Техническая информация
Для обеспечения автозапуска и распространения
Создает или изменяет следующие файлы
- %APPDATA%\microsoft\windows\start menu\programs\startup\catsrvps.url
Вредоносные функции
Внедряет код в
следующие системные процессы:
- %WINDIR%\microsoft.net\framework\v2.0.50727\regsvcs.exe
Изменения в файловой системе
Создает следующие файлы
- %HOMEPATH%\catsrvps\catsrvps.vbs
- %HOMEPATH%\catsrvps\pktmon.exe
- %WINDIR%\assembly\nativeimages_v4.0.30319_32\temp\6d4-0\mscorlib.dll
- %WINDIR%\assembly\nativeimages_v4.0.30319_32\mscorlib\7582400666d289c016013ad0f6e0e3e6\mscorlib.ni.dll.aux.tmp
- %WINDIR%\assembly\nativeimages_v4.0.30319_32\temp\8e0-0\system.dll
- %WINDIR%\assembly\nativeimages_v4.0.30319_32\system\1be7a15b1f33bf22e4f53aaf45518c77\system.ni.dll.aux.tmp
- %WINDIR%\assembly\nativeimages_v4.0.30319_32\temp\e48-0\system.core.dll
- %WINDIR%\assembly\nativeimages_v4.0.30319_32\system.core\eb4cca4f06a15158c3f7e2c56516729b\system.core.ni.dll.aux.tmp
- %WINDIR%\assembly\nativeimages_v4.0.30319_32\temp\f34-0\windowsbase.dll
- %WINDIR%\assembly\nativeimages_v4.0.30319_32\windowsbase\9a2107b30cbb02ca475f58ed046eff63\windowsbase.ni.dll.aux.tmp
- %WINDIR%\assembly\nativeimages_v4.0.30319_32\temp\c5c-0\presentationcore.dll
- %WINDIR%\assembly\nativeimages_v4.0.30319_32\presentationcore\d7a637fdf68801e37fc897b530f9a8a6\presentationcore.ni.dll.aux.tmp
Перемещает следующие файлы
- %WINDIR%\assembly\nativeimages_v4.0.30319_32\temp\6d4-0\mscorlib.dll в %WINDIR%\assembly\nativeimages_v4.0.30319_32\mscorlib\7582400666d289c016013ad0f6e0e3e6\mscorlib.ni.dll
- %WINDIR%\assembly\nativeimages_v4.0.30319_32\mscorlib\7582400666d289c016013ad0f6e0e3e6\mscorlib.ni.dll.aux.tmp в %WINDIR%\assembly\nativeimages_v4.0.30319_32\mscorlib\7582400666d289c016013ad0f6e0e3e6\mscorlib.ni.dll.aux
- %WINDIR%\assembly\nativeimages_v4.0.30319_32\temp\8e0-0\system.dll в %WINDIR%\assembly\nativeimages_v4.0.30319_32\system\1be7a15b1f33bf22e4f53aaf45518c77\system.ni.dll
- %WINDIR%\assembly\nativeimages_v4.0.30319_32\system\1be7a15b1f33bf22e4f53aaf45518c77\system.ni.dll.aux.tmp в %WINDIR%\assembly\nativeimages_v4.0.30319_32\system\1be7a15b1f33bf22e4f53aaf45518c77\system.ni.dll.aux
- %WINDIR%\assembly\nativeimages_v4.0.30319_32\temp\e48-0\system.core.dll в %WINDIR%\assembly\nativeimages_v4.0.30319_32\system.core\eb4cca4f06a15158c3f7e2c56516729b\system.core.ni.dll
- %WINDIR%\assembly\nativeimages_v4.0.30319_32\system.core\eb4cca4f06a15158c3f7e2c56516729b\system.core.ni.dll.aux.tmp в %WINDIR%\assembly\nativeimages_v4.0.30319_32\system.core\eb4cca4f06a15158c3f7e2c56516729b\system.core.ni.dll.aux
- %WINDIR%\assembly\nativeimages_v4.0.30319_32\temp\f34-0\windowsbase.dll в %WINDIR%\assembly\nativeimages_v4.0.30319_32\windowsbase\9a2107b30cbb02ca475f58ed046eff63\windowsbase.ni.dll
- %WINDIR%\assembly\nativeimages_v4.0.30319_32\windowsbase\9a2107b30cbb02ca475f58ed046eff63\windowsbase.ni.dll.aux.tmp в %WINDIR%\assembly\nativeimages_v4.0.30319_32\windowsbase\9a2107b30cbb02ca475f58ed046eff63\windowsbase.ni.dll.aux
- %WINDIR%\assembly\nativeimages_v4.0.30319_32\temp\c5c-0\presentationcore.dll в %WINDIR%\assembly\nativeimages_v4.0.30319_32\presentationcore\d7a637fdf68801e37fc897b530f9a8a6\presentationcore.ni.dll
- %WINDIR%\assembly\nativeimages_v4.0.30319_32\presentationcore\d7a637fdf68801e37fc897b530f9a8a6\presentationcore.ni.dll.aux.tmp в %WINDIR%\assembly\nativeimages_v4.0.30319_32\presentationcore\d7a637fdf68801e37fc897b530f9a8a6\presentationcore.ni.dll.aux
Другое
Ищет следующие окна
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Запускает на исполнение
- '%WINDIR%\microsoft.net\framework\v4.0.30319\mscorsvw.exe' -StartupEvent 210 -InterruptEvent 0 -NGENProcess 150 -Pipe 17c -Comment "NGen Worker Process"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\mscorsvw.exe' -StartupEvent 288 -InterruptEvent 0 -NGENProcess 294 -Pipe 254 -Comment "NGen Worker Process"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\mscorsvw.exe' -StartupEvent 254 -InterruptEvent 0 -NGENProcess 288 -Pipe 290 -Comment "NGen Worker Process"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\mscorsvw.exe' -StartupEvent 290 -InterruptEvent 0 -NGENProcess 254 -Pipe 270 -Comment "NGen Worker Process"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\mscorsvw.exe' -StartupEvent 270 -InterruptEvent 0 -NGENProcess 254 -Pipe 274 -Comment "NGen Worker Process"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\mscorsvw.exe' -StartupEvent 274 -InterruptEvent 0 -NGENProcess 270 -Pipe 268 -Comment "NGen Worker Process"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\mscorsvw.exe' -StartupEvent 268 -InterruptEvent 0 -NGENProcess 274 -Pipe 26c -Comment "NGen Worker Process"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\regsvcs.exe'
- '%WINDIR%\microsoft.net\framework\v4.0.30319\mscorsvw.exe' -StartupEvent 26c -InterruptEvent 0 -NGENProcess 268 -Pipe 230 -Comment "NGen Worker Process"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\mscorsvw.exe' -StartupEvent 230 -InterruptEvent 0 -NGENProcess 26c -Pipe 240 -Comment "NGen Worker Process"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\mscorsvw.exe' -StartupEvent 1b4 -InterruptEvent 0 -NGENProcess 228 -Pipe 294 -Comment "NGen Worker Process"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\mscorsvw.exe' -StartupEvent 240 -InterruptEvent 0 -NGENProcess 230 -Pipe 264 -Comment "NGen Worker Process"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\mscorsvw.exe' -StartupEvent 254 -InterruptEvent 0 -NGENProcess 230 -Pipe 258 -Comment "NGen Worker Process"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\mscorsvw.exe' -StartupEvent 230 -InterruptEvent 0 -NGENProcess 234 -Pipe 22c -Comment "NGen Worker Process"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\mscorsvw.exe' -StartupEvent 22c -InterruptEvent 0 -NGENProcess 224 -Pipe 220 -Comment "NGen Worker Process"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\mscorsvw.exe' -StartupEvent 228 -InterruptEvent 0 -NGENProcess 220 -Pipe 1f4 -Comment "NGen Worker Process"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\mscorsvw.exe' -StartupEvent 224 -InterruptEvent 0 -NGENProcess 1f4 -Pipe 20c -Comment "NGen Worker Process"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\mscorsvw.exe' -StartupEvent 220 -InterruptEvent 0 -NGENProcess 20c -Pipe 210 -Comment "NGen Worker Process"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\mscorsvw.exe' -StartupEvent 1f4 -InterruptEvent 0 -NGENProcess 210 -Pipe 140 -Comment "NGen Worker Process"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -command "start <Полный путь к файлу>" -verb runas
- '%WINDIR%\microsoft.net\framework\v4.0.30319\mscorsvw.exe' -StartupEvent 210 -InterruptEvent 0 -NGENProcess 214 -Pipe 178 -Comment "NGen Worker Process"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\mscorsvw.exe' -StartupEvent 264 -InterruptEvent 0 -NGENProcess 240 -Pipe 260 -Comment "NGen Worker Process"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\mscorsvw.exe' -StartupEvent 280 -InterruptEvent 0 -NGENProcess 288 -Pipe 228 -Comment "NGen Worker Process"
