Техническая информация
Для обеспечения автозапуска и распространения
Модифицирует следующие ключи реестра
- [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] 'SecurityUpdate' = '%TEMP%\0A4897.exe'
Вредоносные функции
Завершает или пытается завершить
следующие пользовательские процессы:
- firefox.exe
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\0a4897.exe
- C:\users\public\pictures\sample pictures\readme_for_unlock.txt
- C:\users\public\music\sample music\readme_for_unlock.txt
- C:\users\public\libraries\readme_for_unlock.txt
- C:\users\public\favorites\readme_for_unlock.txt
- C:\users\public\downloads\readme_for_unlock.txt
- C:\users\public\documents\my videos\readme_for_unlock.txt
- C:\users\public\documents\my pictures\readme_for_unlock.txt
- C:\users\public\documents\my music\readme_for_unlock.txt
- C:\users\public\documents\readme_for_unlock.txt
- C:\users\public\desktop\readme_for_unlock.txt
- C:\users\public\readme_for_unlock.txt
- C:\users\public\recorded tv\readme_for_unlock.txt
- C:\users\default\templates\readme_for_unlock.txt
- C:\users\default\sendto\readme_for_unlock.txt
- C:\users\default\saved games\readme_for_unlock.txt
- C:\users\default\recent\readme_for_unlock.txt
- C:\users\default\printhood\readme_for_unlock.txt
- C:\users\default\nethood\readme_for_unlock.txt
- C:\users\default\links\readme_for_unlock.txt
- C:\users\default\favorites\readme_for_unlock.txt
- C:\users\default\downloads\readme_for_unlock.txt
- C:\users\default\documents\my videos\readme_for_unlock.txt
- C:\users\default\documents\my pictures\readme_for_unlock.txt
- C:\users\default\documents\my music\readme_for_unlock.txt
- C:\users\default\start menu\readme_for_unlock.txt
- %HOMEPATH%\favorites\links for united states\readme_for_unlock.txt
- %HOMEPATH%\voip\readme_for_unlock.txt
- %HOMEPATH%\readme_for_unlock.txt
- %HOMEPATH%\templates\readme_for_unlock.txt
- %HOMEPATH%\start menu\readme_for_unlock.txt
- %HOMEPATH%\sendto\readme_for_unlock.txt
- %HOMEPATH%\searches\readme_for_unlock.txt
- %HOMEPATH%\saved games\readme_for_unlock.txt
- %HOMEPATH%\recent\readme_for_unlock.txt
- %HOMEPATH%\printhood\readme_for_unlock.txt
- %HOMEPATH%\nethood\readme_for_unlock.txt
- %HOMEPATH%\links\readme_for_unlock.txt
- %HOMEPATH%\favorites\windows live\readme_for_unlock.txt
- %HOMEPATH%\favorites\msn websites\readme_for_unlock.txt
- C:\users\default\documents\readme_for_unlock.txt
- %HOMEPATH%\favorites\microsoft websites\readme_for_unlock.txt
- %HOMEPATH%\favorites\links\readme_for_unlock.txt
- %HOMEPATH%\favorites\readme_for_unlock.txt
- %HOMEPATH%\downloads\readme_for_unlock.txt
- %HOMEPATH%\documents\my videos\readme_for_unlock.txt
- %HOMEPATH%\documents\my pictures\readme_for_unlock.txt
- %HOMEPATH%\documents\my music\readme_for_unlock.txt
- %HOMEPATH%\documents\readme_for_unlock.txt
- %HOMEPATH%\desktop\readme_for_unlock.txt
- %HOMEPATH%\cookies\readme_for_unlock.txt
- %HOMEPATH%\contacts\readme_for_unlock.txt
- %HOMEPATH%\application data\readme_for_unlock.txt
- C:\users\public\recorded tv\sample media\readme_for_unlock.txt
- C:\users\public\videos\sample videos\readme_for_unlock.txt
- C:\users\default\desktop\readme_for_unlock.txt
- C:\far2\plugins\brackets\readme_for_unlock.txt
- C:\far2\plugins\align\readme_for_unlock.txt
- C:\far2\plugins\readme_for_unlock.txt
- C:\far2\fexcept\readme_for_unlock.txt
- C:\far2\encyclopedia\tap\readme_for_unlock.txt
- C:\far2\encyclopedia\readme_for_unlock.txt
- C:\far2\documentation\rus\readme_for_unlock.txt
- C:\far2\documentation\eng\readme_for_unlock.txt
- C:\far2\documentation\readme_for_unlock.txt
- C:\far2\addons\xlat\russian\readme_for_unlock.txt
- C:\far2\addons\xlat\readme_for_unlock.txt
- C:\far2\addons\shell\readme_for_unlock.txt
- C:\far2\plugins\arclite\readme_for_unlock.txt
- C:\far2\addons\setup\readme_for_unlock.txt
- C:\far2\addons\colors\default_highlighting\readme_for_unlock.txt
- C:\far2\addons\colors\custom_highlighting\readme_for_unlock.txt
- C:\far2\addons\colors\readme_for_unlock.txt
- C:\far2\addons\readme_for_unlock.txt
- C:\far2\readme_for_unlock.txt
- C:\documents and settings\readme_for_unlock.txt
- C:\readme_for_unlock.txt
- %TEMP%\readme_for_unlock.txt
- %TEMP%\readme_for_unlock.txt.crypt
- <Текущая директория>\5y9i1p2h1.tmp
- %ALLUSERSPROFILE%\microsoft\settings\8d3j3g0u0.bat
- C:\far2\addons\macros\readme_for_unlock.txt
- C:\far2\plugins\tmppanel\readme_for_unlock.txt
- C:\users\default\application data\readme_for_unlock.txt
- C:\far2\plugins\compare\readme_for_unlock.txt
- C:\users\default\readme_for_unlock.txt
- C:\totalcmd\language\readme_for_unlock.txt
- C:\totalcmd\readme_for_unlock.txt
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\readme_for_unlock.txt
- C:\recovery\readme_for_unlock.txt
- nul
- C:\perflogs\admin\readme_for_unlock.txt
- C:\perflogs\readme_for_unlock.txt
- C:\msocache\readme_for_unlock.txt
- C:\far2\pluginsdk\headers.pas\readme_for_unlock.txt
- C:\far2\pluginsdk\headers.c\readme_for_unlock.txt
- C:\users\default\cookies\readme_for_unlock.txt
- C:\far2\pluginsdk\readme_for_unlock.txt
- C:\far2\plugins\proclist\readme_for_unlock.txt
- C:\far2\plugins\network\readme_for_unlock.txt
- C:\far2\plugins\macroview\readme_for_unlock.txt
- C:\far2\plugins\hlfviewer\readme_for_unlock.txt
- C:\far2\plugins\ftp\lib\readme_for_unlock.txt
- C:\far2\plugins\ftp\readme_for_unlock.txt
- C:\far2\plugins\filecase\readme_for_unlock.txt
- C:\far2\plugins\farcmds\readme_for_unlock.txt
- C:\far2\plugins\emenu\readme_for_unlock.txt
- C:\far2\plugins\editcase\readme_for_unlock.txt
- C:\far2\plugins\drawline\readme_for_unlock.txt
- C:\far2\plugins\autowrap\readme_for_unlock.txt
- <Текущая директория>\readme_for_unlock.txt
Удаляет следующие файлы
- <Текущая директория>\5y9i1p2h1.tmp
Изменяет следующие файлы
- C:\far2\addons\colors\custom_highlighting\black_from_july.reg.dnt
- C:\far2\addons\colors\default_highlighting\rodion_doroshkevich.reg.dnt
- C:\far2\addons\colors\default_highlighting\vaxcolors.reg.dnt
- C:\far2\addons\colors\default_highlighting\nc5pal2.reg.dnt
- C:\far2\addons\colors\default_highlighting\hell.reg.dnt
- C:\far2\addons\colors\default_highlighting\greenmile.reg.dnt
- C:\far2\addons\colors\default_highlighting\farcolors242.reg.dnt
- C:\far2\addons\colors\default_highlighting\dn_like.reg.dnt
- C:\far2\addons\colors\default_highlighting\descript.ion.dnt
- C:\far2\addons\colors\default_highlighting\colors_from_admin_essp_ru.reg.dnt
- C:\far2\addons\colors\default_highlighting\colors_from_sadovoj.reg.dnt
- C:\far2\addons\colors\default_highlighting\colors_from_gernichenko.reg.dnt
- C:\far2\addons\colors\default_highlighting\black_from_july.reg.dnt
- C:\far2\addons\colors\default_highlighting\black_from_myodov.reg.dnt
- C:\far2\addons\colors\default_highlighting\black_from_fonarev.reg.dnt
- C:\far2\addons\colors\custom_highlighting\vaxcolors.reg.dnt
- C:\far2\addons\colors\custom_highlighting\rodion_doroshkevich.reg.dnt
- C:\far2\addons\colors\custom_highlighting\nc5pal2.reg.dnt
- C:\far2\addons\colors\custom_highlighting\hell.reg.dnt
- C:\far2\addons\colors\custom_highlighting\greenmile.reg.dnt
- C:\far2\addons\colors\custom_highlighting\farcolors242.reg.dnt
- C:\far2\addons\colors\custom_highlighting\dn_like.reg.dnt
- C:\far2\addons\colors\custom_highlighting\descript.ion.dnt
- C:\far2\addons\colors\custom_highlighting\colors_from_sadovoj.reg.dnt
- C:\far2\addons\colors\custom_highlighting\colors_from_gernichenko.reg.dnt
- C:\far2\addons\colors\custom_highlighting\colors_from_admin_essp_ru.reg.dnt
- C:\far2\addons\colors\custom_highlighting\black_from_myodov.reg.dnt
- C:\far2\addons\colors\custom_highlighting\black_from_fonarev.reg.dnt
- C:\far2\addons\colors\descript.ion.dnt
- C:\far2\addons\descript.ion.dnt
Изменяет множество файлов.
Подменяет следующие файлы
- %HOMEPATH%\ntuser.pol
- %HOMEPATH%\Searches\Everywhere.search-ms
- %HOMEPATH%\Searches\Indexed Locations.search-ms
Самоудаляется.
Изменяет расширения файлов пользовательских данных (Trojan.Encoder).
Другое
Создает и запускает на исполнение
- '%TEMP%\0a4897.exe'
- '%TEMP%\0a4897.exe' ' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c %ALLUSERSPROFILE%\Microsoft\Settings\8d3J3g0u0.bat' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' 䌀/c START /b "" cmd /c DEL "<Полный путь к файлу>" &EXIT' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c net config server /autodisconnect:-1' (со скрытым окном)
Запускает на исполнение
- '<SYSTEM32>\cmd.exe' /c reg add hklm\Software\Microsoft\Windows\CurrentVersion\Run /v SecurityUpdate /t REG_EXPAND_SZ /d %TEMP%\0A4897.exe /f
- '<SYSTEM32>\cmd.exe' /c %ALLUSERSPROFILE%\Microsoft\Settings\8d3J3g0u0.bat
- '<SYSTEM32>\cmd.exe' 䌀/c START /b "" cmd /c DEL "<Полный путь к файлу>" &EXIT
- '<SYSTEM32>\reg.exe' add hklm\Software\Microsoft\Windows\CurrentVersion\Run /v SecurityUpdate /t REG_EXPAND_SZ /d %TEMP%\0A4897.exe /f
- '<SYSTEM32>\tasklist.exe'
- '<SYSTEM32>\findstr.exe' /B /L /I /C:0A4897.exe
- '<SYSTEM32>\cmd.exe' /c DEL "<Полный путь к файлу>"
- '<SYSTEM32>\cmd.exe' /c net config server /autodisconnect:-1
- '<SYSTEM32>\net.exe' config server /autodisconnect:-1
- '<SYSTEM32>\net1.exe' config server /autodisconnect:-1
- '<SYSTEM32>\timeout.exe' /T 1 /NOBREAK
