Техническая информация
Для обеспечения автозапуска и распространения:
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Windows MutiMedia Player] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- '%TEMP%\pft3.tmp\Disk1\setup.exe'
- '%PROGRAM_FILES%\Windows Media Player\winmmp32.exe' -i <Полный путь к вирусу> C:\DOCUME~1\%USERNAME%\LOCALS~1\Temp\TMP20130627172940MediaVAMP_v1182_installer.exe
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\DotD.tmp
- %CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\iKeC.tmp
- %CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\ctoE.tmp
- %CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\ius10.tmp
- %CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\iscF.tmp
- %TEMP%\isp8.tmp\temp.000
- %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\10092c882e91d6f17883c1e9c25cfdf7_23ef5514-3059-436f-a4a7-4cefaab20eb1
- %TEMP%\_isdelet.ini
- %TEMP%\igdA.tmp
- %TEMP%\_seB.tmp
- %CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\isp9.tmp\temp.000
- %TEMP%\{E64B449F-0911-47D6-A578-AA777AC2AA96}\{317D28B8-FD79-4E55-BF5D-40F3A3B3BFC4}\Stri762b.rra
- %TEMP%\{E64B449F-0911-47D6-A578-AA777AC2AA96}\core760c.rra
- %TEMP%\{E64B449F-0911-47D6-A578-AA777AC2AA96}\{317D28B8-FD79-4E55-BF5D-40F3A3B3BFC4}\isrt764a.rra
- %TEMP%\{E64B449F-0911-47D6-A578-AA777AC2AA96}\{317D28B8-FD79-4E55-BF5D-40F3A3B3BFC4}\_IsR76e6.rra
- %TEMP%\{E64B449F-0911-47D6-A578-AA777AC2AA96}\{317D28B8-FD79-4E55-BF5D-40F3A3B3BFC4}\defa76a8.rra
- %TEMP%\{E64B449F-0911-47D6-A578-AA777AC2AA96}\{317D28B8-FD79-4E55-BF5D-40F3A3B3BFC4}\lice75dd.rra
- %CommonProgramFiles%\InstallShield\Professional\RunTime\IsProBE.tlb
- %CommonProgramFiles%\InstallShield\Professional\RunTime\IsP11.tmp
- %CommonProgramFiles%\InstallShield\Professional\RunTime\iKernel.rgs
- %TEMP%\{E64B449F-0911-47D6-A578-AA777AC2AA96}\{317D28B8-FD79-4E55-BF5D-40F3A3B3BFC4}\setu75ae.rra
- %CommonProgramFiles%\InstallShield\Professional\RunTime\Obj12.tmp
- %CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\isp6.tmp\temp.000
- %TEMP%\pft3.tmp\Disk1\setup.boot
- %TEMP%\pft3.tmp\Disk1\engine32.cab
- %TEMP%\pft3.tmp\Disk1\data1.hdr
- %TEMP%\pft3.tmp\Disk1\data2.cab
- %TEMP%\pft3.tmp\Disk1\data1.cab
- %TEMP%\pft3.tmp\pftw1.pkg
- %PROGRAM_FILES%\Windows Media Player\winmmp32.exe
- %TEMP%\TMP20130627172940MediaVAMP_v1182_installer.exe
- <Полный путь к вирусу>
- %TEMP%\plf1.tmp
- %TEMP%\ext2.tmp
- %APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\bc964d6b-dbc8-4d4a-801f-8d0918f96c32
- %APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\Preferred
- %TEMP%\set7.tmp
- %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\94ca9267a2245fc7f002f7f94362dd6e_23ef5514-3059-436f-a4a7-4cefaab20eb1
- %TEMP%\isp4.tmp\temp.000
- %TEMP%\pft3.tmp\Disk1\setup.ini
- %TEMP%\pft3.tmp\Disk1\setup.exe
- %TEMP%\pft3.tmp\Disk1\setup.inx
- %TEMP%\set5.tmp
- %TEMP%\pft3.tmp\Disk1\layout.bin
Удаляет следующие файлы:
- %TEMP%\igdA.tmp
- %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\94ca9267a2245fc7f002f7f94362dd6e_23ef5514-3059-436f-a4a7-4cefaab20eb1
- %CommonProgramFiles%\InstallShield\Professional\RunTime\IsP11.tmp
- %TEMP%\_seB.tmp
- %TEMP%\set7.tmp
- %TEMP%\TMP20130627172940MediaVAMP_v1182_installer.exe
- %TEMP%\ext2.tmp
- %TEMP%\set5.tmp
- %TEMP%\pft3.tmp\pftw1.pkg
Перемещает следующие файлы:
- %TEMP%\{E64B449F-0911-47D6-A578-AA777AC2AA96}\{317D28B8-FD79-4E55-BF5D-40F3A3B3BFC4}\setu75ae.rra в %TEMP%\{E64B449F-0911-47D6-A578-AA777AC2AA96}\{317D28B8-FD79-4E55-BF5D-40F3A3B3BFC4}\setup.inx
- %TEMP%\{E64B449F-0911-47D6-A578-AA777AC2AA96}\{317D28B8-FD79-4E55-BF5D-40F3A3B3BFC4}\lice75dd.rra в %TEMP%\{E64B449F-0911-47D6-A578-AA777AC2AA96}\{317D28B8-FD79-4E55-BF5D-40F3A3B3BFC4}\license.txt
- %CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\ius10.tmp в %CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\iuser.dll
- %CommonProgramFiles%\InstallShield\Professional\RunTime\Obj12.tmp в %CommonProgramFiles%\InstallShield\Professional\RunTime\Objectps.dll
- %TEMP%\{E64B449F-0911-47D6-A578-AA777AC2AA96}\core760c.rra в %TEMP%\{E64B449F-0911-47D6-A578-AA777AC2AA96}\corecomp.ini
- %TEMP%\{E64B449F-0911-47D6-A578-AA777AC2AA96}\{317D28B8-FD79-4E55-BF5D-40F3A3B3BFC4}\defa76a8.rra в %TEMP%\{E64B449F-0911-47D6-A578-AA777AC2AA96}\{317D28B8-FD79-4E55-BF5D-40F3A3B3BFC4}\default.pal
- %TEMP%\{E64B449F-0911-47D6-A578-AA777AC2AA96}\{317D28B8-FD79-4E55-BF5D-40F3A3B3BFC4}\_IsR76e6.rra в %TEMP%\{E64B449F-0911-47D6-A578-AA777AC2AA96}\{317D28B8-FD79-4E55-BF5D-40F3A3B3BFC4}\_IsRes.dll
- %TEMP%\{E64B449F-0911-47D6-A578-AA777AC2AA96}\{317D28B8-FD79-4E55-BF5D-40F3A3B3BFC4}\Stri762b.rra в %TEMP%\{E64B449F-0911-47D6-A578-AA777AC2AA96}\{317D28B8-FD79-4E55-BF5D-40F3A3B3BFC4}\StringTable-0012-Korean.ips
- %TEMP%\{E64B449F-0911-47D6-A578-AA777AC2AA96}\{317D28B8-FD79-4E55-BF5D-40F3A3B3BFC4}\isrt764a.rra в %TEMP%\{E64B449F-0911-47D6-A578-AA777AC2AA96}\{317D28B8-FD79-4E55-BF5D-40F3A3B3BFC4}\isrt.dll
- %CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\iscF.tmp в %CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\iscript.dll
- %CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\isp6.tmp\Setup.dll в %CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\Setup.dll
- %CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\isp9.tmp\temp.000 в %CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\isp9.tmp\IGdi.dll
- %TEMP%\isp4.tmp\temp.000 в %TEMP%\isp4.tmp\Setup.dll
- %CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\isp6.tmp\temp.000 в %CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\isp6.tmp\Setup.dll
- %CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\isp9.tmp\IGdi.dll в %CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\IGdi.dll
- %CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\DotD.tmp в %CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\DotNetInstaller.exe
- %CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\ctoE.tmp в %CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\ctor.dll
- %TEMP%\isp8.tmp\temp.000 в %TEMP%\isp8.tmp\_Setup.dll
- %CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\iKeC.tmp в %CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\iKernel.dll
Самоудаляется.
Сетевая активность:
Подключается к:
- 'localhost':1038
- 'co##.com':8090
UDP:
- DNS ASK co##.com
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'MS_WINHELP' WindowName: '(null)'
