource\\icon_blank.tga
platform\\resource\\icon_checked.tga
platform\\resource\\icon_close.tga
platform\\resource\\icon_down_default.tga
platform\\resource\\icon_down.tga
platform\\resource\\icon_emptybox.tga
platform\\resource\\icon_file.tga
platform\\resource\\icon_folder_selected.tga
platform\\resource\\icon_folder.tga
platform\\resource\\icon_folderup.tga
platform\\resource\\icon_hlicon1.tga
platform\\resource\\icon_hlicon2.tga
platform\\resource\\icon_left.tga
platform\\resource\\icon_maximize.tga
platform\\resource\\icon_minimize.tga
platform\\resource\\icon_password.tga
platform\\resource\\icon_radiosel.tga
platform\\resource\\icon_radiounsel.tga
platform\\resource\\icon_resizer.tga
platform\\resource\\icon_right.tga
platform\\resource\\icon_steam_disabled.tga
platform\\resource\\icon_steam.tga
platform\\resource\\icon_up.tga
platform\\resource\\icon_warning.tga
platform\\resource\\LocalizationDialog.res
platform\\resource\\TrackerScheme.res
platform\\resource\\VAC_shield.tga
platform\\resource\\valve_logo.tga
platform\\resource\\vgui_english.txt
platform\\resource\\vgui_russian.txt
platform\\servers\\AddServerGamesPage.res
platform\\servers\\DialogAddServer.res
platform\\servers\\DialogGameInfo_AutoRetry.res
platform\\servers\\DialogGameInfo.res
platform\\servers\\DialogGameInfo_SinglePlayer.res
platform\\servers\\DialogServerBrowser.res
platform\\servers\\DialogServerPassword.res
platform\\servers\\icon_bots_column.tga
platform\\servers\\icon_bots.tga
platform\\servers\\icon_password_column.tga
platform\\servers\\icon_password.tga
platform\\servers\\icon_robotron_column.tga
platform\\servers\\icon_robotron.tga
platform\\servers\\icon_secure_deny.tga
platform\\servers\\InternetGamesPage_Filters.res
platform\\servers\\InternetGamesPage.res
platform\\servers\\ServerBrowser.dll
platform\\servers\\serverbrowser_english.txt
platform\\servers\\serverbrowser_russian.txt
platform\\servers\\VACBannedConnRefusedDialog.res
valve\\cl_dlls\\client.dll
valve\\cl_dlls\\GameUI.dll
valve\\cl_dlls\\particleman.dll
valve\\dlls\\Director.dll
valve\\dlls\\hl.dll
valve_hd\\models\\agibs.mdl
valve_hd\\models\\agrunt01.mdl
valve_hd\\models\\agrunt.mdl
valve_hd\\models\\barney01.mdl
valve_hd\\models\\barney02.mdl
valve_hd\\models\\barney03.mdl
valve_hd\\models\\barney04.mdl
valve_hd\\models\\barney05.mdl
valve_hd\\models\\barney.mdl
valve_hd\\models\\bullsquid01.mdl
valve_hd\\models\\bullsquid.mdl
valve_hd\\models\\crossbow_bolt.mdl
valve_hd\\models\\gman.mdl
valve_hd\\models\\grenade.mdl
valve_hd\\models\\hgrunt01.mdl
valve_hd\\models\\hgrunt02.mdl
valve_hd\\models\\Hgrunt03.mdl
valve_hd\\models\\hgrunt.mdl
valve_hd\\models\\houndeye.mdl
valve_hd\\models\\islave01.mdl
valve_hd\\models\\islave02.mdl
valve_hd\\models\\islave.mdl
valve_hd\\models\\p_357.mdl
valve_hd\\models\\p_9mmar.mdl
valve_hd\\models\\p_9mmhandgun.mdl
valve_hd\\models\\p_crossbow.mdl
valve_hd\\models\\p_crowbar.mdl
valve_hd\\models\\p_egon.mdl
valve_hd\\models\\p_gauss.mdl
valve_hd\\models\\p_grenade.mdl
valve_hd\\models\\p_hgun.mdl
valve_hd\\models\\p_rpg.mdl
valve_hd\\models\\p_satchel.mdl
valve_hd\\models\\p_satchel_radio.mdl
valve_hd\\models\\p_shotgun.mdl
valve_hd\\models\\p_squeak.mdl
valve_hd\\models\\p_tripmine.mdl
valve_hd\\models\\rpgrocket.mdl
valve_hd\\models\\scientist01.mdl
valve_hd\\models\\scientist02.mdl
valve_hd\\models\\scientist03.mdl
valve_hd\\models\\scientist04.mdl
valve_hd\\models\\scientist05.mdl
valve_hd\\models\\scientist06.mdl
valve_hd\\models\\scientist07.mdl
valve_hd\\models\\scientist08.mdl
valve_hd\\models\\scientist09.mdl
valve_hd\\models\\scientist10.mdl
valve_hd\\models\\scientist.mdl
valve_hd\\models\\shell.mdl
valve_hd\\models\\shotgunshell.mdl
valve_hd\\models\\v_357.mdl
valve_hd\\models\\v_9mmar.mdl
valve_hd\\models\\v_9mmhandgun.mdl
valve_hd\\models\\v_crossbow.mdl
valve_hd\\models\\v_crowbar.mdl
valve_hd\\models\\v_egon.mdl
valve_hd\\models\\v_gauss.mdl
valve_hd\\models\\v_grenade.mdl
valve_hd\\models\\v_hgun.mdl
valve_hd\\models\\v_rpg.mdl
valve_hd\\models\\v_satchel.mdl
valve_hd\\models\\v_satchel_radio.mdl
valve_hd\\models\\v_shotgun.mdl
valve_hd\\models\\v_squeak.mdl
valve_hd\\models\\v_tripmine.mdl
valve_hd\\models\\w_357ammobox.mdl
valve_hd\\models\\w_357ammo.mdl
valve_hd\\models\\w_357.mdl
valve_hd\\models\\w_9mmarclip.mdl
valve_hd\\models\\w_9mmar.mdl
valve_hd\\models\\w_9mmhandgun.mdl
valve_hd\\models\\w_argrenade.mdl
valve_hd\\models\\w_crossbow_clip.mdl
valve_hd\\models\\w_crossbow.mdl
valve_hd\\models\\w_crowbar.mdl
valve_hd\\models\\w_egon.mdl
valve_hd\\models\\w_gaussammo.mdl
valve_hd\\models\\w_gauss.mdl
valve_hd\\models\\w_grenade.mdl
valve_hd\\models\\w_hgun.mdl
valve_hd\\models\\w_rpgammo.mdl
valve_hd\\models\\w_rpg.mdl
valve_hd\\models\\w_satchel.mdl
valve_hd\\models\\w_shotbox.mdl
valve_hd\\models\\w_shotgun.mdl
valve_hd\\models\\w_sqknest.mdl
valve_hd\\models\\w_squeak.mdl
valve_hd\\models\\zombie01.mdl
valve_hd\\models\\zombie02.mdl
valve_hd\\models\\zombie03.mdl
valve_hd\\models\\zombie04.mdl
valve_hd\\models\\zombie.mdl
valve_hd\\sprites\\640hud1.spr
valve_hd\\sprites\\640hud4.spr
valve_hd\\sprites\\muzzleflash1.spr
valve\\hw\\opengl.cfg
valve\\hw\\V2200.cfg
valve\\resource\\CDKeyEntryDialog.res
valve\\resource\\ChangeGameDialog.res
valve\\resource\\ClientScheme.res
valve\\resource\\ContentControlDialog.res
valve\\resource\\CreateMultiplayerGameGameplayPage.res
valve\\resource\\CreateMultiplayerGameServerPage.res
valve\\resource\\DemoEditDialog.res
valve\\resource\\DemoEventsDialog.res
valve\\resource\\DemoPlayerDialog.res
valve\\resource\\DemoPlayerFileDialog.res
valve\\resource\\DialogOptionsIngame.res
valve\\resource\\fake_microphone_meter.tga
valve\\resource\\game_menu_mouseover.tga
valve\\resource\\game_menu.tga
valve\\resource\\gameui_english.txt
valve\\resource\\icon_blocked.tga
valve\\resource\\icon_end.tga
valve\\resource\\icon_faster.tga
valve\\resource\\icon_friend_indicator_scoreboard.tga
valve\\resource\\icon_hlicon1.tga
valve\\resource\\icon_hlicon2.tga
valve\\resource\\icon_load.tga
valve\\resource\\icon_pause.tga
valve\\resource\\icon_play.tga
valve\\resource\\icon_slower.tga
valve\\resource\\icon_start.tga
valve\\resource\\icon_stepb.tga
valve\\resource\\icon_stepf.tga
valve\\resource\\icon_stop.tga
valve\\resource\\icon_vac.tga
valve\\resource\\LoadGameDialog.res
valve\\resource\\LoadingDialogConnectionLost.res
valve\\resource\\LoadingDialogDualProgress.res
valve\\resource\\LoadingDialogDualProgressVAC.res
valve\\resource\\LoadingDialogErrorLoggedInElsewhere.res
valve\\resource\\LoadingDialogErrorNoSteamConnection.res
valve\\resource\\LoadingDialogError.res
valve\\resource\\LoadingDialogErrorVACBanned.res
valve\\resource\\LoadingDialogNoBanner.res
valve\\resource\\LoadingDialogNoBannerSingle.res
valve\\resource\\LoadingDialog.res
valve\\resource\\LoadingDialogVAC.res
valve\\resource\\logo_game.tga
valve\\resource\\menu_hl_no_icon.tga
valve\\resource\\menu_hl_with_icon.tga
valve\\resource\\menu_steam_no_icon.tga
valve\\resource\\menu_steam_with_icon.tga
valve\\resource\\mic_meter_dead.tga
valve\\resource\\mic_meter_live.tga
valve\\resource\\MultiplayerAdvancedDialog.res
valve\\resource\\MultiplayerAdvancedPage.res
valve\\resource\\NewGameDialog.res
valve\\resource\\OptionsSubAdvanced.res
valve\\resource\\OptionsSubAudio.res
valve\\resource\\OptionsSubKeyboard.res
valve\\resource\\OptionsSubMouse.res
valve\\resource\\OptionsSubMultiplayer.res
valve\\resource\\OptionsSubVideo.res
valve\\resource\\OptionsSubVoice.res
valve\\resource\\PlayerListDialog.res
valve\\resource\\refreshlogin.res
valve\\resource\\SaveGameDialog.res
valve\\resource\\steam_menu_mouseover.tga
valve\\resource\\steam_menu.tga
valve\\resource\\SteamPasswordDialog.res
valve\\resource\\ValveCDKeyEntryDialog.res
valve\\resource\\valve_english.txt
valve_russian\\resource\\gameui_russian.txt
valve_russian\\resource\\valve_russian.txt
cstrike_hd\\gfx\\vgui\\ak47.tga
cstrike_hd\\gfx\\vgui\\arctic.tga
cstrike_hd\\gfx\\vgui\\aug.tga
cstrike_hd\\gfx\\vgui\\awp.tga
cstrike_hd\\gfx\\vgui\\bullet.tga
cstrike_hd\\gfx\\vgui\\cartridge.tga
cstrike_hd\\gfx\\vgui\\crosshair.tga
cstrike_hd\\gfx\\vgui\\deserteagle.tga
cstrike_hd\\gfx\\vgui\\elites.tga
cstrike_hd\\gfx\\vgui\\famas.tga
cstrike_hd\\gfx\\vgui\\fiveseven.tga
cstrike_hd\\gfx\\vgui\\flashbang.tga
cstrike_hd\\gfx\\vgui\\g3sg1.tga
cstrike_hd\\gfx\\vgui\\galil.tga
cstrike_hd\\gfx\\vgui\\gign.tga
cstrike_hd\\gfx\\vgui\\glock18.tga
cstrike_hd\\gfx\\vgui\\gsg9.tga
cstrike_hd\\gfx\\vgui\\guerilla.tga
cstrike_hd\\gfx\\vgui\\hegrenade.tga
cstrike_hd\\gfx\\vgui\\leet.tga
cstrike_hd\\gfx\\vgui\\m249.tga
cstrike_hd\\gfx\\vgui\\m3.tga
cstrike_hd\\gfx\\vgui\\m4a1.tga
cstrike_hd\\gfx\\vgui\\mac10.tga
cstrike_hd\\gfx\\vgui\\militia.tga
cstrike_hd\\gfx\\vgui\\mp5.tga
cstrike_hd\\gfx\\vgui\\p228.tga
cstrike_hd\\gfx\\vgui\\p90.tga
cstrike_hd\\gfx\\vgui\\sas.tga
cstrike_hd\\gfx\\vgui\\scout.tga
cstrike_hd\\gfx\\vgui\\sg550.tga
cstrike_hd\\gfx\\vgui\\sg552.tga
cstrike_hd\\gfx\\vgui\\shell.tga
cstrike_hd\\gfx\\vgui\\shield.tga
cstrike_hd\\gfx\\vgui\\smokegrenade.tga
cstrike_hd\\gfx\\vgui\\spetsnaz.tga
cstrike_hd\\gfx\\vgui\\terror.tga
cstrike_hd\\gfx\\vgui\\tmp.tga
cstrike_hd\\gfx\\vgui\\ump45.tga
cstrike_hd\\gfx\\vgui\\urban.tga
cstrike_hd\\gfx\\vgui\\usp45.tga
cstrike_hd\\gfx\\vgui\\xm1014.tga
cstrike\\resource\\UI\\BackgroundPanel.res
cstrike\\resource\\UI\\BottomSpectator.res
cstrike\\resource\\UI\\BuyEquipment_CT.res
cstrike\\resource\\UI\\BuyEquipment.res
cstrike\\resource\\UI\\BuyEquipment_TER.res
cstrike\\resource\\UI\\BuyMachineguns_CT.res
cstrike\\resource\\UI\\BuyMachineguns_TER.res
cstrike\\resource\\UI\\BuyMenu.res
cstrike\\resource\\UI\\BuyPistols_CT.res
cstrike\\resource\\UI\\BuyPistols_TER.res
cstrike\\resource\\UI\\BuyRifles_CT.res
cstrike\\resource\\UI\\BuyRifles_TER.res
cstrike\\resource\\UI\\BuyShotguns_CT.res
cstrike\\resource\\UI\\BuyShotguns_TER.res
cstrike\\resource\\UI\\BuySubMachineguns_CT.res
cstrike\\resource\\UI\\BuySubMachineguns_TER.res
cstrike\\resource\\UI\\Classmenu_CT.res
cstrike\\resource\\UI\\Classmenu_TER.res
cstrike\\resource\\UI\\MainBuyMenu.res
cstrike\\resource\\UI\\MOTD.res
cstrike\\resource\\UI\\ScoreBoard.res
cstrike\\resource\\UI\\Spectator.res
cstrike\\resource\\UI\\Teammenu.res
valve_hd\\sound\\hgrunt\\gr_mgun1.wav
valve_hd\\sound\\hgrunt\\gr_mgun2.wav
valve_hd\\sound\\weapons\\dbarrel1.wav
valve_hd\\sound\\weapons\\hks1.wav
valve_hd\\sound\\weapons\\hks2.wav
valve_hd\\sound\\weapons\\hks3.wav
valve_hd\\sound\\weapons\\sbarrel1.wav
valve_hd\\sound\\weapons\\scock1.wav
valve\\resource\\UI\\MOTD.res
valve\\resource\\UI\\ScoreBoard.res
valve\\resource\\UI\\TextWindow.res
cstrike_hd\\gfx\\vgui\\buy_presets\\ak47.tga
cstrike_hd\\gfx\\vgui\\buy_presets\\aug.tga
cstrike_hd\\gfx\\vgui\\buy_presets\\awp.tga
cstrike_hd\\gfx\\vgui\\buy_presets\\defaultpistol_career.tga
cstrike_hd\\gfx\\vgui\\buy_presets\\defaultpistol.tga
cstrike_hd\\gfx\\vgui\\buy_presets\\defaultrifle_career.tga
cstrike_hd\\gfx\\vgui\\buy_presets\\defaultrifle.tga
cstrike_hd\\gfx\\vgui\\buy_presets\\defuser.tga
cstrike_hd\\gfx\\vgui\\buy_presets\\deserteagle.tga
cstrike_hd\\gfx\\vgui\\buy_presets\\elites.tga
cstrike_hd\\gfx\\vgui\\buy_presets\\famas.tga
cstrike_hd\\gfx\\vgui\\buy_presets\\fiveseven.tga
cstrike_hd\\gfx\\vgui\\buy_presets\\flashbang.tga
cstrike_hd\\gfx\\vgui\\buy_presets\\g3sg1.tga
cstrike_hd\\gfx\\vgui\\buy_presets\\galil.tga
cstrike_hd\\gfx\\vgui\\buy_presets\\glock18.tga
cstrike_hd\\gfx\\vgui\\buy_presets\\hegrenade.tga
cstrike_hd\\gfx\\vgui\\buy_presets\\helmet.tga
cstrike_hd\\gfx\\vgui\\buy_presets\\kevlar_helmet.tga
cstrike_hd\\gfx\\vgui\\buy_presets\\kevlar.tga
cstrike_hd\\gfx\\vgui\\buy_presets\\m249.tga
cstrike_hd\\gfx\\vgui\\buy_presets\\m3.tga
cstrike_hd\\gfx\\vgui\\buy_presets\\m4a1.tga
cstrike_hd\\gfx\\vgui\\buy_presets\\mac10.tga
cstrike_hd\\gfx\\vgui\\buy_presets\\mp5.tga
cstrike_hd\\gfx\\vgui\\buy_presets\\nightvision.tga
cstrike_hd\\gfx\\vgui\\buy_presets\\p228.tga
cstrike_hd\\gfx\\vgui\\buy_presets\\p90.tga
cstrike_hd\\gfx\\vgui\\buy_presets\\scout.tga
cstrike_hd\\gfx\\vgui\\buy_presets\\sg550.tga
cstrike_hd\\gfx\\vgui\\buy_presets\\sg552.tga
cstrike_hd\\gfx\\vgui\\buy_presets\\shield.tga
cstrike_hd\\gfx\\vgui\\buy_presets\\smokegrenade.tga
cstrike_hd\\gfx\\vgui\\buy_presets\\tmp.tga
cstrike_hd\\gfx\\vgui\\buy_presets\\ump45.tga
cstrike_hd\\gfx\\vgui\\buy_presets\\usp45.tga
cstrike_hd\\gfx\\vgui\\buy_presets\\xm1014.tga
cstrike_hd\\models\\player\\arctic\\arctic.mdl
cstrike_hd\\models\\player\\gign\\gign.mdl
cstrike_hd\\models\\player\\gsg9\\gsg9.mdl
cstrike_hd\\models\\player\\guerilla\\guerilla.mdl
cstrike_hd\\models\\player\\leet\\leet.mdl
cstrike_hd\\models\\player\\militia\\militia.mdl
cstrike_hd\\models\\player\\sas\\sas.mdl
cstrike_hd\\models\\player\\spetsnaz\\spetsnaz.mdl
cstrike_hd\\models\\player\\terror\\terror.mdl
cstrike_hd\\models\\player\\urban\\urban.mdl
cstrike_hd\\models\\player\\vip\\vip.mdl
cstrike\\resource\\GameMenu.res
valve\\resource\\GameMenu.res
rev.ini
cstrike\\addons\\metamod\\metamod.dll
cstrike\\addons\\metamod\\plugins.ini
cstrike\\addons\\VoiceTranscoder\\VoiceTranscoder.cfg
cstrike\\addons\\VoiceTranscoder\\VoiceTranscoder.dll
valve\\addons\\metamod\\metamod.dll
valve\\addons\\metamod\\plugins.ini
valve\\addons\\VoiceTranscoder\\VoiceTranscoder.cfg
valve\\addons\\VoiceTranscoder\\VoiceTranscoder.dll
valve\\liblist.gam
Существуют русскоязычная и англоязычная версии следующих файлов:
- rev.ini, valve\\resource\\GameMenu.res,
- cstrike\\resource\\GameMenu.res.
Версия выбирается в зависимости от языковых настроек ОС.
Затем троянец удаляет <path>\\hl.exe и сохраняет на его место свою версию hl.exe (bb18f9895ec0d0254628446a537f9fc6c44fd758). После чего ищет и прекращает процесс, чей путь был передал аргументом этой функции.
Зараженный клиент
hl.exe - представляет собой запакованный загрузчик игры. Mssv36.asi (Trojan.Belonard.10) – другой компонент троянца.
В некоторых файлах размещена реклама ресурсов разработчика троянца - csgoogle.ru и vk.com/mudcs:
- config.cfg - в качестве имени игрока указано "CSGOOGLE-RU";
- cstrike\resource\GameMenu.res - добавлен пункт меню.
{
"label" "Скачать новые сборки CS"
"command" "url https://csgoogle.ru"
}
И его англоязычный вариант:
{
"label" "Check New CS Builds"
"command" "url https://csgoogle.ru"
}
- rev.ini - в параметре RejectText прописана ссылка vk.com/mudcs
- cstrike\\liblist.gam - в параметре url_info прописан vk.com/mudcs
- cstrike\\listenserver.cfg - в качестве имени сервера указан vk.com/mudcs
- cstrike\\server.cfg - в качестве имени сервера указан vk.com/mudcs
- valve\\listenserver.cfg - в качестве имени сервера указан vk.com/mudcs
- valve\\server.cfg - в качестве имени сервера указан vk.com/mudcs
- platform\\servers\\InternetGamesPage.res - прописана ссылка на vk.com/mudcs
- platform\\servers\\InternetGamesPage_Filters.res - прописана ссылка на vk.com/mudcs
