Техническая информация
Вредоносные функции:
Создает и запускает на исполнение:
- C:\EF\reg.ef QUERY "HKEY_CLASSES_ROOT\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}"
- C:\EF\grep.ef -Fiq "0404" .\temp\temp00
- C:\EF\DUMPHIVE.ef ".\temp\shellfolder0101" ".\temp\shellfolder0102"
- C:\EF\reg.ef save "hklm\software\microsoft\windows\currentversion\explorer\shell folders" ".\temp\shellfolder0101"
- C:\EF\mtee.ef /+ .\temp\setpath.bat
- C:\EF\sed.ef "/.*\t/!d;s///;s/.*/C:\\WINDOWS\\system32\\chcp\.com &/" .\temp\temp00
- C:\EF\reg.ef query "hklm\system\currentcontrolset\control\nls\language" /v "default"
- C:\EF\reg.ef add "hkcu\console" /v "codepage" /t reg_dword /d "1251" /f
- C:\EF\reg.ef save "hkcu\software\microsoft\windows\currentversion\explorer\shell folders" ".\temp\shellfolder0201"
- C:\EF\pv.ef -d10000 -x download.exe
- C:\EF\download.exe http://sy######s.myweb.hinet.net/EF/version.txt
- C:\EF\NirCmd.ef QBOXCOM "~nYou're running EFix Ver 5.3 20090921.07~n______________________________________________________________________~n~nAlthough we tested on our windows XP~n~nand it does execute correctly but we do now guarantee that it will run 100 correct on any other PC.~n~nPlease accept that we do not responsible to any of the damage caused by this program.~n~nIf you do not accept this, please enter ~qN~q to exit.~n~n~nAccept Yes/ No?" "Warning" returnval 1
- C:\EF\pv.ef -kf download.exe
- C:\EF\sed.ef -r "/=/!d;s/\\\\/\\/g;s/\x22//g;s/.*/SET \x22&\x22/" .\temp\shellfolder0102 .\temp\shellfolder0202
- C:\EF\DUMPHIVE.ef ".\temp\shellfolder0201" ".\temp\shellfolder0202"
- C:\EF\NirCmd.ef exec hide download.exe http://sy######s.myweb.hinet.net/EF/version.txt
- C:\EF\sed.ef "s/\.//g;s/.*/@SET \x22EFUP=&\x22/"
- C:\EF\reg.ef query "hklm\system\currentcontrolset\control\nls\codepage" /v "acp"
- C:\EF\sed.ef "s/.*/@SET \x22ref1=&\x22/"
- C:\EF\sed.ef "s/.*/@SET \x22ref=&\x22/"
- C:\EF\grep.ef -Fiq "Windows XP" Temp00
- C:\EF\grep.ef -Fiq "Windows 2000" Temp00
- C:\EF\vfind.ef -rtf -s388608 "<SYSTEM32>\*.com"
- C:\EF\mtee.ef /d .\temp\date_start.dat
- C:\EF\sed.ef -r "/C:\\WINDOWS\\system32\\$|^$|C::\\$|C:$/Id;s/\x22//g;/\.com$/I!d;s/.:\\.*/del \/f\/q \x22&\x22/" .\temp\delold.dat
- C:\EF\sed.ef -r "/C:\\WINDOWS\\system32\\[a-f,0-9]{6}\.com$/I!d"
- C:\EF\sed.ef "s/.*/@SET \x22emd=&\x22/"
- C:\EF\sed.ef -r "s/\x22 .*//;s/\x22//g;s/.*/SET \x22SFXNAME=&\x22/"
- C:\EF\NirCmd.ef execmd ECHO.
- C:\EF\grep.ef -q "....-..-.."
- C:\EF\mtee.ef /d .\temp\today
- C:\EF\sed.ef -r "s/(.*)\t(.*)/SET \x22EFVER=\1\x22\nSET \x22EFDATE=\2\x22/" .\temp\EFVer.dat
- <SYSTEM32>\DC588B.com /e:on /v:off /d /c main.bat
- C:\EF\sed.ef -r "s/C:\\WINDOWS\\system32;|C:\\WINDOWS;|C:\\WINDOWS\\system32\\wbem;|C:\\EF;//Ig;s/;+/;/g;s/\x22//g;s/.*/@SET \x22path=C:\\EF;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\system32\\wbem;&\x22/"
- C:\EF\sed.ef -r "s/\.ef;//Ig;s/;+/;/g;s/.*/@SET \x22pathext=\.ef;&\x22/"
Запускает на исполнение:
- <SYSTEM32>\chcp.com 1251
- <SYSTEM32>\ping.exe -n 1 www.hi##t.net
- <SYSTEM32>\cacls.exe "<SYSTEM32>\DC588B.com" /e /g %USERNAME%s:f
- <SYSTEM32>\cacls.exe "<SYSTEM32>\DC588B1.com" /e /g %USERNAME%s:f
Изменения в файловой системе:
Создает следующие файлы:
- C:\EF\temp\delold.dat
- C:\EF\temp\chk_ntfs.bat
- C:\EF\NULL24902
- C:\EF\DC588B.com
- C:\EF\NULL10533
- C:\EF\Rounded.gif
- <SYSTEM32>\ef.txt
- C:\EF\temp\date_start.dat
- C:\EF\NULL15067
- C:\EF\temp\setpath.bat
- C:\EF\temp\winxp.dat
- C:\EF\Temp00
- C:\EF\NULL14172
- <SYSTEM32>\DC588B.com
- C:\EF\NULL5300
- <SYSTEM32>\DC588B1.com
- C:\EF\Circle.gif
- C:\EF\AVTest.vbs
- C:\EF\dat\eula.reg
- C:\EF\getdisk.vbs
- C:\EF\DeviceHFile.vbs
- C:\EF\ERDNTDOS.LOC
- C:\EF\script.hta
- C:\EF\ERUNT.LOC
- C:\EF\ERDNTWIN.LOC
- C:\EF\services.vbs
- C:\EF\restore.vbs
- C:\EF\WU.vbs
- C:\EF\SETPATH2.vbs
- C:\EF\GetUSBDisk.vbs
- C:\EF\getfilesdate.vbs
- C:\EF\lnk.vbs
- C:\EF\ListDisk.vbs
- C:\EF\temp\EFVer.dat
- C:\EF\temp\shellfolder0201
- C:\EF\temp\shellfolder0102
- C:\EF\NULL\31654
- C:\EF\NULL\32666
- C:\EF\temp\shellfolder0101
- C:\EF\NULL\29390
- C:\EF\NULL\17796
- C:\EF\NULL\8129
- C:\EF\NULL\6098
- C:\EF\temp\EFUP.BAT
- C:\EF\NULL\15264
- C:\EF\NULL\6159
- C:\EF\NULL\18697
- C:\EF\temp\shellfolder0202
- C:\EF\NULL\12801
- C:\ef_backup\debug\setpath.bat
- C:\EF\NULL\LA32519
- C:\EF\regedit.ef
- C:\EF\findstr.ef
- C:\EF\NULL\14210
- %WINDIR%\nircmd.com
- C:\EF\NULL\10576
- C:\EF\attrib.ef
- C:\EF\cscript.ef
- C:\EF\cacls.ef
- C:\EF\temp\temp00
- C:\EF\GUIOK.BAT
- C:\EF\NULL\LA26847
- C:\EF\temp\chcp.bat
- C:\EF\NULL\LA30710
- C:\EF\NULL\22411
- C:\EF\DISCLAIMER.BAT
- C:\EF\temp\today
- C:\EF\Run2.bat
- C:\EF\Run.bat
- C:\EF\Scan.bat
- C:\EF\Run3.bat
- C:\EF\pre.bat
- C:\EF\MOVEEx.BAT
- C:\EF\rename.bat
- C:\EF\Reboot.bat
- C:\EF\dat\datetime.dat
- C:\EF\dat\crc32.dat
- C:\EF\dat\disk.dat
- C:\EF\dat\DF.dat
- C:\EF\mshta.exe
- C:\EF\download.exe
- C:\EF\dat\CLSID.dat
- C:\EF\dat\bclsid.dat
- C:\EF\main.bat
- C:\EF\dat\verified.txt
- C:\EF\readme.txt
- C:\EF\clsid.bat
- C:\EF\BOOT.bat
- C:\EF\License\FileDigitalSignVerify\Licence.txt
- C:\EF\License\CRC32\CRC32.txt
- C:\EF\License\FileDigitalSignVerify\Readme.txt
- C:\EF\License\PV\pv.txt
- C:\EF\Lang.bat
- C:\EF\EndEF.bat
- C:\EF\List-B.bat
- C:\EF\List-A.bat
- C:\EF\EFList-Folder.bat
- C:\EF\EFList-File.bat
- C:\EF\EFScript.bat
- C:\EF\EFMOVEEx.bat
- C:\EF\dat\hiden.dat
- C:\EF\NirCmdC.ef
- C:\EF\NirCmd.ef
- C:\EF\reg.ef
- C:\EF\pv.ef
- C:\EF\md5deep.ef
- C:\EF\grep.ef
- C:\EF\mtee.ef
- C:\EF\moveex.ef
- C:\EF\TW\Option.hta
- C:\EF\main.hta
- C:\EF\TW\script.hta
- C:\EF\option.hta
- C:\EF\streams.ef
- C:\EF\sed.ef
- C:\EF\TW\main.hta
- C:\EF\vfind.ef
- C:\EF\FILEVER.ef
- C:\EF\dat\SafeBootXP.dat
- C:\EF\dat\SafeBoot2K.dat
- C:\EF\dat\Service1.dat
- C:\EF\dat\Service.dat
- C:\EF\dat\netsvcs_xp.dat
- C:\EF\dat\netsvcs_win7.dat
- C:\EF\dat\Run1.dat
- C:\EF\dat\notify.dat
- C:\EF\EConfickerRemover.ef
- C:\EF\DUMPHIVE.ef
- C:\EF\fdsv.ef
- C:\EF\ERUNT.ef
- C:\EF\dat\svchost_xp.dat
- C:\EF\dat\Service2.dat
- C:\EF\crc32.ef
- C:\EF\ERDNT.E_E
Удаляет следующие файлы:
- C:\EF\temp\shellfolder0102
- C:\EF\temp\shellfolder0101
- C:\EF\temp\shellfolder0201
- C:\EF\temp\EFUP.BAT
- C:\EF\temp\shellfolder0202
- C:\EF\temp\chcp.bat
- <SYSTEM32>\ef.txt
- C:\EF\temp\date_start.dat
- C:\EF\Temp00
- C:\EF\temp\temp00
- C:\EF\temp\today
Перемещает следующие файлы:
- C:\EF\regedit.ef в C:\EF\fixreg.ef
Сетевая активность:
Подключается к:
- 'sy######s.myweb.hinet.net':80
TCP:
Запросы HTTP GET:
- sy######s.myweb.hinet.net/EF/version.txt
UDP:
- DNS ASK sy######s.myweb.hinet.net
- DNS ASK www.hi##t.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
