Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Exefiles' = '%WINDIR%\Bred.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'System' = '<DRIVERS>\DriverStore.exe'
- [<HKLM>\SOFTWARE\Classes\textfile\shell\open\command] '' = '%WINDIR%\TextFile.txt'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'run' = '%WINDIR%\Infinity.exe'
- [<HKLM>\SOFTWARE\Classes\exefile\shell\open\command] '' = '%WINDIR%\SVCH0ST.exe "%1" %*'
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\notepad.exe' %WINDIR%\TextFile.txt
Изменения в файловой системе:
Создает следующие файлы:
- %WINDIR%\DieMFDie.exe
- %WINDIR%\Dope.exe
- %WINDIR%\Disturbed.exe
- %WINDIR%\Sh1ttyMan.exe
- %WINDIR%\IWillWatchHowYouDie.exe
- %WINDIR%\DieMothefuckerDie.exe
- %WINDIR%\bot.exe
- %WINDIR%\botnet.exe
- %WINDIR%\FuckYeahOwnedBySqueQ.exe
- %WINDIR%\Distributed Denial Of Service.exe
- %WINDIR%\Denial.exe
- %WINDIR%\DDoSbot.exe
- %WINDIR%\Narkoman.exe
- %WINDIR%\FallEverything.exe
- %WINDIR%\FallingCunt.exe
- %WINDIR%\FallingDown.exe
- %WINDIR%\FuckYeah1.exe
- %WINDIR%\FuckYouman.exe
- %WINDIR%\IWIllSeHowYouFallingDown.exe
- %WINDIR%\IWIllInfectAllAroundYou.exe
- %WINDIR%\Cocain.exe
- %WINDIR%\Geroin.exe
- %WINDIR%\HackedbyMe.BySqueQ.exe
- %WINDIR%\FuckYeahMan.exe
- %WINDIR%\HEHEHEHEHEHEHHEHE.exe
- %WINDIR%\WormBySqueQ.exe
- %WINDIR%\VirMacker.exe
- %WINDIR%\axxaxaxa.exe
- %WINDIR%\FuckedByMe.exe
- %WINDIR%\Avi.Jpg.Porno.Haha.DeQz.SqueQ.Worm.exe
- %WINDIR%\I_Love_to_Infect_every_Body_in_the_world.exe
- %WINDIR%\Infinity.exe
- %WINDIR%\SVCH0ST.exe
- %WINDIR%\TextFile.txt
- %WINDIR%\FuckingManYouAre.exe
- <DRIVERS>\DriverStore.exe
- %WINDIR%\hahahahahaahhahahahaha.exe
- %WINDIR%\Bred.exe
- %WINDIR%\Big_Boobs.jpg.exe
- %WINDIR%\Boob.exe
- %WINDIR%\ExcuseMe_Owned.exe
- %WINDIR%\Crashed.exe
- %WINDIR%\Porn.avi.exe
- %WINDIR%\Porn.Jpg.exe
- %WINDIR%\Drocher.exe
- %WINDIR%\Masturbation.exe
- %WINDIR%\FuckYeahSHitit.exe
- %WINDIR%\FuckYouManIwillFuckAllArroundYou.exe
- %WINDIR%\IFuckYourSister.exe
- %WINDIR%\Fucker.exe
- %WINDIR%\Yeahman.exe
- %WINDIR%\FUckYou.exe
- %WINDIR%\InfectMeForevermY.exe
- %WINDIR%\FuckYeah.exe
- %WINDIR%\AnastasyaNikolina.exe
- %WINDIR%\NikolinaNastya.exe
- %WINDIR%\Infector.str.exe
- %WINDIR%\FuckingShit.exe
- %WINDIR%\WormWin32Rebhib.exe
- %WINDIR%\Slayer.exe
- %WINDIR%\IwillFuckyou.exe
- %WINDIR%\HahaCunt.exe
- %WINDIR%\OloLo.exe
- %WINDIR%\Securelist_is_my_favorite_site_xD.exe
- %WINDIR%\infectionList.exe
- %WINDIR%\Infector.exe
- %WINDIR%\Worm.exe
- %WINDIR%\HackedbySqueQ.exe
- %WINDIR%\InfectedbyMe.exe
- %WINDIR%\InfectFolder.exe
- %WINDIR%\IloveNastyaVeryMuch.exe
- %WINDIR%\NikolinaIwantYou.exe
- %WINDIR%\Настенька_Любимая_Моя.exe
- %WINDIR%\Owned.exe
- %WINDIR%\Owner.exe
- %WINDIR%\Koza.exe
- %WINDIR%\Own4d.exe
- %WINDIR%\Lolkati.exe
- %WINDIR%\InfectedByMyWOrm.exe
- %WINDIR%\Niko.exe
- %WINDIR%\HAHAOwnedBySqueQLammaer.exe
- %WINDIR%\YouareOwnedByMe.exe
- %WINDIR%\RеgEdit.exe
- %WINDIR%\WarriorOfRussianWar.exe
- %WINDIR%\FuckIlikeIt.exe
- %WINDIR%\Expl0rer.exe
- %WINDIR%\taskmgr.exe
- %WINDIR%\сmd.exe
- %WINDIR%\Yahahhaha.exe
- %WINDIR%\OloLolSha.exe
- %WINDIR%\AHAHAHACUNT.exe
- %WINDIR%\Mydlo.exe
- %WINDIR%\HackWin.exe
- %WINDIR%\Hacking.exe
- %WINDIR%\Cheater.exe
- %WINDIR%\Asshole.exe
- %WINDIR%\Bitch.exe
- %WINDIR%\OMG.exe
- %WINDIR%\OloLoShka.exe
- %WINDIR%\IhateYouMan.exe
- %WINDIR%\HackedbyMe.exe
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'Indicator' WindowName: '(null)'
