Техническая информация
Для обеспечения автозапуска и распространения
Модифицирует следующие ключи реестра
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = '"<Полный путь к файлу>"'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\control.exe] 'Debugger' = '\'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mspaint.exe] 'Debugger' = '\'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\conhost.exe] 'Debugger' = '\'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe] 'Debugger' = '\'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe] 'Debugger' = '\'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe] 'Debugger' = '\'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\smss.exe] 'Debugger' = '\'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csrss.exe] 'Debugger' = '\'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wininit.exe] 'Debugger' = '\'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shutdown.exe] 'Debugger' = '\'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lsass.exe] 'Debugger' = '\'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winlogon.exe] 'Debugger' = '\'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LogonUI.exe] 'Debugger' = '\'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe] 'Debugger' = '\'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\write.exe] 'Debugger' = '\'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe] 'Debugger' = '\'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe] 'Debugger' = '\'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe] 'Debugger' = '\'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe] 'Debugger' = '\'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Taskmgr.exe] 'Debugger' = '\'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winload.exe] 'Debugger' = '\'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchost.exe] 'Debugger' = '\'
Модифицирует главную загрузочную запись (MBR).
Вредоносные функции
Для затруднения выявления своего присутствия в системе
блокирует запуск следующих системных утилит:
- Интерпретатора командной строки (CMD)
- Диспетчера задач (Taskmgr)
- Редактора реестра (RegEdit)
блокирует:
- Средство контроля пользовательских учетных записей (UAC)
Читает файлы, отвечающие за хранение паролей сторонними программами
- %HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx
- %HOMEPATH%\desktop\archer.avi
- %HOMEPATH%\desktop\contosoroot_1.cer
- %HOMEPATH%\desktop\dashborder_144.bmp
- %HOMEPATH%\desktop\dashborder_192.bmp
- %HOMEPATH%\desktop\dial.bmp
- %HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx
- %HOMEPATH%\desktop\hanni_umami_chapter.doc
- %HOMEPATH%\desktop\lisp_success.doc
- %HOMEPATH%\desktop\nwfieldnotes1966.docx
- %HOMEPATH%\desktop\ovp25012015.doc
- %HOMEPATH%\desktop\pmd.cer
- %HOMEPATH%\desktop\sdksampleprivdeveloper.cer
- %HOMEPATH%\desktop\testcertificate.cer
- %HOMEPATH%\desktop\testee.cer
Изменения в файловой системе
Создает следующие файлы
- %HOMEPATH%\contacts\desktop.ini.douyamemz
- %HOMEPATH%\favorites\msn websites\msn money.url.douyamemz
- %HOMEPATH%\favorites\msn websites\msn sports.url.douyamemz
- %HOMEPATH%\favorites\msn websites\msn.url.douyamemz
- %HOMEPATH%\favorites\msn websites\msnbc news.url.douyamemz
- %HOMEPATH%\favorites\windows live\get windows live.url.douyamemz
- %HOMEPATH%\favorites\windows live\windows live gallery.url.douyamemz
- %HOMEPATH%\favorites\windows live\windows live mail.url.douyamemz
- %HOMEPATH%\favorites\windows live\windows live spaces.url.douyamemz
- %HOMEPATH%\links\desktop.ini.douyamemz
- %HOMEPATH%\links\desktop.lnk.douyamemz
- %HOMEPATH%\links\recentplaces.lnk.douyamemz
- %HOMEPATH%\searches\indexed locations.search-ms.douyamemz
- %HOMEPATH%\music\desktop.ini.douyamemz
- %HOMEPATH%\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tm.blf.douyamemz
- %HOMEPATH%\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000001.regtrans-ms.douyamemz
- %HOMEPATH%\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000002.regtrans-ms.douyamemz
- %HOMEPATH%\ntuser.ini.douyamemz
- %HOMEPATH%\pictures\desktop.ini.douyamemz
- %HOMEPATH%\recent\desktop.ini.douyamemz
- %HOMEPATH%\saved games\desktop.ini.douyamemz
- %HOMEPATH%\searches\desktop.ini.douyamemz
- %HOMEPATH%\searches\everywhere.search-ms.douyamemz
- %HOMEPATH%\favorites\msn websites\msn entertainment.url.douyamemz
- %HOMEPATH%\links\downloads.lnk.douyamemz
- %HOMEPATH%\favorites\msn websites\msn autos.url.douyamemz
- %HOMEPATH%\desktop\telegram.lnk.douyamemz
- %HOMEPATH%\contacts\user.contact.douyamemz
- %HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx.douyamemz
- %HOMEPATH%\desktop\archer.avi.douyamemz
- %HOMEPATH%\desktop\contosoroot_1.cer.douyamemz
- %HOMEPATH%\desktop\dashborder_144.bmp.douyamemz
- %HOMEPATH%\desktop\dashborder_192.bmp.douyamemz
- %HOMEPATH%\desktop\desktop.ini.douyamemz
- %HOMEPATH%\desktop\dial.bmp.douyamemz
- %HOMEPATH%\desktop\google chrome.lnk.douyamemz
- %HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx.douyamemz
- %HOMEPATH%\documents\desktop.ini.douyamemz
- %HOMEPATH%\favorites\microsoft websites\microsoft at work.url.douyamemz
- %HOMEPATH%\downloads\desktop.ini.douyamemz
- %HOMEPATH%\favorites\desktop.ini.douyamemz
- %HOMEPATH%\favorites\links\desktop.ini.douyamemz
- %HOMEPATH%\favorites\links\web slice gallery.url.douyamemz
- %HOMEPATH%\favorites\links for united states\desktop.ini.douyamemz
- %HOMEPATH%\favorites\links for united states\gobiernousa.gov.url.douyamemz
- %HOMEPATH%\favorites\links for united states\usa.gov.url.douyamemz
- %HOMEPATH%\favorites\microsoft websites\ie add-on site.url.douyamemz
- %HOMEPATH%\favorites\microsoft websites\ie site on microsoft.com.url.douyamemz
- %HOMEPATH%\favorites\microsoft websites\microsoft at home.url.douyamemz
- %HOMEPATH%\favorites\microsoft websites\microsoft store.url.douyamemz
- %HOMEPATH%\videos\desktop.ini.douyamemz
Изменяет расширения файлов пользовательских данных (Trojan.Encoder).
Другое
Запускает на исполнение
- '<SYSTEM32>\cmd.exe' /c title Douya MEMZ
- '<SYSTEM32>\cmd.exe' /c color 47
