Техническая информация
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\cacls.exe' %WINDIR%\~tmp4832.exe /c /e /d everyone
- '<SYSTEM32>\cacls.exe' %WINDIR%\zaq1.exe /c /e /d everyone
- '<SYSTEM32>\cacls.exe' %WINDIR%\msccrt.exe /c /e /d everyone
- '<SYSTEM32>\cacls.exe' %WINDIR%\rund1132.exe /c /e /d everyone
- '<SYSTEM32>\cacls.exe' %WINDIR%\zaq4.exe /c /e /d everyone
- '<SYSTEM32>\cacls.exe' %WINDIR%\zaq5.exe /c /e /d everyone
- '<SYSTEM32>\cacls.exe' %WINDIR%\zaq2.exe /c /e /d everyone
- '<SYSTEM32>\cacls.exe' %WINDIR%\zaq3.exe /c /e /d everyone
- '<SYSTEM32>\cacls.exe' %WINDIR%\wsvbs.exe /c /e /d everyone
- '<SYSTEM32>\cacls.exe' %WINDIR%\msccrt.dll /c /e /d everyone
- '<SYSTEM32>\cacls.exe' %WINDIR%\msln.exe /c /e /d everyone
- '<SYSTEM32>\cacls.exe' %WINDIR%\toolsp.exe /c /e /d everyone
- '<SYSTEM32>\cacls.exe' %WINDIR%\run1132.exe /c /e /d everyone
- '<SYSTEM32>\cacls.exe' %WINDIR%\cnwin.dll /c /e /d everyone
- '<SYSTEM32>\cacls.exe' %WINDIR%\cmdbcs.exe /c /e /d everyone
- '<SYSTEM32>\cacls.exe' %WINDIR%\wsvbs.dll /c /e /d everyone
- '<SYSTEM32>\cacls.exe' %WINDIR%\cmdbcs.dll /c /e /d everyone
- '<SYSTEM32>\cacls.exe' <SYSTEM32>\z.dll /c /e /d everyone
- '<SYSTEM32>\cacls.exe' <SYSTEM32>\kava.dll /c /e /d everyone
- '<SYSTEM32>\cacls.exe' <SYSTEM32>\WSD_SOCK32.dll /c /e /d everyone
- '<SYSTEM32>\cacls.exe' <SYSTEM32>\shse.dll /c /e /d everyone
- '<SYSTEM32>\cacls.exe' %WINDIR%\cmd.com /c /e /d everyone
- '<SYSTEM32>\cacls.exe' %WINDIR%\net.com /c /e /d everyone
- '<SYSTEM32>\cacls.exe' <SYSTEM32>\1c79.com /c /e /d everyone
- '<SYSTEM32>\cacls.exe' %WINDIR%\regedit.com /c /e /d everyone
- '<SYSTEM32>\cacls.exe' <SYSTEM32>\windds32.dll /c /e /d everyone
- '<SYSTEM32>\cacls.exe' %WINDIR%\zaq8.exe /c /e /d everyone
- '<SYSTEM32>\cacls.exe' %WINDIR%\zaq9.exe /c /e /d everyone
- '<SYSTEM32>\cacls.exe' %WINDIR%\zaq6.exe /c /e /d everyone
- '<SYSTEM32>\cacls.exe' %WINDIR%\zaq7.exe /c /e /d everyone
- '<SYSTEM32>\cacls.exe' <SYSTEM32>\XpIcfOpt.dll /c /e /d everyone
- '<SYSTEM32>\cacls.exe' <SYSTEM32>\WSD_SOCK32.dl_ /c /e /d everyone
- '<SYSTEM32>\cacls.exe' %WINDIR%\zaq10.exe /c /e /d everyone
- '<SYSTEM32>\cacls.exe' <SYSTEM32>\cmd.dll /c /e /d everyone
- '<SYSTEM32>\cacls.exe' %WINDIR%\~tmp8139.exe /c /e /d everyone
- '<SYSTEM32>\cacls.exe' %WINDIR%\EXP10RER.com /c /e /d everyone
- '<SYSTEM32>\cacls.exe' %WINDIR%\finders.com /c /e /d everyone
- '<SYSTEM32>\cacls.exe' %WINDIR%\1.com /c /e /d everyone
- '<SYSTEM32>\cacls.exe' %WINDIR%\exerouter.exe /c /e /d everyone
- '<SYSTEM32>\cacls.exe' %WINDIR%\svhost.exe /c /e /d everyone
- '<SYSTEM32>\cacls.exe' %WINDIR%\Shell.sys /c /e /d everyone
- '<SYSTEM32>\cacls.exe' %WINDIR%\rundll32.exe /c /e /d everyone
- '<SYSTEM32>\cacls.exe' %WINDIR%\smss.exe /c /e /d everyone
- '<SYSTEM32>\cacls.exe' %WINDIR%\dll.dll /c /e /d everyone
- '<SYSTEM32>\cacls.exe' %WINDIR%\logo1.exe /c /e /d everyone
- '<SYSTEM32>\cacls.exe' %WINDIR%\logo_1.exe /c /e /d everyone
- '<SYSTEM32>\cmd.exe' /c ""%WINDIR%\cal2.bat" "
- '<SYSTEM32>\cacls.exe' %WINDIR%\logo1_.exe /c /e /d everyone
- '<SYSTEM32>\cacls.exe' %WINDIR%\svchqs.exe /c /e /d everyone
- '<SYSTEM32>\cacls.exe' %WINDIR%\*Sy.exe /c /e /d everyone
- '<SYSTEM32>\cacls.exe' %WINDIR%\rundl132.exe /c /e /d everyone
- '<SYSTEM32>\cacls.exe' %WINDIR%\svch0st.exe /c /e /d everyone
- '<SYSTEM32>\cacls.exe' <SYSTEM32>\scrrun.dll /c /e /d everyone
- '<SYSTEM32>\cacls.exe' <SYSTEM32>\MSCOMCTL.OCX /c /e /d everyone
- '<SYSTEM32>\cacls.exe' <SYSTEM32>\IeBar1.dll /c /e /d everyone
- '<SYSTEM32>\cacls.exe' <SYSTEM32>\windhcp.ocx /c /e /d everyone
- '<SYSTEM32>\cacls.exe' %WINDIR%\spoclsv.exe /c /e /d everyone
- '<SYSTEM32>\cacls.exe' %WINDIR%\spcolsv.exe /c /e /d everyone
- '<SYSTEM32>\cacls.exe' <SYSTEM32>\spoclsv.exe /c /e /d everyone
- '<SYSTEM32>\cacls.exe' <SYSTEM32>\spcolsv.exe /c /e /d everyone
- '<SYSTEM32>\cacls.exe' <SYSTEM32>\wsvbs.dll /c /e /d everyone
- '<SYSTEM32>\cacls.exe' <DRIVERS>\spoclsv.exe /c /e /d everyone
- '<SYSTEM32>\cacls.exe' <SYSTEM32>\run1132.dll /c /e /d everyone
- '<SYSTEM32>\cacls.exe' %WINDIR%\vDll.dll /c /e /d everyone
- '<SYSTEM32>\cacls.exe' <DRIVERS>\spcolsv.exe /c /e /d everyone
- '<SYSTEM32>\cacls.exe' <SYSTEM32>\cmdbcs.dll /c /e /d everyone
- '<SYSTEM32>\cacls.exe' <SYSTEM32>\msln.exe /c /e /d everyone
- '<SYSTEM32>\cacls.exe' <SYSTEM32>\cnwin.dll /c /e /d everyone
- '<SYSTEM32>\cacls.exe' <SYSTEM32>\msccrt.dll /c /e /d everyone
Изменения в файловой системе:
Создает следующие файлы:
- %WINDIR%\logo1说明.txt
- %WINDIR%\cal2.bat
Присваивает атрибут 'скрытый' для следующих файлов:
- %WINDIR%\logo1说明.txt
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'EDIT' WindowName: '(null)'
