Техническая информация
Вредоносные функции:
Создает и запускает на исполнение:
- %WINDIR%\winlog.EXE
Запускает на исполнение:
- <SYSTEM32>\ntvdm.exe -f -ib
- <SYSTEM32>\ntvdm.exe -f -ic
- <SYSTEM32>\ntvdm.exe -f -i9
- <SYSTEM32>\ntvdm.exe -f -ia
- <SYSTEM32>\ntvdm.exe -f -if
- <SYSTEM32>\ntvdm.exe -f -i10
- <SYSTEM32>\ntvdm.exe -f -id
- <SYSTEM32>\ntvdm.exe -f -ie
- <SYSTEM32>\ntvdm.exe -f -i3
- <SYSTEM32>\ntvdm.exe -f -i4
- <SYSTEM32>\ntvdm.exe -f -i1
- <SYSTEM32>\ntvdm.exe -f -i2
- <SYSTEM32>\ntvdm.exe -f -i7
- <SYSTEM32>\ntvdm.exe -f -i8
- <SYSTEM32>\ntvdm.exe -f -i5
- <SYSTEM32>\ntvdm.exe -f -i6
Изменения в файловой системе:
Создает следующие файлы:
- %WINDIR%\Temp\scs15.tmp
- %WINDIR%\Temp\scs14.tmp
- %WINDIR%\Temp\scs17.tmp
- %WINDIR%\Temp\scs16.tmp
- %WINDIR%\Temp\scs11.tmp
- %WINDIR%\Temp\scs10.tmp
- %WINDIR%\Temp\scs13.tmp
- %WINDIR%\Temp\scs12.tmp
- %WINDIR%\Temp\scs18.tmp
- %WINDIR%\Temp\scs1E.tmp
- %WINDIR%\Temp\scs1D.tmp
- %WINDIR%\Temp\scs20.tmp
- %WINDIR%\Temp\scs1F.tmp
- %WINDIR%\Temp\scs1A.tmp
- %WINDIR%\Temp\scs19.tmp
- %WINDIR%\Temp\scs1C.tmp
- %WINDIR%\Temp\scs1B.tmp
- %WINDIR%\Temp\scsF.tmp
- %WINDIR%\Temp\scs3.tmp
- %WINDIR%\Temp\scs2.tmp
- %WINDIR%\Temp\scs5.tmp
- %WINDIR%\Temp\scs4.tmp
- %WINDIR%\winlog.EXE
- %WINDIR%\Temp\scs1.tmp
- %WINDIR%\SP00LSV.EXE
- %WINDIR%\Temp\scs6.tmp
- %WINDIR%\Temp\scsC.tmp
- %WINDIR%\Temp\scsB.tmp
- %WINDIR%\Temp\scsE.tmp
- %WINDIR%\Temp\scsD.tmp
- %WINDIR%\Temp\scs8.tmp
- %WINDIR%\Temp\scs7.tmp
- %WINDIR%\Temp\scsA.tmp
- %WINDIR%\Temp\scs9.tmp
Присваивает атрибут 'скрытый' для следующих файлов:
- %WINDIR%\SP00LSV.EXE
- %WINDIR%\winlog.EXE
Удаляет следующие файлы:
- %WINDIR%\Temp\scs16.tmp
- %WINDIR%\Temp\scs15.tmp
- %WINDIR%\Temp\scs18.tmp
- %WINDIR%\Temp\scs17.tmp
- %WINDIR%\Temp\scs12.tmp
- %WINDIR%\Temp\scs11.tmp
- %WINDIR%\Temp\scs14.tmp
- %WINDIR%\Temp\scs13.tmp
- %WINDIR%\Temp\scs1E.tmp
- %WINDIR%\Temp\scs1D.tmp
- %WINDIR%\Temp\scs20.tmp
- %WINDIR%\Temp\scs1F.tmp
- %WINDIR%\Temp\scs1A.tmp
- %WINDIR%\Temp\scs19.tmp
- %WINDIR%\Temp\scs1C.tmp
- %WINDIR%\Temp\scs1B.tmp
- %WINDIR%\Temp\scs10.tmp
- %WINDIR%\Temp\scs5.tmp
- %WINDIR%\Temp\scs4.tmp
- %WINDIR%\Temp\scs7.tmp
- %WINDIR%\Temp\scs6.tmp
- %WINDIR%\Temp\scs1.tmp
- %TEMP%\~DFE4C8.tmp
- %WINDIR%\Temp\scs3.tmp
- %WINDIR%\Temp\scs2.tmp
- %WINDIR%\Temp\scsD.tmp
- %WINDIR%\Temp\scsC.tmp
- %WINDIR%\Temp\scsF.tmp
- %WINDIR%\Temp\scsE.tmp
- %WINDIR%\Temp\scs9.tmp
- %WINDIR%\Temp\scs8.tmp
- %WINDIR%\Temp\scsB.tmp
- %WINDIR%\Temp\scsA.tmp
Сетевая активность:
Подключается к:
- 'gu####nxue.kjs.cn':80
- 'ml##.3322.org':80
TCP:
Запросы HTTP GET:
- gu####nxue.kjs.cn/down.txt
- ml##.3322.org/qq.asp?ip#########
UDP:
- DNS ASK gu####nxue.kjs.cn
- DNS ASK ml##.3322.org
Другое:
Ищет следующие окна:
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-a70.a74.41000d'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-a80.a84.42000e'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-a2c.a30.3f000b'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-a60.a64.40000c'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-ab0.ab4.450011'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-ac4.ac8.460012'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-a90.a94.43000f'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-aa0.aa4.440010'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-9cc.9d0.390005'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-9dc.9e0.3a0006'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-9ac.9b0.370001'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-9bc.9c0.380002'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-a0c.a10.3d0009'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-a1c.a20.3e000a'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-9ec.9f0.3b0007'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-9fc.a00.3c0008'
