Техническая информация
Вредоносные функции:
Для затруднения выявления своего присутствия в системе
блокирует отображение:
- скрытых файлов
- расширений файлов
Создает и запускает на исполнение:
- C:\MGtools\swreg.exe query "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v System
- C:\MGtools\swreg.exe query "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell
- C:\MGtools\grep.exe -v -U -i -E "rdpsnd|sirenacm|tsbyuv|tsccvid|terminal server|vfwwdm32|vp6vfw|wdmaud.drv|wmv9vcm.dll|xvidvfw" C:\MGTools\temp\cvdrv3.txt
- C:\MGtools\grep.exe -v -U -i -E ".acm|dword|iac25|iccvid|ir32|ir41|ir50|iyuv_32|mpg4c32.dll|midimap|msaud32.drv|msh2...drv|msrle32|msvidc32|msyuv" C:\MGTools\temp\cvdrv2.txt
- C:\MGtools\sed.exe "s/^/set SID=/"
- C:\MGtools\sed.exe "s/HKEY_LOCAL_MACHINE\\software\\microsoft\\windows nt\\currentversion\\profilelist\\//"
- C:\MGtools\swreg.exe query "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows" /v run
- C:\MGtools\swreg.exe query "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows" /v load
- C:\MGtools\swreg.exe query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v System
- C:\MGtools\swreg.exe query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Userinit
- C:\MGtools\swreg.exe query "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Startup
- C:\MGtools\swreg.exe query "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v Startup
- C:\MGtools\sed.exe "s/\\0/\n/g"
- C:\MGtools\swreg.exe query "HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost" /v Netsvcs
- C:\MGtools\swreg.exe query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell
- C:\MGtools\swreg.exe query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows" /v AppInit_DLLs
- C:\MGtools\grep.exe -U -E "HKEY_LOCAL_MACHINE" C:\MGtools\temp\ProfInfo2.txt
- C:\MGtools\swreg.exe add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /v HideFileExt /t REG_DWORD /d 0
- C:\MGtools\swreg.exe add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /v ShowSuperHidden /t REG_DWORD /d 1
- C:\MGtools\swreg.exe add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 0
- C:\MGtools\swreg.exe add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 0
- C:\MGtools\zip.exe -j "C:\MGlogs.zip" C:\MGTools\GetUnKey.txt
- C:\MGtools\swreg.exe import fixCF.reg
- C:\MGtools\swreg.exe add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /v SuperHidden /t REG_DWORD /d 1
- C:\MGtools\swreg.exe add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /v Hidden /t REG_DWORD /d 1
- C:\MGtools\sed.exe "s/^..:\\Documents and Settings\\/SET UID=\x22/;s/.$//"
- C:\MGtools\sed.exe -r "/^HKEY| +ProfileImagePath|^$/I!d"
- C:\MGtools\grep.exe -B1 -U -E "%USERNAME%" C:\MGtools\temp\ProfInfo.txt
- C:\MGtools\grep.exe -B1 -U -E -w "%USERNAME%" C:\MGtools\temp\ProfInfo.txt
- C:\MGtools\swreg.exe add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 0
- C:\MGtools\swreg.exe add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 0
- C:\MGtools\swreg.exe query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList" /s
- C:\MGtools\swreg.exe import C:\MGTools\config.reg
Запускает на исполнение:
- %WINDIR%\regedit.exe /E C:\MGTools\temp\xrkey07.txt "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentVersion\RunOnceEx"
- %WINDIR%\regedit.exe /E C:\MGTools\temp\xrkey08.txt "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentVersion\RunServices"
- %WINDIR%\regedit.exe /E C:\MGTools\temp\xrkey09.txt "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentVersion\RunServicesOnce"
- %WINDIR%\regedit.exe /E C:\MGTools\temp\xrkey06.txt "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentVersion\RunOnce"
- %WINDIR%\regedit.exe /E C:\MGTools\temp\xrkey04.txt "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServices"
- %WINDIR%\regedit.exe /E C:\MGTools\temp\xrkey05.txt "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentVersion\Run"
- %WINDIR%\regedit.exe /E C:\MGTools\temp\xrkey05b.txt "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-"
- %WINDIR%\regedit.exe /E C:\MGTools\temp\aedebug.txt "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug"
- %WINDIR%\regedit.exe /E C:\MGTools\temp\xlmcpl.txt "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\load"
- %WINDIR%\regedit.exe /E C:\MGTools\temp\cvdrv1.txt "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32"
- %WINDIR%\regedit.exe /E C:\MGTools\temp\xrkey11b.txt "HKEY_USERS\S-1-5-21-2052111302-484763869-725345543-1003\Software\Microsoft\Windows\CurrentVersion\runonce"
- %WINDIR%\regedit.exe /E C:\MGTools\temp\xrkey10.txt "HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run"
- %WINDIR%\regedit.exe /E C:\MGTools\temp\xrkey11.txt "HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce"
- %WINDIR%\regedit.exe /E C:\MGTools\temp\xrkey11a.txt "HKEY_USERS\S-1-5-21-2052111302-484763869-725345543-1003\Software\Microsoft\Windows\CurrentVersion\run"
- %WINDIR%\regedit.exe /E C:\MGtools\tmpUnKey.txt "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
- <SYSTEM32>\find.exe "Windows 2000"
- <SYSTEM32>\find.exe "5.2"
- <SYSTEM32>\find.exe "Windows Millennium"
- <SYSTEM32>\cmd.exe /c ""C:\MGtools\GetLogs.bat" "
- <SYSTEM32>\find.exe "Windows 95"
- <SYSTEM32>\find.exe "Windows 98"
- %WINDIR%\regedit.exe /E C:\MGTools\temp\xrkey01b.txt "HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-"
- %WINDIR%\regedit.exe /E C:\MGTools\temp\xrkey02.txt "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce"
- %WINDIR%\regedit.exe /E C:\MGTools\temp\xrkey03.txt "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnceEx"
- %WINDIR%\regedit.exe /E C:\MGTools\temp\xrkey01.txt "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run"
- <SYSTEM32>\find.exe "Windows XP"
- <SYSTEM32>\ntvdm.exe -f
- <SYSTEM32>\find.exe "bytes free"
Изменения в файловой системе:
Создает следующие файлы:
- C:\MGtools\za.bat
- C:\MGtools\ZAchk.bat
- C:\MGtools\zip.exe
- C:\MGtools\UserInfo.bat
- C:\MGtools\vfind.exe
- C:\MGtools\VunFind.bat
- C:\MGtools\analyse.exe
- C:\MGtools\GetBrSet.bat
- C:\MGtools\CUT.EXE
- C:\MGtools\scantime.txt
- C:\MGtools\BamFix.bat
- C:\MGtools\setvar
- C:\MGtools\FN2env.bat
- C:\MGtools\RunMB.bat
- C:\MGtools\sed.exe
- C:\MGtools\ShowNew.bat
- C:\MGtools\RemMWS.bat
- C:\MGtools\resetperm.cmd
- C:\MGtools\resetperm-x64.cmd
- C:\MGtools\SN64.bat
- C:\MGtools\SysBU.bat
- C:\MGtools\unhide.reg
- C:\MGtools\UnKeys.bat
- C:\MGtools\SRVen.bat
- C:\MGtools\swreg.exe
- C:\MGtools\swwhoami.exe
- C:\MGtools\temp\GRKflag.log
- C:\MGtools\temp\ProfInfo3.txt
- C:\MGtools\temp\ProfInfo4.txt
- C:\MGtools\temp\setsid.bat
- C:\MGtools\temp\ProfInfo.txt
- C:\MGtools\temp\uid.bat
- C:\MGtools\temp\ProfInfo2.txt
- C:\MGtools\temp\xrkey11a.txt
- C:\MGtools\temp\cvdrv2.txt
- C:\MGtools\temp\cvdrv3.txt
- C:\MGtools\temp\NetSvcs.txt
- C:\MGtools\temp\aedebug.txt
- C:\MGtools\temp\xrquery.txt
- C:\MGtools\temp\cvdrv1.txt
- C:\MGtools\zia02632
- C:\MGtools\temp\header0.txt
- C:\MGtools\temp\junk.txt
- C:\MGtools\filelog.txt
- C:\MGtools\GetUnKey.txt
- C:\MGtools\tmpUnKey.txt
- %WINDIR%\Temp\scs1.tmp
- C:\MGtools\temp\xrkey06.txt
- C:\MGtools\temp\xrkey07.txt
- C:\MGtools\temp\xrkey10.txt
- %WINDIR%\Temp\scs2.tmp
- C:\MGtools\temp\xrkey01.txt
- C:\MGtools\temp\xrkey05.txt
- C:\MGtools\fixChode.reg
- C:\MGtools\FixFA.bat
- C:\MGtools\fixFA.reg
- C:\MGtools\FixbamRC.bat
- C:\MGtools\FixCF.bat
- C:\MGtools\fixCF.reg
- C:\MGtools\FixNet.bat
- C:\MGtools\FixW7BFE.reg
- C:\MGtools\FixW7FW.reg
- C:\MGtools\FixW7FWdrv.reg
- C:\MGtools\FixPerm.bat
- C:\MGtools\FixSBM.bat
- C:\MGtools\fixSBM.reg
- C:\MGtools\DebugMGT.bat
- C:\MGtools\DisableUAC.reg
- C:\MGtools\download.exe
- C:\MGtools\bamRCfix.txt
- C:\MGtools\chodefix.bat
- C:\MGtools\config.reg
- C:\MGtools\EnableUAC.reg
- C:\MGtools\FixAttr.bat
- C:\MGtools\FixBagle.bat
- C:\MGtools\fixBagle.reg
- C:\MGtools\FindOVL.bat
- C:\MGtools\FindRN.bat
- C:\MGtools\FixACLS.bat
- C:\MGtools\FixWFW.bat
- C:\MGtools\mbrfix.bat
- C:\MGtools\MGclean.bat
- C:\MGtools\MIalt.bat
- C:\MGtools\IEFIX.reg
- C:\MGtools\locate.com
- C:\MGtools\ltime.exe
- C:\MGtools\MiscInfo.bat
- C:\MGtools\Process.exe
- C:\MGtools\ProcessDll.exe
- C:\MGtools\Regfix.bat
- C:\MGtools\NwkTst.bat
- C:\MGtools\perm.cmd
- C:\MGtools\pevFind.exe
- C:\MGtools\GetMBR.bat
- C:\MGtools\GetMsrv.bat
- C:\MGtools\GetNetInf.bat
- C:\MGtools\fixXPnetbt.reg
- C:\MGtools\GetDetails.exe
- C:\MGtools\GetLogs.Bat
- C:\MGtools\GetRunKey.bat
- C:\MGtools\hide.reg
- C:\MGtools\history.txt
- C:\MGtools\HTAfind.bat
- C:\MGtools\GetUnKeys.bat
- C:\MGtools\grep.exe
- C:\MGtools\GRK64.bat
Удаляет следующие файлы:
- %WINDIR%\Temp\scs1.tmp
- %WINDIR%\Temp\scs2.tmp
- C:\MGtools\GetUnKey.txt
- C:\MGtools\tmpUnKey.txt
Перемещает следующие файлы:
- C:\MGtools\zia02632 в C:\MGlogs.zip
Другое:
Ищет следующие окна:
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-bb8.bbc.380001'
- ClassName: 'RegEdit_RegEdit' WindowName: ''
