Техническая информация
Вредоносные функции
Устанавливает процедуры перхвата сообщений
о нажатии клавиш клавиатуры:
- Библиотека-обработчик для всех процессов: %TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\LdxShareData32.dll
- Библиотека-обработчик для всех процессов: %TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\LdxShareData64.dll
оконных сообщений:
- Библиотека-обработчик для всех процессов: %TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\LdxShareData32.dll
- Библиотека-обработчик для всех процессов: %TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\LdWaterMarkHook32.dll
- Библиотека-обработчик для всех процессов: %TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\LdxShareData64.dll
- Библиотека-обработчик для всех процессов: %TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\LdWaterMarkHook64.dll
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\ldcab.exe.ldtmp
- %TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\ldcab.lddat.ldtmp
- %TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\ldcab.ldind.ldtmp
- %TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\ldcab.ldx.ldtmp
- %TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\ldreject32.exe.ldtmp
- %TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\ldprintmonitor64.dll.ldtmp
- %TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\ldprintmonitor.dll.ldtmp
- %TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\ldwatermarkhook32.dll.ldtmp
- %TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\ldwatermarkhook64.dll.ldtmp
- %TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\ldx.en.ldtmp
- %TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\ldx.cht.ldtmp
- %TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\ghhlp32.dll.ldtmp
- %TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\ghhlp64.dll.ldtmp
- %TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\ldxghijt64.dll.ldtmp
- %TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\ldxghijt32.dll.ldtmp
- %TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\ldxhook32.dll.ldtmp
- %TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\ldxhook64.dll.ldtmp
- %TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\ldxghcore64.sys.ldtmp
- %TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\ldxghcore32.sys.ldtmp
- %TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\ldxsharedata64.dll.ldtmp
- %TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\ldxsharedata32.dll.ldtmp
- %TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\lddisk64.sys.ldtmp
- %TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\ldreject64.exe.ldtmp
- %TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\ldxguard.exe.ldtmp
- %TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\forbit.ini.ldtmp
- %TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\lddisk32.sys.ldtmp
- %TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\detoured.dll.ldtmp
- %TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\ldxsysctrl.dll.ldtmp
- %TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\arlib.dll.ldtmp
- %TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\ldx.exe.ldtmp
- C:\inetpub\ftproot\tipray\ldterm\log\oabpdihcf_user\ldx.log
- %TEMP%\@tiprayldx@\forbit.ini
Удаляет следующие файлы
- %TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\ldcab.exe
Перемещает следующие файлы
- %TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\ldcab.exe.ldtmp в %TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\ldcab.exe
- %TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\ldcab.ldx.ldtmp в %TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\ldcab.ldx
- %TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\ldreject32.exe.ldtmp в %TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\ldreject32.exe
- %TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\ldprintmonitor64.dll.ldtmp в %TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\ldprintmonitor64.dll
- %TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\ldprintmonitor.dll.ldtmp в %TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\ldprintmonitor.dll
- %TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\ldwatermarkhook32.dll.ldtmp в %TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\ldwatermarkhook32.dll
- %TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\ldwatermarkhook64.dll.ldtmp в %TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\ldwatermarkhook64.dll
- %TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\ldx.en.ldtmp в %TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\ldx.en
- %TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\ldx.cht.ldtmp в %TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\ldx.cht
- %TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\ghhlp32.dll.ldtmp в %TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\ghhlp32.dll
- %TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\ghhlp64.dll.ldtmp в %TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\ghhlp64.dll
- %TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\ldxghijt64.dll.ldtmp в %TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\ldxghijt64.dll
- %TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\ldxghijt32.dll.ldtmp в %TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\ldxghijt32.dll
- %TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\ldxhook32.dll.ldtmp в %TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\ldxhook32.dll
- %TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\ldxhook64.dll.ldtmp в %TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\ldxhook64.dll
- %TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\ldxghcore64.sys.ldtmp в %TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\ldxghcore64.sys
- %TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\ldxghcore32.sys.ldtmp в %TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\ldxghcore32.sys
- %TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\ldxsharedata64.dll.ldtmp в %TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\ldxsharedata64.dll
- %TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\ldxsharedata32.dll.ldtmp в %TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\ldxsharedata32.dll
- %TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\lddisk64.sys.ldtmp в %TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\lddisk64.sys
- %TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\ldreject64.exe.ldtmp в %TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\ldreject64.exe
- %TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\ldxguard.exe.ldtmp в %TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\ldxguard.exe
- %TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\forbit.ini.ldtmp в %TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\forbit.ini
- %TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\lddisk32.sys.ldtmp в %TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\lddisk32.sys
- %TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\detoured.dll.ldtmp в %TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\detoured.dll
- %TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\ldxsysctrl.dll.ldtmp в %TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\ldxsysctrl.dll
- %TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\arlib.dll.ldtmp в %TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\arlib.dll
- %TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\ldx.exe.ldtmp в %TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\ldx.exe
- %TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\ldcab.ldind.ldtmp в %TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\ldcab.ldind
- %TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\ldcab.lddat.ldtmp в %TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\ldcab.lddat
Подменяет следующие файлы
- %TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\ldcab.exe.ldtmp
- %TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\ldcab.exe
Другое
Создает и запускает на исполнение
- '%TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\ldx.exe' -srcfile "<Полный путь к файлу>"
- '%TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\ldxguard.exe' -GuardPath %TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\
- '%TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\ldreject64.exe'
- '%TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\ldreject32.exe'
- '%TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\ldxguard.exe' -GuardPath %TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\' (со скрытым окном)
- '%TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\ldreject64.exe' ' (со скрытым окном)
- '%TEMP%\@tiprayldx@\a6bbe9b9b4c7a3668ede6bbee58f7b6b\ldreject32.exe' ' (со скрытым окном)
