Техническая информация
Для обеспечения автозапуска и распространения
Модифицирует следующие ключи реестра
- [<HKLM>\Software\Classes\inffile\shell\open\command] '' = 'C:\Users\Public\ghostroot\Message.vbs %1 %*'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\attrib.exe] 'Debugger' = 'wscript.exe C:\Users\Public\ghostroot\Message.vbs'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\install.exe] 'Debugger' = 'wscript.exe C:\Users\Public\ghostroot\Message.vbs'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setup.exe] 'Debugger' = 'wscript.exe C:\Users\Public\ghostroot\Message.vbs'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe] 'Debugger' = 'wscript.exe C:\Users\Public\ghostroot\Message.vbs'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe] 'Debugger' = 'wscript.exe C:\Users\Public\ghostroot\Message.vbs'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe] 'Debugger' = 'wscript.exe C:\Users\Public\ghostroot\Message.vbs'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\chrome.exe] 'Debugger' = 'wscript.exe C:\Users\Public\ghostroot\Message.vbs'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\firefox.exe] 'Debugger' = 'wscript.exe C:\Users\Public\ghostroot\Message.vbs'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCleaner64.exe] 'Debugger' = 'wscript.exe C:\Users\Public\ghostroot\Message.vbs'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\installer.exe] 'Debugger' = 'wscript.exe C:\Users\Public\ghostroot\Message.vbs'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\updater.exe] 'Debugger' = 'wscript.exe C:\Users\Public\ghostroot\Message.vbs'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\plugin-hang-ui.exe] 'Debugger' = 'wscript.exe C:\Users\Public\ghostroot\Message.vbs'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wmic.exe] 'Debugger' = 'wscript.exe C:\Users\Public\ghostroot\Message.vbs'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\control.exe] 'Debugger' = 'wscript.exe C:\Users\Public\ghostroot\Message.vbs'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mdsched.exe] 'Debugger' = 'wscript.exe C:\Users\Public\ghostroot\Message.vbs'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskhost.exe] 'Debugger' = 'wscript.exe C:\Users\Public\ghostroot\Message.vbs'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\crashreporter.exe] 'Debugger' = 'wscript.exe C:\Users\Public\ghostroot\Message.vbs'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autoruns.exe] 'Debugger' = 'wscript.exe C:\Users\Public\ghostroot\Message.vbs'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe] 'Debugger' = 'wscript.exe C:\Users\Public\ghostroot\Message.vbs'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe] 'Debugger' = 'wscript.exe C:\Users\Public\ghostroot\Message.vbs'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe] 'Debugger' = 'wscript.exe C:\Users\Public\ghostroot\Message.vbs'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe] 'Debugger' = 'wscript.exe C:\Users\Public\ghostroot\Message.vbs'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe] 'Debugger' = 'wscript.exe C:\Users\Public\ghostroot\Message.vbs'
- [<HKLM>\SOFTWARE\Classes\hlpfile\shell\open\command] '' = 'C:\Users\Public\ghostroot\Message.vbs'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Kevin' = 'C:\Users\Public\ghostroot\Kevin'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'Kevin' = 'C:\Users\Public\ghostroot\Kevin'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msert.exe] 'Debugger' = 'wscript.exe C:\Users\Public\ghostroot\Message.vbs'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mssecse.exe] 'Debugger' = 'wscript.exe C:\Users\Public\ghostroot\Message.vbs'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCui.exe] 'Debugger' = 'wscript.exe C:\Users\Public\ghostroot\Message.vbs'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe] 'Debugger' = 'wscript.exe C:\Users\Public\ghostroot\Message.vbs'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCleaner.exe] 'Debugger' = 'wscript.exe C:\Users\Public\ghostroot\Message.vbs'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procxp.exe] 'Debugger' = 'wscript.exe C:\Users\Public\ghostroot\Message.vbs'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\update.exe] 'Debugger' = 'wscript.exe C:\Users\Public\ghostroot\Message.vbs'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCleaner32.exe] 'Debugger' = 'wscript.exe C:\Users\Public\ghostroot\Message.vbs'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\htaedit.exe] 'Debugger' = 'wscript.exe C:\Users\Public\ghostroot\Message.vbs'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VirtualBox.exe] 'Debugger' = 'wscript.exe C:\Users\Public\ghostroot\Message.vbs'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbam.exe] 'Debugger' = 'wscript.exe C:\Users\Public\ghostroot\Message.vbs'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\uTorrent.exe] 'Debugger' = 'wscript.exe C:\Users\Public\ghostroot\Message.vbs'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\uninstall.exe] 'Debugger' = 'wscript.exe C:\Users\Public\ghostroot\Message.vbs'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad++.exe] 'Debugger' = 'wscript.exe C:\Users\Public\ghostroot\Message.vbs'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\adwcleaner_5.005.exe] 'Debugger' = 'wscript.exe C:\Users\Public\ghostroot\Message.vbs'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\student.exe] 'Debugger' = 'wscript.exe C:\Users\Public\ghostroot\Message.vbs'
- [<HKLM>\Software\Classes\regfile\shell\open\command] '' = 'C:\Users\Public\ghostroot\Message.vbs %1 %*'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vbsedit.exe] 'Debugger' = 'wscript.exe C:\Users\Public\ghostroot\Message.vbs'
- [<HKLM>\Software\Classes\exefile\shell\open\command] '' = 'C:\Users\Public\ghostroot\Message.vbs %1 %*'
Вредоносные функции
Для затруднения выявления своего присутствия в системе
блокирует отображение:
- скрытых файлов
- расширений файлов
блокирует запуск следующих системных утилит:
- Диспетчера задач (Taskmgr)
блокирует:
- Средство контроля пользовательских учетных записей (UAC)
изменяет следующие системные настройки:
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoSetTaskbar' = '00000001'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoTrayItemsDisplay' = '00000001'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoTrayContextMenu' = '00000001'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoSaveSettings' = '00000001'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoControlPanel' = '00000001'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoStartMenuPinnedList' = '00000001'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoStartMenuMFUprogramsList' = '00000001'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoFolderOptions' = '00000001'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoRun' = '00000001'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoFind' = '00000001'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoSecurityTab' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoSecurityTab' = '00000001'
Изменения в файловой системе
Создает следующие файлы
- C:\users\public\ghostroot\message.vbs
- C:\users\public\ghostroot\starter.bat
Другое
Запускает на исполнение
- '<SYSTEM32>\wscript.exe' "<PATH_SAMPLE>.vbs" /elevated
- '<SYSTEM32>\cmd.exe' /c ""C:\Users\Public\ghostroot\starter.bat" "
