Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Skype' = '"%APPDATA%\Skype\Phone\Skype.exe" /nosplash /minimized'
Вредоносные функции:
Создает и запускает на исполнение:
- %TEMP%\3986.exe
- %TEMP%\4658.exe
Запускает на исполнение:
- <SYSTEM32>\systeminfo.exe
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\3986.exe
- %TEMP%\bm3.tmp
- %APPDATA%\Skype\Phone\Skype.exe
- %TEMP%\nsn2.tmp
- %TEMP%\4658.exe
- %APPDATA%\Microsoft\Sze\hqhmp
Удаляет следующие файлы:
- %TEMP%\4658.exe
Другое:
Ищет следующие окна:
- ClassName: 'STATUS_UNIVED' WindowName: 'Chard'
- ClassName: 'STATUS_ACTIVED ' WindowName: 'Microsoft V8bisMode '
- ClassName: 'USER_DETE ' WindowName: 'c:\viewported '
- ClassName: 'STATUS_UNIVED' WindowName: 'STATUS_WMINE'
- ClassName: 'Chard' WindowName: 'can inished offset Allocaller=%d'
- ClassName: 'STATUS_INVALIGNAL_FOUNTER_INTOLEC ' WindowName: 'Chard'
- ClassName: 'STATUS_UNIVED' WindowName: 'RPC_NT_EXCEEDENT '
- ClassName: 'STATUS_SMALL_TX_AND_LOOK4RING ' WindowName: 'STATUS_SMALL_TX_AND_LOOK4RING '
- ClassName: 'RPC_NT_MED' WindowName: 'EV_HMAC_PHY_LONIZATION '
- ClassName: '\Spkr AnsMached' WindowName: 'c:\viewported '
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'Timiticall: InBuffer V.90: %c_LAST_SLEEP_SHADOW_CONFIGURATION_ALIAS' WindowName: 'ClearDownConfig configurateDatring'
- ClassName: 'Ignoring strue/fall ' WindowName: 'c:\viewported '
- ClassName: 'BCS_EVT ' WindowName: 'BCS_EVT '
- ClassName: 'can inished offset Allocaller=%d' WindowName: 'can inished offset Allocaller=%d'
- ClassName: 'STATUS_UNFO' WindowName: 'UpdataPump - Wronment detectoring Driver size sampArray '
- ClassName: 'STATUS_INVALID_DOT11_TX_CLOSE_ACPI000 not fount of ratoring B1, Locallocated %d' WindowName: 'MSG_SUCCESSIVED '
- ClassName: 'CEA-861B:#9' WindowName: '48M_MIMO_20M - andler)'
- ClassName: 'Rx Frequenabled the suppoing verFormat to long' WindowName: 'STATUS_INVALID_DOT11_TX_CLOSE_ACPI000 not fount of ratoring B1, Locallocated %d'
- ClassName: 'EV_MMAC_REQ_FILTER_NO_SET_OUT_EXPIRED' WindowName: 'CurrenegE'
- ClassName: 'RegPath}\UninstrolSet\Session' WindowName: 'CD_DOW_ADDBA_REQ_EVT '
- ClassName: 'Microsoft Visual bias: call' WindowName: 'ALONE '
- ClassName: 'ALONE' WindowName: 'ALONE'
- ClassName: 'The down sys (force record in type: %d.%d.%d.%d %d ' WindowName: 'KERNATED'
- ClassName: 'EV_HMAC_OID_DOT11_IBSS' WindowName: 'MM/dd/yy '
- ClassName: 'Indicator' WindowName: ''
- ClassName: 'Timiticall: InBuffer V.90: %c_LAST_SLEEP_SHADOW_CONFIGURATION_ALIAS' WindowName: 'Timiticall: InBuffer V.90: %c_LAST_SLEEP_SHADOW_CONFIGURATION_ALIAS'
- ClassName: 'STATUS_WMI' WindowName: 'RegPath}\UninstrolSet\Session'
- ClassName: 'LCB_STUB_AUTH' WindowName: 'RegSepOcted samplify volument ForData '
- ClassName: 'EV_HMAC_OID_DOT11_IBSS' WindowName: 'EV_HMAC_CALL_CCX_MUTANT_NONDICATE'
- ClassName: 'IRP_MN_STATE_INSTATUS_NONDIDATA_FRESSAGER_CLASTCH ' WindowName: 'RegKey}\{*Logical ForL2'
