Техническая информация
Для обеспечения автозапуска и распространения
Модифицирует следующие ключи реестра
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe] 'debugger' = 'svchost.exe'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwcfg.exe] 'debugger' = 'svchost.exe'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RsAqent.exe] 'debugger' = 'svchost.exe'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rsaupd.exe] 'debugger' = 'svchost.exe'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SmartUp.exe] 'debugger' = 'svchost.exe'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shcfg32.exe] 'debugger' = 'svchost.exe'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scan32.exe] 'debugger' = 'svchost.exe'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmqczj.exe] 'debugger' = 'svchost.exe'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\safelive.exe] 'debugger' = 'svchost.exe'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\symlcsvc.exe] 'debugger' = 'svchost.exe'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrojanDetector.exe] 'debugger' = 'svchost.exe'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SysSafe.exe] 'debugger' = 'svchost.exe'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PFWLveUpdate.exe] 'debugger' = 'svchost.exe'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QHSET.exe] 'debugger' = 'svchost.exe'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NAVSetup.exe] 'debugger' = 'svchost.exe'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SREng.exe] 'debugger' = 'svchost.exe'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmsk.exe] 'debugger' = 'svchost.exe'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RegClean.exe] 'debugger' = 'svchost.exe'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxPol.exe] 'debugger' = 'svchost.exe'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kavsvc.exe] 'debugger' = 'svchost.exe'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe] 'debugger' = 'svchost.exe'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe] 'debugger' = 'svchost.exe'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe] 'debugger' = 'svchost.exe'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zxsweep.exe] 'debugger' = 'svchost.exe'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WoptiClean.exe] 'debugger' = 'svchost.exe'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Trojanwall.exe] 'debugger' = 'svchost.exe'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwProxy.exe] 'debugger' = 'svchost.exe'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxFwHlp.exe] 'debugger' = 'svchost.exe'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxCfg.exe] 'debugger' = 'svchost.exe'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxAttachment.exe] 'debugger' = 'svchost.exe'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxAgent.exe] 'debugger' = 'svchost.exe'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UIHost.exe] 'debugger' = 'svchost.exe'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrojDie.kxp] 'debugger' = 'svchost.exe'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UpLive.EXE.exe] 'debugger' = 'svchost.exe'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcconsol.exe] 'debugger' = 'svchost.exe'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MagicSet.exe] 'debugger' = 'svchost.exe'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\loaddll.exe] 'debugger' = 'svchost.exe'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mctskshd.exe] 'debugger' = 'svchost.exe'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcupdmgr.exe] 'debugger' = 'svchost.exe'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\McAgent.exe] 'debugger' = 'svchost.exe'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ras.exe] 'debugger' = 'svchost.exe'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\runiep.exe] 'debugger' = 'svchost.exe'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DefWatch.exe] 'debugger' = 'svchost.exe'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwsrv.exe] 'debugger' = 'svchost.exe'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMON.exe] 'debugger' = 'svchost.exe'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavStub.exe] 'debugger' = 'svchost.exe'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavTask.exe] 'debugger' = 'svchost.exe'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rav.exe] 'debugger' = 'svchost.exe'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ravmond.exe] 'debugger' = 'svchost.exe'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCenter.exe] 'debugger' = 'svchost.exe'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RfwMain.exe] 'debugger' = 'svchost.exe'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccSetMgr.exe] 'debugger' = 'svchost.exe'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rtvscan.exe] 'debugger' = 'svchost.exe'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccEvtMgr.exe] 'debugger' = 'svchost.exe'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatchX.exe] 'debugger' = 'svchost.exe'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FWMon.exe] 'debugger' = 'svchost.exe'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatch9x.exe] 'debugger' = 'svchost.exe'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvXP_1.kxp] 'debugger' = 'svchost.exe'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvXP.kxp] 'debugger' = 'svchost.exe'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvupload.exe] 'debugger' = 'svchost.exe'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVStub.kxp] 'debugger' = 'svchost.exe'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVMonXP.exe] 'debugger' = 'svchost.exe'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PFW.exe] 'debugger' = 'svchost.exe'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccSetApp.exe] 'debugger' = 'svchost.exe'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvsrvxp.exe] 'debugger' = 'svchost.exe'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVWSC.exe] 'debugger' = 'svchost.exe'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVStart.exe] 'debugger' = 'svchost.exe'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPfwSvc.exe] 'debugger' = 'svchost.exe'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatch.exe] 'debugger' = 'svchost.exe'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32kui.exe] 'debugger' = 'svchost.exe'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQDoctor.exe] 'debugger' = 'svchost.exe'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQSC.exe] 'debugger' = 'svchost.exe'
Устанавливает следующие настройки сервисов
- [HKLM\System\CurrentControlSet\Services\RESSDT] 'ImagePath' = '%WINDIR%\SysWOW64\RESSDT.sys'
Создает следующие сервисы
- 'RESSDT' %WINDIR%\SysWOW64\RESSDT.sys
Вредоносные функции
Для затруднения выявления своего присутствия в системе
блокирует запуск следующих системных утилит:
- Центр обеспечения безопасности (Security Center)
Запускает на исполнение
- '%WINDIR%\syswow64\net.exe' stop wscsvc
- '%WINDIR%\syswow64\net.exe' stop sharedaccess
- '%WINDIR%\syswow64\net.exe' stop KPfwSvc
- '%WINDIR%\syswow64\net.exe' stop KWatchsvc
- '%WINDIR%\syswow64\net.exe' stop McShield
- '%WINDIR%\syswow64\net.exe' stop "Norton AntiVirus Server"
Внедряет код в
следующие пользовательские процессы:
- iexplore.exe
Изменения в файловой системе
Создает следующие файлы
- %WINDIR%\syswow64\ressdt.sys
- %WINDIR%\syswow64\ressdt.exe
- %WINDIR%\syswow64\sysave.exe
- %ProgramFiles%\sys.bat
Присваивает атрибут 'скрытый' для следующих файлов
- %WINDIR%\syswow64\sysave.exe
Удаляет следующие файлы
- %WINDIR%\syswow64\ressdt.exe
- %WINDIR%\syswow64\ressdt.sys
Самоудаляется.
Сетевая активность
UDP
- DNS ASK fa##uizd.cn
Другое
Ищет следующие окна
- ClassName: 'IEFrame' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
- ClassName: 'Static' WindowName: ''
Создает и запускает на исполнение
- '%WINDIR%\syswow64\ressdt.exe'
- '%WINDIR%\syswow64\sysave.exe'
Запускает на исполнение
- '%WINDIR%\syswow64\cmd.exe' /c net stop wscsvc&net stop sharedaccess&sc config sharedaccess start= disabled&sc config wscsvc start= disabled &net stop KPfwSvc&net stop KWatchsvc&net stop McShield&net stop "Norton AntiVi... (со скрытым окном)
- '%WINDIR%\syswow64\net1.exe' stop wscsvc
- '%WINDIR%\syswow64\net1.exe' stop sharedaccess
- '%WINDIR%\syswow64\sc.exe' config sharedaccess start= disabled
- '%WINDIR%\syswow64\sc.exe' config wscsvc start= disabled
- '%WINDIR%\syswow64\net1.exe' stop KPfwSvc
- '%WINDIR%\syswow64\net1.exe' stop KWatchsvc
- '%WINDIR%\syswow64\net1.exe' stop McShield
- '%WINDIR%\syswow64\net1.exe' stop "Norton AntiVirus Server"
- '%WINDIR%\syswow64\cacls.exe' "%ProgramFiles%\Tencent\QQ\QQDoctor" /d everyone
- '%ProgramFiles%\internet explorer\iexplore.exe' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /c echo ping 127.1 -n 4 >nul 2>nul >"%ProgramFiles%\sys.bat" & echo del "<Полный путь к файлу>" >>"%ProgramFiles%\sys.bat" & echo del "%ProgramFiles%\sys.bat">>"%ProgramFiles%\sys.bat" & "%Pro... (со скрытым окном)
- '%WINDIR%\syswow64\ping.exe' 127.1 -n 4
