Техническая информация
Вредоносные функции:
Создает и запускает на исполнение:
- '%TEMP%\software.exe'
- '%TEMP%\mySecureSurfer_no_chrome.exe'
Завершает или пытается завершить
следующие пользовательские процессы:
- firefox.exe
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\InstallShield\Professional\RunTime\IsP11.tmp
- %CommonProgramFiles%\InstallShield\Professional\RunTime\09\01\Intel32\ius10.tmp
- %CommonProgramFiles%\InstallShield\Professional\RunTime\09\01\Intel32\iscF.tmp
- %CommonProgramFiles%\InstallShield\Professional\RunTime\Obj12.tmp
- %CommonProgramFiles%\InstallShield\Professional\RunTime\iKernel.rgs
- %CommonProgramFiles%\InstallShield\Professional\RunTime\IsProBE.tlb
- %TEMP%\isp8.tmp\temp.000
- %TEMP%\_seB.tmp
- %CommonProgramFiles%\InstallShield\Professional\RunTime\09\01\Intel32\isp9.tmp\temp.000
- %CommonProgramFiles%\InstallShield\Professional\RunTime\09\01\Intel32\ctoE.tmp
- %CommonProgramFiles%\InstallShield\Professional\RunTime\09\01\Intel32\DotD.tmp
- %CommonProgramFiles%\InstallShield\Professional\RunTime\09\01\Intel32\iKeC.tmp
- %TEMP%\{E40CAF88-00C1-4C53-A638-1FC7D6715894}\{1B577927-CE83-4A4C-8010-18480D61DF5B}\Stri4bee.rra
- %TEMP%\{E40CAF88-00C1-4C53-A638-1FC7D6715894}\core4bb0.rra
- %TEMP%\{E40CAF88-00C1-4C53-A638-1FC7D6715894}\{1B577927-CE83-4A4C-8010-18480D61DF5B}\_ISU4b52.rra
- %TEMP%\{E40CAF88-00C1-4C53-A638-1FC7D6715894}\{1B577927-CE83-4A4C-8010-18480D61DF5B}\_IsR4cc9.rra
- %TEMP%\{E40CAF88-00C1-4C53-A638-1FC7D6715894}\{1B577927-CE83-4A4C-8010-18480D61DF5B}\defa4c9a.rra
- %TEMP%\{E40CAF88-00C1-4C53-A638-1FC7D6715894}\{1B577927-CE83-4A4C-8010-18480D61DF5B}\isrt4c1d.rra
- %TEMP%\{E40CAF88-00C1-4C53-A638-1FC7D6715894}\{1B577927-CE83-4A4C-8010-18480D61DF5B}\KSIn4632.rra
- %TEMP%\{E40CAF88-00C1-4C53-A638-1FC7D6715894}\{1B577927-CE83-4A4C-8010-18480D61DF5B}\LICE45d4.rra
- %TEMP%\{E40CAF88-00C1-4C53-A638-1FC7D6715894}\{1B577927-CE83-4A4C-8010-18480D61DF5B}\setu4586.rra
- %TEMP%\{E40CAF88-00C1-4C53-A638-1FC7D6715894}\{1B577927-CE83-4A4C-8010-18480D61DF5B}\KSIn492f.rra
- %TEMP%\{E40CAF88-00C1-4C53-A638-1FC7D6715894}\{1B577927-CE83-4A4C-8010-18480D61DF5B}\NoRe48d2.rra
- %TEMP%\{E40CAF88-00C1-4C53-A638-1FC7D6715894}\{1B577927-CE83-4A4C-8010-18480D61DF5B}\Logo48a3.rra
- %TEMP%\ISPackFiles.ini
- %TEMP%\software.exe
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{d64e478d-4dee-4bfb-afe4-30b84e6a3157}\chrome\content\extension.js
- %TEMP%\bye4.tmp\Disk1\engine32.cab
- %TEMP%\bye4.tmp\Disk1\data1.hdr
- %TEMP%\bye4.tmp\Disk1\data1.cab
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{d64e478d-4dee-4bfb-afe4-30b84e6a3157}\bootstrap.js
- %TEMP%\nsj3.tmp\KillProcDLL.dll
- %TEMP%\mySecureSurfer_no_chrome.exe
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{d64e478d-4dee-4bfb-afe4-30b84e6a3157}\install.rdf
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{d64e478d-4dee-4bfb-afe4-30b84e6a3157}\icon32.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{d64e478d-4dee-4bfb-afe4-30b84e6a3157}\icon.png
- %CommonProgramFiles%\InstallShield\Professional\RunTime\09\01\Intel32\isp6.tmp\temp.000
- %CommonProgramFiles%\InstallShield\Professional\RunTime\09\01\Intel32\set7.tmp
- %TEMP%\iss5.tmp\setup.ini
- %TEMP%\igdA.tmp
- %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\361e9a1dc6adc8c6da8e3b241832df49_23ef5514-3059-436f-a4a7-4cefaab20eb1
- %TEMP%\bye4.tmp\Disk1\setup.ibt
- %TEMP%\bye4.tmp\Disk1\setup.exe
- %TEMP%\bye4.tmp\Disk1\layout.bin
- %TEMP%\bye4.tmp\Disk1\setup.iss
- %TEMP%\bye4.tmp\Disk1\setup.inx
- %TEMP%\bye4.tmp\Disk1\setup.ini
Удаляет следующие файлы:
- %TEMP%\igdA.tmp
- %TEMP%\_seB.tmp
- %CommonProgramFiles%\InstallShield\Professional\RunTime\IsP11.tmp
- %TEMP%\nsj3.tmp\KillProcDLL.dll
- %TEMP%\mySecureSurfer_no_chrome.exe
- %CommonProgramFiles%\InstallShield\Professional\RunTime\09\01\Intel32\set7.tmp
Перемещает следующие файлы:
- %TEMP%\{E40CAF88-00C1-4C53-A638-1FC7D6715894}\{1B577927-CE83-4A4C-8010-18480D61DF5B}\NoRe48d2.rra в %TEMP%\{E40CAF88-00C1-4C53-A638-1FC7D6715894}\{1B577927-CE83-4A4C-8010-18480D61DF5B}\NoReboot.exe
- %TEMP%\{E40CAF88-00C1-4C53-A638-1FC7D6715894}\{1B577927-CE83-4A4C-8010-18480D61DF5B}\KSIn492f.rra в %TEMP%\{E40CAF88-00C1-4C53-A638-1FC7D6715894}\{1B577927-CE83-4A4C-8010-18480D61DF5B}\KSInst64.dll
- %TEMP%\{E40CAF88-00C1-4C53-A638-1FC7D6715894}\{1B577927-CE83-4A4C-8010-18480D61DF5B}\Logo48a3.rra в %TEMP%\{E40CAF88-00C1-4C53-A638-1FC7D6715894}\{1B577927-CE83-4A4C-8010-18480D61DF5B}\Logo.bmp
- %TEMP%\{E40CAF88-00C1-4C53-A638-1FC7D6715894}\{1B577927-CE83-4A4C-8010-18480D61DF5B}\LICE45d4.rra в %TEMP%\{E40CAF88-00C1-4C53-A638-1FC7D6715894}\{1B577927-CE83-4A4C-8010-18480D61DF5B}\LICENSE.TXT
- %TEMP%\{E40CAF88-00C1-4C53-A638-1FC7D6715894}\{1B577927-CE83-4A4C-8010-18480D61DF5B}\KSIn4632.rra в %TEMP%\{E40CAF88-00C1-4C53-A638-1FC7D6715894}\{1B577927-CE83-4A4C-8010-18480D61DF5B}\KSInst.dll
- %TEMP%\{E40CAF88-00C1-4C53-A638-1FC7D6715894}\{1B577927-CE83-4A4C-8010-18480D61DF5B}\_ISU4b52.rra в %TEMP%\{E40CAF88-00C1-4C53-A638-1FC7D6715894}\{1B577927-CE83-4A4C-8010-18480D61DF5B}\_ISUser.dll
- %TEMP%\{E40CAF88-00C1-4C53-A638-1FC7D6715894}\{1B577927-CE83-4A4C-8010-18480D61DF5B}\defa4c9a.rra в %TEMP%\{E40CAF88-00C1-4C53-A638-1FC7D6715894}\{1B577927-CE83-4A4C-8010-18480D61DF5B}\default.pal
- %TEMP%\{E40CAF88-00C1-4C53-A638-1FC7D6715894}\{1B577927-CE83-4A4C-8010-18480D61DF5B}\_IsR4cc9.rra в %TEMP%\{E40CAF88-00C1-4C53-A638-1FC7D6715894}\{1B577927-CE83-4A4C-8010-18480D61DF5B}\_IsRes.dll
- %TEMP%\{E40CAF88-00C1-4C53-A638-1FC7D6715894}\{1B577927-CE83-4A4C-8010-18480D61DF5B}\isrt4c1d.rra в %TEMP%\{E40CAF88-00C1-4C53-A638-1FC7D6715894}\{1B577927-CE83-4A4C-8010-18480D61DF5B}\isrt.dll
- %TEMP%\{E40CAF88-00C1-4C53-A638-1FC7D6715894}\core4bb0.rra в %TEMP%\{E40CAF88-00C1-4C53-A638-1FC7D6715894}\corecomp.ini
- %TEMP%\{E40CAF88-00C1-4C53-A638-1FC7D6715894}\{1B577927-CE83-4A4C-8010-18480D61DF5B}\Stri4bee.rra в %TEMP%\{E40CAF88-00C1-4C53-A638-1FC7D6715894}\{1B577927-CE83-4A4C-8010-18480D61DF5B}\StringTable-0007-German.ips
- %TEMP%\{E40CAF88-00C1-4C53-A638-1FC7D6715894}\{1B577927-CE83-4A4C-8010-18480D61DF5B}\setu4586.rra в %TEMP%\{E40CAF88-00C1-4C53-A638-1FC7D6715894}\{1B577927-CE83-4A4C-8010-18480D61DF5B}\setup.inx
- %CommonProgramFiles%\InstallShield\Professional\RunTime\09\01\Intel32\isp9.tmp\IGdi.dll в %CommonProgramFiles%\InstallShield\Professional\RunTime\09\01\Intel32\iGdi.dll
- %TEMP%\isp8.tmp\temp.000 в %TEMP%\isp8.tmp\_Setup.dll
- %CommonProgramFiles%\InstallShield\Professional\RunTime\09\01\Intel32\isp9.tmp\temp.000 в %CommonProgramFiles%\InstallShield\Professional\RunTime\09\01\Intel32\isp9.tmp\IGdi.dll
- %CommonProgramFiles%\InstallShield\Professional\RunTime\09\01\Intel32\isp6.tmp\temp.000 в %CommonProgramFiles%\InstallShield\Professional\RunTime\09\01\Intel32\isp6.tmp\setup.dll
- %CommonProgramFiles%\InstallShield\Professional\RunTime\09\01\Intel32\isp6.tmp\setup.dll в %CommonProgramFiles%\InstallShield\Professional\RunTime\09\01\Intel32\setup.dll
- %CommonProgramFiles%\InstallShield\Professional\RunTime\09\01\Intel32\iKeC.tmp в %CommonProgramFiles%\InstallShield\Professional\RunTime\09\01\Intel32\iKernel.dll
- %CommonProgramFiles%\InstallShield\Professional\RunTime\09\01\Intel32\ius10.tmp в %CommonProgramFiles%\InstallShield\Professional\RunTime\09\01\Intel32\iuser.dll
- %CommonProgramFiles%\InstallShield\Professional\RunTime\Obj12.tmp в %CommonProgramFiles%\InstallShield\Professional\RunTime\Objectps.dll
- %CommonProgramFiles%\InstallShield\Professional\RunTime\09\01\Intel32\iscF.tmp в %CommonProgramFiles%\InstallShield\Professional\RunTime\09\01\Intel32\iscript.dll
- %CommonProgramFiles%\InstallShield\Professional\RunTime\09\01\Intel32\DotD.tmp в %CommonProgramFiles%\InstallShield\Professional\RunTime\09\01\Intel32\DotNetInstaller.exe
- %CommonProgramFiles%\InstallShield\Professional\RunTime\09\01\Intel32\ctoE.tmp в %CommonProgramFiles%\InstallShield\Professional\RunTime\09\01\Intel32\ctor.dll
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
