Техническая информация
Вредоносные функции:
Запускает на исполнение:
- <SYSTEM32>\cacls.exe %TEMP%\zxdll.dat /d everyone
- <SYSTEM32>\cacls.exe %TEMP%\SysDir.dat /d everyone
- <SYSTEM32>\cacls.exe %TEMP%\msdll.dat /d everyone
- <SYSTEM32>\cacls.exe <SYSTEM32>\HookSSDT.sys /d everyone
- <SYSTEM32>\cacls.exe %TEMP%\TempFile.sys /d everyone
- <SYSTEM32>\cacls.exe %TEMP%\acpidisk.sys /d everyone
- <SYSTEM32>\cacls.exe %TEMP%\xccs.dll /d everyone
- <SYSTEM32>\cacls.exe %TEMP%\gametl.dll /d everyone
- <SYSTEM32>\cacls.exe %TEMP%\Sysa.dat /d everyone
- <SYSTEM32>\cacls.exe %TEMP%\tmpqq10000d.tmp /d everyone
- <SYSTEM32>\cacls.exe <SYSTEM32>\nskhelper2.sys /d everyone
- <SYSTEM32>\cacls.exe <SYSTEM32>\system.dll /d everyone
- <SYSTEM32>\cacls.exe <SYSTEM32>\nspass4.sys /d everyone
- <SYSTEM32>\cacls.exe <SYSTEM32>\nspass2.sys /d everyone
- <SYSTEM32>\cacls.exe <SYSTEM32>\nspass3.sys /d everyone
- <SYSTEM32>\cacls.exe <SYSTEM32>\jrny.dll /d everyone
- <SYSTEM32>\cacls.exe <SYSTEM32>\360Protect.sys /d everyone
- <SYSTEM32>\cacls.exe <SYSTEM32>\ndy.dll /d everyone
- <SYSTEM32>\cacls.exe <SYSTEM32>\killdll.dll /d everyone
- <SYSTEM32>\cacls.exe <SYSTEM32>\pps.dll /d everyone
- <SYSTEM32>\cacls.exe <SYSTEM32>\killkb.dll /d everyone
- <SYSTEM32>\cacls.exe <SYSTEM32>\tcpip.sys /d everyone
- <SYSTEM32>\cacls.exe %WINDIR%\update.dll /d everyone
- <SYSTEM32>\cacls.exe %WINDIR%\WanPacket.dll /d everyone
- <SYSTEM32>\cacls.exe %WINDIR%\wpcap.dll /d everyone
- <SYSTEM32>\cacls.exe <DRIVERS>\aliimz.sys /d everyone
- <SYSTEM32>\cacls.exe <DRIVERS>\caibcuma.sys /d everyone
- <SYSTEM32>\cacls.exe <DRIVERS>\puid.sys /d everyone
- <SYSTEM32>\cacls.exe <SYSTEM32>\Aduio.sys /d everyone
- <SYSTEM32>\cacls.exe <SYSTEM32>\terple.sys /d everyone
- <SYSTEM32>\cacls.exe %TEMP%\xunxianqq.dll /d everyone
- <SYSTEM32>\cacls.exe %WINDIR%\temp\npptools.dll /d everyone
- <SYSTEM32>\cacls.exe %TEMP%\jxinit.dat /d everyone
- <SYSTEM32>\cacls.exe %TEMP%\tmp.tmp /d everyone
- <SYSTEM32>\cacls.exe %TEMP%\Migsni.sys /d everyone
- <SYSTEM32>\cacls.exe %WINDIR%\npptools.dll /d everyone
- <SYSTEM32>\cacls.exe %WINDIR%\Packet.dll /d everyone
- <SYSTEM32>\cacls.exe %WINDIR%\temp\wpcap.dll /d everyone
- <SYSTEM32>\cacls.exe %WINDIR%\temp\Packet.dll /d everyone
- <SYSTEM32>\cacls.exe %WINDIR%\temp\WanPacket.dll /d everyone
- <SYSTEM32>\cacls.exe <SYSTEM32>\cursors /c /p Everyone:r
- <SYSTEM32>\cacls.exe %PROGRAM_FILES%\windows NT\system /d everyone
- <SYSTEM32>\cacls.exe <SYSTEM32>\cursors /d everyone
- <SYSTEM32>\cacls.exe c:\MyRARwork /d everyone
- <SYSTEM32>\cacls.exe c:\MyRARwork /c /p Everyone:r
- <SYSTEM32>\cacls.exe %PROGRAM_FILES%\WinRAR\com.run /d everyone
- <SYSTEM32>\cacls.exe %WINDIR%\phpi.dll /d everyone
- <SYSTEM32>\cacls.exe <Имя диска съемного носителя>:\system.dll /d everyone
- <SYSTEM32>\cacls.exe %PROGRAM_FILES%\windows NT\system /c /p Everyone:r
- <SYSTEM32>\cacls.exe <Имя диска съемного носителя>:\autorun.inf /d everyone
- <SYSTEM32>\regsvr32.exe <SYSTEM32>\wbem\ievkbd.dll /s /u
- <SYSTEM32>\cacls.exe %WINDIR%\LastGood\system32\drivers /d everyone
- %WINDIR%\regedit.exe /s %TEMP%\qdal.reg
- <SYSTEM32>\cacls.exe <Имя диска съемного носителя>:\mspaint.exe /d everyone
- <SYSTEM32>\cacls.exe <Имя диска съемного носителя>:\ctfmen.exe /d everyone
- <SYSTEM32>\cacls.exe %CommonProgramFiles%\Microsoft /d everyone
- <SYSTEM32>\cacls.exe %CommonProgramFiles%\Microsoft /c /p Everyone:r
- <SYSTEM32>\cacls.exe %PROGRAM_FILES%\marvell /c /p Everyone:r
- <SYSTEM32>\cacls.exe %WINDIR%\LastGood\system32\drivers /c /p Everyone:r
- <SYSTEM32>\cacls.exe %PROGRAM_FILES%\marvell /d everyone
- <SYSTEM32>\cacls.exe <SYSTEM32>\ssdtti.sys /d everyone
- <SYSTEM32>\cacls.exe %WINDIR%\linkinfo.dll /d everyone
- <SYSTEM32>\cacls.exe <SYSTEM32>\fuck.dll /d everyone
- <SYSTEM32>\cacls.exe <SYSTEM32>\ShowIP.dll /d everyone
- <SYSTEM32>\cacls.exe <SYSTEM32>\kisl.sys /d everyone
- <SYSTEM32>\cacls.exe <SYSTEM32>\nspass0.sys /d everyone
- <SYSTEM32>\cacls.exe <SYSTEM32>\nspass1.sys /d everyone
- <SYSTEM32>\cacls.exe <SYSTEM32>\TcpFilter.sys /d everyone
- <SYSTEM32>\cacls.exe <SYSTEM32>\BrowserHelper.dll /d everyone
- <SYSTEM32>\cacls.exe <SYSTEM32>\sgcq.dll /d everyone
- <SYSTEM32>\cacls.exe %WINDIR%\stin.bat /d everyone
- <SYSTEM32>\cacls.exe %WINDIR%\SearchInfo.dll /d everyone
- <SYSTEM32>\cacls.exe %WINDIR%\Dll.dll /d everyone
- <SYSTEM32>\cacls.exe %WINDIR%\aboy.dll /d everyone
- <SYSTEM32>\cacls.exe %WINDIR%\winyyy.sys /d everyone
- <SYSTEM32>\cacls.exe <SYSTEM32>\sadfasdf.jpg /d everyone
- <SYSTEM32>\cacls.exe <SYSTEM32>\IEMaster.dll /d everyone
- <SYSTEM32>\cacls.exe <SYSTEM32>\justkit.dll /d everyone
- <SYSTEM32>\cacls.exe <SYSTEM32>\KbProtect.sys /d everyone
- <SYSTEM32>\cacls.exe <SYSTEM32>\LocaSync.dll /d everyone
Завершает или пытается завершить
следующие системные процессы:
- <SYSTEM32>\alg.exe
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\aut2.tmp
- %TEMP%\qdal.reg
- %TEMP%\aut1.tmp
- %TEMP%\Ot
Удаляет следующие файлы:
- %TEMP%\aut2.tmp
- %TEMP%\qdal.reg
- %TEMP%\aut1.tmp
- %TEMP%\Ot
Другое:
Ищет следующие окна:
- ClassName: 'RegEdit_RegEdit' WindowName: ''
