Техническая информация
Для обеспечения автозапуска и распространения
Создает или изменяет следующие файлы
- %APPDATA%\microsoft\windows\start menu\programs\startup\startmbr.bat
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\e_n60005\krnln.fnr
- %HOMEPATH%\links\desktop.lnk.cxk_nmsl
- %HOMEPATH%\contacts\user.contact.cxk_nmsl
- %HOMEPATH%\downloads\winamp5666_full_all.exe.cxk_nmsl
- %HOMEPATH%\downloads\thunderbird setup 31.6.0.exe.cxk_nmsl
- %HOMEPATH%\downloads\tcmd851ax64.exe.cxk_nmsl
- %HOMEPATH%\downloads\steamsetup.exe.cxk_nmsl
- %HOMEPATH%\downloads\pidgin-2.10.11.exe.cxk_nmsl
- %HOMEPATH%\downloads\opera_ni_stable.exe.cxk_nmsl
- %HOMEPATH%\downloads\mirc741.exe.cxk_nmsl
- %HOMEPATH%\downloads\magent_rfrset.exe.cxk_nmsl
- %HOMEPATH%\downloads\k-lite_codec_pack_1110_mega_dlm.exe.cxk_nmsl
- %HOMEPATH%\downloads\k-lite_codec_pack_1110_mega.exe.cxk_nmsl
- %HOMEPATH%\downloads\jre-8u45-windows-x64.exe.cxk_nmsl
- %HOMEPATH%\downloads\icq_rfrset.exe.cxk_nmsl
- %HOMEPATH%\downloads\chromesetup.exe.cxk_nmsl
- %HOMEPATH%\desktop\total commander 64 bit.lnk.cxk_nmsl
- %HOMEPATH%\desktop\telegram.lnk.cxk_nmsl
- %HOMEPATH%\desktop\tcm851ax32.exe.cxk_nmsl
- %HOMEPATH%\desktop\qip 2012.lnk.cxk_nmsl
- %HOMEPATH%\desktop\notepad.exe.cxk_nmsl
- %HOMEPATH%\desktop\mail.ru agent.lnk.cxk_nmsl
- %HOMEPATH%\desktop\icq.lnk.cxk_nmsl
- %HOMEPATH%\desktop\dotnetfx45_full_setup.exe.cxk_nmsl
- %HOMEPATH%\desktop\calc.exe.cxk_nmsl
- %APPDATA%\cxk-nmsl\fuze.bat
- %APPDATA%\cxk-nmsl\cxk-nmsl.bat
- %APPDATA%\mbr.bat
- %HOMEPATH%\links\downloads.lnk.cxk_nmsl
- %HOMEPATH%\links\recentplaces.lnk.cxk_nmsl
Изменяет расширения файлов пользовательских данных (Trojan.Encoder).
Другое
Ищет следующие окна
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Создает и запускает на исполнение
- '%WINDIR%\syswow64\cmd.exe' /C "%APPDATA%\CXK-NMSL\CXK-NMSL.bat" ::' (со скрытым окном)
Запускает на исполнение
- '%WINDIR%\syswow64\cmd.exe' /c %APPDATA%\CXK-NMSL\fuze.bat
- '%WINDIR%\syswow64\certutil.exe' -encode "notepad.exe.cxkdata" "notepad.exe.cxk_nmsl"
- '%WINDIR%\syswow64\certutil.exe' -encode "pushkin.jpg.cxkdata" "pushkin.jpg.cxk_nmsl"
- '%WINDIR%\syswow64\certutil.exe' -encode "QIP 2012.lnk.cxkdata" "QIP 2012.lnk.cxk_nmsl"
- '%WINDIR%\syswow64\certutil.exe' -encode "region-north-karelia.jpg.cxkdata" "region-north-karelia.jpg.cxk_nmsl"
- '%WINDIR%\syswow64\certutil.exe' -encode "SDKSampleUnprivDeveloper.cer.cxkdata" "SDKSampleUnprivDeveloper.cer.cxk_nmsl"
- '%WINDIR%\syswow64\certutil.exe' -encode "tcm851ax32.exe.cxkdata" "tcm851ax32.exe.cxk_nmsl"
- '%WINDIR%\syswow64\certutil.exe' -encode "Telegram.lnk.cxkdata" "Telegram.lnk.cxk_nmsl"
- '%WINDIR%\syswow64\certutil.exe' -encode "testEE.cer.cxkdata" "testEE.cer.cxk_nmsl"
- '%WINDIR%\syswow64\certutil.exe' -encode "Total Commander 64 bit.lnk.cxkdata" "Total Commander 64 bit.lnk.cxk_nmsl"
- '%WINDIR%\syswow64\certutil.exe' -encode "tree_view.htm.cxkdata" "tree_view.htm.cxk_nmsl"
- '%WINDIR%\syswow64\certutil.exe' -encode "uep_form_786_bulletin_1726i602.doc.cxkdata" "uep_form_786_bulletin_1726i602.doc.cxk_nmsl"
- '%WINDIR%\syswow64\certutil.exe' -encode "ChromeSetup.exe.cxkdata" "ChromeSetup.exe.cxk_nmsl"
- '%WINDIR%\syswow64\certutil.exe' -encode "jre-8u45-windows-x64.exe.cxkdata" "jre-8u45-windows-x64.exe.cxk_nmsl"
- '%WINDIR%\syswow64\certutil.exe' -encode "Downloads.lnk.cxkdata" "Downloads.lnk.cxk_nmsl"
- '%WINDIR%\syswow64\certutil.exe' -encode "K-Lite_Codec_Pack_1110_Mega.exe.cxkdata" "K-Lite_Codec_Pack_1110_Mega.exe.cxk_nmsl"
- '%WINDIR%\syswow64\certutil.exe' -encode "K-Lite_Codec_Pack_1110_Mega_dlm.exe.cxkdata" "K-Lite_Codec_Pack_1110_Mega_dlm.exe.cxk_nmsl"
- '%WINDIR%\syswow64\certutil.exe' -encode "magent_rfrset.exe.cxkdata" "magent_rfrset.exe.cxk_nmsl"
- '%WINDIR%\syswow64\certutil.exe' -encode "mirc741.exe.cxkdata" "mirc741.exe.cxk_nmsl"
- '%WINDIR%\syswow64\certutil.exe' -encode "Opera_NI_stable.exe.cxkdata" "Opera_NI_stable.exe.cxk_nmsl"
- '%WINDIR%\syswow64\certutil.exe' -encode "pidgin-2.10.11.exe.cxkdata" "pidgin-2.10.11.exe.cxk_nmsl"
- '%WINDIR%\syswow64\certutil.exe' -encode "SteamSetup.exe.cxkdata" "SteamSetup.exe.cxk_nmsl"
- '%WINDIR%\syswow64\certutil.exe' -encode "tcmd851ax64.exe.cxkdata" "tcmd851ax64.exe.cxk_nmsl"
- '%WINDIR%\syswow64\certutil.exe' -encode "Thunderbird Setup 31.6.0.exe.cxkdata" "Thunderbird Setup 31.6.0.exe.cxk_nmsl"
- '%WINDIR%\syswow64\certutil.exe' -encode "winamp5666_full_all.exe.cxkdata" "winamp5666_full_all.exe.cxk_nmsl"
- '%WINDIR%\syswow64\certutil.exe' -encode "user.contact.cxkdata" "user.contact.cxk_nmsl"
- '%WINDIR%\syswow64\certutil.exe' -encode "Desktop.lnk.cxkdata" "Desktop.lnk.cxk_nmsl"
- '%WINDIR%\syswow64\certutil.exe' -encode "Mail.Ru Agent.lnk.cxkdata" "Mail.Ru Agent.lnk.cxk_nmsl"
- '%WINDIR%\syswow64\certutil.exe' -encode "icq_rfrset.exe.cxkdata" "icq_rfrset.exe.cxk_nmsl"
- '%WINDIR%\syswow64\certutil.exe' -encode "join.avi.cxkdata" "join.avi.cxk_nmsl"
- '%WINDIR%\syswow64\certutil.exe' -encode "archer.avi.cxkdata" "archer.avi.cxk_nmsl"
- '%WINDIR%\syswow64\cmd.exe' /K CXK-NMSL.bat
- '%WINDIR%\syswow64\mshta.exe' vbscript:createobject("shell.application").shellexecute("""CXK-NMSL.bat""","::",,"runas",0)(window.close)
- '%WINDIR%\syswow64\cmd.exe' /C "%APPDATA%\CXK-NMSL\CXK-NMSL.bat" :
- '%WINDIR%\syswow64\certutil.exe' -encode "13.jpeg.cxkdata" "13.jpeg.cxk_nmsl"
- '%WINDIR%\syswow64\certutil.exe' -encode "2.jpg.cxkdata" "2.jpg.cxk_nmsl"
- '%WINDIR%\syswow64\certutil.exe' -encode "210252809.jpeg.cxkdata" "210252809.jpeg.cxk_nmsl"
- '%WINDIR%\syswow64\certutil.exe' -encode "508softwareandos.doc.cxkdata" "508softwareandos.doc.cxk_nmsl"
- '%WINDIR%\syswow64\certutil.exe' -encode "about.htm.cxkdata" "about.htm.cxk_nmsl"
- '%WINDIR%\syswow64\certutil.exe' -encode "adadsi.html.cxkdata" "adadsi.html.cxk_nmsl"
- '%WINDIR%\syswow64\certutil.exe' -encode "advice_process.htm.cxkdata" "advice_process.htm.cxk_nmsl"
- '%WINDIR%\syswow64\certutil.exe' -encode "alert.htm.cxkdata" "alert.htm.cxk_nmsl"
- '%WINDIR%\syswow64\certutil.exe' -encode "api-hashmap.html.cxkdata" "api-hashmap.html.cxk_nmsl"
- '%WINDIR%\syswow64\certutil.exe' -encode "browse.htm.cxkdata" "browse.htm.cxk_nmsl"
- '%WINDIR%\syswow64\certutil.exe' -encode "iisstart.htm.cxkdata" "iisstart.htm.cxk_nmsl"
- '%WINDIR%\syswow64\certutil.exe' -encode "calc.exe.cxkdata" "calc.exe.cxk_nmsl"
- '%WINDIR%\syswow64\certutil.exe' -encode "contoso_1.cer.cxkdata" "contoso_1.cer.cxk_nmsl"
- '%WINDIR%\syswow64\certutil.exe' -encode "correct.avi.cxkdata" "correct.avi.cxk_nmsl"
- '%WINDIR%\syswow64\certutil.exe' -encode "dashBorder_192.bmp.cxkdata" "dashBorder_192.bmp.cxk_nmsl"
- '%WINDIR%\syswow64\certutil.exe' -encode "dashBorder_96.bmp.cxkdata" "dashBorder_96.bmp.cxk_nmsl"
- '%WINDIR%\syswow64\certutil.exe' -encode "default.bmp.cxkdata" "default.bmp.cxk_nmsl"
- '%WINDIR%\syswow64\certutil.exe' -encode "dialmap.bmp.cxkdata" "dialmap.bmp.cxk_nmsl"
- '%WINDIR%\syswow64\certutil.exe' -encode "dotnetfx45_full_setup.exe.cxkdata" "dotnetfx45_full_setup.exe.cxk_nmsl"
- '%WINDIR%\syswow64\certutil.exe' -encode "Garden.htm.cxkdata" "Garden.htm.cxk_nmsl"
- '%WINDIR%\syswow64\certutil.exe' -encode "glidescope_review_rev_010.docx.cxkdata" "glidescope_review_rev_010.docx.cxk_nmsl"
- '%WINDIR%\syswow64\certutil.exe' -encode "howto-index.html.cxkdata" "howto-index.html.cxk_nmsl"
- '%WINDIR%\syswow64\certutil.exe' -encode "ICQ.lnk.cxkdata" "ICQ.lnk.cxk_nmsl"
- '%WINDIR%\syswow64\certutil.exe' -encode "issi2013_template_for_posters.docx.cxkdata" "issi2013_template_for_posters.docx.cxk_nmsl"
- '%WINDIR%\syswow64\certutil.exe' -encode "RecentPlaces.lnk.cxkdata" "RecentPlaces.lnk.cxk_nmsl"
