Техническая информация
Для обеспечения автозапуска и распространения:
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\uninst] 'Start' = '00000002'
Вредоносные функции:
Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%WINDIR%\inf\netclient.exe' = '%WINDIR%\inf\netclient.exe:*:Enabled:TCP/IP'
Создает и запускает на исполнение:
- '%WINDIR%\inf\cacls.exe' %WINDIR%\ServicePackFiles\i386\cscript.exe /E /C /P SYSTEM:N
- '%WINDIR%\inf\cacls.exe' %WINDIR%\ServicePackFiles\i386\net.exe /E /C /P SYSTEM:N
- '%WINDIR%\inf\cacls.exe' %WINDIR%\ServicePackFiles\i386\net1.exe /E /C /P SYSTEM:N
- '%WINDIR%\inf\cacls.exe' %WINDIR%\ServicePackFiles\i386\tftp.exe /E /C /P SYSTEM:N
- '%WINDIR%\inf\sc.exe' /pid=324
- '%WINDIR%\inf\cacls.exe' %WINDIR%\ServicePackFiles\i386\rcp.exe /E /C /P SYSTEM:N
- '%WINDIR%\inf\cacls.exe' %WINDIR%\ServicePackFiles\i386\debug.exe /E /C /P SYSTEM:N
- '%WINDIR%\inf\sc.exe' %WINDIR%\ServicePackFiles\i386\posix.exe /E /C /P SYSTEM:N
- '%WINDIR%\inf\sc.exe' /pid=2700
- '%WINDIR%\inf\sc.exe' %WINDIR%\ServicePackFiles\i386\telnet.exe /E /C /P SYSTEM:N
- '%WINDIR%\inf\cacls.exe' %WINDIR%\ServicePackFiles\i386\sc.exe /E /C /P SYSTEM:N
- '%WINDIR%\inf\cacls.exe' %WINDIR%\ServicePackFiles\i386\copy.exe /E /C /P SYSTEM:N
- '%WINDIR%\inf\cacls.exe' %WINDIR%\ServicePackFiles\i386\arp.exe /E /C /P SYSTEM:N
- '%WINDIR%\inf\cacls.exe' %WINDIR%\ServicePackFiles\i386\ftp.exe /E /C /P SYSTEM:N
- '%WINDIR%\inf\cacls.exe' %WINDIR%\$NtServicePackUninstall$\ipconfig.exe /E /C /P SYSTEM:N
- '%WINDIR%\inf\cacls.exe' %WINDIR%\$NtServicePackUninstall$\xcopy.exe /E /C /P SYSTEM:N
- '%WINDIR%\inf\cacls.exe' %WINDIR%\$NtServicePackUninstall$\regedit.exe /E /C /P SYSTEM:N
- '%WINDIR%\inf\cacls.exe' %WINDIR%\$NtServicePackUninstall$\arp.exe /E /C /P SYSTEM:N
- '%WINDIR%\inf\cacls.exe' %WINDIR%\$NtServicePackUninstall$\posix.exe /E /C /P SYSTEM:N
- '%WINDIR%\inf\cacls.exe' %WINDIR%\$NtServicePackUninstall$\telnet.exe /E /C /P SYSTEM:N
- '%WINDIR%\inf\cacls.exe' %WINDIR%\$NtServicePackUninstall$\ping.exe /E /C /P SYSTEM:N
- '%WINDIR%\inf\cacls.exe' %WINDIR%\$NtServicePackUninstall$\rsh.exe /E /C /P SYSTEM:N
- '%WINDIR%\inf\cacls.exe' %WINDIR%\$NtServicePackUninstall$\tracert.exe /E /C /P SYSTEM:N
- '%WINDIR%\inf\cacls.exe' %WINDIR%\ServicePackFiles\i386\mshta.exe /E /C /P SYSTEM:N
- '%WINDIR%\inf\cacls.exe' %WINDIR%\$NtServicePackUninstall$\finger.exe /E /C /P SYSTEM:N
- '%WINDIR%\inf\cacls.exe' %WINDIR%\$NtServicePackUninstall$\runonce.exe /E /C /P SYSTEM:N
- '%WINDIR%\inf\cacls.exe' %WINDIR%\$NtServicePackUninstall$\at.exe /E /C /P SYSTEM:N
- '%WINDIR%\inf\cacls.exe' <SYSTEM32>\dllcache\net.exe /E /C /P SYSTEM:N
- '%WINDIR%\inf\cacls.exe' <SYSTEM32>\dllcache\net1.exe /E /C /P SYSTEM:N
- '%WINDIR%\inf\cacls.exe' /pid=764
- '%WINDIR%\inf\cacls.exe' /pid=3768
- '%WINDIR%\inf\cacls.exe' <SYSTEM32>\dllcache\ftp.exe /E /C /P SYSTEM:N
- '%WINDIR%\inf\cacls.exe' <SYSTEM32>\dllcache\tftp.exe /E /C /P SYSTEM:N
- '%WINDIR%\inf\cacls.exe' /pid=4032
- '%WINDIR%\inf\cacls.exe' <SYSTEM32>\net.exe /E /C /P SYSTEM:N
- '%WINDIR%\inf\cacls.exe' <SYSTEM32>\net1.exe /E /C /P SYSTEM:N
- '%WINDIR%\inf\cacls.exe' <SYSTEM32>\sc.exe /E /C /P SYSTEM:N
- '%WINDIR%\inf\cacls.exe' <SYSTEM32>\dllcache\debug.exe /E /C /P SYSTEM:N
- '%WINDIR%\inf\cacls.exe' <SYSTEM32>\ftp.exe /E /C /P SYSTEM:N
- '%WINDIR%\inf\cacls.exe' <SYSTEM32>\tftp.exe /E /C /P SYSTEM:N
- '%WINDIR%\inf\cacls.exe' /pid=3704
- '%WINDIR%\inf\cacls.exe' /pid=2984
- '%WINDIR%\inf\caclsENG.exe' %WINDIR%\ServicePackFiles\i386\xcopy.exe /E /C /P SYSTEM:N
- '%WINDIR%\inf\cacls.exe' %WINDIR%\ServicePackFiles\i386\rsh.exe /E /C /P SYSTEM:N
- '%WINDIR%\inf\sc.exe' /pid=2840
- '%WINDIR%\inf\sc.exe' /S /D /c" echo y"
- '%WINDIR%\inf\caclsENG.exe' /pid=2900
- '%WINDIR%\inf\changetime.exe' %WINDIR%\ServicePackFiles\i386\regedit.exe /E /C /P SYSTEM:N
- '%WINDIR%\inf\cacls.exe' /pid=3568
- '%WINDIR%\inf\cacls.exe' %WINDIR%\ServicePackFiles\i386\tracert.exe /E /C /P SYSTEM:N
- '%WINDIR%\inf\cacls.exe' /pid=3676
- '%WINDIR%\inf\cacls.exe' %WINDIR%\ServicePackFiles\i386\ping.exe /E /C /P SYSTEM:N
- '%WINDIR%\inf\cacls.exe' /pid=1580
- '%WINDIR%\inf\cacls.exe' /S /D /c" echo y"
- '%WINDIR%\inf\changetime.exe' %WINDIR%\inf\dllcache\tunmp.sys %WINDIR%\inf\servucert.key
- '%WINDIR%\inf\netclient.exe' /i /s /h
- '%WINDIR%\inf\netclient.exe'
- '%WINDIR%\inf\changetime.exe' %WINDIR%\inf\dllcache\tunmp.sys %WINDIR%\inf\ssleay32.dll
- '%WINDIR%\inf\changetime.exe' %WINDIR%\inf\dllcache\ndistapi.sys %WINDIR%\inf\Unwise32.dll
- '%WINDIR%\inf\changetime.exe' %WINDIR%\inf\dllcache\tdi.sys %WINDIR%\inf\servucert.crt
- '%WINDIR%\inf\sc.exe' config uninst displayname= "TCP/IP Net Client"
- '%WINDIR%\inf\sc.exe' config lanmanserver depend= uninst
- '%WINDIR%\inf\sc.exe' config lanmanworkstation depend= uninst
- '%WINDIR%\inf\sc.exe' config LSASS depend= uninst
- '%WINDIR%\inf\sc.exe' description RAS "This service handles the connections in your network. If this service is disabled, all services that depend on it, default: Remote Procedure Call (RPC), will fail to start. It is highly recommended to enable this service."
- '%WINDIR%\inf\sc.exe' config uninst error= ignore
- '%WINDIR%\inf\sc.exe' failure uninst actions= restart/500 reset= 10
- '%WINDIR%\inf\changetime.exe' %WINDIR%\inf\dllcache\tdi.sys %WINDIR%\inf\libeay32.dll
- '%WINDIR%\inf\caclsENG.exe' "<Имя диска съемного носителя>:\System Volume Information\restore.wci\snapshot" /T /G system:f
- '%WINDIR%\inf\caclsENG.exe' "e:\System Volume Information\restore.wci" /T /G system:f %USERNAME%s:R
- '%WINDIR%\inf\caclsENG.exe' "e:\System Volume Information\restore.wci\snapshot" /T /G system:f
- '%WINDIR%\inf\caclsENG.exe' "C:\System Volume Information\restore.wci" /T /G system:f %USERNAME%s:R
- '%WINDIR%\inf\caclsENG.exe' "C:\System Volume Information\restore.wci\snapshot" /T /G system:f
- '%WINDIR%\inf\caclsENG.exe' "<Имя диска съемного носителя>:\System Volume Information\restore.wci" /T /G system:f %USERNAME%s:R
- '%WINDIR%\inf\changetime.exe' <SYSTEM32>\svchost.exe %WINDIR%\inf\JAsfv.dll
- '%WINDIR%\inf\changetime.exe' %WINDIR%\explorer.exe %WINDIR%\inf\netclient.exe
- '%WINDIR%\inf\changetime.exe' <SYSTEM32>\svchost.exe "c:\RECYCLER\S-1-5-21-329068152-1677128483-839522115-1110\ipf.cc"
- '%WINDIR%\inf\changetime.exe' <SYSTEM32>\svchost.exe "c:\RECYCLER\S-1-5-21-329068152-1677128483-839522115-1110\ips.cc"
- '%WINDIR%\inf\changetime.exe' <SYSTEM32>\svchost.exe %WINDIR%\inf\JAsfv.ini
- '%WINDIR%\inf\changetime.exe' <SYSTEM32>\svchost.exe %WINDIR%\inf\JAstat.dll
- '%WINDIR%\inf\changetime.exe' <SYSTEM32>\svchost.exe %WINDIR%\inf\JAstat.ini
- '%WINDIR%\inf\changetime.exe' %WINDIR%\$NtServicePackUninstall$\cscript.exe /E /C /P SYSTEM:N
- '%WINDIR%\inf\changetime.exe' /pid=3224
- '%WINDIR%\inf\changetime.exe' /pid=3240
- '%WINDIR%\inf\changetime.exe' %WINDIR%\$NtServicePackUninstall$\rcp.exe /E /C /P SYSTEM:N
- '%WINDIR%\inf\changetime.exe' /pid=3160
- '%WINDIR%\inf\changetime.exe' /pid=3176
- '%WINDIR%\inf\changetime.exe' %WINDIR%\$NtServicePackUninstall$\net.exe /E /C /P SYSTEM:N
- '%WINDIR%\inf\cacls.exe' %WINDIR%\$NtServicePackUninstall$\debug.exe /E /C /P SYSTEM:N
- '%WINDIR%\inf\cacls.exe' %WINDIR%\$NtServicePackUninstall$\sc.exe /E /C /P SYSTEM:N
- '%WINDIR%\inf\cacls.exe' %WINDIR%\$NtServicePackUninstall$\copy.exe /E /C /P SYSTEM:N
- '%WINDIR%\inf\changetime.exe' /pid=3288
- '%WINDIR%\inf\netclient.exe' /pid=3304
- '%WINDIR%\inf\cacls.exe' %WINDIR%\$NtServicePackUninstall$\net1.exe /E /C /P SYSTEM:N
- '%WINDIR%\inf\changetime.exe' /S /D /c" echo y"
- '%WINDIR%\inf\sc.exe' config Dhcp depend= uninst
- '%WINDIR%\inf\sc.exe' config Dnscache depend= uninst
- '%WINDIR%\inf\sc.exe' config Eventlog depend= uninst
- '%WINDIR%\inf\sc.exe' config RpcSs depend= uninst
- '%WINDIR%\inf\sc.exe' config ProtectedStorage depend= uninst
- '%WINDIR%\inf\sc.exe' config Netman depend= uninst
- '%WINDIR%\inf\caclsENG.exe' /pid=2916
- '%WINDIR%\inf\caclsENG.exe' /S /D /c" echo y"
- '%WINDIR%\inf\caclsENG.exe' /pid=3088
- '%WINDIR%\inf\changetime.exe' /pid=3112
- '%WINDIR%\inf\caclsENG.exe' start uninst
- '%WINDIR%\inf\cacls.exe' %WINDIR%\$NtServicePackUninstall$\mshta.exe /E /C /P SYSTEM:N
- '%WINDIR%\inf\caclsENG.exe' /pid=3004
Запускает на исполнение:
- '<SYSTEM32>\attrib.exe' +r +s +h +a dllcache\
- '<SYSTEM32>\attrib.exe' config uninst error= ignore
- '<SYSTEM32>\attrib.exe' /pid=2784
- '<SYSTEM32>\attrib.exe' /S /D /c" echo y"
- '<SYSTEM32>\attrib.exe' %WINDIR%\ServicePackFiles\i386\nc.exe /E /C /P SYSTEM:N
- '<SYSTEM32>\attrib.exe' %WINDIR%\$NtServicePackUninstall$\ftp.exe /E /C /P SYSTEM:N
- '<SYSTEM32>\net1.exe' start uninst
- '<SYSTEM32>\attrib.exe' "C:\System Volume Information\restore.wci" +s +h
- '<SYSTEM32>\attrib.exe' +s +h "c:\RECYCLER\S-1-5-21-329068152-1677128483-839522115-1110"
- '<SYSTEM32>\cmd.exe' /c ""%WINDIR%\inf\install.bat" "
- '<SYSTEM32>\netsh.exe' firewall add allowedprogram %WINDIR%\inf\netclient.exe TCP/IP ENABLE
- '<SYSTEM32>\attrib.exe' "e:\System Volume Information\restore.wci" +s +h
- '<SYSTEM32>\attrib.exe' "<Имя диска съемного носителя>:\System Volume Information\restore.wci" +s +h
Внедряет код в
следующие системные процессы:
- <SYSTEM32>\cmd.exe
- <SYSTEM32>\attrib.exe
Изменения в файловой системе:
Создает следующие файлы:
- %WINDIR%\inf\JAsfv.ini
- %WINDIR%\inf\JAsfv.dll
- %WINDIR%\inf\cacls.exe
- %WINDIR%\inf\JAstat.ini
- %WINDIR%\inf\Unwise32.dll
- %WINDIR%\inf\ssleay32.dll
- %WINDIR%\inf\Tweak.dll
- %WINDIR%\inf\install.bat
- %WINDIR%\inf\libeay32.dll
- %WINDIR%\inf\filter.dll
- %WINDIR%\inf\JAstat.dll
- %WINDIR%\inf\netclient.exe
- %WINDIR%\inf\ipf.cc
- %WINDIR%\inf\ips.cc
- %WINDIR%\inf\sc.exe
- %WINDIR%\inf\caclsENG.exe
- %WINDIR%\inf\changetime.exe
- %WINDIR%\inf\ServUCert.crt
- %WINDIR%\inf\ServUCert.key
Присваивает атрибут 'скрытый' для следующих файлов:
- %WINDIR%\inf\ssleay32.dll
- %WINDIR%\inf\libeay32.dll
Перемещает следующие файлы:
- %WINDIR%\inf\ips.cc в C:\RECYCLER\S-1-5-21-329068152-1677128483-839522115-1110\ips.cc
- %WINDIR%\inf\ipf.cc в C:\RECYCLER\S-1-5-21-329068152-1677128483-839522115-1110\ipf.cc
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'EDIT' WindowName: '(null)'
