Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004] 'PackedCatalogItem' = '{43,3a,5c,57,49,4e,44,4f,57,53,5c,73,79,73,74,65,6d,33,32,5c,68,61,72,64,70,6f,6c,5c,68,61,72,64,70,6f,6c,2e,64,6c,6c,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,02,20,00,00,10,00,00,00,00,00,00,09,26,02,00,00,00,00,00,00,00,00,00,00,00,00,00,08,00,00,00,e0,a9,60,9d,7a,33,d0,11,bd,88,00,00,c0,82,e6,9a,ec,03,00,00,01,00,00,00,84,f8,97,01,7c,f8,97,01,88,f9,97,01,04,a4,60,75,b0,0b,00,00,a0,3c,5f,75,b0,f9,97,01,06,00,00,00,02,00,00,00,10,00,00,00,10,00,00,00,02,00,00,00,11,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,bb,ff,00,00,00,00,00,00,52,00,53,00,56,00,50,00,20,00,55,00,44,00,50,00,20,00,53,00,65,00,72,00,76,00,69,00,63,00,65,00,20,00,50,00,72,00,6f,00,76,00,69,00,64,00,65,00,72,00,00,00,01,00,00,00,e4,fb,97,01,01,00,00,00,10,8e,dc,02,00,00,00,00,3d,fb,90,7c,80,f9,97,01,00,00,00,00,00,f9,97,01,6c,fb,90,7c,71,fb,90,7c,00,00,00,00,80,f9,97,01,3d,fb,90,7c,dc,f8,97,01,2c,f9,97,01,48,f9,97,01,18,ee,90,7c,78,fb,90,7c,ff,ff,ff,ff,71,fb,90,7c,18,6a,dd,77,51,6a,dd,77,b8,3c,5f,75,d4,0b,00,00,d4,0b,00,00,88,01,1c,00,d4,0b,00,00,80,f9,97,01,40,00,00,00,00,00,00,00,00,00,00,00,08,00,08,00,b8,3c,5f,75,5c,00,44,00,65,00,76,00,69,00,63,00,65,00,5c,00,4e,00,65,00,74,00,42,00,54,00,5f,00,54,00,63,00,70,00,69,00,70,00,00,00,96,15,91,7c,eb,06,91,7c,0e,00,07,80,4c,2f,06,01,60,a5,06,01,19,00,02,00,28,fa,97,01,0c,00,00,00,08,00,08,00,40,04,00,00,a8,f9,97,01,fe,a4,60,75,b0,0b,00,00,a0,3c,5f,75,b0,f9,97,01,92,d5,90,7c,cc,6b,dd,77,d4,0b,00,00,00,00,00,00,b8,f9,97,01,74,6c,dd,77,c0,f9,97,01,40,fc,97,01,07,89,61,75,00,00,00,00,60,a5,06,01,00,00,00,00,b2,8a,61,75,5e,6b,dd,77,a8,04,00,00,f4,f9,97,01,00,00,00,00,19,00,02,00,48,fa,97,01,b8,8d,5f,75,48,fa,97,01,00,00,00,00,00,00,c3,00,a0,0f,00,00,96,15,91,7c,eb,06,91,7c,01,00,00,00,a0,0f,00,00,96,15,91,7c,eb,06,91,7c,00,00,00,00,00,00,00,00,58,00,00,00,eb,06,91,7c,01,00,00,00,58,fd,97,01,01,00,00,00,00,00,00,00,28,00,00,00,b8,e0,1f,01,d4,f1,97,01,00,00,00,00,88,8f,f2,02,68,fa,ce,01,00,00,00,00,00,00,00,00,45,00,4d,00,5c,00,43,00,75,00,72,00,72,00,65,00,0c,00,00,00,1c,00,00,00,88,01,1c,00,a0,0f,00,00,01,00,00,00,96,15,91,7c}'
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005] 'PackedCatalogItem' = '{43,3a,5c,57,49,4e,44,4f,57,53,5c,73,79,73,74,65,6d,33,32,5c,68,61,72,64,70,6f,6c,5c,68,61,72,64,70,6f,6c,2e,64,6c,6c,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,02,20,00,00,10,00,00,00,00,00,00,66,20,02,00,00,00,00,00,00,00,00,00,00,00,00,00,08,00,00,00,e0,a9,60,9d,7a,33,d0,11,bd,88,00,00,c0,82,e6,9a,ed,03,00,00,01,00,00,00,88,01,1c,00,00,00,1c,00,00,00,c3,00,00,00,00,00,08,e3,1f,01,78,01,1c,00,99,00,00,00,06,00,00,00,02,00,00,00,10,00,00,00,10,00,00,00,01,00,00,00,06,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,52,00,53,00,56,00,50,00,20,00,54,00,43,00,50,00,20,00,53,00,65,00,72,00,76,00,69,00,63,00,65,00,20,00,50,00,72,00,6f,00,76,00,69,00,64,00,65,00,72,00,00,00,88,01,1c,00,00,00,00,00,10,00,00,00,50,fb,97,01,b8,44,64,75,78,01,1c,00,90,8f,f2,02,7c,fb,97,01,f4,fb,97,01,0c,00,00,00,08,00,00,00,60,fb,97,01,00,00,1c,00,08,00,00,00,00,00,1c,00,00,00,c3,00,00,00,00,00,3c,fc,97,01,5c,0d,91,7c,00,00,1c,00,91,0e,91,7c,08,06,1c,00,6d,05,91,7c,68,aa,db,02,00,00,00,00,68,aa,db,02,00,00,c3,00,a0,e0,1f,01,60,aa,db,02,02,00,00,00,d0,b8,d9,02,60,fa,ce,01,0b,6e,60,75,68,aa,db,02,d8,01,1c,00,08,e3,1f,01,68,fa,ce,01,00,00,00,00,78,01,1c,00,d8,01,1c,00,10,e3,1f,01,10,00,00,00,28,06,e8,02,0c,00,00,00,78,01,1c,00,00,00,00,00,60,00,00,00,88,01,1c,00,00,00,00,00,10,00,00,00,60,aa,db,02,30,06,e8,02,00,00,00,00,61,a8,91,7c,02,00,00,00,7c,aa,db,02,00,00,1c,00,00,00,1c,00,84,aa,db,02,60,00,00,00,00,00,1c,00,98,e0,1f,01,08,e3,1f,01,3c,fc,97,01,46,0f,91,7c,99,00,00,00,08,e3,1f,01,00,00,1c,00,98,e0,1f,01,00,00,1c,00,00,00,1c,00,78,01,1c,00,10,fd,97,01,91,0e,91,7c,08,06,1c,00,6d,05,91,7c,24,8f,f2,02,00,00,00,00,f8,8b,f2,02,00,00,c3,00,c0,d7,dd,77,98,e0,1f,01,78,01,1c,00,00,00,00,00,a0,e0,1f,01,00,00,00,00,00,00,00,00,00,00,00,00,78,01,1c,00,00,00,00,00,28,06,e8,02,dc,fc,97,01,9d,d8,dd,77,b0,0b,00,00,b8,fc,97,01,03,00,00,00,a0,e0,1f,01,af,d8,dd,77,30,06,e8,02,70,02,00,00,f8,8b,f2,02,0c,00,0e,00,3c,56,5f,75,00,00,00,00,ac,fc,97,01,f8,8b,f2,02,00,00,00,00,24,8f,f2,02,04,fd,97,01,6c,fb,90,7c,71,fb,90,7c,24,8f,f2,02,00,00,00,00,f8,8b,f2,02,e0,fc,97,01}'
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003] 'PackedCatalogItem' = '{43,3a,5c,57,49,4e,44,4f,57,53,5c,73,79,73,74,65,6d,33,32,5c,68,61,72,64,70,6f,6c,5c,68,61,72,64,70,6f,6c,2e,64,6c,6c,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,02,20,00,00,10,00,00,00,00,00,00,09,06,02,00,00,00,00,00,00,00,00,00,00,00,00,00,0c,00,00,00,a0,1a,0f,e7,8b,ab,cf,11,8c,a3,00,80,5f,48,a1,92,eb,03,00,00,01,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,02,00,00,00,02,00,00,00,10,00,00,00,10,00,00,00,03,00,00,00,00,00,00,00,ff,00,00,00,00,00,00,00,00,00,00,00,bb,ff,00,00,00,00,00,00,4d,00,53,00,41,00,46,00,44,00,20,00,54,00,63,00,70,00,69,00,70,00,20,00,5b,00,52,00,41,00,57,00,2f,00,49,00,50,00,5d,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00}'
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001] 'PackedCatalogItem' = '{43,3a,5c,57,49,4e,44,4f,57,53,5c,73,79,73,74,65,6d,33,32,5c,68,61,72,64,70,6f,6c,5c,68,61,72,64,70,6f,6c,2e,64,6c,6c,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,02,20,00,00,10,00,00,00,00,00,00,66,00,02,00,00,00,00,00,00,00,00,00,00,00,00,00,08,00,00,00,a0,1a,0f,e7,8b,ab,cf,11,8c,a3,00,80,5f,48,a1,92,e9,03,00,00,01,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,02,00,00,00,02,00,00,00,10,00,00,00,10,00,00,00,01,00,00,00,06,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,4d,00,53,00,41,00,46,00,44,00,20,00,54,00,63,00,70,00,69,00,70,00,20,00,5b,00,54,00,43,00,50,00,2f,00,49,00,50,00,5d,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00}'
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002] 'PackedCatalogItem' = '{43,3a,5c,57,49,4e,44,4f,57,53,5c,73,79,73,74,65,6d,33,32,5c,68,61,72,64,70,6f,6c,5c,68,61,72,64,70,6f,6c,2e,64,6c,6c,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,02,20,00,00,10,00,00,00,00,00,00,09,06,02,00,00,00,00,00,00,00,00,00,00,00,00,00,08,00,00,00,a0,1a,0f,e7,8b,ab,cf,11,8c,a3,00,80,5f,48,a1,92,ea,03,00,00,01,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,02,00,00,00,02,00,00,00,10,00,00,00,10,00,00,00,02,00,00,00,11,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,bb,ff,00,00,00,00,00,00,4d,00,53,00,41,00,46,00,44,00,20,00,54,00,63,00,70,00,69,00,70,00,20,00,5b,00,55,00,44,00,50,00,2f,00,49,00,50,00,5d,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00}'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\NetHomeIDE] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- '%PROGRAM_FILES%\baidu\msfsg.exe' uncompress -s dsop7.xml -d setup959554.exe
- '%PROGRAM_FILES%\baidu\ipseccmd.exe' -p Block0 -r Block0 -f 118.145.31.*+0 -n BLOCK -x
- '%TEMP%\is-SQH9I.tmp\setup959554.tmp' /SL5="$C0106,822997,54272,%PROGRAM_FILES%\baidu\setup959554.exe" /VERYSILENT /NORESTART
- '%PROGRAM_FILES%\baidu\setup959554.exe' /VERYSILENT /NORESTART
- '%TEMP%\nsl2.tmp\nsF.tmp' ipseccmd -p Block0 -r Block0 -f 118.145.31.*+0 -n BLOCK -x
- '%PROGRAM_FILES%\baidu\ipseccmd.exe' -p Block8 -r Block8 -f 220.181.126.*+0 -n BLOCK -x
- '%TEMP%\nsl2.tmp\nsD.tmp' ipseccmd -p Block8 -r Block8 -f 220.181.126.*+0 -n BLOCK -x
- '%PROGRAM_FILES%\baidu\ipseccmd.exe' -p Block9 -r Block9 -f 221.194.142.*+0 -n BLOCK -x
- '%TEMP%\nsl2.tmp\nsE.tmp' ipseccmd -p Block9 -r Block9 -f 221.194.142.*+0 -n BLOCK -x
- '%TEMP%\nsl2.tmp\ns16.tmp' sc stop PolicyAgent
- '%PROGRAM_FILES%\baidu\dsetup.exe' install
- '%TEMP%\~nsu.tmp\Au_.exe' _?=%PROGRAM_FILES%\baidu\
- '%PROGRAM_FILES%\baidu\un1130104631499.exe'
- '%PROGRAM_FILES%\baidu\msfsg.exe' md5 -s sumpod-nos.sys -d sumpod-nos.sys
- '%PROGRAM_FILES%\baidu\msfsg.exe' md5 -s dsetup.exe -d dsetup.exe
- '%PROGRAM_FILES%\baidu\msfsg.exe' md5 -s passthru.dll -d passthru.dll
- '%PROGRAM_FILES%\baidu\msfsg.exe' md5 -s newnetgar.dll -d newnetgar.dll
- '%PROGRAM_FILES%\baidu\msfsg.exe' md5 -s spass.dll -d spass.dll
- '%TEMP%\nsl2.tmp\ns7.tmp' ipseccmd -p Block2 -r BlockNEW -f 119.188.4.*+0 -n BLOCK -x
- '%PROGRAM_FILES%\baidu\ipseccmd.exe' -p Block1 -r BlockTCP -f 119.147.91.*+0 -n BLOCK -x
- '%TEMP%\nsl2.tmp\ns8.tmp' ipseccmd -p Block3 -r BlockTWO -f 122.70.130.*+0 -n BLOCK -x
- '%PROGRAM_FILES%\baidu\ipseccmd.exe' -p Block2 -r BlockNEW -f 119.188.4.*+0 -n BLOCK -x
- '%TEMP%\nsl2.tmp\ns6.tmp' ipseccmd -p Block1 -r BlockTCP -f 119.147.91.*+0 -n BLOCK -x
- '%PROGRAM_FILES%\baidu\msfsg.exe' uncompress -s s0001.xml -d ipseccmd.exe
- '<Текущая директория>\uuse-5891.exe'
- '%TEMP%\nsl2.tmp\ns5.tmp' sc start PolicyAgent
- '%PROGRAM_FILES%\baidu\msfsg.exe' md5 -s ipseccmd.exe -d ipseccmd.exe -l 10000000
- '%PROGRAM_FILES%\baidu\ipseccmd.exe' -p Block6 -r Block6 -f 125.39.100.*+0 -n BLOCK -x
- '%TEMP%\nsl2.tmp\nsB.tmp' ipseccmd -p Block6 -r Block6 -f 125.39.100.*+0 -n BLOCK -x
- '%PROGRAM_FILES%\baidu\ipseccmd.exe' -p Block7 -r Block7 -f 125.39.102.*+0 -n BLOCK -x
- '%TEMP%\nsl2.tmp\nsC.tmp' ipseccmd -p Block7 -r Block7 -f 125.39.102.*+0 -n BLOCK -x
- '%PROGRAM_FILES%\baidu\ipseccmd.exe' -p Block5 -r Block5 -f 124.238.244.*+0 -n BLOCK -x
- '%TEMP%\nsl2.tmp\ns9.tmp' ipseccmd -p Block4 -r BlockTHREE -f 124.238.243.*+0 -n BLOCK -x
- '%PROGRAM_FILES%\baidu\ipseccmd.exe' -p Block3 -r BlockTWO -f 122.70.130.*+0 -n BLOCK -x
- '%TEMP%\nsl2.tmp\nsA.tmp' ipseccmd -p Block5 -r Block5 -f 124.238.244.*+0 -n BLOCK -x
- '%PROGRAM_FILES%\baidu\ipseccmd.exe' -p Block4 -r BlockTHREE -f 124.238.243.*+0 -n BLOCK -x
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe' -k mysysgroup3
- '<SYSTEM32>\sc.exe' stop PolicyAgent
- '<SYSTEM32>\sc.exe' <SYSTEM32>\idecomp.dll RundllInstall NetHomeIDE
- '<SYSTEM32>\sc.exe' start PolicyAgent
- '<SYSTEM32>\runonce.exe' -r
Внедряет код в
следующие системные процессы:
- <SYSTEM32>\sc.exe
Изменения в файловой системе:
Создает следующие файлы:
- %PROGRAM_FILES%\baidu\dsetup.exe
- %PROGRAM_FILES%\baidu\spass.dll
- <SYSTEM32>\hardpol\MyIEData\main.ini
- %PROGRAM_FILES%\baidu\passthru.dll
- %APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\96dad47b-ab05-4f6f-99e6-d0720a0ccf1c
- %PROGRAM_FILES%\baidu\newnetgar.dll
- %PROGRAM_FILES%\baidu\sumpod-nos.sys
- %PROGRAM_FILES%\baidu\is-K5G6I.tmp
- %PROGRAM_FILES%\baidu\is-NIBLI.tmp
- %PROGRAM_FILES%\baidu\is-4PGKS.tmp
- %PROGRAM_FILES%\baidu\is-0F0DK.tmp
- %PROGRAM_FILES%\baidu\is-0HQG4.tmp
- %PROGRAM_FILES%\baidu\is-E8S0B.tmp
- %PROGRAM_FILES%\baidu\is-FQRRO.tmp
- %PROGRAM_FILES%\baidu\is-3HN2U.tmp
- <SYSTEM32>\idecomp.dll
- <SYSTEM32>\hardpol\hardpol.dll
- <DRIVERS>\SET15.tmp
- %APPDATA%\MyIEData\main.ini
- %TEMP%\nsl2.tmp\ns16.tmp
- %TEMP%\~nsu.tmp\Au_.exe
- <SYSTEM32>\hardpol\MyIEData\SysDat.bin
- <DRIVERS>\sumpod.sys
- %WINDIR%\inf\oem3.inf
- %WINDIR%\inf\oem3.PNF
- %APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\Preferred
- %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\ec702f375e1b12d218f67ab9ef19ca23_23ef5514-3059-436f-a4a7-4cefaab20eb1
- %WINDIR%\inf\INFCACHE.0
- <SYSTEM32>\SET14.tmp
- %WINDIR%\inf\oem4.inf
- %WINDIR%\inf\oem4.PNF
- %PROGRAM_FILES%\baidu\is-F5FOP.tmp
- %TEMP%\nsx4.tmp\ioSpecial.ini
- %TEMP%\nsx4.tmp\modern-wizard.bmp
- %TEMP%\nsl2.tmp\AccessControl.dll
- %TEMP%\nsl2.tmp\Internet.dll
- %TEMP%\nsl2.tmp\nsExec.dll
- %TEMP%\nsl2.tmp\ns5.tmp
- %TEMP%\nsx4.tmp\InstallOptions.dll
- %PROGRAM_FILES%\baidu\ipseccmd.exe
- %PROGRAM_FILES%\baidu\s0001.xml
- <Текущая директория>\uuse-5891.exe
- %PROGRAM_FILES%\baidu\dsop7.xml
- %PROGRAM_FILES%\baidu\msfsg.exe
- %PROGRAM_FILES%\baidu\un1130104631499.exe
- %TEMP%\nsl2.tmp\nsRandom.dll
- %TEMP%\nsl2.tmp\System.dll
- %PROGRAM_FILES%\baidu\temp555.ini
- %PROGRAM_FILES%\baidu\setup959554.exe
- %TEMP%\is-SQH9I.tmp\setup959554.tmp
- %TEMP%\nsl2.tmp\nsE.tmp
- %TEMP%\nsl2.tmp\nsF.tmp
- %TEMP%\is-I166V.tmp\spass.dll
- %PROGRAM_FILES%\baidu\is-4COM7.tmp
- %TEMP%\is-I166V.tmp\_isetup\_RegDLL.tmp
- %TEMP%\is-I166V.tmp\_isetup\_shfoldr.dll
- %TEMP%\nsl2.tmp\ns8.tmp
- %TEMP%\nsl2.tmp\ns9.tmp
- %TEMP%\nsl2.tmp\ns6.tmp
- %TEMP%\nsl2.tmp\ns7.tmp
- %TEMP%\nsl2.tmp\nsC.tmp
- %TEMP%\nsl2.tmp\nsD.tmp
- %TEMP%\nsl2.tmp\nsA.tmp
- %TEMP%\nsl2.tmp\nsB.tmp
Удаляет следующие файлы:
- %TEMP%\is-I166V.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-I166V.tmp\_isetup\_RegDLL.tmp
- %TEMP%\nsl2.tmp\ns16.tmp
- %TEMP%\is-SQH9I.tmp\setup959554.tmp
- %PROGRAM_FILES%\baidu\SysDat.bin
- %PROGRAM_FILES%\baidu\netsf_m.inf
- %TEMP%\is-I166V.tmp\spass.dll
- %PROGRAM_FILES%\baidu\sumpod-nos.sys
- %PROGRAM_FILES%\baidu\setup959554.exe
- %TEMP%\nsl2.tmp\nsRandom.dll
- %TEMP%\nsl2.tmp\nsExec.dll
- %PROGRAM_FILES%\baidu\un1130104631499.exe
- %TEMP%\nsl2.tmp\System.dll
- %PROGRAM_FILES%\baidu\s0001.xml
- %PROGRAM_FILES%\baidu\ipseccmd.exe
- %TEMP%\nsl2.tmp\Internet.dll
- %TEMP%\nsl2.tmp\AccessControl.dll
- %PROGRAM_FILES%\baidu\netsf.inf
- %TEMP%\nsl2.tmp\nsA.tmp
- %TEMP%\nsl2.tmp\ns9.tmp
- %TEMP%\nsl2.tmp\nsC.tmp
- %TEMP%\nsl2.tmp\nsB.tmp
- %TEMP%\nsl2.tmp\ns6.tmp
- %TEMP%\nsl2.tmp\ns5.tmp
- %TEMP%\nsl2.tmp\ns8.tmp
- %TEMP%\nsl2.tmp\ns7.tmp
- %TEMP%\nsl2.tmp\nsD.tmp
- %PROGRAM_FILES%\baidu\passthru.dll
- %PROGRAM_FILES%\baidu\dsetup.exe
- %PROGRAM_FILES%\baidu\newnetgar.dll
- %PROGRAM_FILES%\baidu\sumpod.sys
- %TEMP%\nsl2.tmp\nsF.tmp
- %TEMP%\nsl2.tmp\nsE.tmp
- %PROGRAM_FILES%\baidu\spass.dll
- %PROGRAM_FILES%\baidu\msfsg.exe
Перемещает следующие системные файлы:
- %WINDIR%\inf\INFCACHE.2 в %WINDIR%\inf\OLDCACHE.000
- %WINDIR%\inf\INFCACHE.1 в %WINDIR%\inf\INFCACHE.2
Перемещает следующие файлы:
- %PROGRAM_FILES%\baidu\is-0HQG4.tmp в %PROGRAM_FILES%\baidu\netsf_m.inf
- %PROGRAM_FILES%\baidu\is-3HN2U.tmp в %PROGRAM_FILES%\baidu\netsf.inf
- %PROGRAM_FILES%\baidu\is-FQRRO.tmp в %PROGRAM_FILES%\baidu\msfsg.exe
- <DRIVERS>\SET15.tmp в <DRIVERS>\sumpod.sys
- <SYSTEM32>\SET14.tmp в <SYSTEM32>\passthru.dll
- %PROGRAM_FILES%\baidu\is-E8S0B.tmp в %PROGRAM_FILES%\baidu\SysDat.bin
- %PROGRAM_FILES%\baidu\is-4PGKS.tmp в %PROGRAM_FILES%\baidu\sumpod.sys
- %PROGRAM_FILES%\baidu\is-F5FOP.tmp в %PROGRAM_FILES%\baidu\dsetup.exe
- %PROGRAM_FILES%\baidu\is-4COM7.tmp в %PROGRAM_FILES%\baidu\passthru.dll
- %PROGRAM_FILES%\baidu\is-NIBLI.tmp в %PROGRAM_FILES%\baidu\spass.dll
- %PROGRAM_FILES%\baidu\is-K5G6I.tmp в %PROGRAM_FILES%\baidu\newnetgar.dll
- %PROGRAM_FILES%\baidu\is-0F0DK.tmp в %PROGRAM_FILES%\baidu\sumpod-nos.sys
Самоудаляется.
Сетевая активность:
Подключается к:
- 'tj.#ogle.cn':80
TCP:
Запросы HTTP GET:
- tj.#ogle.cn/svr.asp?t=####################################
UDP:
- DNS ASK tj.#ogle.cn
- 'localhost':1045
- '23#.#55.255.250':1900
Другое:
Ищет следующие окна:
- ClassName: '(null)' WindowName: '??????...'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
