Техническая информация
Вредоносные функции:
Создает и запускает на исполнение:
- '%PROGRAM_FILES%\INITECH\INISAFE Web Client v6.4\INISAFEWeb60Tray.exe' /RegServer
- '%TEMP%\nsp3.tmp\ns4.tmp' "%PROGRAM_FILES%\INITECH\INISAFE Web Client v6.4\INISAFEWeb60Tray.exe" /RegServer
Изменения в файловой системе:
Создает следующие файлы:
- %PROGRAM_FILES%\INITECH\INISAFE Web Client v6.4\inicrypto_v5.1.9.dll
- %PROGRAM_FILES%\INITECH\INISAFE Web Client v6.4\inicore_v2.3.40.dll
- %PROGRAM_FILES%\NPKI\CrossCert\B674A99B923CC751B122A44FBCB73CFE2233D776_4100.der
- %PROGRAM_FILES%\INITECH\INISAFE Web Client v6.4\inipki_v5.1.40.dll
- %PROGRAM_FILES%\INITECH\INISAFE Web Client v6.4\INISAFEWeb60.dll
- <SYSTEM32>\nsldap32v11.dll
- %PROGRAM_FILES%\INITECH\INISAFE Web Client v6.4\inisafeweb6.cfg
- %PROGRAM_FILES%\NPKI\KICA\6F1F0BD880BE4AC7184E62CDCE3A6FA19B447061_10056.der
- %PROGRAM_FILES%\NPKI\NCASign\FE2A1DC3637EBFFD31830AB1F1D3F0DA2BE78D7A_10082.der
- %PROGRAM_FILES%\NPKI\NCASign\766D8BCDAD940DF5A5B63F2202B6F59F4349398A_10045.der
- %PROGRAM_FILES%\NPKI\KICA\B909F2B621489A2ABA025980862793166A77F559_10081.der
- %PROGRAM_FILES%\NPKI\CrossCert\0FD92CAF8B33B1B2B4F1151C9D786162E19B1427_10078.der
- %PROGRAM_FILES%\NPKI\CrossCert\D3C1937BD61F964F1C2C6872ACEC4C85614CD2DC_10018.der
- %PROGRAM_FILES%\NPKI\KICA\AE52FD0E0E01F83086377EF618C649254A600970_4106.der
- %PROGRAM_FILES%\INITECH\INISAFE Web Client v6.4\INISAFEWeb60.sig
- %TEMP%\nsp3.tmp\nsExec.dll
- %PROGRAM_FILES%\INITECH\INISAFE Web Client v6.4\INISAFEWeb60vcs.dll
- %PROGRAM_FILES%\INITECH\INISAFE Web Client v6.4\INISAFEAdminCtrl.dll
- %TEMP%\nsp3.tmp\ns4.tmp
- %APPDATA%\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\{0AB9084F-0EF8-499a-A461-DE46D3C4A45B}\plugins\npCrossWeb.dll
- %APPDATA%\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\{0AB9084F-0EF8-499a-A461-DE46D3C4A45B}\defaults\preferences\npcrossweb.js
- %APPDATA%\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\{0AB9084F-0EF8-499a-A461-DE46D3C4A45B}\install.rdf
- %PROGRAM_FILES%\INITECH\INISAFE Web Client v6.4\initech.gif
- %PROGRAM_FILES%\INITECH\INISAFE Web Client v6.4\INISAFEWeb60vcs.sig
- %TEMP%\nsp3.tmp\AccessControl.dll
- %PROGRAM_FILES%\INITECH\INISAFE Web Client v6.4\INISAFEWeb60Tray.sig
- %PROGRAM_FILES%\INITECH\INISAFE Web Client v6.4\INISAFEWeb60Tray.exe
- %PROGRAM_FILES%\INITECH\INISAFE Web Client v6.4\UnINIS64.exe
- %PROGRAM_FILES%\INITECH\INISAFE Web Client v6.4\INISAFEAdminCtrl.sig
- %TEMP%\nsp3.tmp\ISF_NSIS_UTIL.dll
- %WINDIR%\ISF_CheckSFilter.dll
- %PROGRAM_FILES%\NPKI\KISA\FF8A46723358E8488822AA1768DA1648098B3591_3.der
- %PROGRAM_FILES%\NPKI\KISA\troot-rsa-3280.der
- %PROGRAM_FILES%\NPKI\KISA\C8D08EC749AE1F2042B24B7F13C977580CA1CDC1_1.der
- %PROGRAM_FILES%\NPKI\KISA\BFB627D8035A76654C6101415631E58B7B3AD9CC_4.der
- %TEMP%\nsp3.tmp\UAC.dll
- %TEMP%\nsp3.tmp\UAC.LNG
- %TEMP%\nsp2.tmp
- %TEMP%\splashen.bmp
- %TEMP%\nsp3.tmp\modern-header.bmp
- %TEMP%\nsp3.tmp\AdvSplash.dll
- %TEMP%\splashkr.bmp
- %WINDIR%\Application Data\initech\KeyContainer\CACert\D3C1937BD61F964F1C2C6872ACEC4C85614CD2DC_10018.der
- %PROGRAM_FILES%\NPKI\TradeSign\2B7602AE825C7DEE81919EF5895BB9E2995BA9AF_10084.der
- %PROGRAM_FILES%\NPKI\TradeSign\CE671644B27E73FD85A7CD0D1ED3F0D3A52D2639_10023.der
- %PROGRAM_FILES%\NPKI\yessign\5204329F8F9D2172BAFA3398A8617E2733248D5F_4099.der
- %PROGRAM_FILES%\NPKI\TradeSign\4D5D560A0703DF83CAF3D56D8F19FC12AC90A28A_4105.der
- %PROGRAM_FILES%\NPKI\SignKorea\279696BEF384DC5901622423E2187BD3418D2D42_4098.der
- %PROGRAM_FILES%\NPKI\SignKorea\8DAA2008F089E01141BC7FA48E2AC4405ECA563A_10079.der
- %PROGRAM_FILES%\NPKI\SignKorea\B063E7EBA3DBD862C64427FF65E9316273A7C6CC_10010.der
- %WINDIR%\Application Data\initech\KeyContainer\CACert\562174c6.0
- %WINDIR%\Application Data\initech\KeyContainer\CACert\ccefed47.0
- %WINDIR%\Application Data\initech\KeyContainer\CACert\0FD92CAF8B33B1B2B4F1151C9D786162E19B1427_10078.der
- %WINDIR%\Application Data\initech\KeyContainer\CACert\af049c7a.0
- %PROGRAM_FILES%\NPKI\yessign\4AFBBD332D8BB1D18C946BFFE042365F1C91CB08_10080.der
- %PROGRAM_FILES%\NPKI\yessign\E2EC6D2CE57D9BC09EAC015379BA9A8F9A85D90B_10050.der
- %WINDIR%\Application Data\initech\KeyContainer\CACert\5ad027d4.0
Удаляет следующие файлы:
- %TEMP%\nsp3.tmp\ns4.tmp
Другое:
Ищет следующие окна:
- ClassName: '#32770' WindowName: '(null)'
- ClassName: 'SysListView32' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: '' WindowName: ''
