Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %ALLUSERSPROFILE%\Start Menu\Programs\Startup\OCS Inventory NG Systray.lnk
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\OCS Inventory Service] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- '%TEMP%\nsf7.tmp\nsB.tmp' %PROGRAM_FILES%\OCS Inventory Agent\OcsService.exe -install
- '%PROGRAM_FILES%\OCS Inventory Agent\OCSInventory.exe' /SAVE_CONF /SERVER=http://oc###ventory-ng/ocsinventory /USER= /PWD= /SSL=1 /CA=cacert.pem /PROXY_TYPE=0 /PROXY= /PROXY_PORT= /PROXY_USER= /PROXY_PWD= /DEBUG=0 /TAG=
- '%TEMP%\nsf7.tmp\nsA.tmp' "%PROGRAM_FILES%\OCS Inventory Agent\ocsinventory.exe" /SAVE_CONF /SERVER=http://oc###ventory-ng/ocsinventory /USER= /PWD= /SSL=1 /CA=cacert.pem /PROXY_TYPE=0 /PROXY= /PROXY_PORT= /PROXY_USER= /PROXY_PWD= /DEBUG=0 /TAG=
- '%PROGRAM_FILES%\OCS Inventory Agent\OCSInventory.exe'
- '%PROGRAM_FILES%\OCS Inventory Agent\OcsService.exe'
- '%PROGRAM_FILES%\OCS Inventory Agent\OcsService.exe' -install
- '%TEMP%\nsf7.tmp\ns8.tmp' SetACL -on "%ALLUSERSPROFILE%\Application Data\OCS Inventory NG\Agent" -ot file -actn ace -ace "n:S-1-5-32-545;p:read_ex,change;s:y;m:set" -ace "n:S-1-5-32-547;p:read_ex,change;s:y;m:set" -actn clear -clr "dacl,sacl" -actn rstchldrn -rst "dacl,sacl"
- '%TEMP%\nsa2.tmp\OcsSetup.exe' /S /NP /PNUM:80 /DEBUG /SERVER:192.168.0.112 /NOSPLASH /FORCE
- '%TEMP%\nsa2.tmp\instocs.exe'
- '%TEMP%\nsf7.tmp\SetACL.exe' -on "%ALLUSERSPROFILE%\Application Data\OCS Inventory NG\Agent\Download" -ot file -actn setprot -op "dacl:np;sacl:np" -actn clear -clr "dacl,sacl" -actn rstchldrn -rst "dacl,sacl"
- '%TEMP%\nsf7.tmp\ns9.tmp' SetACL.exe -on "%ALLUSERSPROFILE%\Application Data\OCS Inventory NG\Agent\Download" -ot file -actn setprot -op "dacl:np;sacl:np" -actn clear -clr "dacl,sacl" -actn rstchldrn -rst "dacl,sacl"
- '%TEMP%\nsf7.tmp\SetACL.exe' -on "%ALLUSERSPROFILE%\Application Data\OCS Inventory NG\Agent" -ot file -actn ace -ace "n:S-1-5-32-545;p:read_ex,change;s:y;m:set" -ace "n:S-1-5-32-547;p:read_ex,change;s:y;m:set" -actn clear -clr "dacl,sacl" -actn rstchldrn -rst "dacl,sacl"
Изменения в файловой системе:
Создает следующие файлы:
- %PROGRAM_FILES%\OCS Inventory Agent\ZipArchive.dll
- %PROGRAM_FILES%\OCS Inventory Agent\mfcm90u.dll
- %PROGRAM_FILES%\OCS Inventory Agent\mfcm90.dll
- %PROGRAM_FILES%\OCS Inventory Agent\zlib1.dll
- %PROGRAM_FILES%\OCS Inventory Agent\SysInfo.dll
- %PROGRAM_FILES%\OCS Inventory Agent\OcsWmi.dll
- %PROGRAM_FILES%\OCS Inventory Agent\ComHTTP.dll
- %PROGRAM_FILES%\OCS Inventory Agent\msvcp90.dll
- %PROGRAM_FILES%\OCS Inventory Agent\msvcm90.dll
- %PROGRAM_FILES%\OCS Inventory Agent\Microsoft.VC90.CRT.manifest
- %PROGRAM_FILES%\OCS Inventory Agent\msvcr90.dll
- %PROGRAM_FILES%\OCS Inventory Agent\mfc90u.dll
- %PROGRAM_FILES%\OCS Inventory Agent\mfc90.dll
- %PROGRAM_FILES%\OCS Inventory Agent\Microsoft.VC90.MFC.manifest
- %TEMP%\nsf7.tmp\SimpleFC.dll
- %ALLUSERSPROFILE%\Application Data\OCS Inventory NG\Agent\ocsinventory.log
- %TEMP%\nsf7.tmp\nsA.tmp
- %TEMP%\nsf7.tmp\nsB.tmp
- %ALLUSERSPROFILE%\Application Data\OCS Inventory NG\Agent\ocsinventory.dat
- %ALLUSERSPROFILE%\Application Data\OCS Inventory NG\Agent\rand
- %PROGRAM_FILES%\OCS Inventory Agent\uninst.exe
- %PROGRAM_FILES%\OCS Inventory Agent\Download.exe
- %PROGRAM_FILES%\OCS Inventory Agent\OCSInventory.exe
- %PROGRAM_FILES%\OCS Inventory Agent\OCSInventory Front.dll
- %PROGRAM_FILES%\OCS Inventory Agent\OcsService.exe
- %PROGRAM_FILES%\OCS Inventory Agent\OCS-transform.xsl
- %PROGRAM_FILES%\OCS Inventory Agent\OcsNotifyUser.exe
- %PROGRAM_FILES%\OCS Inventory Agent\OcsSystray.exe
- %TEMP%\nsu6.tmp
- %TEMP%\nsb4.tmp\System.dll
- %TEMP%\nsa2.tmp\UserInfo.dll
- %TEMP%\nsa2.tmp\OCS-NG-Windows-Agent-Setup.log
- %TEMP%\nsf7.tmp\proxy.ini
- %TEMP%\nsf7.tmp\server.ini
- %TEMP%\nsf7.tmp\System.dll
- %TEMP%\nsa2.tmp\RemCom.exe
- %TEMP%\nsa2.tmp\System.dll
- <Текущая директория>\ocspackage.log
- %TEMP%\nsa2.tmp\OcsSetup.exe
- %TEMP%\nsa2.tmp\ocsdat.ini
- %TEMP%\nsa2.tmp\instocs.exe
- %TEMP%\nsa2.tmp\pack.ico
- %TEMP%\nsf7.tmp\KillProcDLL.dll
- %TEMP%\nsf7.tmp\services.dll
- %TEMP%\nsf7.tmp\ns9.tmp
- %ALLUSERSPROFILE%\Application Data\OCS Inventory NG\Agent\ocsinventory.ini
- %PROGRAM_FILES%\OCS Inventory Agent\ssleay32.dll
- %PROGRAM_FILES%\OCS Inventory Agent\libeay32.dll
- %PROGRAM_FILES%\OCS Inventory Agent\libcurl.dll
- %TEMP%\nsf7.tmp\splash.bmp
- %TEMP%\nsf7.tmp\local.ini
- %TEMP%\nsf7.tmp\agent.ini
- %TEMP%\nsf7.tmp\SetACL.exe
- %TEMP%\nsf7.tmp\ns8.tmp
- %TEMP%\nsf7.tmp\nsExec.dll
- %TEMP%\nsf7.tmp\UserInfo.dll
Удаляет следующие файлы:
- %TEMP%\nsf7.tmp\UserInfo.dll
- %TEMP%\nsb4.tmp\System.dll
- %TEMP%\nsa2.tmp\instocs.exe
- %TEMP%\nsf7.tmp\SimpleFC.dll
- %TEMP%\nsf7.tmp\splash.bmp
- %TEMP%\nsf7.tmp\System.dll
- %TEMP%\nsa2.tmp\OCS-NG-Windows-Agent-Setup.log
- %TEMP%\nsa2.tmp\RemCom.exe
- %TEMP%\nsa2.tmp\System.dll
- %TEMP%\nsa2.tmp\UserInfo.dll
- %TEMP%\nsa2.tmp\ocsdat.ini
- %TEMP%\nsa2.tmp\OcsSetup.exe
- %TEMP%\nsa2.tmp\pack.ico
- %TEMP%\nsf7.tmp\SetACL.exe
- %TEMP%\nsf7.tmp\nsB.tmp
- %ALLUSERSPROFILE%\Application Data\OCS Inventory NG\Agent\ocsinventory.log
- %ALLUSERSPROFILE%\Application Data\OCS Inventory NG\Agent\rand
- %TEMP%\nsf7.tmp\ns8.tmp
- %TEMP%\nsf7.tmp\ns9.tmp
- %TEMP%\nsf7.tmp\nsA.tmp
- %TEMP%\nsf7.tmp\agent.ini
- %TEMP%\nsf7.tmp\proxy.ini
- %TEMP%\nsf7.tmp\server.ini
- %TEMP%\nsf7.tmp\services.dll
- %TEMP%\nsf7.tmp\KillProcDLL.dll
- %TEMP%\nsf7.tmp\local.ini
- %TEMP%\nsf7.tmp\nsExec.dll
