Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\At58.job
- %WINDIR%\Tasks\At59.job
- %WINDIR%\Tasks\At57.job
- %WINDIR%\Tasks\At55.job
- %WINDIR%\Tasks\At56.job
- %WINDIR%\Tasks\At63.job
- %WINDIR%\Tasks\At64.job
- %WINDIR%\Tasks\At62.job
- %WINDIR%\Tasks\At60.job
- %WINDIR%\Tasks\At61.job
- %WINDIR%\Tasks\At54.job
- %WINDIR%\Tasks\At47.job
- %WINDIR%\Tasks\At48.job
- %WINDIR%\Tasks\At46.job
- %WINDIR%\Tasks\At44.job
- %WINDIR%\Tasks\At45.job
- %WINDIR%\Tasks\At52.job
- %WINDIR%\Tasks\At53.job
- %WINDIR%\Tasks\At51.job
- %WINDIR%\Tasks\At49.job
- %WINDIR%\Tasks\At50.job
- %WINDIR%\Tasks\At65.job
- %WINDIR%\Tasks\At80.job
- %WINDIR%\Tasks\At81.job
- %WINDIR%\Tasks\At79.job
- %WINDIR%\Tasks\At77.job
- %WINDIR%\Tasks\At78.job
- %WINDIR%\Tasks\At85.job
- %WINDIR%\Tasks\At86.job
- %WINDIR%\Tasks\At84.job
- %WINDIR%\Tasks\At82.job
- %WINDIR%\Tasks\At83.job
- %WINDIR%\Tasks\At76.job
- %WINDIR%\Tasks\At69.job
- %WINDIR%\Tasks\At70.job
- %WINDIR%\Tasks\At68.job
- %WINDIR%\Tasks\At66.job
- %WINDIR%\Tasks\At67.job
- %WINDIR%\Tasks\At74.job
- %WINDIR%\Tasks\At75.job
- %WINDIR%\Tasks\At73.job
- %WINDIR%\Tasks\At71.job
- %WINDIR%\Tasks\At72.job
- %WINDIR%\Tasks\At15.job
- %WINDIR%\Tasks\At16.job
- %WINDIR%\Tasks\At14.job
- %WINDIR%\Tasks\At12.job
- %WINDIR%\Tasks\At13.job
- %WINDIR%\Tasks\At20.job
- %WINDIR%\Tasks\At21.job
- %WINDIR%\Tasks\At19.job
- %WINDIR%\Tasks\At17.job
- %WINDIR%\Tasks\At18.job
- %WINDIR%\Tasks\At11.job
- %WINDIR%\Tasks\At4.job
- %WINDIR%\Tasks\At5.job
- %WINDIR%\Tasks\At3.job
- %WINDIR%\Tasks\At1.job
- %WINDIR%\Tasks\At2.job
- %WINDIR%\Tasks\At9.job
- %WINDIR%\Tasks\At10.job
- %WINDIR%\Tasks\At8.job
- %WINDIR%\Tasks\At6.job
- %WINDIR%\Tasks\At7.job
- %WINDIR%\Tasks\At22.job
- %WINDIR%\Tasks\At37.job
- %WINDIR%\Tasks\At38.job
- %WINDIR%\Tasks\At36.job
- %WINDIR%\Tasks\At34.job
- %WINDIR%\Tasks\At35.job
- %WINDIR%\Tasks\At42.job
- %WINDIR%\Tasks\At43.job
- %WINDIR%\Tasks\At41.job
- %WINDIR%\Tasks\At39.job
- %WINDIR%\Tasks\At40.job
- %WINDIR%\Tasks\At33.job
- %WINDIR%\Tasks\At26.job
- %WINDIR%\Tasks\At27.job
- %WINDIR%\Tasks\At25.job
- %WINDIR%\Tasks\At23.job
- %WINDIR%\Tasks\At24.job
- %WINDIR%\Tasks\At31.job
- %WINDIR%\Tasks\At32.job
- %WINDIR%\Tasks\At30.job
- %WINDIR%\Tasks\At28.job
- %WINDIR%\Tasks\At29.job
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\at.exe' 00:57 shutdown -s -t 20 -c "TE JODI..... XD"
- '<SYSTEM32>\at.exe' 00:58 shutdown -s -t 20 -c "TE JODI..... XD"
- '<SYSTEM32>\at.exe' 00:56 shutdown -s -t 20 -c "TE JODI..... XD"
- '<SYSTEM32>\at.exe' 00:54 shutdown -s -t 20 -c "TE JODI..... XD"
- '<SYSTEM32>\at.exe' 00:55 shutdown -s -t 20 -c "TE JODI..... XD"
- '<SYSTEM32>\at.exe' 01:02 shutdown -s -t 20 -c "TE JODI..... XD"
- '<SYSTEM32>\at.exe' 01:03 shutdown -s -t 20 -c "TE JODI..... XD"
- '<SYSTEM32>\at.exe' 01:01 shutdown -s -t 20 -c "TE JODI..... XD"
- '<SYSTEM32>\at.exe' 00:59 shutdown -s -t 20 -c "TE JODI..... XD"
- '<SYSTEM32>\at.exe' 01:00 shutdown -s -t 20 -c "TE JODI..... XD"
- '<SYSTEM32>\at.exe' 00:53 shutdown -s -t 20 -c "TE JODI..... XD"
- '<SYSTEM32>\at.exe' 00:46 shutdown -s -t 20 -c "TE JODI..... XD"
- '<SYSTEM32>\at.exe' 00:47 shutdown -s -t 20 -c "TE JODI..... XD"
- '<SYSTEM32>\at.exe' 00:45 shutdown -s -t 20 -c "TE JODI..... XD"
- '<SYSTEM32>\at.exe' 00:43 shutdown -s -t 20 -c "TE JODI..... XD"
- '<SYSTEM32>\at.exe' 00:44 shutdown -s -t 20 -c "TE JODI..... XD"
- '<SYSTEM32>\at.exe' 00:51 shutdown -s -t 20 -c "TE JODI..... XD"
- '<SYSTEM32>\at.exe' 00:52 shutdown -s -t 20 -c "TE JODI..... XD"
- '<SYSTEM32>\at.exe' 00:50 shutdown -s -t 20 -c "TE JODI..... XD"
- '<SYSTEM32>\at.exe' 00:48 shutdown -s -t 20 -c "TE JODI..... XD"
- '<SYSTEM32>\at.exe' 00:49 shutdown -s -t 20 -c "TE JODI..... XD"
- '<SYSTEM32>\at.exe' 01:04 shutdown -s -t 20 -c "TE JODI..... XD"
- '<SYSTEM32>\at.exe' 01:19 shutdown -s -t 20 -c "TE JODI..... XD"
- '<SYSTEM32>\at.exe' 01:20 shutdown -s -t 20 -c "TE JODI..... XD"
- '<SYSTEM32>\at.exe' 01:18 shutdown -s -t 20 -c "TE JODI..... XD"
- '<SYSTEM32>\at.exe' 01:16 shutdown -s -t 20 -c "TE JODI..... XD"
- '<SYSTEM32>\at.exe' 01:17 shutdown -s -t 20 -c "TE JODI..... XD"
- '<SYSTEM32>\at.exe' 01:24 shutdown -s -t 20 -c "TE JODI..... XD"
- '<SYSTEM32>\at.exe' 01:25 shutdown -s -t 20 -c "TE JODI..... XD"
- '<SYSTEM32>\at.exe' 01:23 shutdown -s -t 20 -c "TE JODI..... XD"
- '<SYSTEM32>\at.exe' 01:21 shutdown -s -t 20 -c "TE JODI..... XD"
- '<SYSTEM32>\at.exe' 01:22 shutdown -s -t 20 -c "TE JODI..... XD"
- '<SYSTEM32>\at.exe' 01:15 shutdown -s -t 20 -c "TE JODI..... XD"
- '<SYSTEM32>\at.exe' 01:08 shutdown -s -t 20 -c "TE JODI..... XD"
- '<SYSTEM32>\at.exe' 01:09 shutdown -s -t 20 -c "TE JODI..... XD"
- '<SYSTEM32>\at.exe' 01:07 shutdown -s -t 20 -c "TE JODI..... XD"
- '<SYSTEM32>\at.exe' 01:05 shutdown -s -t 20 -c "TE JODI..... XD"
- '<SYSTEM32>\at.exe' 01:06 shutdown -s -t 20 -c "TE JODI..... XD"
- '<SYSTEM32>\at.exe' 01:13 shutdown -s -t 20 -c "TE JODI..... XD"
- '<SYSTEM32>\at.exe' 01:14 shutdown -s -t 20 -c "TE JODI..... XD"
- '<SYSTEM32>\at.exe' 01:12 shutdown -s -t 20 -c "TE JODI..... XD"
- '<SYSTEM32>\at.exe' 01:10 shutdown -s -t 20 -c "TE JODI..... XD"
- '<SYSTEM32>\at.exe' 01:11 shutdown -s -t 20 -c "TE JODI..... XD"
- '<SYSTEM32>\at.exe' 00:42 shutdown -s -t 20 -c "TE JODI..... XD"
- '<SYSTEM32>\at.exe' 00:13 shutdown -s -t 20 -c "TE JODI..... XD"
- '<SYSTEM32>\at.exe' 00:14 shutdown -s -t 20 -c "TE JODI..... XD"
- '<SYSTEM32>\at.exe' 00:12 shutdown -s -t 20 -c "TE JODI..... XD"
- '<SYSTEM32>\at.exe' 00:10 shutdown -s -t 20 -c "TE JODI..... XD"
- '<SYSTEM32>\at.exe' 00:11 shutdown -s -t 20 -c "TE JODI..... XD"
- '<SYSTEM32>\at.exe' 00:18 shutdown -s -t 20 -c "TE JODI..... XD"
- '<SYSTEM32>\at.exe' 00:19 shutdown -s -t 20 -c "TE JODI..... XD"
- '<SYSTEM32>\at.exe' 00:17 shutdown -s -t 20 -c "TE JODI..... XD"
- '<SYSTEM32>\at.exe' 00:15 shutdown -s -t 20 -c "TE JODI..... XD"
- '<SYSTEM32>\at.exe' 00:16 shutdown -s -t 20 -c "TE JODI..... XD"
- '<SYSTEM32>\at.exe' 00:09 shutdown -s -t 20 -c "TE JODI..... XD"
- '<SYSTEM32>\at.exe' 00:02 shutdown -s -t 20 -c "TE JODI..... XD"
- '<SYSTEM32>\at.exe' 00:03 shutdown -s -t 20 -c "TE JODI..... XD"
- '<SYSTEM32>\at.exe' 00:01 shutdown -s -t 20 -c "TE JODI..... XD"
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\1.tmp\Copia de shutdowner.bat" "
- '<SYSTEM32>\at.exe' 00:00 shutdown -s -t 20 -c "TE JODI..... XD"
- '<SYSTEM32>\at.exe' 00:07 shutdown -s -t 20 -c "TE JODI..... XD"
- '<SYSTEM32>\at.exe' 00:08 shutdown -s -t 20 -c "TE JODI..... XD"
- '<SYSTEM32>\at.exe' 00:06 shutdown -s -t 20 -c "TE JODI..... XD"
- '<SYSTEM32>\at.exe' 00:04 shutdown -s -t 20 -c "TE JODI..... XD"
- '<SYSTEM32>\at.exe' 00:05 shutdown -s -t 20 -c "TE JODI..... XD"
- '<SYSTEM32>\at.exe' 00:20 shutdown -s -t 20 -c "TE JODI..... XD"
- '<SYSTEM32>\at.exe' 00:35 shutdown -s -t 20 -c "TE JODI..... XD"
- '<SYSTEM32>\at.exe' 00:36 shutdown -s -t 20 -c "TE JODI..... XD"
- '<SYSTEM32>\at.exe' 00:34 shutdown -s -t 20 -c "TE JODI..... XD"
- '<SYSTEM32>\at.exe' 00:32 shutdown -s -t 20 -c "TE JODI..... XD"
- '<SYSTEM32>\at.exe' 00:33 shutdown -s -t 20 -c "TE JODI..... XD"
- '<SYSTEM32>\at.exe' 00:40 shutdown -s -t 20 -c "TE JODI..... XD"
- '<SYSTEM32>\at.exe' 00:41 shutdown -s -t 20 -c "TE JODI..... XD"
- '<SYSTEM32>\at.exe' 00:39 shutdown -s -t 20 -c "TE JODI..... XD"
- '<SYSTEM32>\at.exe' 00:37 shutdown -s -t 20 -c "TE JODI..... XD"
- '<SYSTEM32>\at.exe' 00:38 shutdown -s -t 20 -c "TE JODI..... XD"
- '<SYSTEM32>\at.exe' 00:31 shutdown -s -t 20 -c "TE JODI..... XD"
- '<SYSTEM32>\at.exe' 00:24 shutdown -s -t 20 -c "TE JODI..... XD"
- '<SYSTEM32>\at.exe' 00:25 shutdown -s -t 20 -c "TE JODI..... XD"
- '<SYSTEM32>\at.exe' 00:23 shutdown -s -t 20 -c "TE JODI..... XD"
- '<SYSTEM32>\at.exe' 00:21 shutdown -s -t 20 -c "TE JODI..... XD"
- '<SYSTEM32>\at.exe' 00:22 shutdown -s -t 20 -c "TE JODI..... XD"
- '<SYSTEM32>\at.exe' 00:29 shutdown -s -t 20 -c "TE JODI..... XD"
- '<SYSTEM32>\at.exe' 00:30 shutdown -s -t 20 -c "TE JODI..... XD"
- '<SYSTEM32>\at.exe' 00:28 shutdown -s -t 20 -c "TE JODI..... XD"
- '<SYSTEM32>\at.exe' 00:26 shutdown -s -t 20 -c "TE JODI..... XD"
- '<SYSTEM32>\at.exe' 00:27 shutdown -s -t 20 -c "TE JODI..... XD"
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\1.tmp\Copia de shutdowner.bat
