Техническая информация
Для обеспечения автозапуска и распространения
Создает следующие сервисы
- [<HKLM>\System\CurrentControlSet\Services\IKEEXT] 'Start' = '00000002'
Вредоносные функции
Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра
- [<HKLM>\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] 'EnableFirewall' = '00000000'
- [<HKLM>\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'
Запускает на исполнение
- '%WINDIR%\syswow64\taskkill.exe' /f /im steamwebhelper.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im GameOverlayUI.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im Steam.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im csgo.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im powershell.exe
Другое
Ищет следующие окна
- ClassName: '' WindowName: ''
Запускает на исполнение
- '%WINDIR%\syswow64\cmd.exe' /c netsh advfirewall set domainprofile state off
- '%WINDIR%\syswow64\cmd.exe' /c bcdedit /deletevalue nx
- '%WINDIR%\syswow64\cmd.exe' /c net user %username% /active:yes
- '%WINDIR%\syswow64\net.exe' user user /active:yes
- '%WINDIR%\syswow64\net1.exe' user user /active:yes
- '%WINDIR%\syswow64\cmd.exe' /c net user ÀäìèГèñòðà òîð /active:yes
- '%WINDIR%\syswow64\net.exe' user ÀäìèГèñòðà òîð /active:yes
- '%WINDIR%\syswow64\cmd.exe' /c net user Administrator /active:yes
- '%WINDIR%\syswow64\cmd.exe' /c netsh advfirewall set allprofiles state off
- '%WINDIR%\syswow64\net.exe' user Administrator /active:yes
- '%WINDIR%\syswow64\net1.exe' user Administrator /active:yes
- '%WINDIR%\syswow64\cmd.exe' /c net user DefaultAccount /active:yes
- '%WINDIR%\syswow64\net.exe' user DefaultAccount /active:yes
- '%WINDIR%\syswow64\net1.exe' user DefaultAccount /active:yes
- '%WINDIR%\syswow64\cmd.exe' /c bcdedit /set {current} nx OptIn
- '%WINDIR%\syswow64\cmd.exe' /c bcdedit /debug off
- '%WINDIR%\syswow64\cmd.exe' /c bcdedit /deletevalue loadoptions
- '%WINDIR%\syswow64\cmd.exe' /c bcdedit /deletevalue nointegritychecks
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im powershell.exe
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im csgo.exe
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im Steam.exe
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im GameOverlayUI.exe
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im steamwebhelper.exe
- '%WINDIR%\syswow64\netsh.exe' advfirewall set allprofiles state off
- '%WINDIR%\syswow64\net1.exe' user ÀäìèГèñòðà òîð /active:yes
- '%WINDIR%\syswow64\netsh.exe' advfirewall set publicprofile state off
- '%WINDIR%\syswow64\cmd.exe' /c netsh advfirewall set publicprofile state off
- '%WINDIR%\syswow64\netsh.exe' advfirewall set privateprofile state off
- '%WINDIR%\syswow64\cmd.exe' /c netsh advfirewall set privateprofile state off
- '%WINDIR%\syswow64\netsh.exe' advfirewall set currentprofile state off
- '%WINDIR%\syswow64\cmd.exe' /c netsh advfirewall set currentprofile state off
- '%WINDIR%\syswow64\netsh.exe' advfirewall set domainprofile state off
- '%ProgramFiles(x86)%\steam\steam.exe'
- '%ProgramFiles(x86)%\steam\bin\steamwebhelper.exe' -cachedir="%LOCALAPPDATA%\Steam\htmlcache" -steampid=1120 -buildid=1451690000 -steamid="0" --disable-gpu-compositing --disable-gpu --process-per-tab --enable-system-flash --disable-spell-check...
