Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'MAAgent' = '%PROGRAM_FILES%\MarkAny\ContentSAFER\MAAgent.exe'
- [<HKLM>\SOFTWARE\Classes\MarkAny ContentSAFER Client\Shell\Open\Command] '' = '"%PROGRAM_FILES%\MarkAny\ContentSAFER\MaCSMgr.exe" "%1"'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] '{88485281-8b4b-4f8d-9ede-82e29a064277}' = 'MarkAny Contents Safer Manager 1.0'
Вредоносные функции:
Создает и запускает на исполнение:
- '%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\IKernel.exe' 32\IKernel.exe -Embedding
- '%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\IKernel.exe' /REGSERVER
- '%TEMP%\pft3~tmp\Disk1\Setup.exe' -s
- '%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\IKernel.exe' -RegServer
Изменения в файловой системе:
Создает следующие файлы:
- <SYSTEM32>\MK_L5a2c.rra
- %PROGRAM_FILES%\InstallShield Installation Information\{69E0D9E4-1474-48C9-A191-A32CC6A40027}\Setup.ini
- %PROGRAM_FILES%\InstallShield Installation Information\{69E0D9E4-1474-48C9-A191-A32CC6A40027}\setu5922.rra
- <SYSTEM32>\MaJU5a6a.rra
- <SYSTEM32>\MACX5b07.rra
- <SYSTEM32>\MaJG5ad8.rra
- <SYSTEM32>\MaXM5aa9.rra
- %PROGRAM_FILES%\InstallShield Installation Information\{69E0D9E4-1474-48C9-A191-A32CC6A40027}\layo57ea.rra
- %ALLUSERSPROFILE%\Start Menu\Programs\MarkAny\ContentSAFER Client\ContentSAFER Client »иБ¦.lnk
- %TEMP%\pft3~tmp\Disk1\setup.log
- %PROGRAM_FILES%\InstallShield Installation Information\{69E0D9E4-1474-48C9-A191-A32CC6A40027}\data5819.rra
- %PROGRAM_FILES%\InstallShield Installation Information\{69E0D9E4-1474-48C9-A191-A32CC6A40027}\Setu58f3.rra
- %PROGRAM_FILES%\InstallShield Installation Information\{69E0D9E4-1474-48C9-A191-A32CC6A40027}\Setu58a5.rra
- %PROGRAM_FILES%\InstallShield Installation Information\{69E0D9E4-1474-48C9-A191-A32CC6A40027}\data5838.rra
- <SYSTEM32>\MASe5ceb.rra
- %PROGRAM_FILES%\MarkAny\ContentSAFER\mapw5cbc.rra
- %PROGRAM_FILES%\MarkAny\ContentSAFER\maps5c9d.rra
- %PROGRAM_FILES%\MarkAny\ContentSAFER\UpdateClient\MAUp5d0a.rra
- %PROGRAM_FILES%\MarkAny\ContentSAFER\MACS5db6.rra
- %PROGRAM_FILES%\MarkAny\ContentSAFER\UpdateClient\MAFi5d58.rra
- %PROGRAM_FILES%\MarkAny\ContentSAFER\UpdateClient\MaUp5d39.rra
- %PROGRAM_FILES%\MarkAny\ContentSAFER\MAAg5bc2.rra
- %PROGRAM_FILES%\MarkAny\ContentSAFER\User5b84.rra
- <SYSTEM32>\MADR5b45.rra
- %PROGRAM_FILES%\MarkAny\ContentSAFER\MAWe5bf1.rra
- %PROGRAM_FILES%\MarkAny\ContentSAFER\MaCS5c6e.rra
- %PROGRAM_FILES%\MarkAny\ContentSAFER\MaCS5c4f.rra
- %PROGRAM_FILES%\MarkAny\ContentSAFER\MAAu5c10.rra
- %TEMP%\{69e0d9e4-1474-48c9-a191-a32cc6a40027}\_IsR4879.rra
- %TEMP%\pft3~tmp\Disk1\Setup.ini
- %TEMP%\pft3~tmp\Disk1\Setup.exe
- %TEMP%\pft3~tmp\Disk1\data2.cab
- %TEMP%\pft3~tmp\Disk1\Setup.inx
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\temp.000
- %TEMP%\IEC4.tmp
- %TEMP%\pft3~tmp\Disk1\layout.bin
- %TEMP%\pft3~tmp\pftw1.pkg
- %TEMP%\plf1.tmp
- %TEMP%\ext2.tmp
- %TEMP%\pft3~tmp\Disk1\setup.iss
- %TEMP%\pft3~tmp\Disk1\data1.cab
- %TEMP%\pft3~tmp\Disk1\data1.hdr
- %TEMP%\pft3~tmp\Disk1\ikernel.ex_
- %TEMP%\{69e0d9e4-1474-48c9-a191-a32cc6a40027}\vssv45f8.rra
- %TEMP%\{69e0d9e4-1474-48c9-a191-a32cc6a40027}\lice45d9.rra
- %TEMP%\{69e0d9e4-1474-48c9-a191-a32cc6a40027}\info45aa.rra
- %TEMP%\{69e0d9e4-1474-48c9-a191-a32cc6a40027}\valu46a4.rra
- %TEMP%\{69e0d9e4-1474-48c9-a191-a32cc6a40027}\defa47ec.rra
- %TEMP%\{69e0d9e4-1474-48c9-a191-a32cc6a40027}\isrt475f.rra
- %TEMP%\{69e0d9e4-1474-48c9-a191-a32cc6a40027}\vssv46d3.rra
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\ctor31e3.rra
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\core3157.rra
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\obje34c2.rra
- %TEMP%\{69e0d9e4-1474-48c9-a191-a32cc6a40027}\setu44fe.rra
- %CommonProgramFiles%\InstallShield\IScript\iscr38b9.rra
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\iuse354e.rra
Удаляет следующие файлы:
- %TEMP%\pft3~tmp\Disk1\data2.cab
- %TEMP%\pft3~tmp\Disk1\ikernel.ex_
- %TEMP%\pft3~tmp\Disk1\data1.hdr
- %TEMP%\plf1.tmp
- %TEMP%\pft3~tmp\Disk1\data1.cab
- %TEMP%\pft3~tmp\Disk1\layout.bin
- %TEMP%\pft3~tmp\Disk1\setup.iss
- %TEMP%\pft3~tmp\Disk1\setup.log
- %TEMP%\pft3~tmp\Disk1\Setup.inx
- %TEMP%\pft3~tmp\Disk1\Setup.exe
- %TEMP%\pft3~tmp\Disk1\Setup.ini
- %TEMP%\{69e0d9e4-1474-48c9-a191-a32cc6a40027}\vssver.scc
- %TEMP%\{69e0d9e4-1474-48c9-a191-a32cc6a40027}\_IsRes.dll
- %TEMP%\IEC4.tmp
- %TEMP%\ext2.tmp
- %TEMP%\pft3~tmp\pftw1.pkg
- %TEMP%\{69e0d9e4-1474-48c9-a191-a32cc6a40027}\default.pal
- %TEMP%\{69e0d9e4-1474-48c9-a191-a32cc6a40027}\infolist.txt
- %TEMP%\{69e0d9e4-1474-48c9-a191-a32cc6a40027}\setup.inx
- %TEMP%\{69e0d9e4-1474-48c9-a191-a32cc6a40027}\license.txt
- %TEMP%\{69e0d9e4-1474-48c9-a191-a32cc6a40027}\isrt.dll
- %TEMP%\{69e0d9e4-1474-48c9-a191-a32cc6a40027}\value.shl
Перемещает следующие файлы:
- %PROGRAM_FILES%\MarkAny\ContentSAFER\User5b84.rra в %PROGRAM_FILES%\MarkAny\ContentSAFER\UserShare.dll
- <SYSTEM32>\MADR5b45.rra в <SYSTEM32>\MADRM.dll
- %PROGRAM_FILES%\MarkAny\ContentSAFER\MAAg5bc2.rra в %PROGRAM_FILES%\MarkAny\ContentSAFER\MAAgent.exe
- %PROGRAM_FILES%\MarkAny\ContentSAFER\MAAu5c10.rra в %PROGRAM_FILES%\MarkAny\ContentSAFER\MAAuthProc.dll
- %PROGRAM_FILES%\MarkAny\ContentSAFER\MAWe5bf1.rra в %PROGRAM_FILES%\MarkAny\ContentSAFER\MAWebControl.dll
- <SYSTEM32>\MaJU5a6a.rra в <SYSTEM32>\MaJUtilLib.dll
- <SYSTEM32>\MK_L5a2c.rra в <SYSTEM32>\MK_Lyric.dll
- <SYSTEM32>\MaXM5aa9.rra в <SYSTEM32>\MaXMLProto.dll
- <SYSTEM32>\MACX5b07.rra в <SYSTEM32>\MACXMLProto.dll
- <SYSTEM32>\MaJG5ad8.rra в <SYSTEM32>\MaJGUILib.dll
- %PROGRAM_FILES%\MarkAny\ContentSAFER\UpdateClient\MaUp5d39.rra в %PROGRAM_FILES%\MarkAny\ContentSAFER\UpdateClient\MaUpdateClient.exe
- %PROGRAM_FILES%\MarkAny\ContentSAFER\UpdateClient\MAUp5d0a.rra в %PROGRAM_FILES%\MarkAny\ContentSAFER\UpdateClient\MAUpdateBoot.exe
- %PROGRAM_FILES%\MarkAny\ContentSAFER\UpdateClient\MAFi5d58.rra в %PROGRAM_FILES%\MarkAny\ContentSAFER\UpdateClient\MAFileUpdate.dll
- %TEMP%\2c27.rra в %PROGRAM_FILES%\InstallShield Installation Information\{69E0D9E4-1474-48C9-A191-A32CC6A40027}\setup.ilg
- %PROGRAM_FILES%\MarkAny\ContentSAFER\MACS5db6.rra в %PROGRAM_FILES%\MarkAny\ContentSAFER\MACSMANAGER.dll
- %PROGRAM_FILES%\MarkAny\ContentSAFER\MaCS5c6e.rra в %PROGRAM_FILES%\MarkAny\ContentSAFER\MaCSProHook.dll
- %PROGRAM_FILES%\MarkAny\ContentSAFER\MaCS5c4f.rra в %PROGRAM_FILES%\MarkAny\ContentSAFER\MaCSMgr.exe
- %PROGRAM_FILES%\MarkAny\ContentSAFER\maps5c9d.rra в %PROGRAM_FILES%\MarkAny\ContentSAFER\mapshapi.dll
- <SYSTEM32>\MASe5ceb.rra в <SYSTEM32>\MASetupCleaner.exe
- %PROGRAM_FILES%\MarkAny\ContentSAFER\mapw5cbc.rra в %PROGRAM_FILES%\MarkAny\ContentSAFER\mapwij10.dll
- %PROGRAM_FILES%\InstallShield Installation Information\{69E0D9E4-1474-48C9-A191-A32CC6A40027}\setu5922.rra в %PROGRAM_FILES%\InstallShield Installation Information\{69E0D9E4-1474-48C9-A191-A32CC6A40027}\setup.inx
- %TEMP%\{69e0d9e4-1474-48c9-a191-a32cc6a40027}\setu44fe.rra в %TEMP%\{69e0d9e4-1474-48c9-a191-a32cc6a40027}\setup.inx
- %CommonProgramFiles%\InstallShield\IScript\iscr38b9.rra в %CommonProgramFiles%\InstallShield\IScript\iscript.dll
- %TEMP%\{69e0d9e4-1474-48c9-a191-a32cc6a40027}\info45aa.rra в %TEMP%\{69e0d9e4-1474-48c9-a191-a32cc6a40027}\infolist.txt
- %TEMP%\{69e0d9e4-1474-48c9-a191-a32cc6a40027}\vssv45f8.rra в %TEMP%\{69e0d9e4-1474-48c9-a191-a32cc6a40027}\vssver.scc
- %TEMP%\{69e0d9e4-1474-48c9-a191-a32cc6a40027}\lice45d9.rra в %TEMP%\{69e0d9e4-1474-48c9-a191-a32cc6a40027}\license.txt
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\core3157.rra в %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\corecomp.ini
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\temp.000 в %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\IKernel.exe
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\ctor31e3.rra в %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\ctor.dll
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\iuse354e.rra в %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\iuser.dll
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\obje34c2.rra в %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\objectps.dll
- %PROGRAM_FILES%\InstallShield Installation Information\{69E0D9E4-1474-48C9-A191-A32CC6A40027}\data5819.rra в %PROGRAM_FILES%\InstallShield Installation Information\{69E0D9E4-1474-48C9-A191-A32CC6A40027}\data1.hdr
- %PROGRAM_FILES%\InstallShield Installation Information\{69E0D9E4-1474-48C9-A191-A32CC6A40027}\layo57ea.rra в %PROGRAM_FILES%\InstallShield Installation Information\{69E0D9E4-1474-48C9-A191-A32CC6A40027}\layout.bin
- %PROGRAM_FILES%\InstallShield Installation Information\{69E0D9E4-1474-48C9-A191-A32CC6A40027}\data5838.rra в %PROGRAM_FILES%\InstallShield Installation Information\{69E0D9E4-1474-48C9-A191-A32CC6A40027}\data1.cab
- %PROGRAM_FILES%\InstallShield Installation Information\{69E0D9E4-1474-48C9-A191-A32CC6A40027}\Setu58f3.rra в %PROGRAM_FILES%\InstallShield Installation Information\{69E0D9E4-1474-48C9-A191-A32CC6A40027}\Setup.ini
- %PROGRAM_FILES%\InstallShield Installation Information\{69E0D9E4-1474-48C9-A191-A32CC6A40027}\Setu58a5.rra в %PROGRAM_FILES%\InstallShield Installation Information\{69E0D9E4-1474-48C9-A191-A32CC6A40027}\Setup.exe
- %TEMP%\{69e0d9e4-1474-48c9-a191-a32cc6a40027}\vssv46d3.rra в %TEMP%\{69e0d9e4-1474-48c9-a191-a32cc6a40027}\vssver.scc
- %TEMP%\{69e0d9e4-1474-48c9-a191-a32cc6a40027}\valu46a4.rra в %TEMP%\{69e0d9e4-1474-48c9-a191-a32cc6a40027}\value.shl
- %TEMP%\{69e0d9e4-1474-48c9-a191-a32cc6a40027}\isrt475f.rra в %TEMP%\{69e0d9e4-1474-48c9-a191-a32cc6a40027}\isrt.dll
- %TEMP%\{69e0d9e4-1474-48c9-a191-a32cc6a40027}\_IsR4879.rra в %TEMP%\{69e0d9e4-1474-48c9-a191-a32cc6a40027}\_IsRes.dll
- %TEMP%\{69e0d9e4-1474-48c9-a191-a32cc6a40027}\defa47ec.rra в %TEMP%\{69e0d9e4-1474-48c9-a191-a32cc6a40027}\default.pal
Другое:
Ищет следующие окна:
- ClassName: '(null)' WindowName: 'MaAgent_{9E8B0CC0-AACD-4a03-812B-CB4C6D215209}'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
