Техническая информация
Вредоносные функции:
Создает и запускает на исполнение:
- '%TEMP%\B.tmp\SetupZiptrc.exe'
- '%WINDIR%\SetupZipTrc42410.exe' /S
Запускает на исполнение:
- '<SYSTEM32>\regsvr32.exe' /S "%PROGRAM_FILES%\Carreker\ZipTrc\SetupLog4x.ocx"
- '<SYSTEM32>\regsvr32.exe' /S "%PROGRAM_FILES%\Carreker\ZipTrc\log4X.ocx"
- '<SYSTEM32>\regsvr32.exe' /u /s setuplog4x.ocx
- '<SYSTEM32>\regsvr32.exe' /S /u "%PROGRAM_FILES%\Carreker\ZipTrc\SetupLog4x.ocx"
- '<SYSTEM32>\xcopy.exe' SampleImage.tif "%APPDATA%\Fiserv\Alternatiff" /Y
- '<SYSTEM32>\ping.exe' 127.0.0.1 -n 6
- '<SYSTEM32>\cmd.exe' /c ""%PROGRAM_FILES%\Carreker\ZipTrc\mktemp.cmd""
- '<SYSTEM32>\cacls.exe' C:\Temp /E /T /C /G INTERACTIVE:C
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\B.tmp\install.bat" "/S" "
- '<SYSTEM32>\msiexec.exe' /V
- '<SYSTEM32>\msiexec.exe' -Embedding B7E95127CFF8C24CD9C1C1278039DBAA
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\1.tmp\ActiveXInstalls.cmd""
- '<SYSTEM32>\msiexec.exe' /i "Alternatiff.msi" /quiet
- '<SYSTEM32>\msiexec.exe' -Embedding 31174842C92E818616D58CADA432866E
- '<SYSTEM32>\xcopy.exe' SetupZipTrc42410.exe %WINDIR% /Y
- '<SYSTEM32>\msiexec.exe' /Y "%PROGRAM_FILES%\Carreker\Alternatiff\alttiff.ocx"
- '<SYSTEM32>\msiexec.exe' /i "Alternatiff_Setup_NSI.msi" /qn
Изменения в файловой системе:
Создает следующие файлы:
- %PROGRAM_FILES%\Carreker\ZipTrc\ziptrc.lst
- %PROGRAM_FILES%\Carreker\ZipTrc\zip.exe
- %PROGRAM_FILES%\Carreker\ZipTrc\ziptrc_Vista.lst
- %PROGRAM_FILES%\Carreker\ZipTrc\ziptrc.cmd
- %PROGRAM_FILES%\Carreker\ZipTrc\DOZE.EXE
- %PROGRAM_FILES%\Carreker\ZipTrc\rangerlogdump.exe
- %TEMP%\B.tmp\install.bat
- %WINDIR%\SetupZipTrc42410.exe
- %TEMP%\B.tmp\SetupZiptrc.exe
- %PROGRAM_FILES%\Carreker\ZipTrc\dumpel.exe
- %TEMP%\nseD.tmp\UserInfo.dll
- %PROGRAM_FILES%\Carreker\ZipTrc\mktemp.cmd
- %PROGRAM_FILES%\Carreker\ZipTrc\testcrash.cmd
- %PROGRAM_FILES%\Carreker\ZipTrc\SetupLog4x.ocx
- %ALLUSERSPROFILE%\Start Menu\Programs\Carreker\Test Crash Handler.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Carreker\Gather Diagnostic Data.lnk
- %PROGRAM_FILES%\Carreker\ZipTrc\testcrash.htm
- %PROGRAM_FILES%\Carreker\ZipTrc\sem.dll
- %PROGRAM_FILES%\Carreker\ZipTrc\log4cplus.dll
- %PROGRAM_FILES%\Carreker\ZipTrc\Log4X.ocx
- %PROGRAM_FILES%\Carreker\ZipTrc\BugslayerUtil.dll
- %PROGRAM_FILES%\Carreker\ZipTrc\log4cplus.properties
- %WINDIR%\Installer\MSI2.tmp
- %WINDIR%\Installer\MSI3.tmp
- %PROGRAM_FILES%\Carreker\Alternatiff\alttifflicense.dat
- C:\Config.Msi\29d91.rbs
- %WINDIR%\Installer\29d8e.msi
- %TEMP%\1.tmp\Alternatiff_Setup_NSI.msi
- %TEMP%\1.tmp\ActiveXInstalls.cmd
- %TEMP%\1.tmp\SampleImage.tif
- %TEMP%\1.tmp\Alternatiff.msi
- %TEMP%\1.tmp\SetupZipTrc42410.exe
- C:\Config.Msi\29d96.rbs
- %WINDIR%\Installer\MSI8.tmp
- %APPDATA%\Fiserv\Alternatiff\alternatiff_licensed.cab
- %APPDATA%\Fiserv\Alternatiff\SampleImage.tif
- %APPDATA%\Fiserv\Alternatiff\InstallTiffViewer.html
- %WINDIR%\Installer\MSI7.tmp
- %PROGRAM_FILES%\Carreker\Alternatiff\alttiff.ocx
- %PROGRAM_FILES%\Carreker\Alternatiff\alttiff.inf
- %PROGRAM_FILES%\Carreker\Alternatiff\Front.tif
- %WINDIR%\Installer\MSI6.tmp
- %WINDIR%\Installer\29d93.msi
Удаляет следующие файлы:
- %WINDIR%\Installer\29d93.msi
- C:\Config.Msi\29d96.rbs
- %WINDIR%\Installer\MSI8.tmp
- %WINDIR%\Installer\29d95.ipi
- %TEMP%\B.tmp\install.bat
- %TEMP%\B.tmp\SetupZiptrc.exe
- %TEMP%\nseD.tmp\UserInfo.dll
- C:\Config.Msi\29d91.rbs
- %WINDIR%\Installer\MSI3.tmp
- %WINDIR%\Installer\MSI2.tmp
- %WINDIR%\Installer\29d8e.msi
- %WINDIR%\Installer\MSI7.tmp
- %WINDIR%\Installer\MSI6.tmp
- %WINDIR%\Installer\29d90.ipi
Другое:
Ищет следующие окна:
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
