Техническая информация
Вредоносные функции:
Создает и запускает на исполнение:
- %PROGRAM_FILES%\MSBuild\ctfmon.exe
Запускает на исполнение:
- <SYSTEM32>\cmd.exe /c <Текущая директория>\a.bat
- <SYSTEM32>\sfc.exe /purgecache
- <SYSTEM32>\regsvr32.exe /s <SYSTEM32>\MSWINSCK.OCX
Изменения в файловой системе:
Создает следующие файлы:
- <Текущая директория>\a.bat
- %PROGRAM_FILES%\MSBuild\ctfmon.exe
- <SYSTEM32>\MSWINSCK.OCX
Удаляет следующие файлы:
- <SYSTEM32>\dllcache\agt0804.dll
- <SYSTEM32>\dllcache\agt0816.dll
- <SYSTEM32>\dllcache\agt0c0a.dll
- <SYSTEM32>\dllcache\agt0419.dll
- <SYSTEM32>\dllcache\agt041d.dll
- <SYSTEM32>\dllcache\agt041f.dll
- <SYSTEM32>\dllcache\alg.exe
- <SYSTEM32>\dllcache\alrsvc.dll
- <SYSTEM32>\dllcache\amstream.dll
- <SYSTEM32>\dllcache\agtctl15.tlb
- <SYSTEM32>\dllcache\agtintl.dll
- <SYSTEM32>\dllcache\ahui.exe
- <SYSTEM32>\dllcache\agt040d.dll
- <SYSTEM32>\dllcache\agt040e.dll
- <SYSTEM32>\dllcache\agt0410.dll
- <SYSTEM32>\dllcache\agt0409.dll
- <SYSTEM32>\dllcache\agt040b.dll
- <SYSTEM32>\dllcache\agt040c.dll
- <SYSTEM32>\dllcache\agt0414.dll
- <SYSTEM32>\dllcache\agt0415.dll
- <SYSTEM32>\dllcache\agt0416.dll
- <SYSTEM32>\dllcache\agt0411.dll
- <SYSTEM32>\dllcache\agt0412.dll
- <SYSTEM32>\dllcache\agt0413.dll
- <SYSTEM32>\dllcache\ansi.sys
- <SYSTEM32>\dllcache\aspperf.dll
- <SYSTEM32>\dllcache\asptxn.dll
- <SYSTEM32>\dllcache\asr_fmt.exe
- <SYSTEM32>\dllcache\asctrls.ocx
- <SYSTEM32>\dllcache\asferror.dll
- <SYSTEM32>\dllcache\asp51.dll
- <SYSTEM32>\dllcache\asyncmac.sys
- <SYSTEM32>\dllcache\at.exe
- <SYSTEM32>\dllcache\atkctrs.dll
- <SYSTEM32>\dllcache\asr_ldm.exe
- <SYSTEM32>\dllcache\asr_pfu.exe
- <SYSTEM32>\dllcache\asycfilt.dll
- <SYSTEM32>\dllcache\apphelp.dll
- <SYSTEM32>\dllcache\apphelp.sdb
- <SYSTEM32>\dllcache\apph_sp.sdb
- <SYSTEM32>\dllcache\apcups.dll
- <SYSTEM32>\dllcache\appconf.dll
- <SYSTEM32>\dllcache\append.exe
- <SYSTEM32>\dllcache\appwiz.cpl
- <SYSTEM32>\dllcache\aqueue.dll
- <SYSTEM32>\dllcache\arp.exe
- <SYSTEM32>\dllcache\appmgmts.dll
- <SYSTEM32>\dllcache\appmgr.dll
- <SYSTEM32>\dllcache\apps.chm
- <SYSTEM32>\dllcache\agt0408.dll
- <SYSTEM32>\dllcache\actmovie.exe
- <SYSTEM32>\dllcache\actxprxy.dll
- <SYSTEM32>\dllcache\acxtrnal.dll
- <SYSTEM32>\dllcache\acspecfc.dll
- <SYSTEM32>\dllcache\activeds.dll
- <SYSTEM32>\dllcache\activeds.tlb
- <SYSTEM32>\dllcache\admparse.dll
- <SYSTEM32>\dllcache\admwprox.dll
- <SYSTEM32>\dllcache\admxprox.dll
- <SYSTEM32>\dllcache\admexs.dll
- <SYSTEM32>\dllcache\admin.dll
- <SYSTEM32>\dllcache\admin.exe
- <SYSTEM32>\dllcache\aaaamon.dll
- <SYSTEM32>\dllcache\access.cpl
- <SYSTEM32>\dllcache\acctres.dll
- <SYSTEM32>\dllcache\12520437.cpx
- <SYSTEM32>\dllcache\12520850.cpx
- <SYSTEM32>\dllcache\6to4svc.dll
- <SYSTEM32>\dllcache\acledit.dll
- <SYSTEM32>\dllcache\aclua.dll
- <SYSTEM32>\dllcache\aclui.dll
- <SYSTEM32>\dllcache\accwiz.exe
- <SYSTEM32>\dllcache\acgenral.dll
- <SYSTEM32>\dllcache\aclayers.dll
- <SYSTEM32>\dllcache\adptif.dll
- <SYSTEM32>\dllcache\agentmpx.dll
- <SYSTEM32>\dllcache\agentpsh.dll
- <SYSTEM32>\dllcache\agentsr.dll
- <SYSTEM32>\dllcache\agentctl.dll
- <SYSTEM32>\dllcache\agentdp2.dll
- <SYSTEM32>\dllcache\agentdpv.dll
- <SYSTEM32>\dllcache\agt0405.dll
- <SYSTEM32>\dllcache\agt0406.dll
- <SYSTEM32>\dllcache\agt0407.dll
- <SYSTEM32>\dllcache\agentsvr.exe
- <SYSTEM32>\dllcache\agt0401.dll
- <SYSTEM32>\dllcache\agt0404.dll
- <SYSTEM32>\dllcache\adsldpc.dll
- <SYSTEM32>\dllcache\adsmsext.dll
- <SYSTEM32>\dllcache\adsnds.dll
- <SYSTEM32>\dllcache\adrot.dll
- <SYSTEM32>\dllcache\adsiis51.dll
- <SYSTEM32>\dllcache\adsldp.dll
- <SYSTEM32>\dllcache\advpack.dll
- <SYSTEM32>\dllcache\afd.sys
- <SYSTEM32>\dllcache\agentanm.dll
- <SYSTEM32>\dllcache\adsnt.dll
- <SYSTEM32>\dllcache\adsnw.dll
- <SYSTEM32>\dllcache\advapi32.dll
Самоудаляется.
