Техническая информация
Для обеспечения автозапуска и распространения:
Подменяет следующие исполняемые системные файлы:
- <SYSTEM32>\hid.dll файлом <SYSTEM32>\SETA.tmp
Вредоносные функции:
Создает и запускает на исполнение:
- '%WINDIR%\DTDT32\QD\devcon.exe' install Hid_FlexDef2d.inf "USB\Vid_04d9&Pid_2519&MI_02"
Запускает на исполнение:
- '<SYSTEM32>\runonce.exe' -r
- '<SYSTEM32>\cmd.exe' /c ""%WINDIR%\DTDT32\QD\Driver_Setup.bat" "
Изменения в файловой системе:
Создает следующие файлы:
- %WINDIR%\DTDT32\win7\°Чµг.dll
- %WINDIR%\DTDT32\win7\И·¶ЁКХПВF.dll
- %WINDIR%\DTDT32\win7\єм1.dll
- %WINDIR%\DTDT32\win7\°Ч1.dll
- %WINDIR%\DTDT32\win7\ЛАНц2.dll
- %WINDIR%\DTDT32\win7\ЛАНцµВ.dll
- %WINDIR%\DTDT32\win7\НжјТ°ЧГы.dll
- %WINDIR%\DTDT32\win7\ВМЙ«ЧЦ.dll
- %WINDIR%\DTDT32\win7\Ѕьѕа№ЦСЄМх.dll
- %WINDIR%\DTDT32\win7\НЛіц°ЧЧЦ.dll
- %WINDIR%\DTDT32\win7\Ѕр1.dll
- %WINDIR%\DTDT32\win7\ґьЧУ.dll
- %WINDIR%\DTDT32\win7\±і°ь°ЧЧЦ.dll
- %WINDIR%\DTDT32\win7\А¶.dll
- %WINDIR%\DTDT32\win7\А¶1.dll
- %WINDIR%\DTDT32\win7\№ЦѕаАлГЧ.dll
- %WINDIR%\DTDT32\win7\№Цѕаі¬10ГЧ.dll
- %WINDIR%\DTDT32\win7\јсОпИ«јс.dll
- %WINDIR%\DTDT32\win7\ТССЎЦР№Ц.dll
- %WINDIR%\DTDT32\win7\ЙМПдВъјсІ»ЅшµВ.dll
- %WINDIR%\DTDT32\win7\»ШіЗґ°P.dll
- %WINDIR%\DTDT32\win7\¶Ф»°FЧЦіцПЦ.dll
- %WINDIR%\DTDT32\win7\јсОпКЦ.dll
- %WINDIR%\DTDT32\win7\ёЛТС°ЪєГ.dll
- %WINDIR%\DTDT32\win7\ёЛТС°ЪєГ2.dll
- %WINDIR%\DTDT32\win7\ЛАНц.dll
- %WINDIR%\DTDT32\win7\К±ЦУОґ»Цёґ.dll
- %WINDIR%\DTDT32\win7\µфПЯ.dll
- %WINDIR%\DTDT32\win7\ХыАн.dll
- %WINDIR%\DTDT32\win7\К±ЦУТС»Цёґ.dll
- <DRIVERS>\SET5.tmp
- <DRIVERS>\SET6.tmp
- <SYSTEM32>\SET7.tmp
- <SYSTEM32>\dllcache\hidusb.sys.new
- %WINDIR%\inf\oem3.PNF
- <DRIVERS>\SET3.tmp
- <DRIVERS>\SET4.tmp
- %WINDIR%\LastGood\TMP8.tmp
- <DRIVERS>\SETD.tmp
- <SYSTEM32>\dllcache\hidclass.sys.new
- <SYSTEM32>\dllcache\hidparse.sys.new
- <DRIVERS>\SETC.tmp
- %WINDIR%\Temp\OLD9.tmp
- <SYSTEM32>\SETA.tmp
- <DRIVERS>\SETB.tmp
- %WINDIR%\DTDT32\xp\XY\2.BMP
- %WINDIR%\DTDT32\xp\XY\3.BMP
- %WINDIR%\DTDT32\xp\XY\4.BMP
- %WINDIR%\DTDT32\xp\XY\1.BMP
- %WINDIR%\DTDT32\win7\ОКєЕіц°Ч.dll
- %WINDIR%\DTDT32\win7\єЪ1.dll
- %WINDIR%\DTDT32\xp\XY\0.BMP
- %WINDIR%\DTDT32\xp\XY\5.BMP
- %WINDIR%\DTDT32\іцґрµЪ1МЁ.wav
- <SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem3.CAT
- %WINDIR%\inf\oem3.inf
- %WINDIR%\DTDT32\xp\XY\9.BMP
- %WINDIR%\DTDT32\xp\XY\6.BMP
- %WINDIR%\DTDT32\xp\XY\7.BMP
- %WINDIR%\DTDT32\xp\XY\8.BMP
- %WINDIR%\DTDT32\win7\ЙМПдВъјсІ»Ѕш.dll
- %WINDIR%\DTDT32\QD\x64\filter_multiuse_fd2d_fd4.cat
- %WINDIR%\DTDT32\QD\x64\Hid_FlexDef2d.inf
- %WINDIR%\DTDT32\QD\x64\InputFilter_FlexDef2d.sys
- %WINDIR%\DTDT32\QD\x64\Driver_Setup.bat
- %WINDIR%\DTDT32\QD\x64\DIFxAPI.dll
- %WINDIR%\DTDT32\QD\x64\DIFxCmd.exe
- %WINDIR%\DTDT32\QD\x64\Driver_Remove.bat
- %WINDIR%\DTDT32\win7\ESC±»°ґіц.dll
- %WINDIR%\DTDT32\win7\XY\3.BMP
- %WINDIR%\DTDT32\win7\XY\4.BMP
- %WINDIR%\DTDT32\win7\XY\5.BMP
- %WINDIR%\DTDT32\win7\XY\2.BMP
- %WINDIR%\DTDT32\win7\TAB.dll
- %WINDIR%\DTDT32\win7\XY\0.BMP
- %WINDIR%\DTDT32\win7\XY\1.BMP
- %WINDIR%\DTDT32\QD\devcon.exe
- %WINDIR%\DTDT32\QD\DIFxAPI.dll
- %WINDIR%\DTDT32\QD\DIFxCmd.exe
- %WINDIR%\DTDT32\QD\Copy.bat
- %WINDIR%\1.dll
- %WINDIR%\2.dll
- %WINDIR%\DTDT32\QD\BackInDll.dll
- %WINDIR%\DTDT32\QD\Driver_Remove.bat
- %WINDIR%\DTDT32\QD\InputFilter_FlexDef2d.sys
- %WINDIR%\DTDT32\QD\pljd.dll
- %WINDIR%\DTDT32\QD\x64\devcon.exe
- %WINDIR%\DTDT32\QD\Hid_FlexDef2d.inf
- %WINDIR%\DTDT32\QD\Driver_Setup.bat
- %WINDIR%\DTDT32\QD\filter_multiuse_fd2d_fd4.cat
- %WINDIR%\DTDT32\QD\hao.dll
- %WINDIR%\DTDT32\win7\єф±¦±¦јсОп.dll
- %WINDIR%\DTDT32\win7\ЙМDratіЗТ©Л®ЙМ.dll
- %WINDIR%\DTDT32\win7\ЙМJUNOіЗТ©Л®ЙМ.dll
- %WINDIR%\DTDT32\win7\єфѕнґ°.dll
- %WINDIR%\DTDT32\win7\°ьА¶±Я.dll
- %WINDIR%\DTDT32\win7\°ьЅр±Я.dll
- %WINDIR%\DTDT32\win7\УТЅЗ°ЧЧЦ.dll
- %WINDIR%\DTDT32\win7\ЙМТСАµЅЧоµЧ.dll
- %WINDIR%\DTDT32\win7\ЙМµкґ°И·¶Ё.dll
- %WINDIR%\DTDT32\win7\ЙМµкґ°СЎВфРР.dll
- %WINDIR%\DTDT32\win7\ЙМКэБїOKИ·¶Ё.dll
- %WINDIR%\DTDT32\win7\ЙМµкґ°ЅзГж.dll
- %WINDIR%\DTDT32\win7\ЙМµкВфОпТСХјВъ.dll
- %WINDIR%\DTDT32\win7\ЙМµкёсЧУ.dll
- %WINDIR%\DTDT32\win7\ЙМµк°ЧЧЦ.dll
- %WINDIR%\DTDT32\win7\РЮЧ°єм.dll
- %WINDIR%\DTDT32\win7\іцРЕПўїтИ·¶Ё.dll
- %WINDIR%\DTDT32\win7\іцСйЦ¤Мв.dll
- %WINDIR%\DTDT32\win7\XY\9.BMP
- %WINDIR%\DTDT32\win7\XY\6.BMP
- %WINDIR%\DTDT32\win7\XY\7.BMP
- %WINDIR%\DTDT32\win7\XY\8.BMP
- %WINDIR%\DTDT32\win7\ё±±ѕДЪµШНј49.dll
- %WINDIR%\DTDT32\win7\ё±±ѕСЎ·їРР.dll
- %WINDIR%\DTDT32\win7\ё±±ѕОКєЕ.dll
- %WINDIR%\DTDT32\win7\°ьОЮОп.dll
- %WINDIR%\DTDT32\win7\ё±±ѕ¶Ф»°·ЕЖъїт.dll
- %WINDIR%\DTDT32\win7\ё±±ѕіцїЪ.dll
- %WINDIR%\DTDT32\win7\ё±±ѕіцїЪFЧЦ.dll
- %WINDIR%\DTDT32\win7\ё±±ѕНвµШНј49.dll
Присваивает атрибут 'скрытый' для следующих файлов:
- <SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem3.CAT
Удаляет следующие файлы:
- <SYSTEM32>\SET7.tmp
- <SYSTEM32>\hid.dll
- %WINDIR%\Temp\OLD9.tmp
- <DRIVERS>\SETB.tmp
- %WINDIR%\2.dll
- %WINDIR%\1.dll
- <DRIVERS>\SET5.tmp
- <DRIVERS>\SET3.tmp
Перемещает следующие файлы:
- <DRIVERS>\SETC.tmp в <DRIVERS>\hidparse.sys
- <DRIVERS>\SETD.tmp в <DRIVERS>\InputFilter_FlexDef2d.sys
- %WINDIR%\LastGood\TMP8.tmp в %WINDIR%\LastGood\system32\hid.dll
- <DRIVERS>\SET4.tmp в <DRIVERS>\hidusb.sys
- <DRIVERS>\SET6.tmp в <DRIVERS>\hidclass.sys
Сетевая активность:
Подключается к:
- '12#.#38.140.44':37
- '12#.#32.2.21':37
- '20#.#88.185.33':37
- '19#.#3.244.18':37
- '25#.#55.255.255':37
- '66.##3.43.21':37
- '13#.#07.1.10':37
- '20#.#00.81.113':37
- '12#.6.15.28':37
- '13#.#63.4.103':37
- '13#.#63.4.102':37
- '12#.6.15.29':37
- '20#.#26.98.204':37
- '20#.#84.49.9':37
- '21#.#00.93.8':37
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
