Техническая информация
Для обеспечения автозапуска и распространения
Модифицирует следующие ключи реестра
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce] 'Explorer' = '%WINDIR%\system\explorer.exe RO'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce] 'Svchost' = '%WINDIR%\system\svchost.exe RO'
- [HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon] 'shell' = '%WINDIR%\explorer.exe, %WINDIR%\system\explorer.exe'
- [HKLM\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}] 'StubPath' = '%APPDATA%\mrsys.exe MR'
- [HKLM\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}] 'StubPath' = '%APPDATA%\mrsys.exe MR'
Создает или изменяет следующие файлы
- %WINDIR%\tasks\at1.job
- <SYSTEM32>\tasks\at1
Устанавливает следующие настройки сервисов
- [HKLM\SYSTEM\CurrentControlSet\Services\Schedule] 'Start' = '00000002'
Вредоносные функции
Для затруднения выявления своего присутствия в системе
блокирует отображение:
- скрытых файлов
Запускает на исполнение
- '%WINDIR%\syswow64\at.exe' 17:20 /interactive /every:M,T,W,Th,F,S,Su %WINDIR%\system\svchost.exe
- '%WINDIR%\syswow64\at.exe' 17:21 /interactive /every:M,T,W,Th,F,S,Su %WINDIR%\system\svchost.exe
Изменения в файловой системе
Создает следующие файлы
- %HOMEPATH%\documents\ps\uninstal.$$a
- %HOMEPATH%\documents\ps\_asyncio.$$a
- %HOMEPATH%\documents\ps\vcruntime140.$$a
- %HOMEPATH%\documents\ps\unicodedata.$$a
- %HOMEPATH%\documents\ps\ucrtbase.$$a
- %HOMEPATH%\documents\ps\select.$$a
- %HOMEPATH%\documents\ps\python38.$$a
- %HOMEPATH%\documents\ps\api-ms-win-crt-time-l1-1-0.$$a
- %HOMEPATH%\documents\ps\pyexpat.$$a
- %HOMEPATH%\documents\ps\libssl-1_1.$$a
- %HOMEPATH%\documents\ps\libffi-7.$$a
- %HOMEPATH%\documents\ps\libcrypto-1_1.$$a
- %HOMEPATH%\documents\ps\host.$$a
- %HOMEPATH%\documents\ps\host.exe.$$a
- %HOMEPATH%\documents\ps\base_library.$$a
- %HOMEPATH%\documents\ps\ps.$$a
- %HOMEPATH%\documents\ps\api-ms-win-crt-utility-l1-1-0.$$a
- %HOMEPATH%\documents\ps\_bz2.$$a
- %HOMEPATH%\documents\ps\_ssl.$$a
- %WINDIR%\system\svchost.exe
- %WINDIR%\system\spoolsv.exe
- %WINDIR%\system\explorer.exe
- %LOCALAPPDATA%\icsys.icn.exe
- %HOMEPATH%\desktop\ps.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\instalador ps\uninstall instalador ps.lnk
- %HOMEPATH%\documents\ps\_decimal.$$a
- %HOMEPATH%\documents\ps\_ctypes.$$a
- %HOMEPATH%\documents\ps\_socket.$$a
- %HOMEPATH%\documents\ps\_queue.$$a
- %HOMEPATH%\documents\ps\_overlapped.$$a
- %HOMEPATH%\documents\ps\_multiprocessing.$$a
- %HOMEPATH%\documents\ps\_lzma.$$a
- %HOMEPATH%\documents\ps\_hashlib.$$a
- %HOMEPATH%\documents\ps\uninstal.exe
- %HOMEPATH%\documents\ps\api-ms-win-crt-string-l1-1-0.$$a
- %HOMEPATH%\documents\ps\api-ms-win-crt-stdio-l1-1-0.$$a
- %HOMEPATH%\documents\ps\api-ms-win-crt-runtime-l1-1-0.$$a
- %HOMEPATH%\documents\ps\api-ms-win-core-memory-l1-1-0.$$a
- %HOMEPATH%\documents\ps\api-ms-win-core-localization-l1-2-0.$$a
- %HOMEPATH%\documents\ps\api-ms-win-core-libraryloader-l1-1-0.$$a
- %HOMEPATH%\documents\ps\api-ms-win-core-interlocked-l1-1-0.$$a
- %HOMEPATH%\documents\ps\api-ms-win-core-heap-l1-1-0.$$a
- %HOMEPATH%\documents\ps\api-ms-win-core-processenvironment-l1-1-0.$$a
- %HOMEPATH%\documents\ps\api-ms-win-core-handle-l1-1-0.$$a
- %HOMEPATH%\documents\ps\api-ms-win-core-file-l1-2-0.$$a
- %HOMEPATH%\documents\ps\api-ms-win-core-file-l1-1-0.$$a
- %HOMEPATH%\documents\ps\api-ms-win-core-errorhandling-l1-1-0.$$a
- %HOMEPATH%\documents\ps\api-ms-win-core-debug-l1-1-0.$$a
- %HOMEPATH%\documents\ps\api-ms-win-core-datetime-l1-1-0.$$a
- %HOMEPATH%\documents\ps\api-ms-win-core-console-l1-1-0.$$a
- %HOMEPATH%\documents\ps\api-ms-win-core-file-l2-1-0.$$a
- %HOMEPATH%\documents\ps\api-ms-win-core-processthreads-l1-1-0.$$a
- %HOMEPATH%\documents\ps\api-ms-win-core-namedpipe-l1-1-0.$$a
- %HOMEPATH%\documents\ps\api-ms-win-core-processthreads-l1-1-1.$$a
- %HOMEPATH%\documents\ps\api-ms-win-crt-process-l1-1-0.$$a
- %HOMEPATH%\documents\ps\api-ms-win-crt-conio-l1-1-0.$$a
- %HOMEPATH%\documents\ps\api-ms-win-crt-math-l1-1-0.$$a
- %HOMEPATH%\documents\ps\api-ms-win-crt-locale-l1-1-0.$$a
- %HOMEPATH%\documents\ps\api-ms-win-crt-heap-l1-1-0.$$a
- %HOMEPATH%\documents\ps\api-ms-win-crt-filesystem-l1-1-0.$$a
- %HOMEPATH%\documents\ps\api-ms-win-crt-environment-l1-1-0.$$a
- %HOMEPATH%\documents\ps\api-ms-win-crt-convert-l1-1-0.$$a
- %HOMEPATH%\documents\ps\api-ms-win-core-util-l1-1-0.$$a
- %HOMEPATH%\documents\ps\api-ms-win-core-profile-l1-1-0.$$a
- %HOMEPATH%\documents\ps\api-ms-win-core-timezone-l1-1-0.$$a
- %HOMEPATH%\documents\ps\api-ms-win-core-sysinfo-l1-1-0.$$a
- %HOMEPATH%\documents\ps\api-ms-win-core-synch-l1-2-0.$$a
- %HOMEPATH%\documents\ps\api-ms-win-core-synch-l1-1-0.$$a
- %HOMEPATH%\documents\ps\api-ms-win-core-string-l1-1-0.$$a
- %HOMEPATH%\documents\ps\api-ms-win-core-rtlsupport-l1-1-0.$$a
- %APPDATA%\mrsys.exe
- %ALLUSERSPROFILE%\microsoft\crypto\rsa\s-1-5-18\d42cc0c3858a58db2db37658219e6400_d99ef00b-ccd3-4f1d-9980-90ac453b0b47
Присваивает атрибут 'скрытый' для следующих файлов
- %WINDIR%\system\explorer.exe
- %WINDIR%\system\spoolsv.exe
- %WINDIR%\system\svchost.exe
- %APPDATA%\mrsys.exe
Удаляет следующие файлы
- %WINDIR%\tasks\at1.job
- <SYSTEM32>\tasks\at1
Перемещает следующие файлы
- %HOMEPATH%\documents\ps\uninstal.$$a в %HOMEPATH%\documents\ps\uninstal.exe
- %HOMEPATH%\documents\ps\api-ms-win-crt-process-l1-1-0.$$a в %HOMEPATH%\documents\ps\api-ms-win-crt-process-l1-1-0.dll
- %HOMEPATH%\documents\ps\api-ms-win-crt-runtime-l1-1-0.$$a в %HOMEPATH%\documents\ps\api-ms-win-crt-runtime-l1-1-0.dll
- %HOMEPATH%\documents\ps\api-ms-win-crt-stdio-l1-1-0.$$a в %HOMEPATH%\documents\ps\api-ms-win-crt-stdio-l1-1-0.dll
- %HOMEPATH%\documents\ps\api-ms-win-crt-string-l1-1-0.$$a в %HOMEPATH%\documents\ps\api-ms-win-crt-string-l1-1-0.dll
- %HOMEPATH%\documents\ps\api-ms-win-crt-time-l1-1-0.$$a в %HOMEPATH%\documents\ps\api-ms-win-crt-time-l1-1-0.dll
- %HOMEPATH%\documents\ps\api-ms-win-crt-utility-l1-1-0.$$a в %HOMEPATH%\documents\ps\api-ms-win-crt-utility-l1-1-0.dll
- %HOMEPATH%\documents\ps\base_library.$$a в %HOMEPATH%\documents\ps\base_library.zip
- %HOMEPATH%\documents\ps\host.exe.$$a в %HOMEPATH%\documents\ps\host.exe.manifest
- %HOMEPATH%\documents\ps\host.$$a в %HOMEPATH%\documents\ps\host.exeВ
- %HOMEPATH%\documents\ps\libcrypto-1_1.$$a в %HOMEPATH%\documents\ps\libcrypto-1_1.dll
- %HOMEPATH%\documents\ps\libffi-7.$$a в %HOMEPATH%\documents\ps\libffi-7.dll
- %HOMEPATH%\documents\ps\libssl-1_1.$$a в %HOMEPATH%\documents\ps\libssl-1_1.dll
- %HOMEPATH%\documents\ps\ps.$$a в %HOMEPATH%\documents\ps\ps.exe
- %HOMEPATH%\documents\ps\python38.$$a в %HOMEPATH%\documents\ps\python38.dll
- %HOMEPATH%\documents\ps\_socket.$$a в %HOMEPATH%\documents\ps\_socket.pyd
- %HOMEPATH%\documents\ps\select.$$a в %HOMEPATH%\documents\ps\select.pyd
- %HOMEPATH%\documents\ps\ucrtbase.$$a в %HOMEPATH%\documents\ps\ucrtbase.dll
- %HOMEPATH%\documents\ps\unicodedata.$$a в %HOMEPATH%\documents\ps\unicodedata.pyd
- %HOMEPATH%\documents\ps\vcruntime140.$$a в %HOMEPATH%\documents\ps\vcruntime140.dll
- %HOMEPATH%\documents\ps\_asyncio.$$a в %HOMEPATH%\documents\ps\_asyncio.pyd
- %HOMEPATH%\documents\ps\_bz2.$$a в %HOMEPATH%\documents\ps\_bz2.pyd
- %HOMEPATH%\documents\ps\_ctypes.$$a в %HOMEPATH%\documents\ps\_ctypes.pyd
- %HOMEPATH%\documents\ps\_decimal.$$a в %HOMEPATH%\documents\ps\_decimal.pyd
- %HOMEPATH%\documents\ps\_hashlib.$$a в %HOMEPATH%\documents\ps\_hashlib.pyd
- %HOMEPATH%\documents\ps\_lzma.$$a в %HOMEPATH%\documents\ps\_lzma.pyd
- %HOMEPATH%\documents\ps\_multiprocessing.$$a в %HOMEPATH%\documents\ps\_multiprocessing.pyd
- %HOMEPATH%\documents\ps\_overlapped.$$a в %HOMEPATH%\documents\ps\_overlapped.pyd
- %HOMEPATH%\documents\ps\_queue.$$a в %HOMEPATH%\documents\ps\_queue.pyd
- %HOMEPATH%\documents\ps\api-ms-win-crt-math-l1-1-0.$$a в %HOMEPATH%\documents\ps\api-ms-win-crt-math-l1-1-0.dll
- %HOMEPATH%\documents\ps\pyexpat.$$a в %HOMEPATH%\documents\ps\pyexpat.pyd
- %HOMEPATH%\documents\ps\api-ms-win-crt-locale-l1-1-0.$$a в %HOMEPATH%\documents\ps\api-ms-win-crt-locale-l1-1-0.dll
- %HOMEPATH%\documents\ps\api-ms-win-core-namedpipe-l1-1-0.$$a в %HOMEPATH%\documents\ps\api-ms-win-core-namedpipe-l1-1-0.dll
- %HOMEPATH%\documents\ps\api-ms-win-core-console-l1-1-0.$$a в %HOMEPATH%\documents\ps\api-ms-win-core-console-l1-1-0.dll
- %HOMEPATH%\documents\ps\api-ms-win-core-datetime-l1-1-0.$$a в %HOMEPATH%\documents\ps\api-ms-win-core-datetime-l1-1-0.dll
- %HOMEPATH%\documents\ps\api-ms-win-core-debug-l1-1-0.$$a в %HOMEPATH%\documents\ps\api-ms-win-core-debug-l1-1-0.dll
- %HOMEPATH%\documents\ps\api-ms-win-core-errorhandling-l1-1-0.$$a в %HOMEPATH%\documents\ps\api-ms-win-core-errorhandling-l1-1-0.dll
- %HOMEPATH%\documents\ps\api-ms-win-core-file-l1-1-0.$$a в %HOMEPATH%\documents\ps\api-ms-win-core-file-l1-1-0.dll
- %HOMEPATH%\documents\ps\api-ms-win-core-file-l1-2-0.$$a в %HOMEPATH%\documents\ps\api-ms-win-core-file-l1-2-0.dll
- %HOMEPATH%\documents\ps\api-ms-win-core-file-l2-1-0.$$a в %HOMEPATH%\documents\ps\api-ms-win-core-file-l2-1-0.dll
- %HOMEPATH%\documents\ps\api-ms-win-core-handle-l1-1-0.$$a в %HOMEPATH%\documents\ps\api-ms-win-core-handle-l1-1-0.dll
- %HOMEPATH%\documents\ps\api-ms-win-core-heap-l1-1-0.$$a в %HOMEPATH%\documents\ps\api-ms-win-core-heap-l1-1-0.dll
- %HOMEPATH%\documents\ps\api-ms-win-core-interlocked-l1-1-0.$$a в %HOMEPATH%\documents\ps\api-ms-win-core-interlocked-l1-1-0.dll
- %HOMEPATH%\documents\ps\api-ms-win-core-libraryloader-l1-1-0.$$a в %HOMEPATH%\documents\ps\api-ms-win-core-libraryloader-l1-1-0.dll
- %HOMEPATH%\documents\ps\api-ms-win-core-localization-l1-2-0.$$a в %HOMEPATH%\documents\ps\api-ms-win-core-localization-l1-2-0.dll
- %HOMEPATH%\documents\ps\api-ms-win-core-memory-l1-1-0.$$a в %HOMEPATH%\documents\ps\api-ms-win-core-memory-l1-1-0.dll
- %HOMEPATH%\documents\ps\api-ms-win-core-processenvironment-l1-1-0.$$a в %HOMEPATH%\documents\ps\api-ms-win-core-processenvironment-l1-1-0.dll
- %HOMEPATH%\documents\ps\api-ms-win-crt-filesystem-l1-1-0.$$a в %HOMEPATH%\documents\ps\api-ms-win-crt-filesystem-l1-1-0.dll
- %HOMEPATH%\documents\ps\api-ms-win-core-processthreads-l1-1-0.$$a в %HOMEPATH%\documents\ps\api-ms-win-core-processthreads-l1-1-0.dll
- %HOMEPATH%\documents\ps\api-ms-win-core-processthreads-l1-1-1.$$a в %HOMEPATH%\documents\ps\api-ms-win-core-processthreads-l1-1-1.dll
- %HOMEPATH%\documents\ps\api-ms-win-core-profile-l1-1-0.$$a в %HOMEPATH%\documents\ps\api-ms-win-core-profile-l1-1-0.dll
- %HOMEPATH%\documents\ps\api-ms-win-core-rtlsupport-l1-1-0.$$a в %HOMEPATH%\documents\ps\api-ms-win-core-rtlsupport-l1-1-0.dll
- %HOMEPATH%\documents\ps\api-ms-win-core-string-l1-1-0.$$a в %HOMEPATH%\documents\ps\api-ms-win-core-string-l1-1-0.dll
- %HOMEPATH%\documents\ps\api-ms-win-core-synch-l1-1-0.$$a в %HOMEPATH%\documents\ps\api-ms-win-core-synch-l1-1-0.dll
- %HOMEPATH%\documents\ps\api-ms-win-core-synch-l1-2-0.$$a в %HOMEPATH%\documents\ps\api-ms-win-core-synch-l1-2-0.dll
- %HOMEPATH%\documents\ps\api-ms-win-core-sysinfo-l1-1-0.$$a в %HOMEPATH%\documents\ps\api-ms-win-core-sysinfo-l1-1-0.dll
- %HOMEPATH%\documents\ps\api-ms-win-core-timezone-l1-1-0.$$a в %HOMEPATH%\documents\ps\api-ms-win-core-timezone-l1-1-0.dll
- %HOMEPATH%\documents\ps\api-ms-win-core-util-l1-1-0.$$a в %HOMEPATH%\documents\ps\api-ms-win-core-util-l1-1-0.dll
- %HOMEPATH%\documents\ps\api-ms-win-crt-conio-l1-1-0.$$a в %HOMEPATH%\documents\ps\api-ms-win-crt-conio-l1-1-0.dll
- %HOMEPATH%\documents\ps\api-ms-win-crt-convert-l1-1-0.$$a в %HOMEPATH%\documents\ps\api-ms-win-crt-convert-l1-1-0.dll
- %HOMEPATH%\documents\ps\api-ms-win-crt-environment-l1-1-0.$$a в %HOMEPATH%\documents\ps\api-ms-win-crt-environment-l1-1-0.dll
- %HOMEPATH%\documents\ps\api-ms-win-crt-heap-l1-1-0.$$a в %HOMEPATH%\documents\ps\api-ms-win-crt-heap-l1-1-0.dll
- %HOMEPATH%\documents\ps\_ssl.$$a в %HOMEPATH%\documents\ps\_ssl.pyd
Подменяет следующие файлы
- %HOMEPATH%\documents\ps\ps.$$a
- %HOMEPATH%\documents\ps\ps.exeВ
Другое
Ищет следующие окна
- ClassName: 'InstItClass' WindowName: ''
Создает и запускает на исполнение
- '%HOMEPATH%\documents\ps\ps.exe'
- '%LOCALAPPDATA%\icsys.icn.exe'
- '%WINDIR%\system\explorer.exe'
- '%WINDIR%\system\spoolsv.exe' SE
- '%WINDIR%\system\svchost.exe'
- '%WINDIR%\system\spoolsv.exe' PR
Запускает на исполнение
- '%LOCALAPPDATA%\icsys.icn.exe' (со скрытым окном)
- '%WINDIR%\system\explorer.exe' (со скрытым окном)
- '%WINDIR%\system\spoolsv.exe' SE (со скрытым окном)
- '%WINDIR%\system\svchost.exe' (со скрытым окном)
- '%WINDIR%\system\spoolsv.exe' PR (со скрытым окном)
- '%WINDIR%\syswow64\at.exe' 17:20 /interactive /every:M,T,W,Th,F,S,Su %WINDIR%\system\svchost.exe (со скрытым окном)
- '%WINDIR%\syswow64\at.exe' 17:21 /interactive /every:M,T,W,Th,F,S,Su %WINDIR%\system\svchost.exe (со скрытым окном)
