Trojan.Carberp.2351

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run\] 'SafeDot' = '%WINDIR%\SysWOW64\zwSafedotSpace.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run\] 'SafeDotX' = '<SYSTEM32>\zwSafedotSpaceX.exe'
[<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run\] 'EGAgent' = '%ProgramFiles(x86)%\EGISi\EGAgent.exe /a'

Создает или изменяет следующие файлы

<SYSTEM32>\tasks\egisi_encrypt_1

Вредоносные функции

Для затруднения выявления своего присутствия в системе

блокирует:

Средство контроля пользовательских учетных записей (UAC)

Изменения в файловой системе

Создает следующие файлы

C:\temp\temp.zip
%WINDIR%\syswow64\zwsafedotship.dll
<SYSTEM32>\zsdspacemapx.dll
%WINDIR%\syswow64\zsdspacemap.dll
%WINDIR%\syswow64\egresi_kr.dll
%WINDIR%\syswow64\egresi_en.dll
%WINDIR%\syswow64\egres_kr.dll
%WINDIR%\syswow64\egres_en.dll
%WINDIR%\syswow64\jsecurexsol3.dll
%WINDIR%\syswow64\jsecurexsol.dll
%WINDIR%\syswow64\jsecurexca.dll
%WINDIR%\syswow64\escm.dll
<SYSTEM32>\esccx.dll
%WINDIR%\syswow64\escc.dll
<SYSTEM32>\zwsafedotshipx.dll
<SYSTEM32>\egsocketx.dll
%WINDIR%\syswow64\egshell.dll
<SYSTEM32>\egpolix.dll
%WINDIR%\syswow64\egpoli.dll
<SYSTEM32>\eglinkx.dll
%WINDIR%\syswow64\eglink.dll
<SYSTEM32>\eglccx.dll
%WINDIR%\syswow64\eglcc.dll
%ProgramFiles(x86)%\egisi\egres.ini
%ProgramFiles(x86)%\egisi\egfileinfo.exe
%ProgramFiles(x86)%\egisi\egencrypt.exe
%ProgramFiles(x86)%\egisi\egdecrypt.exe
%ALLUSERSPROFILE%\microsoft\windows\start menu\egisi\egisi.lnk
C:\users\public\desktop\egisi.lnk
%WINDIR%\syswow64\egsocket.dll
%WINDIR%\syswow64\zwsafedotxwingdrv.dll
<SYSTEM32>\zwsafedotxwingdrvx.dll
%WINDIR%\syswow64\zwsafedotxwingout.dll
%WINDIR%\syswow64\eg_checker.exe
%ProgramFiles(x86)%\egisi\watermark.ini
%ProgramFiles(x86)%\egisi\pdfexportserver.dll
%ProgramFiles(x86)%\egisi\egpdfagent.exe
%ProgramFiles(x86)%\egisi\egpdf_env.ini
<SYSTEM32>\egproc_batch.exe
%WINDIR%\syswow64\egproc.exe
%ProgramFiles(x86)%\egisi\encrypt_task.bat
<SYSTEM32>\escmx.dll
%WINDIR%\syswow64\egcurve.dll
%WINDIR%\syswow64\zwsafedotskywalker.dll
%WINDIR%\syswow64\egmbind.dll
%ProgramFiles(x86)%\egisi\egmbindx.dll
<SYSTEM32>\egcurvex.dll
%ProgramFiles(x86)%\egisi\zwsdvirscan.dll
<SYSTEM32>\egsubx.dll
<SYSTEM32>\egcryptx.sgn
<SYSTEM32>\egcryptx.dll
<SYSTEM32>\egshellx.dll
%WINDIR%\syswow64\egsub.dll
%WINDIR%\syswow64\egcrypt.sgn
%WINDIR%\syswow64\egcrypt.dll
%ProgramFiles(x86)%\egisi\updater.exe
%ProgramFiles(x86)%\egisi\setupxml86.dll
%ProgramFiles(x86)%\egisi\instinf.dll
%ProgramFiles(x86)%\egisi\center.bmp
<SYSTEM32>\zwsafedotspacex.exe
%WINDIR%\syswow64\zwsafedotspace.exe
<SYSTEM32>\zwsafedotxwingoutx.dll
%ProgramFiles(x86)%\egisi\egagent.exe
%ProgramFiles(x86)%\egisi\setup.ini
%WINDIR%\installtemp\command.reboot
%WINDIR%\installtemp\ds_x64.xml
%WINDIR%\installtemp\system\zwsafedotshipx.dll
%WINDIR%\installtemp\system\zwsafedotship.dll
%WINDIR%\installtemp\system\zsdspacemapx.dll
%WINDIR%\installtemp\system\zsdspacemap.dll
%WINDIR%\installtemp\system\egresi_kr.dll
%WINDIR%\installtemp\system\egresi_en.dll
%WINDIR%\installtemp\system\egres_kr.dll
%WINDIR%\installtemp\system\egres_en.dll
%WINDIR%\installtemp\system\jsecurexsol3.dll
%WINDIR%\installtemp\system\jsecurexsol.dll
%WINDIR%\installtemp\system\jsecurexca.dll
%WINDIR%\installtemp\system\escm.dll
%WINDIR%\installtemp\system\esccx.dll
%WINDIR%\installtemp\system\zwsafedotxwingdrv.dll
%WINDIR%\installtemp\system\escc.dll
%WINDIR%\installtemp\system\egsocket.dll
%WINDIR%\installtemp\system\egshell.dll
%WINDIR%\installtemp\system\egpolix.dll
%WINDIR%\installtemp\system\egpoli.dll
%WINDIR%\installtemp\system\eglinkx.dll
%WINDIR%\installtemp\system\eglink.dll
%WINDIR%\installtemp\system\eglccx.dll
%WINDIR%\installtemp\system\eglcc.dll
%WINDIR%\installtemp\egisi\egres.ini
%WINDIR%\installtemp\egisi\egfileinfo.exe
%WINDIR%\installtemp\egisi\egencrypt.exe
%WINDIR%\installtemp\egisi\egdecrypt.exe
%WINDIR%\installtemp\egisi\egagent.exe
%WINDIR%\installtemp\system\egsocketx.dll
%WINDIR%\installtemp\system\zwsafedotxwingdrvx.dll
%WINDIR%\installtemp\system\zwsafedotxwingout.dll
%WINDIR%\installtemp\system\zwsafedotxwingoutx.dll
%WINDIR%\installtemp\system\eg_checker.exe
%WINDIR%\installtemp\system\taskkill.exe
%WINDIR%\installtemp\egisi\watermark.ini
%WINDIR%\installtemp\egisi\pdfexportserver.dll
%WINDIR%\installtemp\egisi\egpdfagent.exe
%WINDIR%\installtemp\egisi\egpdf_env.ini
%WINDIR%\installtemp\system\egproc_batch.exe
%WINDIR%\installtemp\system\egproc.exe
%WINDIR%\installtemp\egisi\encrypt_task.bat
%WINDIR%\installtemp\system\escmx.dll
%WINDIR%\installtemp\system\egcurve.dll
%WINDIR%\installtemp\system\zwsafedotskywalker.dll
%WINDIR%\installtemp\system\egmbind.dll
%WINDIR%\installtemp\system\egmbindx.dll
%WINDIR%\installtemp\system\egcurvex.dll
%WINDIR%\installtemp\system\zwsdvirscan.dll
%WINDIR%\installtemp\system\egsubx.dll
%WINDIR%\installtemp\system\egcryptx.sgn
%WINDIR%\installtemp\system\egcryptx.dll
%WINDIR%\installtemp\system\egshellx.dll
%WINDIR%\installtemp\system\egsub.dll
%WINDIR%\installtemp\system\egcrypt.sgn
%WINDIR%\installtemp\system\egcrypt.dll
%WINDIR%\installtemp\updater.exe
%WINDIR%\installtemp\setupxml86.dll
%WINDIR%\installtemp\instinf.dll
%WINDIR%\installtemp\center.bmp
%WINDIR%\installtemp\system\zwsafedotspacex.exe
%WINDIR%\installtemp\system\zwsafedotspace.exe
%WINDIR%\installtemp\setup.ini
%ProgramFiles(x86)%\egisi\ds_x64.xml

Удаляет следующие файлы

C:\temp\temp.zip

Другое

Создает и запускает на исполнение

'%WINDIR%\installtemp\updater.exe' install 0
'%WINDIR%\syswow64\eg_checker.exe'
'<SYSTEM32>\regsvr32.exe' /u /s "%WINDIR%\SysWOW64\egShell.dll"' (со скрытым окном)
'<SYSTEM32>\regsvr32.exe' /s "%WINDIR%\SysWOW64\egShell.dll"' (со скрытым окном)
'<SYSTEM32>\regsvr32.exe' /u /s "<SYSTEM32>\egShellx.dll"' (со скрытым окном)
'<SYSTEM32>\regsvr32.exe' /s "<SYSTEM32>\egShellx.dll"' (со скрытым окном)

Запускает на исполнение

'<SYSTEM32>\regsvr32.exe' /u /s "%WINDIR%\SysWOW64\egShell.dll"
'<SYSTEM32>\regsvr32.exe' /s "%WINDIR%\SysWOW64\egShell.dll"
'<SYSTEM32>\regsvr32.exe' /u /s "<SYSTEM32>\egShellx.dll"
'<SYSTEM32>\regsvr32.exe' /s "<SYSTEM32>\egShellx.dll"
'<SYSTEM32>\cmd.exe' /c ""%ProgramFiles(x86)%\EGISi\encrypt_task.bat""
'<SYSTEM32>\schtasks.exe' /Create /SC daily /TN EGISi_Encrypt_1 /TR <SYSTEM32>\egproc_batch.exe /ST 12:00 /F