Техническая информация
Вредоносные функции:
Создает и запускает на исполнение:
- '%TEMP%\setup.exe'
- '%TEMP%\setup.exe' (загружен из сети Интернет)
Изменения в файловой системе:
Создает следующие файлы:
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\drivetable.txt
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\domain.txt
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\ComDb.Dat
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP15\drivetable.txt
- %PROGRAM_FILES%\InstallShield Installation Information\{A74159CB-5F27-296A-A210-911E78D7B3F3}\layo94ee.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.BTR
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\$WinMgmt.CFG
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_.DEFAULT
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SECURITY
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SAM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SYSTEM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SOFTWARE
- %PROGRAM_FILES%\InstallShield Installation Information\{A74159CB-5F27-296A-A210-911E78D7B3F3}\data94fe.rra
- %PROGRAM_FILES%\InstallShield Installation Information\{A74159CB-5F27-296A-A210-911E78D7B3F3}\setu9684.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.DATA
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING2.MAP
- %PROGRAM_FILES%\InstallShield Installation Information\{A74159CB-5F27-296A-A210-911E78D7B3F3}\setup.ini
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\RestorePointSize
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.MAP
- %WINDIR%\rSpe9701.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.MAP
- %PROGRAM_FILES%\InstallShield Installation Information\{A74159CB-5F27-296A-A210-911E78D7B3F3}\setu959a.rra
- %PROGRAM_FILES%\InstallShield Installation Information\{A74159CB-5F27-296A-A210-911E78D7B3F3}\data952c.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING.VER
- %PROGRAM_FILES%\InstallShield Installation Information\{A74159CB-5F27-296A-A210-911E78D7B3F3}\ISSe9607.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING1.MAP
- %PROGRAM_FILES%\InstallShield Installation Information\{A74159CB-5F27-296A-A210-911E78D7B3F3}\_Set95d8.rra
- %TEMP%\{A8CAB851-138F-46BB-9A7B-BDC9E2D481AA}\setup.ini
- %TEMP%\{A8CAB851-138F-46BB-9A7B-BDC9E2D481AA}\_Setup.dll
- %TEMP%\{EC33A841-DDE6-49F6-BE32-BB93E6369996}\{A74159CB-5F27-296A-A210-911E78D7B3F3}\setu226d.rra
- %TEMP%\{EC33A841-DDE6-49F6-BE32-BB93E6369996}\{A74159CB-5F27-296A-A210-911E78D7B3F3}\Font29a1.rra
- %TEMP%\{EC33A841-DDE6-49F6-BE32-BB93E6369996}\dotn28e6.rra
- %TEMP%\{EC33A841-DDE6-49F6-BE32-BB93E6369996}\core24ee.rra
- %TEMP%\{A8CAB851-138F-46BB-9A7B-BDC9E2D481AA}\Disk1\ISSetup.dll
- %TEMP%\{A8CAB851-138F-46BB-9A7B-BDC9E2D481AA}\Disk1\data1.hdr
- %TEMP%\{A8CAB851-138F-46BB-9A7B-BDC9E2D481AA}\Disk1\data1.cab
- %TEMP%\{A8CAB851-138F-46BB-9A7B-BDC9E2D481AA}\Disk1\layout.bin
- %TEMP%\{A8CAB851-138F-46BB-9A7B-BDC9E2D481AA}\Disk1\_Setup.dll
- %TEMP%\{A8CAB851-138F-46BB-9A7B-BDC9E2D481AA}\Disk1\setup.ini
- %TEMP%\{A8CAB851-138F-46BB-9A7B-BDC9E2D481AA}\Disk1\setup.exe
- %TEMP%\{EC33A841-DDE6-49F6-BE32-BB93E6369996}\{A74159CB-5F27-296A-A210-911E78D7B3F3}\DIFx29c0.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\rp.log
- %TEMP%\setu68bd.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
- %TEMP%\{EC33A841-DDE6-49F6-BE32-BB93E6369996}\{A74159CB-5F27-296A-A210-911E78D7B3F3}\defa3029.rra
- %TEMP%\{EC33A841-DDE6-49F6-BE32-BB93E6369996}\{A74159CB-5F27-296A-A210-911E78D7B3F3}\isrt2e35.rra
- %TEMP%\{EC33A841-DDE6-49F6-BE32-BB93E6369996}\{A74159CB-5F27-296A-A210-911E78D7B3F3}\Stri2b09.rra
- %TEMP%\{EC33A841-DDE6-49F6-BE32-BB93E6369996}\{A74159CB-5F27-296A-A210-911E78D7B3F3}\_IsR353a.rra
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\download[1].php
- %ALLUSERSPROFILE%\Start Menu\Programs\Speckled Butterflyfish Wallpaper\Uninstall SpeckledButterflyfishWallpaper.lnk
- %TEMP%\{EC33A841-DDE6-49F6-BE32-BB93E6369996}\{A74159CB-5F27-296A-A210-911E78D7B3F3}\difx39be.rra
Перемещает следующие файлы:
- %PROGRAM_FILES%\InstallShield Installation Information\{A74159CB-5F27-296A-A210-911E78D7B3F3}\data94fe.rra в %PROGRAM_FILES%\InstallShield Installation Information\{A74159CB-5F27-296A-A210-911E78D7B3F3}\data1.hdr
- %PROGRAM_FILES%\InstallShield Installation Information\{A74159CB-5F27-296A-A210-911E78D7B3F3}\data952c.rra в %PROGRAM_FILES%\InstallShield Installation Information\{A74159CB-5F27-296A-A210-911E78D7B3F3}\data1.cab
- %TEMP%\setu68bd.rra в %TEMP%\setup.exe
- %PROGRAM_FILES%\InstallShield Installation Information\{A74159CB-5F27-296A-A210-911E78D7B3F3}\layo94ee.rra в %PROGRAM_FILES%\InstallShield Installation Information\{A74159CB-5F27-296A-A210-911E78D7B3F3}\layout.bin
- %PROGRAM_FILES%\InstallShield Installation Information\{A74159CB-5F27-296A-A210-911E78D7B3F3}\setu959a.rra в %PROGRAM_FILES%\InstallShield Installation Information\{A74159CB-5F27-296A-A210-911E78D7B3F3}\setup.exe
- %PROGRAM_FILES%\InstallShield Installation Information\{A74159CB-5F27-296A-A210-911E78D7B3F3}\setu9684.rra в %PROGRAM_FILES%\InstallShield Installation Information\{A74159CB-5F27-296A-A210-911E78D7B3F3}\setup.ini
- %WINDIR%\rSpe9701.rra в %WINDIR%\rSpeckle.exe
- %PROGRAM_FILES%\InstallShield Installation Information\{A74159CB-5F27-296A-A210-911E78D7B3F3}\_Set95d8.rra в %PROGRAM_FILES%\InstallShield Installation Information\{A74159CB-5F27-296A-A210-911E78D7B3F3}\_Setup.dll
- %PROGRAM_FILES%\InstallShield Installation Information\{A74159CB-5F27-296A-A210-911E78D7B3F3}\ISSe9607.rra в %PROGRAM_FILES%\InstallShield Installation Information\{A74159CB-5F27-296A-A210-911E78D7B3F3}\ISSetup.dll
- %TEMP%\{EC33A841-DDE6-49F6-BE32-BB93E6369996}\{A74159CB-5F27-296A-A210-911E78D7B3F3}\difx39be.rra в %TEMP%\{EC33A841-DDE6-49F6-BE32-BB93E6369996}\{A74159CB-5F27-296A-A210-911E78D7B3F3}\difxapi.dll
- %TEMP%\{EC33A841-DDE6-49F6-BE32-BB93E6369996}\dotn28e6.rra в %TEMP%\{EC33A841-DDE6-49F6-BE32-BB93E6369996}\dotnetinstaller.exe
- %TEMP%\{EC33A841-DDE6-49F6-BE32-BB93E6369996}\{A74159CB-5F27-296A-A210-911E78D7B3F3}\Font29a1.rra в %TEMP%\{EC33A841-DDE6-49F6-BE32-BB93E6369996}\{A74159CB-5F27-296A-A210-911E78D7B3F3}\FontData.ini
- %TEMP%\{EC33A841-DDE6-49F6-BE32-BB93E6369996}\{A74159CB-5F27-296A-A210-911E78D7B3F3}\setu226d.rra в %TEMP%\{EC33A841-DDE6-49F6-BE32-BB93E6369996}\{A74159CB-5F27-296A-A210-911E78D7B3F3}\setup.inx
- %TEMP%\{EC33A841-DDE6-49F6-BE32-BB93E6369996}\core24ee.rra в %TEMP%\{EC33A841-DDE6-49F6-BE32-BB93E6369996}\corecomp.ini
- %TEMP%\{EC33A841-DDE6-49F6-BE32-BB93E6369996}\{A74159CB-5F27-296A-A210-911E78D7B3F3}\DIFx29c0.rra в %TEMP%\{EC33A841-DDE6-49F6-BE32-BB93E6369996}\{A74159CB-5F27-296A-A210-911E78D7B3F3}\DIFxData.ini
- %TEMP%\{EC33A841-DDE6-49F6-BE32-BB93E6369996}\{A74159CB-5F27-296A-A210-911E78D7B3F3}\defa3029.rra в %TEMP%\{EC33A841-DDE6-49F6-BE32-BB93E6369996}\{A74159CB-5F27-296A-A210-911E78D7B3F3}\default.pal
- %TEMP%\{EC33A841-DDE6-49F6-BE32-BB93E6369996}\{A74159CB-5F27-296A-A210-911E78D7B3F3}\_IsR353a.rra в %TEMP%\{EC33A841-DDE6-49F6-BE32-BB93E6369996}\{A74159CB-5F27-296A-A210-911E78D7B3F3}\_IsRes.dll
- %TEMP%\{EC33A841-DDE6-49F6-BE32-BB93E6369996}\{A74159CB-5F27-296A-A210-911E78D7B3F3}\Stri2b09.rra в %TEMP%\{EC33A841-DDE6-49F6-BE32-BB93E6369996}\{A74159CB-5F27-296A-A210-911E78D7B3F3}\StringTable-0009-English.ips
- %TEMP%\{EC33A841-DDE6-49F6-BE32-BB93E6369996}\{A74159CB-5F27-296A-A210-911E78D7B3F3}\isrt2e35.rra в %TEMP%\{EC33A841-DDE6-49F6-BE32-BB93E6369996}\{A74159CB-5F27-296A-A210-911E78D7B3F3}\isrt.dll
Сетевая активность:
Подключается к:
- 'www.co###13west.com':80
- 'localhost':1035
TCP:
Запросы HTTP GET:
- www.co###13west.com/download.php?ln######
UDP:
- DNS ASK www.co###13west.com
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
