Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'UNAX.exe' = '<SYSTEM32>\UNAX.exe'
Создает или изменяет следующие файлы:
- %ALLUSERSPROFILE%\Start Menu\Programs\Startup\sfitwdti.exe
Вредоносные функции:
Для затруднения выявления своего присутствия в системе
блокирует отображение:
- скрытых файлов
блокирует запуск следующих системных утилит:
- Интерпретатора командной строки (CMD)
- Редактора реестра (RegEdit)
Создает и запускает на исполнение:
- %TEMP%\mh6bvq.dll
- %TEMP%\ni4cwr.dll
- %TEMP%\st6dxs.dll
- %TEMP%\gyknwr.dll
- %TEMP%\mh6bvq.dll (загружен из сети Интернет)
- %TEMP%\ni4cwr.dll (загружен из сети Интернет)
- %TEMP%\gyknwr.dll (загружен из сети Интернет)
- %TEMP%\st6dxs.dll (загружен из сети Интернет)
Запускает на исполнение:
- <SYSTEM32>\wbem\wmiadap.exe /R /T
- <SYSTEM32>\cmd.exe /c <SYSTEM32>\feafvc.bat
Изменяет следующие настройки проводника Windows (Windows Explorer):
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoRun' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoControlPanel' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoLogOff' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoSetFolders' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoRecentDocsMenu' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoDesktop' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoFolderOptions' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoClose' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoFileMenu' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoFind' = '00000001'
Скрывает следующие процессы:
- <Полный путь к вирусу>
Изменения в файловой системе:
Создает следующие файлы:
- C:\Documents and Settings\Default User\Start Menu\Programs\Startup\febvniap.exe
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Entertainment\gahjnzza.exe
- C:\Documents and Settings\LocalService\qufivvwf.exe
- C:\Documents and Settings\Default User\Templates\lyakipbc.exe
- C:\Documents and Settings\Default User\Start Menu\Programs\yaept059.exe
- C:\Documents and Settings\Default User\Start Menu\ozrm0u5b.exe
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Accessibility\werzrdde.exe
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\y0sase05.exe
- C:\Documents and Settings\LocalService\Application Data\Microsoft\Media Player\qbto9wfd.exe
- C:\Documents and Settings\LocalService\Application Data\Microsoft\Internet Explorer\cpwoabcl.exe
- C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\htyklrgs.exe
- C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\uqjdv9hh.exe
- C:\Documents and Settings\LocalService\Application Data\Microsoft\fsm9vcrd.exe
- C:\Documents and Settings\LocalService\Application Data\owvxakkl.exe
- C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\S-1-5-19\uwblpbcd.exe
- C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\mydppwlx.exe
- C:\Documents and Settings\Default User\SendTo\dt9jtn5v.exe
- C:\Documents and Settings\Default User\Local Settings\Temp\eavsqwgh.exe
- C:\Documents and Settings\Default User\Local Settings\History\History.IE5\g5zphtwx.exe
- C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\kmqefrst.exe
- C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\dl5brgsn.exe
- C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\vimehzi5.exe
- C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Media Player\bkpe0iaj.exe
- C:\Documents and Settings\Default User\Local Settings\History\m0rxhiup.exe
- C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\juogyet0.exe
- C:\Documents and Settings\Default User\NetHood\xtm5xhhi.exe
- C:\Documents and Settings\Default User\My Documents\q9kaetzo.exe
- C:\Documents and Settings\Default User\Recent\esymtiup.exe
- C:\Documents and Settings\Default User\PrintHood\hycqxmyt.exe
- C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\jwzhcxo5.exe
- C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\9gkycllm.exe
- C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\otfgmeni.exe
- C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\rtbpytia.exe
- C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\Certificates\vdqyqccd.exe
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\Credentials\S-1-5-20\9antjbkf.exe
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\Credentials\um0qzpbc.exe
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\Media Player\ck5aqhto.exe
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\Internet Explorer\9jwajklx.exe
- C:\Documents and Settings\NetworkService\pegrpqwl.exe
- C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\MOE00UY1\z9zkoaab.exe
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\cngbqwlx.exe
- C:\Documents and Settings\NetworkService\Application Data\lb0uapbw.exe
- C:\Documents and Settings\NetworkService\Cookies\qcwphz0u.exe
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CTLs\xbmqccdm.exe
- C:\Documents and Settings\NetworkService\Local Settings\Application Data\xilyyzi5.exe
- C:\Documents and Settings\NetworkService\Local Settings\oj0xmsht.exe
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\ozskcgyh.exe
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\znqfmeni.exe
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CRLs\lwojbqcx.exe
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\Certificates\kr9m9qrs.exe
- C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\LBMMC3H3\uwesbwme.exe
- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\5uymtiup.exe
- C:\Documents and Settings\LocalService\Local Settings\Application Data\jtmgzoav.exe
- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-19\dasl5pqr.exe
- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\g5yphtuv.exe
- C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CTLs\95fla9wl.exe
- C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CRLs\bse9ldse.exe
- C:\Documents and Settings\LocalService\Local Settings\tdaxstu5.exe
- C:\Documents and Settings\LocalService\Cookies\jcqxghto.exe
- C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\suzjnzab.exe
- C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\ztk5tzp9.exe
- C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\CJCTQ25G\mack9csh.exe
- C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\BGGTYMH1\5zmsiaj9.exe
- C:\Documents and Settings\LocalService\Local Settings\History\zntgkcfx.exe
- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\mzbmkqcd.exe
- C:\Documents and Settings\LocalService\Local Settings\Temp\smfy9dde.exe
- C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\iksgpkcr.exe
- C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\rbownaab.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\Media Index\yb5sbrgs.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\HTML Help\yozaenop.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\Network\mxsm0u5b.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\Media Player\bhdwqgyh.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\MachineKeys\ejz9yiij.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\bxwqi5vk.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\Dr Watson\tyjmyzaj.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\S-1-5-18\izdrynzu.exe
- %ALLUSERSPROFILE%\Desktop\pcekdmnz.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\ujzdsypb.exe
- %ALLUSERSPROFILE%\Documents\My Music\0otfgmen.exe
- %ALLUSERSPROFILE%\Documents\wzdoree0.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\Network\Connections\Cm\dix0xghi.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\Network\Connections\9pjdszoa.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\akmayeno.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\Network\Connections\Pbk\wycnrdee.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\DSS\MachineKeys\zincdgyh.exe
- <SYSTEM32>\feafvc.bat
- <SYSTEM32>\UNAX.ico
- <SYSTEM32>\dllcache\UNAX.exe
- <SYSTEM32>\UNAX.exe
- %TEMP%\st6dxs.dll
- %TEMP%\gyknwr.dll
- %TEMP%\mh6bvq.dll
- %TEMP%\ni4cwr.dll
- %ALLUSERSPROFILE%\Application Data\Microsoft\lusuyhhi.exe
- %ALLUSERSPROFILE%\Application Data\ewp5stap.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\DSS\0otfgmen.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\iuzlmsht.exe
- C:\zjlujwxg.exe
- <Текущая директория>\ezupkfdy.exe
- %ALLUSERSPROFILE%\veceftuv.exe
- C:\Documents and Settings\plhewrhz.exe
- %ALLUSERSPROFILE%\Documents\My Music\My Playlists\0thlcgyh.exe
- C:\Documents and Settings\Default User\Application Data\Microsoft\Media Player\boshn9ql.exe
- C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\tvzkoaab.exe
- C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\iq5l0ppq.exe
- C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\zpefpkcr.exe
- C:\Documents and Settings\Default User\vnzabk9c.exe
- %ALLUSERSPROFILE%\Templates\lk9zukcl.exe
- C:\Documents and Settings\Default User\Application Data\Microsoft\tpicu559.exe
- C:\Documents and Settings\Default User\Application Data\0kafajjk.exe
- C:\Documents and Settings\Default User\Favorites\cxtqou59.exe
- C:\Documents and Settings\Default User\Desktop\ewfghtoj.exe
- C:\Documents and Settings\Default User\Local Settings\Application Data\sanvnzza.exe
- C:\Documents and Settings\Default User\Local Settings\hbikoaab.exe
- C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CRLs\o0gxet0a.exe
- C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\Certificates\kvphy0u5.exe
- C:\Documents and Settings\Default User\Cookies\yrj0ryo5.exe
- C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CTLs\qmh90ivw.exe
- %ALLUSERSPROFILE%\Start Menu\Programs\Games\0btiuv9c.exe
- %ALLUSERSPROFILE%\Documents\My Videos\fsuf5jxy.exe
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\re9ph0uj.exe
- %ALLUSERSPROFILE%\Favorites\wsl0wggh.exe
- %ALLUSERSPROFILE%\DRM\zp5idsyn.exe
- %ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\cejaheuj.exe
- %ALLUSERSPROFILE%\Documents\My Music\Sample Music\byrhclop.exe
- %ALLUSERSPROFILE%\Documents\My Pictures\9qs5ehuv.exe
- %ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\diy0xghi.exe
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Entertainment\9su0xsia.exe
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Communications\nefwdsez.exe
- %ALLUSERSPROFILE%\Start Menu\Programs\Administrative Tools\qgtbnt59.exe
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\System Tools\feaumhap.exe
- %ALLUSERSPROFILE%\Start Menu\Programs\hzmqfldm.exe
- %ALLUSERSPROFILE%\Start Menu\hxbqwlxs.exe
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Accessibility\yo0gxet0.exe
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\yhmbbfxg.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- <Полный путь к вирусу>
- <SYSTEM32>\dllcache\UNAX.exe
- <SYSTEM32>\UNAX.exe
Сетевая активность:
Подключается к:
- 'www.sn##ele.com':80
TCP:
Запросы HTTP GET:
- www.sn##ele.com/GG/f/bbg.exe
- www.sn##ele.com/GG/f/binladen.exe
- www.sn##ele.com/GG/f/Klez.exe
- www.sn##ele.com/GG/f/Pikachu.exe
UDP:
- DNS ASK www.sn##ele.com
