Техническая информация
Для обеспечения автозапуска и распространения:
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\NetDDESER] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\Evntconnections] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- '%WINDIR%\Installer\Cache\closetftp.exe'
- '%WINDIR%\inf\WINNET'
- '%WINDIR%\Installer\Cache\Nvsvc32.exe'
- '%WINDIR%\Installer\Cache\Nvsvc.exe'
- '%WINDIR%\Installer\Cache\chengeprot.exe'
Запускает на исполнение:
- '<SYSTEM32>\cmd.exe' /c %WINDIR%\Installer\Cache\bfdde.bat
- '<SYSTEM32>\sc.exe' delete NetDDESER
- '<SYSTEM32>\sc.exe' description Evntconnections "?????????????????????,???????,??????????"
- '<SYSTEM32>\sc.exe' start Evntconnections
- '<SYSTEM32>\cmd.exe' /c %WINDIR%\Installer\Cache\delmeme.bat
- '<SYSTEM32>\sc.exe' start NetDDESER
- '<SYSTEM32>\sc.exe' create NetDDESER BinPath= %WINDIR%\inf\WINNET type= own type= interact start= auto DisplayName= "Network DDE Service"
- '<SYSTEM32>\sc.exe' description NetDDESER "???????????????????????????? (DDE) ?????????????????, DDE ??????????????????,??????????????"
- '<SYSTEM32>\sc.exe' create Evntconnections BinPath= "%WINDIR%\Installer\Cache\Nvsvc32.exe" type= own type= interact start= auto DisplayName= "Evnt connections"
- '<SYSTEM32>\sc.exe' delete ""
- '<SYSTEM32>\wscript.exe' %WINDIR%\Installer\Cache\sl.vbs
- '<SYSTEM32>\net.exe' stop Evntconnections
- '<SYSTEM32>\net1.exe' stop Evntconnections
- '%WINDIR%\regedit.exe' /s "%WINDIR%\Installer\Cache\235.reg"
- '<SYSTEM32>\sc.exe' delete Evntconnections
- '<SYSTEM32>\cmd.exe' /c %WINDIR%\Installer\Cache\bftmp.bat
- '<SYSTEM32>\sc.exe' stop Evntconnections
Завершает или пытается завершить
следующие системные процессы:
- <SYSTEM32>\cmd.exe
Изменения в файловой системе:
Создает следующие файлы:
- %WINDIR%\Installer\Cache\chengeprot.exe
- %WINDIR%\Installer\Cache\bftmp.bat
- <SYSTEM32>\235.dll
- %WINDIR%\Installer\Cache\volume_27038.msi
- <SYSTEM32>\NTSVC.ocx
- %WINDIR%\Installer\Cache\closetftp.exe
- %WINDIR%\Help\MEM689cd.hlp
- %WINDIR%\Installer\Cache\delmeme.bat
- %WINDIR%\Installer\Cache\NOstart
- %WINDIR%\Installer\Cache\235.reg
- %WINDIR%\Installer\Cache\bfdde.bat
- %WINDIR%\AppPatch\MEM689cd.dll
- %WINDIR%\inf\volume_AMD.inf
- %WINDIR%\Installer\undelok
- %WINDIR%\Installer\Cache\NTSVC.ocx
- %WINDIR%\inf\WINNET
- %WINDIR%\Installer\Cache\undelok
- %WINDIR%\inf\undelok
- %WINDIR%\inf\pnc865.PNF
- %WINDIR%\inf\pnc845.PNF
- %WINDIR%\Installer\Cache\sl.vbs
- %WINDIR%\Installer\MEM689cd.msi
- %WINDIR%\Installer\Cache\Nvsvc.exe
- %WINDIR%\Installer\Cache\Nvsvc32.exe
Удаляет следующие файлы:
- %TEMP%\~DFFC7E.tmp
- %WINDIR%\Installer\Cache\chengeprot.exe
- %WINDIR%\Installer\Cache\235.reg
- %WINDIR%\Installer\Cache\sl.vbs
- %WINDIR%\Installer\Cache\undelok
- %WINDIR%\inf\undelok
- %WINDIR%\Installer\undelok
Самоудаляется.
Сетевая активность:
Подключается к:
- 'wi####8.vicp.net':8000
UDP:
- DNS ASK wi####8.vicp.net
Другое:
Ищет следующие окна:
- ClassName: '(null)' WindowName: 'about:blank - Microsoft Internet Explorer'
- ClassName: '(null)' WindowName: 'IM'
- ClassName: '(null)' WindowName: 'Pserver'
- ClassName: '(null)' WindowName: 'ENT58VIP2008'
- ClassName: '(null)' WindowName: '%WINDIR%\inf'
- ClassName: '(null)' WindowName: 'SlavesystemSer'
- ClassName: 'RegEdit_RegEdit' WindowName: '(null)'
- ClassName: 'TApplication' WindowName: 'Iexplore'
- ClassName: 'TApplication' WindowName: 'svchost'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: '(null)' WindowName: 'ENT58???'
- ClassName: '(null)' WindowName: '??2008???'
- ClassName: '(null)' WindowName: 'server'
- ClassName: '(null)' WindowName: 'Tlkwks'
- ClassName: '(null)' WindowName: 'eciojer'
- ClassName: '(null)' WindowName: 'rejoice'
- ClassName: '(null)' WindowName: 'WINNET - ??????'
- ClassName: '(null)' WindowName: '???'
- ClassName: '(null)' WindowName: 'MastersystemSer'
- ClassName: '(null)' WindowName: '??????'
- ClassName: '(null)' WindowName: 'NX??????'
- ClassName: '(null)' WindowName: 'Cache'
- ClassName: '(null)' WindowName: '%WINDIR%\Installer\Cache'
- ClassName: '(null)' WindowName: 'Installer'
- ClassName: '(null)' WindowName: 'Nvsvc32.exe - ??????'
- ClassName: '(null)' WindowName: 'WINNET: WINNET - ??????'
- ClassName: '(null)' WindowName: 'WINNET:WINNET - ??????'
- ClassName: '(null)' WindowName: 'WINNET '
