Техническая информация
Вредоносные функции
Для затруднения выявления своего присутствия в системе
блокирует запуск следующих системных утилит:
- Диспетчера задач (Taskmgr)
Читает файлы, отвечающие за хранение паролей сторонними программами
- %HOMEPATH%\desktop\508softwareandos.doc
- %HOMEPATH%\desktop\contoso_1.cer
- %HOMEPATH%\desktop\dashborder_120.bmp
- %HOMEPATH%\desktop\dial.bmp
- %HOMEPATH%\desktop\dialmap.bmp
- %HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx
- %HOMEPATH%\desktop\join.avi
- %HOMEPATH%\desktop\pmd.cer
- %HOMEPATH%\desktop\testcertificate.cer
- %HOMEPATH%\desktop\testee.cer
- %HOMEPATH%\desktop\tileimage.bmp
- %APPDATA%\thunderbird\profiles.ini
- %APPDATA%\mozilla\firefox\profiles.ini
Изменения в файловой системе
Создает следующие файлы
- %HOMEPATH%\ntuser.ini.slank
- %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\sitesecurityservicestate.txt.slank
- %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\sessioncheckpoints.json.slank
- %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\securitypreloadstate.txt.slank
- %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\search.json.mozlz4.slank
- %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\prefs.js.slank
- %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\places.sqlite.slank
- %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\pkcs11.txt.slank
- %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\permissions.sqlite.slank
- %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\parent.lock.slank
- %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\openpgp.sqlite.slank
- %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\global-messages-db.sqlite.slank
- %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\times.json.slank
- %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\formhistory.sqlite.slank
- %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\favicons.sqlite.slank
- %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\extensions.json.slank
- %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\extension-preferences.json.slank
- %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\enigmail.sqlite.slank
- %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\directorytree.json.slank
- %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\cookies.sqlite.slank
- %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\compatibility.ini.slank
- %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\blist.sqlite.slank
- %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\history.sqlite.slank
- %HOMEPATH%\desktop\dial.bmp.slank
- %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\webappsstore.sqlite.slank
- %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\broadcast-listeners.json.slank
- %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\alternateservices.txt.slank
- %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\addonstartup.json.lz4.slank
- %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\addons.json.slank
- %APPDATA%\mozilla\firefox\profiles.ini.slank
- %APPDATA%\mozilla\firefox\installs.ini.slank
- %APPDATA%\telegram desktop\updater.exe.slank
- %APPDATA%\telegram desktop\unins000.exe.slank
- %APPDATA%\telegram desktop\telegram.exe.slank
- %APPDATA%\thunderbird\crash reports\installtime20210406220621.slank
- %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\alternateservices.txt.slank
- %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\storage.sqlite.slank
- %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\datareporting\archived\2022-09\1664411764036.a6077284-6dcc-4781-9fb7-7f9d7b5132bf.first-shutdown.jsonlz4.slank
- %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\datareporting\archived\2022-09\1664411764034.d092fa80-6cc0-49cc-9da4-f67b3d6cdc55.main.jsonlz4.slank
- %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\datareporting\archived\2022-09\1664411763506.e60182f3-3480-48d0-bc12-b3b897042a6b.new-profile.jsonlz4.slank
- %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\datareporting\state.json.slank
- %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\datareporting\session-state.json.slank
- %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\saved-telemetry-pings\e60182f3-3480-48d0-bc12-b3b897042a6b.slank
- %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\saved-telemetry-pings\d092fa80-6cc0-49cc-9da4-f67b3d6cdc55.slank
- %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\saved-telemetry-pings\a6077284-6dcc-4781-9fb7-7f9d7b5132bf.slank
- %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite.slank
- %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\storage\permanent\chrome\.metadata-v2.slank
- %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\crashes\store.json.mozlz4.slank
- %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\xulstore.json.slank
- %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\addonstartup.json.lz4.slank
- %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\addons.json.slank
- %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\abook.sqlite.slank
- %HOMEPATH%\favorites\windows live\get windows live.url.slank
- %HOMEPATH%\favorites\microsoft websites\ie add-on site.url.slank
- %HOMEPATH%\favorites\msn websites\msnbc news.url.slank
- %HOMEPATH%\favorites\msn websites\msn.url.slank
- %HOMEPATH%\favorites\msn websites\msn sports.url.slank
- %HOMEPATH%\favorites\msn websites\msn money.url.slank
- %HOMEPATH%\favorites\msn websites\msn entertainment.url.slank
- %HOMEPATH%\favorites\msn websites\msn autos.url.slank
- %HOMEPATH%\favorites\windows live\windows live spaces.url.slank
- %HOMEPATH%\favorites\windows live\windows live mail.url.slank
- %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\compatibility.ini.slank
- %HOMEPATH%\favorites\microsoft websites\microsoft at home.url.slank
- %HOMEPATH%\favorites\desktop.ini.slank
- %HOMEPATH%\links\recentplaces.lnk.slank
- %HOMEPATH%\links\downloads.lnk.slank
- %HOMEPATH%\links\desktop.lnk.slank
- %HOMEPATH%\links\desktop.ini.slank
- %HOMEPATH%\music\desktop.ini.slank
- %HOMEPATH%\pictures\desktop.ini.slank
- %HOMEPATH%\saved games\desktop.ini.slank
- %HOMEPATH%\searches\desktop.ini.slank
- %HOMEPATH%\videos\desktop.ini.slank
- %HOMEPATH%\favorites\windows live\windows live gallery.url.slank
- %APPDATA%\thunderbird\profiles\49zr3fqa.default\times.json.slank
- %HOMEPATH%\favorites\microsoft websites\microsoft at work.url.slank
- %HOMEPATH%\favorites\links for united states\gobiernousa.gov.url.slank
- %HOMEPATH%\favorites\microsoft websites\microsoft store.url.slank
- %APPDATA%\thunderbird\profiles.ini.slank
- %APPDATA%\thunderbird\installs.ini.slank
- %HOMEPATH%\contacts\user.contact.slank
- %HOMEPATH%\contacts\desktop.ini.slank
- %HOMEPATH%\desktop\wrar520.exe.slank
- %HOMEPATH%\desktop\telegram.lnk.slank
- %HOMEPATH%\desktop\skypesetup.exe.slank
- %HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx.slank
- %HOMEPATH%\desktop\google chrome.lnk.slank
- %HOMEPATH%\favorites\links for united states\desktop.ini.slank
- %HOMEPATH%\desktop\dotnetfx45_full_setup.exe.slank
- %HOMEPATH%\favorites\microsoft websites\ie site on microsoft.com.url.slank
- %HOMEPATH%\desktop\desktop.ini.slank
- %HOMEPATH%\desktop\dashborder_120.bmp.slank
- %HOMEPATH%\desktop\contoso_1.cer.slank
- %HOMEPATH%\desktop\508softwareandos.doc.slank
- %HOMEPATH%\documents\desktop.ini.slank
- %HOMEPATH%\downloads\desktop.ini.slank
- %HOMEPATH%\favorites\links\web slice gallery.url.slank
- %HOMEPATH%\favorites\links\desktop.ini.slank
- %HOMEPATH%\favorites\links for united states\usa.gov.url.slank
- %HOMEPATH%\desktop\dialmap.bmp.slank
- %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\containers.json.slank
Изменяет расширения файлов пользовательских данных (Trojan.Encoder).
Другое
Создает и запускает на исполнение
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f' (со скрытым окном)
Запускает на исполнение
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
