Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'AmIcoSinglun' = '%PROGRAM_FILES%\AmIcoSingLun\AmIcoSinglun.exe'
Вредоносные функции:
Создает и запускает на исполнение:
- '%PROGRAM_FILES%\AmIcoSingLun\AmIcoSinglun.exe'
- 'C:\Drivers\IS-1558_Cardreader_Win7x64\setup.exe' /s
Запускает на исполнение:
- '<SYSTEM32>\msiexec.exe' -Embedding B7E93385F1A80EF4A4897D598CDF1581 C
- '<SYSTEM32>\msiexec.exe' -Embedding 344952BB2931E49655BA5385A746F3A3
- '<SYSTEM32>\cmd.exe' /c ""C:\Drivers\IS-1558_Cardreader_Win7x64\Install.bat" "
- '<SYSTEM32>\msiexec.exe' /V
Изменения в файловой системе:
Создает следующие файлы:
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.DATA
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING1.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING2.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\RestorePointSize
- %WINDIR%\Installer\MSI3.tmp
- %WINDIR%\Installer\MSI4.tmp
- %WINDIR%\Installer\2f553.msi
- %WINDIR%\Installer\2f554.mst
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING.VER
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\ComDb.Dat
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\domain.txt
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SYSTEM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SAM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\drivetable.txt
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.BTR
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP15\drivetable.txt
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\$WinMgmt.CFG
- %PROGRAM_FILES%\InstallShield Installation Information\{BF91B300-EEBC-4223-96F3-0FCBF7241B50}\20521dca.rra
- %PROGRAM_FILES%\InstallShield Installation Information\{BF91B300-EEBC-4223-96F3-0FCBF7241B50}\0x041e18.rra
- %PROGRAM_FILES%\InstallShield Installation Information\{BF91B300-EEBC-4223-96F3-0FCBF7241B50}\setu1d1e.rra
- %PROGRAM_FILES%\InstallShield Installation Information\{BF91B300-EEBC-4223-96F3-0FCBF7241B50}\0x081d7c.rra
- %PROGRAM_FILES%\InstallShield Installation Information\{BF91B300-EEBC-4223-96F3-0FCBF7241B50}\10281e47.rra
- %PROGRAM_FILES%\InstallShield Installation Information\{BF91B300-EEBC-4223-96F3-0FCBF7241B50}\setup.ini
- C:\Drivers\IS-1558_Cardreader_Win7x64\setup.log
- %PROGRAM_FILES%\InstallShield Installation Information\{BF91B300-EEBC-4223-96F3-0FCBF7241B50}\0x041e85.rra
- %PROGRAM_FILES%\InstallShield Installation Information\{BF91B300-EEBC-4223-96F3-0FCBF7241B50}\10331ec4.rra
- %PROGRAM_FILES%\InstallShield Installation Information\{BF91B300-EEBC-4223-96F3-0FCBF7241B50}\ISSe1b78.rra
- %PROGRAM_FILES%\AmIcoSingLun\amicosinglun.ini
- %PROGRAM_FILES%\AmIcoSingLun\gamicon.icl
- C:\Config.Msi\2f556.rbs
- %PROGRAM_FILES%\AmIcoSingLun\AmIcoSinglun.exe
- %WINDIR%\Installer\{BF91B300-EEBC-4223-96F3-0FCBF7241B50}\ARPPRODUCTICON.exe
- %TEMP%\2c24d.mst
- %PROGRAM_FILES%\InstallShield Installation Information\{BF91B300-EEBC-4223-96F3-0FCBF7241B50}\setu1994.rra
- %WINDIR%\Installer\{BF91B300-EEBC-4223-96F3-0FCBF7241B50}\1033.mst
- %WINDIR%\Installer\MSI7.tmp
- C:\Drivers\IS-1558_Cardreader_Win7x64\program files\AmIcoSingLun\amicosinglun.ini
- C:\Drivers\IS-1558_Cardreader_Win7x64\program files\AmIcoSingLun\AmIcoSinglun64.exe
- C:\Drivers\IS-1558_Cardreader_Win7x64\ISSetup.dll
- C:\Drivers\IS-1558_Cardreader_Win7x64\program files\AmIcoSingLun\AmIcoSinglun.exe
- C:\Drivers\IS-1558_Cardreader_Win7x64\program files\AmIcoSingLun\gamicon.icl
- C:\Drivers\IS-1558_Cardreader_Win7x64\setup.iss
- %TEMP%\{D6B7353B-8D6A-42FC-98B5-FAD36BA7DE86}\setup.inx
- C:\Drivers\IS-1558_Cardreader_Win7x64\setup.exe
- C:\Drivers\IS-1558_Cardreader_Win7x64\Setup.ini
- C:\Drivers\IS-1558_Cardreader_Win7x64\instmsiw.exe
- C:\Drivers\IS-1558_Cardreader_Win7x64\0x0804.ini
- C:\Drivers\IS-1558_Cardreader_Win7x64\1028.mst
- C:\Drivers\IS-1558_Cardreader_Win7x64\0x0404.ini
- C:\Drivers\IS-1558_Cardreader_Win7x64\0x0409.ini
- C:\Drivers\IS-1558_Cardreader_Win7x64\1033.mst
- C:\Drivers\IS-1558_Cardreader_Win7x64\Install.bat
- C:\Drivers\IS-1558_Cardreader_Win7x64\instmsia.exe
- C:\Drivers\IS-1558_Cardreader_Win7x64\2052.mst
- C:\Drivers\IS-1558_Cardreader_Win7x64\AmIcoSingLun.msi
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SECURITY
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SOFTWARE
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_.DEFAULT
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
- %TEMP%\{D6B7353B-8D6A-42FC-98B5-FAD36BA7DE86}\_isres.dll
- %TEMP%\{D6B7353B-8D6A-42FC-98B5-FAD36BA7DE86}\String1033.txt
- %TEMP%\{D6B7353B-8D6A-42FC-98B5-FAD36BA7DE86}\ISRT.dll
- %TEMP%\{D6B7353B-8D6A-42FC-98B5-FAD36BA7DE86}\setup.exe
- %TEMP%\MSI1.tmp
- %TEMP%\MSI2.tmp
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\rp.log
- %TEMP%\{D6B7353B-8D6A-42FC-98B5-FAD36BA7DE86}\amKillProcess.exe
- %TEMP%\{D6B7353B-8D6A-42FC-98B5-FAD36BA7DE86}\amKillProcess64.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\Config.Msi\2f558.rbf
Удаляет следующие файлы:
- %TEMP%\{D6B7353B-8D6A-42FC-98B5-FAD36BA7DE86}\String1033.txt
- %TEMP%\{D6B7353B-8D6A-42FC-98B5-FAD36BA7DE86}\_isres.dll
- %TEMP%\2c24d.mst
- %TEMP%\{D6B7353B-8D6A-42FC-98B5-FAD36BA7DE86}\ISRT.dll
- %TEMP%\{D6B7353B-8D6A-42FC-98B5-FAD36BA7DE86}\amKillProcess.exe
- %TEMP%\{D6B7353B-8D6A-42FC-98B5-FAD36BA7DE86}\amKillProcess64.exe
- %TEMP%\{D6B7353B-8D6A-42FC-98B5-FAD36BA7DE86}\setup.exe
- %TEMP%\{D6B7353B-8D6A-42FC-98B5-FAD36BA7DE86}\setup.inx
- %WINDIR%\Installer\2f553.msi
- %WINDIR%\Installer\MSI3.tmp
- %WINDIR%\Installer\MSI4.tmp
- %TEMP%\MSI1.tmp
- %TEMP%\MSI2.tmp
- %WINDIR%\Installer\MSI7.tmp
- %WINDIR%\Installer\2f554.mst
- C:\Config.Msi\2f558.rbf
- C:\Config.Msi\2f556.rbs
Перемещает следующие файлы:
- %PROGRAM_FILES%\InstallShield Installation Information\{BF91B300-EEBC-4223-96F3-0FCBF7241B50}\0x041e18.rra в %PROGRAM_FILES%\InstallShield Installation Information\{BF91B300-EEBC-4223-96F3-0FCBF7241B50}\0x0404.ini
- %PROGRAM_FILES%\InstallShield Installation Information\{BF91B300-EEBC-4223-96F3-0FCBF7241B50}\20521dca.rra в %PROGRAM_FILES%\InstallShield Installation Information\{BF91B300-EEBC-4223-96F3-0FCBF7241B50}\2052.mst
- %PROGRAM_FILES%\InstallShield Installation Information\{BF91B300-EEBC-4223-96F3-0FCBF7241B50}\10281e47.rra в %PROGRAM_FILES%\InstallShield Installation Information\{BF91B300-EEBC-4223-96F3-0FCBF7241B50}\1028.mst
- %PROGRAM_FILES%\InstallShield Installation Information\{BF91B300-EEBC-4223-96F3-0FCBF7241B50}\10331ec4.rra в %PROGRAM_FILES%\InstallShield Installation Information\{BF91B300-EEBC-4223-96F3-0FCBF7241B50}\1033.mst
- %PROGRAM_FILES%\InstallShield Installation Information\{BF91B300-EEBC-4223-96F3-0FCBF7241B50}\0x041e85.rra в %PROGRAM_FILES%\InstallShield Installation Information\{BF91B300-EEBC-4223-96F3-0FCBF7241B50}\0x0409.ini
- %PROGRAM_FILES%\InstallShield Installation Information\{BF91B300-EEBC-4223-96F3-0FCBF7241B50}\setu1994.rra в %PROGRAM_FILES%\InstallShield Installation Information\{BF91B300-EEBC-4223-96F3-0FCBF7241B50}\setup.exe
- %WINDIR%\Installer\{BF91B300-EEBC-4223-96F3-0FCBF7241B50}\1033.mst в C:\Config.Msi\2f558.rbf
- %PROGRAM_FILES%\InstallShield Installation Information\{BF91B300-EEBC-4223-96F3-0FCBF7241B50}\ISSe1b78.rra в %PROGRAM_FILES%\InstallShield Installation Information\{BF91B300-EEBC-4223-96F3-0FCBF7241B50}\ISSetup.dll
- %PROGRAM_FILES%\InstallShield Installation Information\{BF91B300-EEBC-4223-96F3-0FCBF7241B50}\0x081d7c.rra в %PROGRAM_FILES%\InstallShield Installation Information\{BF91B300-EEBC-4223-96F3-0FCBF7241B50}\0x0804.ini
- %PROGRAM_FILES%\InstallShield Installation Information\{BF91B300-EEBC-4223-96F3-0FCBF7241B50}\setu1d1e.rra в %PROGRAM_FILES%\InstallShield Installation Information\{BF91B300-EEBC-4223-96F3-0FCBF7241B50}\setup.ini
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'EDIT' WindowName: '(null)'
