Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Classes\iefixfile\shell\open\command] '' = '%PROGRAM_FILES%\Super Rabbit\MagicSET\srieh.exe %1'
- [<HKLM>\SOFTWARE\Classes\SuperRabbitUncryFile\shell\open\command] '' = '%PROGRAM_FILES%\Super Rabbit\MagicSET\SafeEdit.exe /Uncrypt %1'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Super Rabbit SRRestore' = '%PROGRAM_FILES%\Super Rabbit\MagicSET\SRRest.exe /FIRST'
Подменяет следующие исполняемые системные файлы:
- <SYSTEM32>\msvbvm60.dll файлом <SYSTEM32>\is-KHN4L.tmp
Вредоносные функции:
Создает и запускает на исполнение:
- '%TEMP%\is-9NEPD.tmp\is-MRO0T.tmp' /SL4 $200EA "%TEMP%\pft3.tmp\MagicSet_80.exe" 8790936 52736 /VERYSILENT /SP-
- '%TEMP%\pft3.tmp\MagicSet_80.exe' /VERYSILENT /SP-
Запускает на исполнение:
- '<SYSTEM32>\regsvr32.exe' /s "<SYSTEM32>\vbalIml6.ocx"
- '<SYSTEM32>\regsvr32.exe' /s "<SYSTEM32>\vbalExpBar6.ocx"
- '<SYSTEM32>\regsvr32.exe' /s "<SYSTEM32>\SSubTmr6.dll"
- '<SYSTEM32>\regsvr32.exe' /s "<SYSTEM32>\dx8vb.dll"
- '<SYSTEM32>\regsvr32.exe' /s "<SYSTEM32>\msvbvm60.dll"
- '<SYSTEM32>\regsvr32.exe' /s "<SYSTEM32>\Vb6cht.dll"
- '<SYSTEM32>\regsvr32.exe' /s "<SYSTEM32>\shlObj71.ocx"
- '<SYSTEM32>\regsvr32.exe' /s "%PROGRAM_FILES%\Super Rabbit\MagicSET\xFoCtrl2.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%PROGRAM_FILES%\Super Rabbit\MagicSET\xFoCtrl.dll"
- '<SYSTEM32>\regsvr32.exe' /s "<SYSTEM32>\chklsb26.ocx"
- '<SYSTEM32>\regsvr32.exe' /s "<SYSTEM32>\oleacc.dll"
- '<SYSTEM32>\regsvr32.exe' /s "<SYSTEM32>\fldrvw71.ocx"
Изменения в файловой системе:
Создает следующие файлы:
- %PROGRAM_FILES%\Super Rabbit\MagicSET\is-KR4LE.tmp
- %PROGRAM_FILES%\Super Rabbit\MagicSET\is-7086J.tmp
- %PROGRAM_FILES%\Super Rabbit\MagicSET\is-75RTQ.tmp
- %PROGRAM_FILES%\Super Rabbit\MagicSET\is-2HVF2.tmp
- %PROGRAM_FILES%\Super Rabbit\MagicSET\is-27HIN.tmp
- %PROGRAM_FILES%\Super Rabbit\MagicSET\is-23S5R.tmp
- <SYSTEM32>\is-SLNPR.tmp
- %PROGRAM_FILES%\Super Rabbit\MagicSET\is-UEUUF.tmp
- %PROGRAM_FILES%\Super Rabbit\MagicSET\is-HQ25F.tmp
- %PROGRAM_FILES%\Super Rabbit\MagicSET\is-GNM37.tmp
- %PROGRAM_FILES%\Super Rabbit\MagicSET\is-H6548.tmp
- %PROGRAM_FILES%\Super Rabbit\MagicSET\is-5O94K.tmp
- %PROGRAM_FILES%\Super Rabbit\MagicSET\is-NE67R.tmp
- %PROGRAM_FILES%\Super Rabbit\MagicSET\is-P9N2O.tmp
- %PROGRAM_FILES%\Super Rabbit\MagicSET\is-SMD29.tmp
- %PROGRAM_FILES%\Super Rabbit\MagicSET\is-L0U7Q.tmp
- %PROGRAM_FILES%\Super Rabbit\MagicSET\is-J4QPF.tmp
- %PROGRAM_FILES%\Super Rabbit\MagicSET\is-N1727.tmp
- %ALLUSERSPROFILE%\Start Menu\Programs\¶WЇЕЁЯ¤lЕ]Єkі]©w\¶WЇЕЁЯ¤lЁtІО±Пґ©.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\¶WЇЕЁЯ¤lЕ]Єkі]©w\¶WЇЕЁЯ¤lАu¤Ж¤э.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\¶WЇЕЁЯ¤lЕ]Єkі]©w\іX°Э¶WЇЕЁЯ¤l.url
- %ALLUSERSPROFILE%\Start Menu\Programs\¶WЇЕЁЯ¤lЕ]Єkі]©w\¶WЇЕЁЯ¤l¤WєфєлЖF.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\¶WЇЕЁЯ¤lЕ]Єkі]©w\¶WЇЕЁЯ¤l.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\¶WЇЕЁЯ¤lЕ]Єkі]©w\Іѕ°Ј¶WЇЕЁЯ¤l.lnk
- %PROGRAM_FILES%\Super Rabbit\MagicSET\unins000.dat
- %ALLUSERSPROFILE%\Start Menu\Programs\¶WЇЕЁЯ¤lЕ]Єkі]©w\¶WЇЕЁЯ¤lЕ]Єkі]©wҐш·~Є©.lnk
- %HOMEPATH%\Desktop\¶WЇЕЁЯ¤l.lnk
- <SYSTEM32>\is-43L08.tmp
- <SYSTEM32>\is-CQCP0.tmp
- <SYSTEM32>\is-UD9P6.tmp
- <SYSTEM32>\is-ETIU5.tmp
- <SYSTEM32>\is-HSES0.tmp
- <SYSTEM32>\is-NMUPU.tmp
- %ALLUSERSPROFILE%\Start Menu\Programs\¶WЇЕЁЯ¤lЕ]Єkі]©w\ЁПҐО»Ў©ъ.lnk
- <SYSTEM32>\is-H7PF8.tmp
- <SYSTEM32>\is-KHN4L.tmp
- %PROGRAM_FILES%\Super Rabbit\MagicSET\is-L2BV3.tmp
- %PROGRAM_FILES%\Super Rabbit\MagicSET\is-NNQVU.tmp
- %PROGRAM_FILES%\Super Rabbit\MagicSET\is-75QV3.tmp
- %PROGRAM_FILES%\Super Rabbit\MagicSET\is-R446C.tmp
- %PROGRAM_FILES%\Super Rabbit\MagicSET\is-B7MUB.tmp
- %PROGRAM_FILES%\Super Rabbit\MagicSET\is-NJJU3.tmp
- %PROGRAM_FILES%\Super Rabbit\MagicSET\is-G33G3.tmp
- %PROGRAM_FILES%\Super Rabbit\MagicSET\is-QFUPJ.tmp
- %PROGRAM_FILES%\Super Rabbit\MagicSET\is-V0QI4.tmp
- %TEMP%\pft3.tmp\pftw1.pkg
- %TEMP%\pft3.tmp\MagicSet_80.exe
- %TEMP%\ext2.tmp
- %TEMP%\plf1.tmp
- %TEMP%\is-9NEPD.tmp\is-MRO0T.tmp
- %PROGRAM_FILES%\Super Rabbit\MagicSET\is-C8AB0.tmp
- %PROGRAM_FILES%\Super Rabbit\MagicSET\is-JEBJ7.tmp
- %TEMP%\is-LSGKK.tmp\_isetup\_RegDLL.tmp
- %TEMP%\is-LSGKK.tmp\_isetup\_shfoldr.dll
- %PROGRAM_FILES%\Super Rabbit\MagicSET\is-ONJPU.tmp
- %PROGRAM_FILES%\Super Rabbit\MagicSET\is-0CUVM.tmp
- %PROGRAM_FILES%\Super Rabbit\MagicSET\is-BCHNI.tmp
- %PROGRAM_FILES%\Super Rabbit\MagicSET\is-T02M8.tmp
- %PROGRAM_FILES%\Super Rabbit\MagicSET\is-KHASL.tmp
- %PROGRAM_FILES%\Super Rabbit\MagicSET\is-MRBH9.tmp
- %PROGRAM_FILES%\Super Rabbit\MagicSET\is-8FFNK.tmp
- %PROGRAM_FILES%\Super Rabbit\MagicSET\is-MFIEN.tmp
- %PROGRAM_FILES%\Super Rabbit\MagicSET\is-JPSF9.tmp
- %PROGRAM_FILES%\Super Rabbit\MagicSET\is-5FAMM.tmp
- %PROGRAM_FILES%\Super Rabbit\MagicSET\is-QF3M4.tmp
- %PROGRAM_FILES%\Super Rabbit\MagicSET\is-96CPC.tmp
- %PROGRAM_FILES%\Super Rabbit\MagicSET\is-URCK2.tmp
- %PROGRAM_FILES%\Super Rabbit\MagicSET\is-VKLEG.tmp
- %PROGRAM_FILES%\Super Rabbit\MagicSET\is-JPCM5.tmp
- %PROGRAM_FILES%\Super Rabbit\MagicSET\is-3SQLM.tmp
- %PROGRAM_FILES%\Super Rabbit\MagicSET\is-AKUGK.tmp
- %PROGRAM_FILES%\Super Rabbit\MagicSET\is-JT54G.tmp
Удаляет следующие файлы:
- %TEMP%\is-9NEPD.tmp\is-MRO0T.tmp
- %TEMP%\is-LSGKK.tmp\_isetup\_shfoldr.dll
- %TEMP%\pft3.tmp\MagicSet_80.exe
- %TEMP%\plf1.tmp
- %TEMP%\pft3.tmp\pftw1.pkg
- %TEMP%\ext2.tmp
- %TEMP%\is-LSGKK.tmp\_isetup\_RegDLL.tmp
- <SYSTEM32>\msvbvm60.dll
Перемещает следующие файлы:
- %PROGRAM_FILES%\Super Rabbit\MagicSET\is-SMD29.tmp в %PROGRAM_FILES%\Super Rabbit\MagicSET\srsb.exe
- %PROGRAM_FILES%\Super Rabbit\MagicSET\is-N1727.tmp в %PROGRAM_FILES%\Super Rabbit\MagicSET\srmsprogui.exe
- %PROGRAM_FILES%\Super Rabbit\MagicSET\is-J4QPF.tmp в %PROGRAM_FILES%\Super Rabbit\MagicSET\srms.exe
- %PROGRAM_FILES%\Super Rabbit\MagicSET\is-2HVF2.tmp в %PROGRAM_FILES%\Super Rabbit\MagicSET\srsi.exe
- %PROGRAM_FILES%\Super Rabbit\MagicSET\is-75RTQ.tmp в %PROGRAM_FILES%\Super Rabbit\MagicSET\srshut.exe
- %PROGRAM_FILES%\Super Rabbit\MagicSET\is-L0U7Q.tmp в %PROGRAM_FILES%\Super Rabbit\MagicSET\srsd.exe
- %PROGRAM_FILES%\Super Rabbit\MagicSET\is-P9N2O.tmp в %PROGRAM_FILES%\Super Rabbit\MagicSET\srieh.exe
- %PROGRAM_FILES%\Super Rabbit\MagicSET\is-5O94K.tmp в %PROGRAM_FILES%\Super Rabbit\MagicSET\srck.exe
- %PROGRAM_FILES%\Super Rabbit\MagicSET\is-8FFNK.tmp в %PROGRAM_FILES%\Super Rabbit\MagicSET\srcdnoti.exe
- %PROGRAM_FILES%\Super Rabbit\MagicSET\is-MRBH9.tmp в %PROGRAM_FILES%\Super Rabbit\MagicSET\srcd2.exe
- %PROGRAM_FILES%\Super Rabbit\MagicSET\is-H6548.tmp в %PROGRAM_FILES%\Super Rabbit\MagicSET\sriecli.exe
- %PROGRAM_FILES%\Super Rabbit\MagicSET\is-GNM37.tmp в %PROGRAM_FILES%\Super Rabbit\MagicSET\srgui.exe
- %PROGRAM_FILES%\Super Rabbit\MagicSET\is-NE67R.tmp в %PROGRAM_FILES%\Super Rabbit\MagicSET\srfc.exe
- %PROGRAM_FILES%\Super Rabbit\MagicSET\is-KR4LE.tmp в %PROGRAM_FILES%\Super Rabbit\MagicSET\srtask.exe
- <SYSTEM32>\is-CQCP0.tmp в <SYSTEM32>\vbalExpBar6.ocx
- <SYSTEM32>\is-43L08.tmp в <SYSTEM32>\SSubTmr6.dll
- <SYSTEM32>\is-ETIU5.tmp в <SYSTEM32>\chklsb26.ocx
- <SYSTEM32>\is-NMUPU.tmp в <SYSTEM32>\internat.exe
- <SYSTEM32>\is-H7PF8.tmp в <SYSTEM32>\Vb6cht.dll
- <SYSTEM32>\is-HSES0.tmp в <SYSTEM32>\vbalIml6.ocx
- <SYSTEM32>\is-UD9P6.tmp в <SYSTEM32>\fldrvw71.ocx
- %PROGRAM_FILES%\Super Rabbit\MagicSET\is-UEUUF.tmp в %PROGRAM_FILES%\Super Rabbit\MagicSET\winspeed.exe
- %PROGRAM_FILES%\Super Rabbit\MagicSET\is-27HIN.tmp в %PROGRAM_FILES%\Super Rabbit\MagicSET\uicon.gif
- %PROGRAM_FILES%\Super Rabbit\MagicSET\is-7086J.tmp в %PROGRAM_FILES%\Super Rabbit\MagicSET\srvd.exe
- <SYSTEM32>\is-SLNPR.tmp в <SYSTEM32>\shlObj71.ocx
- %PROGRAM_FILES%\Super Rabbit\MagicSET\is-23S5R.tmp в %PROGRAM_FILES%\Super Rabbit\MagicSET\xFoCtrl2.dll
- %PROGRAM_FILES%\Super Rabbit\MagicSET\is-HQ25F.tmp в %PROGRAM_FILES%\Super Rabbit\MagicSET\xFoCtrl.dll
- %PROGRAM_FILES%\Super Rabbit\MagicSET\is-NJJU3.tmp в %PROGRAM_FILES%\Super Rabbit\MagicSET\SafeEdit.exe
- %PROGRAM_FILES%\Super Rabbit\MagicSET\is-V0QI4.tmp в %PROGRAM_FILES%\Super Rabbit\MagicSET\SRshutdown.dll
- %PROGRAM_FILES%\Super Rabbit\MagicSET\is-QFUPJ.tmp в %PROGRAM_FILES%\Super Rabbit\MagicSET\SRSearch.exe
- %PROGRAM_FILES%\Super Rabbit\MagicSET\is-URCK2.tmp в %PROGRAM_FILES%\Super Rabbit\MagicSET\Wf98.dat
- %PROGRAM_FILES%\Super Rabbit\MagicSET\is-96CPC.tmp в %PROGRAM_FILES%\Super Rabbit\MagicSET\Wf2000.icl
- %PROGRAM_FILES%\Super Rabbit\MagicSET\is-G33G3.tmp в %PROGRAM_FILES%\Super Rabbit\MagicSET\Wf2000.dat
- %PROGRAM_FILES%\Super Rabbit\MagicSET\is-B7MUB.tmp в %PROGRAM_FILES%\Super Rabbit\MagicSET\SRRest.exe
- %PROGRAM_FILES%\Super Rabbit\MagicSET\is-75QV3.tmp в %PROGRAM_FILES%\Super Rabbit\MagicSET\Cabarc.exe
- %PROGRAM_FILES%\Super Rabbit\MagicSET\is-JEBJ7.tmp в %PROGRAM_FILES%\Super Rabbit\MagicSET\Norton_Removal_Tool.exe
- %PROGRAM_FILES%\Super Rabbit\MagicSET\is-C8AB0.tmp в %PROGRAM_FILES%\Super Rabbit\MagicSET\unins000.exe
- %PROGRAM_FILES%\Super Rabbit\MagicSET\is-NNQVU.tmp в %PROGRAM_FILES%\Super Rabbit\MagicSET\SRPort.exe
- %PROGRAM_FILES%\Super Rabbit\MagicSET\is-L2BV3.tmp в %PROGRAM_FILES%\Super Rabbit\MagicSET\Help.chm
- %PROGRAM_FILES%\Super Rabbit\MagicSET\is-R446C.tmp в %PROGRAM_FILES%\Super Rabbit\MagicSET\Ds.exe
- %PROGRAM_FILES%\Super Rabbit\MagicSET\is-5FAMM.tmp в %PROGRAM_FILES%\Super Rabbit\MagicSET\Wfxp.icl
- %PROGRAM_FILES%\Super Rabbit\MagicSET\is-0CUVM.tmp в %PROGRAM_FILES%\Super Rabbit\MagicSET\iepro.exe
- %PROGRAM_FILES%\Super Rabbit\MagicSET\is-ONJPU.tmp в %PROGRAM_FILES%\Super Rabbit\MagicSET\haokanbar2.dll
- %PROGRAM_FILES%\Super Rabbit\MagicSET\is-T02M8.tmp в %PROGRAM_FILES%\Super Rabbit\MagicSET\haokanbar.dll
- %PROGRAM_FILES%\Super Rabbit\MagicSET\is-JPSF9.tmp в %PROGRAM_FILES%\Super Rabbit\MagicSET\memdef.exe
- %PROGRAM_FILES%\Super Rabbit\MagicSET\is-MFIEN.tmp в %PROGRAM_FILES%\Super Rabbit\MagicSET\magicset.exe
- %PROGRAM_FILES%\Super Rabbit\MagicSET\is-KHASL.tmp в %PROGRAM_FILES%\Super Rabbit\MagicSET\liveupdate.exe
- %PROGRAM_FILES%\Super Rabbit\MagicSET\is-BCHNI.tmp в %PROGRAM_FILES%\Super Rabbit\MagicSET\close.gif
- %PROGRAM_FILES%\Super Rabbit\MagicSET\is-AKUGK.tmp в %PROGRAM_FILES%\Super Rabbit\MagicSET\big5.dll
- %PROGRAM_FILES%\Super Rabbit\MagicSET\is-VKLEG.tmp в %PROGRAM_FILES%\Super Rabbit\MagicSET\apple.icl
- %PROGRAM_FILES%\Super Rabbit\MagicSET\is-QF3M4.tmp в %PROGRAM_FILES%\Super Rabbit\MagicSET\WhiteSite.dat
- %PROGRAM_FILES%\Super Rabbit\MagicSET\is-3SQLM.tmp в %PROGRAM_FILES%\Super Rabbit\MagicSET\cdopen.wav
- %PROGRAM_FILES%\Super Rabbit\MagicSET\is-JPCM5.tmp в %PROGRAM_FILES%\Super Rabbit\MagicSET\cdclose.wav
- %PROGRAM_FILES%\Super Rabbit\MagicSET\is-JT54G.tmp в %PROGRAM_FILES%\Super Rabbit\MagicSET\blank.ico
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
