Техническая информация
Вредоносные функции
Запускает на исполнение
- '<SYSTEM32>\taskkill.exe' /f /im IEMonitor.exe
- '<SYSTEM32>\taskkill.exe' /f /im IDMan.exe
- '<SYSTEM32>\taskkill.exe' /f /im firefox.exe
- '<SYSTEM32>\taskkill.exe' /f /im Opera
- '<SYSTEM32>\taskkill.exe' /f /im Opera.exe
- '<SYSTEM32>\taskkill.exe' /f /im Maxthon.exe
- '<SYSTEM32>\taskkill.exe' /f /im IEXPLORE.exe
- '<SYSTEM32>\taskkill.exe' /f /im fire
- '<SYSTEM32>\taskkill.exe' /f /im chrome.exe
Завершает или пытается завершить
следующие пользовательские процессы:
- firefox.exe
- iexplore.exe
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\rarsfx0\hosts.exe
- %ProgramFiles%\internet download manager\toolbar\mosi3d_1.tbi
- %ProgramFiles%\internet download manager\toolbar\luckytoolbarsh2.bmp
- %ProgramFiles%\internet download manager\toolbar\luckytoolbars2.bmp
- %ProgramFiles%\internet download manager\toolbar\luckytoolbarh2.bmp
- %ProgramFiles%\internet download manager\toolbar\luckytoolbar2.tbi
- %ProgramFiles%\internet download manager\toolbar\luckytoolbar2.bmp
- %ProgramFiles%\internet download manager\toolbar\koushik_halder_small_normal.bmp
- %ProgramFiles%\internet download manager\toolbar\koushik_halder_small_hot.bmp
- %ProgramFiles%\internet download manager\toolbar\koushik_halder_small_disable.bmp
- %ProgramFiles%\internet download manager\toolbar\koushik_halder_large_normal.bmp
- %ProgramFiles%\internet download manager\toolbar\koushik_halder_large_hot.bmp
- %ProgramFiles%\internet download manager\toolbar\koushik_halder_large_disable.bmp
- %ProgramFiles%\internet download manager\toolbar\koushik halder.tbi
- %ProgramFiles%\internet download manager\toolbar\kitihot.bmp
- %ProgramFiles%\internet download manager\toolbar\kiti.tbi
- %ProgramFiles%\internet download manager\toolbar\mosi3d_largehot_1.bmp
- %ProgramFiles%\internet download manager\toolbar\mosi3d_large_1.bmp
- %ProgramFiles%\internet download manager\toolbar\mosi3d_smallhot_1.bmp
- %ProgramFiles%\internet download manager\toolbar\mosi3d_small_1.bmp
- %ProgramFiles%\internet download manager\idmwfp.inf
- %ProgramFiles%\internet download manager\idmtdi.inf
- %ProgramFiles%\internet download manager\toolbar\thumbs.db
- %ProgramFiles%\internet download manager\toolbar\thl-toolbar_bmps\thumbs.db
- %ProgramFiles%\internet download manager\toolbar\thl-toolbar_bmps\thl-normal.bmp
- %ProgramFiles%\internet download manager\toolbar\thl-toolbar_bmps\thl-hot.bmp
- %ProgramFiles%\internet download manager\toolbar\thl-toolbar.tbi
- %ProgramFiles%\internet download manager\toolbar\skin2\thumbs.db
- %ProgramFiles%\internet download manager\toolbar\skin2.tbi
- %ProgramFiles%\internet download manager\toolbar\skin2\3d_small_3.bmp
- %ProgramFiles%\internet download manager\toolbar\skin2\3d_smallhot_3.bmp
- %ProgramFiles%\internet download manager\toolbar\skin2\3d_large_3.bmp
- %ProgramFiles%\internet download manager\toolbar\skin2\3d_largehot_3.bmp
- %ProgramFiles%\internet download manager\toolbar\mosi_modern_xphot.bmp
- %ProgramFiles%\internet download manager\toolbar\mosi_modern_xp.tbi
- %ProgramFiles%\internet download manager\toolbar\mosi_modern_xp.bmp
- %TEMP%\7zipsfx.000\stop.exe
- %ProgramFiles%\internet download manager\toolbar\kiti.bmp
- %ProgramFiles%\internet download manager\toolbar\h3m_glossy_toolbar\thumbs.db
- %ProgramFiles%\internet download manager\toolbar\h3m_glossy_toolbar\h3m_glossy_small_normal.bmp
- %ProgramFiles%\internet download manager\toolbar\3d_smallhot_3.bmp
- %ProgramFiles%\internet download manager\toolbar\3d_large_3.bmp
- %ProgramFiles%\internet download manager\toolbar\3d_largehot_3.bmp
- %ProgramFiles%\internet download manager\languages\tips_fr.txt
- %ProgramFiles%\internet download manager\languages\tips_ar.txt
- %ProgramFiles%\internet download manager\languages\inst_ar.lng
- %ProgramFiles%\internet download manager\languages\idm_fr.lng
- %ProgramFiles%\internet download manager\languages\idm_ar.lng
- %ProgramFiles%\internet download manager\idman.exe
- %ProgramFiles%\internet download manager\regkey.reg
- %TEMP%\7zipsfx.000\mang.exe
- %ProgramFiles%\internet download manager\kill.cmd
- %TEMP%\rarsfx0\stop.exe
- %TEMP%\rarsfx0\kill.exe
- %TEMP%\rarsfx0\mang.exe
- %ProgramFiles%\internet download manager\toolbar\3d_small_3.bmp
- %ProgramFiles%\internet download manager\toolbar\3d_style_3.tbi
- %ProgramFiles%\internet download manager\toolbar\blue arrow author\i.r.iran.gif
- %ProgramFiles%\internet download manager\toolbar\blue arrow author\larg-preview.bmp
- %ProgramFiles%\internet download manager\toolbar\h3m_glossy_toolbar\h3m_glossy_large_normal.bmp
- %ProgramFiles%\internet download manager\toolbar\h3m_glossy_toolbar\h3m_glossy_large_hot.bmp
- %ProgramFiles%\internet download manager\toolbar\h3m_glossy.tbi
- %ProgramFiles%\internet download manager\toolbar\globehot.bmp
- %ProgramFiles%\internet download manager\toolbar\globe.tbi
- %ProgramFiles%\internet download manager\toolbar\globe.bmp
- %ProgramFiles%\internet download manager\toolbar\blue_arrow_normal.bmp
- %ProgramFiles%\internet download manager\toolbar\blue_arrow_mini_hot.bmp
- %ProgramFiles%\internet download manager\toolbar\blue_arrow_mini_normal.bmp
- %ProgramFiles%\internet download manager\toolbar\blue_arrow_mini_disable.bmp
- %ProgramFiles%\internet download manager\toolbar\blue_arrow_hot.bmp
- %ProgramFiles%\internet download manager\toolbar\blue_arrow_disable.bmp
- %ProgramFiles%\internet download manager\toolbar\blue_arrow.tbi
- %ProgramFiles%\internet download manager\toolbar\blue arrow author\thumbs.db
- %ProgramFiles%\internet download manager\toolbar\blue arrow author\read-me.htm
- %ProgramFiles%\internet download manager\toolbar\blue arrow author\mini-preview.bmp
- %ProgramFiles%\internet download manager\toolbar\h3m_glossy_toolbar\h3m_glossy_small_hot.bmp
- %TEMP%\7zipsfx.000\stop.reg
Присваивает атрибут 'скрытый' для следующих файлов
- %ProgramFiles%\internet download manager\toolbar\blue arrow author\thumbs.db
- %ProgramFiles%\internet download manager\toolbar\h3m_glossy_toolbar\thumbs.db
- %ProgramFiles%\internet download manager\toolbar\skin2\thumbs.db
- %ProgramFiles%\internet download manager\toolbar\thl-toolbar_bmps\thumbs.db
- %ProgramFiles%\internet download manager\toolbar\thumbs.db
Удаляет следующие файлы
- %TEMP%\7zipsfx.000\mang.exe
- %TEMP%\7zipsfx.000\stop.exe
- %TEMP%\7zipsfx.000\stop.reg
- %TEMP%\rarsfx0\hosts.exe
- %TEMP%\rarsfx0\kill.exe
- %TEMP%\rarsfx0\mang.exe
- %TEMP%\rarsfx0\stop.exe
Изменяет файл HOSTS.
Другое
Ищет следующие окна
- ClassName: 'EDIT' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'RegEdit_RegEdit' WindowName: ''
Создает и запускает на исполнение
- '%TEMP%\rarsfx0\kill.exe'
- '%TEMP%\rarsfx0\mang.exe'
- '%TEMP%\7zipsfx.000\mang.exe' /s
- '%TEMP%\rarsfx0\hosts.exe'
- '%TEMP%\rarsfx0\stop.exe'
- '%TEMP%\7zipsfx.000\stop.exe' /s
Запускает на исполнение
- '<SYSTEM32>\cmd.exe' /c ""%ProgramFiles%\Internet Download Manager\Kill.cmd" "
- '<SYSTEM32>\reg.exe' delete "HKEY_LOCAL_MACHINE\SOFTWARE\Internet Download Manager" /f
- '%WINDIR%\regedit.exe' /S RegKey.reg
- '%WINDIR%\regedit.exe' /S stop.reg
