Техническая информация
Вредоносные функции
Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра
- [<HKLM>\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%ProgramFiles%\IPinside_LWS\I3GProc.exe' = '%ProgramFiles%\IPinsid...
Запускает на исполнение
- '<SYSTEM32>\netsh.exe' firewall add allowedprogram "%ProgramFiles%\IPinside_LWS\I3GProc.exe" "Interezen Process"
Изменения в файловой системе
Создает следующие файлы
- C:\programdata\i3glog\i3gsetuplog.log
- %ProgramFiles%\ipinside_lws\certfr\softokn3.dll
- %ProgramFiles%\ipinside_lws\certfr\sqlite3.dll
- %ProgramFiles%\ipinside_lws\certfr\ssl3.dll
- %ProgramFiles%\ipinside_lws\certmgr.exe
- %ProgramFiles%\ipinside_lws\cosa.dll
- %WINDIR%\hipiw.dll
- %ProgramFiles%\ipinside_lws\i3gescp.dll
- %ProgramFiles%\ipinside_lws\i3gex.exe
- %ProgramFiles%\ipinside_lws\i3ginit.exe
- D:\ce233e9583e84e27a542a253b4f79b\vc_red.cab
- %TEMP%\dd_vcredistmsi7791.txt
- D:\ce233e9583e84e27a542a253b4f79b\vc_red.msi
- D:\ce233e9583e84e27a542a253b4f79b\install.exe
- D:\ce233e9583e84e27a542a253b4f79b\install.res.1042.dll
- D:\ce233e9583e84e27a542a253b4f79b\eula.1042.txt
- D:\ce233e9583e84e27a542a253b4f79b\globdata.ini
- D:\ce233e9583e84e27a542a253b4f79b\install.ini
- D:\ce233e9583e84e27a542a253b4f79b\vcredist.bmp
- D:\ce233e9583e84e27a542a253b4f79b\$shtdwn$.req
- %TEMP%\dd_vcredistui7791.txt
- %ProgramFiles%\ipinside_lws\certfr\smime3.dll
- %ProgramFiles%\ipinside_lws\i3gsvcmanager.exe
- %ProgramFiles%\ipinside_lws\certfr\nssutil3.dll
- %ProgramFiles%\ipinside_lws\interezen-rootca.crt
- %ProgramFiles%\ipinside_lws\i3gmainsvc.exe
- %ProgramFiles%\ipinside_lws\i3gmanager.dll
- %ProgramFiles%\ipinside_lws\i3gproc.exe
- %ProgramFiles%\ipinside_lws\interezen.crt
- %ProgramFiles%\ipinside_lws\interezen.opt
- %ProgramFiles%\ipinside_lws\interezen_sha1.crt
- %ProgramFiles%\ipinside_lws\interezen_sha1.opt
- %ProgramFiles%\ipinside_lws\interezenk.opt
- %ProgramFiles%\ipinside_lws\interezenk_sha1.opt
- %ProgramFiles%\ipinside_lws\interezen-rootca_sha1.crt
- %ProgramFiles%\ipinside_lws\certfr\nssckbi.dll
- %ProgramFiles%\ipinside_lws\libeay32.dll
- %ProgramFiles%\ipinside_lws\ssleay32.dll
- %ProgramFiles%\ipinside_lws\vcredist_x86.exe
- %ProgramFiles%\ipinside_lws\certfr\certutil.exe
- %ProgramFiles%\ipinside_lws\certfr\freebl3.dll
- %ProgramFiles%\ipinside_lws\certfr\libnspr4.dll
- %ProgramFiles%\ipinside_lws\certfr\libplc4.dll
- %ProgramFiles%\ipinside_lws\certfr\libplds4.dll
- %ProgramFiles%\ipinside_lws\certfr\nss3.dll
- %ProgramFiles%\ipinside_lws\certfr\nssdbm3.dll
- %TEMP%\vwl5.tmp
Присваивает атрибут 'скрытый' для следующих файлов
- %WINDIR%\hipiw.dll
Удаляет следующие файлы
- %TEMP%\vwl5.tmp
- D:\ce233e9583e84e27a542a253b4f79b\vcredist.bmp
- D:\ce233e9583e84e27a542a253b4f79b\install.ini
- D:\ce233e9583e84e27a542a253b4f79b\globdata.ini
- D:\ce233e9583e84e27a542a253b4f79b\eula.1042.txt
- D:\ce233e9583e84e27a542a253b4f79b\install.res.1042.dll
- D:\ce233e9583e84e27a542a253b4f79b\install.exe
- D:\ce233e9583e84e27a542a253b4f79b\vc_red.msi
- D:\ce233e9583e84e27a542a253b4f79b\vc_red.cab
Другое
Создает и запускает на исполнение
- '%ProgramFiles%\ipinside_lws\vcredist_x86.exe' /q:a /c:"msiexec /i vcredist.msi /qn /l*v %temp% credist_x86.log"
- 'D:\ce233e9583e84e27a542a253b4f79b\install.exe' /q:a /c:"msiexec /i vcredist.msi /qn /l*v %temp% credist_x86.log"
- '<SYSTEM32>\netsh.exe' firewall delete allowedprogram "%ProgramFiles%\IPinside_LWS\I3GProc.exe"' (со скрытым окном)
- '<SYSTEM32>\netsh.exe' firewall add allowedprogram "%ProgramFiles%\IPinside_LWS\I3GProc.exe" "Interezen Process"' (со скрытым окном)
- '%ProgramFiles%\ipinside_lws\vcredist_x86.exe' /q:a /c:"msiexec /i vcredist.msi /qn /l*v %temp% credist_x86.log"' (со скрытым окном)
Запускает на исполнение
- '<SYSTEM32>\netsh.exe' firewall delete allowedprogram "%ProgramFiles%\IPinside_LWS\I3GProc.exe"
- '<SYSTEM32>\msiexec.exe' /V
- '<SYSTEM32>\msiexec.exe' -Embedding E95124F3DC3192A1E1181B24A5D722A7
