Техническая информация
Вредоносные функции:
Создает и запускает на исполнение:
- '%PROGRAM_FILES%\M-Plus Messenger\mplusservice\AutowayMplusService.exe' -install
- '%TEMP%\7zS1.tmp\setup.exe' -s -f1./setup.iss
Запускает на исполнение:
- '<SYSTEM32>\msiexec.exe' -Embedding 6A42C9339663F50EF4A481D9DFBBDD51 M Global\MSI0000
- '<SYSTEM32>\wbem\wmiadap.exe' /R /T
- '<SYSTEM32>\msiexec.exe' -Embedding 1C3120D0598CDFAA38C0B6DBA5D0174E
- '<SYSTEM32>\cmd.exe' /c .\install.bat
- '<SYSTEM32>\msiexec.exe' /V
Изменения в файловой системе:
Создает следующие файлы:
- %PROGRAM_FILES%\M-Plus Messenger\core package\AxonKill.exe
- %PROGRAM_FILES%\M-Plus Messenger\CertMgr.Exe
- C:\Config.Msi\3238a.rbs
- %WINDIR%\Installer\MSI11.tmp
- %WINDIR%\Installer\MSI12.tmp
- %PROGRAM_FILES%\M-Plus Messenger\mplus.exe
- %PROGRAM_FILES%\M-Plus Messenger\uninstall.exe
- %PROGRAM_FILES%\M-Plus Messenger\tools\UserEnvironmentCheck.exe
- %PROGRAM_FILES%\M-Plus Messenger\GUCC-Ent-CA.cer
- %PROGRAM_FILES%\M-Plus Messenger\Microsoft.CSharp.dll
- %PROGRAM_FILES%\M-Plus Messenger\HMGCProdRootCA.cer
- %WINDIR%\Installer\32388.mst
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING.VER
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.BTR
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\domain.txt
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\$WinMgmt.CFG
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING1.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\RestorePointSize
- %WINDIR%\Installer\32387.msi
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING2.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.DATA
- %PROGRAM_FILES%\M-Plus Messenger\cert.exe
- %WINDIR%\Installer\MSI14.tmp
- %WINDIR%\Installer\{6AE9F02B-3D88-4EEE-9DCE-FB633A3F29E8}\ARPPRODUCTICON.exe
- %ALLUSERSPROFILE%\Desktop\Autoway M+.lnk
- %WINDIR%\Installer\$PatchCache$\Managed\B20F9EA688D3EEE4D9ECBF36A3F3928E\0.7.1\Global_System_OLEAUT32_f3.8C0C59A0_7DC8_11D2_B95D_006097C4DE24
- %ALLUSERSPROFILE%\Start Menu\Programs\Autoway M+\Autoway M+.lnk
- %WINDIR%\Installer\{6AE9F02B-3D88-4EEE-9DCE-FB633A3F29E8}\NewShortcut1_3CB5F8D0ECA04F49882D6C776B3AB38E.exe
- %TEMP%\7zS1.tmp\setup.log
- %TEMP%\2ee8e.mst
- %TEMP%\MSI2ee8d.LOG
- %WINDIR%\Installer\{6AE9F02B-3D88-4EEE-9DCE-FB633A3F29E8}\NewShortcut2_65ED413361D946959101542D52EC526A.exe
- %WINDIR%\Installer\{6AE9F02B-3D88-4EEE-9DCE-FB633A3F29E8}\1033.MST
- %WINDIR%\Installer\$PatchCache$\Managed\B20F9EA688D3EEE4D9ECBF36A3F3928E\0.7.1\Global_System_OLEAUT32_f2.8C0C59A0_7DC8_11D2_B95D_006097C4DE24
- %PROGRAM_FILES%\M-Plus Messenger\images\sms.png
- %PROGRAM_FILES%\M-Plus Messenger\images\file.png
- %PROGRAM_FILES%\M-Plus Messenger\images\Thumbs.db
- %PROGRAM_FILES%\M-Plus Messenger\AxonMsg.exe
- %PROGRAM_FILES%\M-Plus Messenger\System.Dynamic.dll
- %PROGRAM_FILES%\M-Plus Messenger\images\memo.png
- %WINDIR%\Installer\$PatchCache$\Managed\B20F9EA688D3EEE4D9ECBF36A3F3928E\0.7.1\Global_System_OLEPRO32_f0.8C0C59A0_7DC8_11D2_B95D_006097C4DE24
- %WINDIR%\Installer\$PatchCache$\Managed\B20F9EA688D3EEE4D9ECBF36A3F3928E\0.7.1\Global_System_STDOLE_f1.8C0C59A0_7DC8_11D2_B95D_006097C4DE24
- %PROGRAM_FILES%\M-Plus Messenger\script.exe
- %PROGRAM_FILES%\M-Plus Messenger\mplusservice\AutowayMplusService.exe
- %PROGRAM_FILES%\M-Plus Messenger\System.Xaml.dll
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\ComDb.Dat
- %TEMP%\{7A80D9C8-3CE2-4416-8596-6169394D3EC2}\Autoway M+.msi
- %WINDIR%\Downloaded Installations\{88CE9D0A-2FCF-486E-ADF1-C885EF6307ED}\Autoway M+.msi
- %TEMP%\_is8.tmp
- %TEMP%\_is7.tmp
- %TEMP%\{7A80D9C8-3CE2-4416-8596-6169394D3EC2}\1033.MST
- %WINDIR%\Downloaded Installations\{88CE9D0A-2FCF-486E-ADF1-C885EF6307ED}\1033.MST
- %TEMP%\_isB.tmp
- %TEMP%\{7A80D9C8-3CE2-4416-8596-6169394D3EC2}\ISSetup.dll
- %TEMP%\~9.tmp
- %WINDIR%\Downloaded Installations\{88CE9D0A-2FCF-486E-ADF1-C885EF6307ED}\0x0409.ini
- %TEMP%\_isA.tmp
- %TEMP%\~5.tmp
- %TEMP%\_is2.tmp
- %TEMP%\{7A80D9C8-3CE2-4416-8596-6169394D3EC2}\Setup.INI
- %TEMP%\7zS1.tmp\setup.exe
- %TEMP%\7zS1.tmp\install.bat
- %TEMP%\7zS1.tmp\setup.iss
- %TEMP%\{7A80D9C8-3CE2-4416-8596-6169394D3EC2}\_ISMSIDEL.INI
- %TEMP%\{7A80D9C8-3CE2-4416-8596-6169394D3EC2}\0x0412.ini
- %TEMP%\_is6.tmp
- %TEMP%\_is4.tmp
- %TEMP%\_is3.tmp
- %TEMP%\{7A80D9C8-3CE2-4416-8596-6169394D3EC2}\0x0409.ini
- %TEMP%\_isC.tmp
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SYSTEM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SAM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SOFTWARE
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_.DEFAULT
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SECURITY
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
- %TEMP%\_isE.tmp
- %TEMP%\{EDA55659-E2E1-4F2D-A802-FF1703D2A551}\setup.exe
- %TEMP%\{EDA55659-E2E1-4F2D-A802-FF1703D2A551}\ISRT.dll
- %TEMP%\{EDA55659-E2E1-4F2D-A802-FF1703D2A551}\setup.inx
- %TEMP%\_isD.tmp
- %TEMP%\_isF.tmp
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\rp.log
- %TEMP%\{EDA55659-E2E1-4F2D-A802-FF1703D2A551}\String1033.txt
- %TEMP%\{EDA55659-E2E1-4F2D-A802-FF1703D2A551}\_isres_0x0409.dll
- %TEMP%\_is10.tmp
Удаляет следующие файлы:
- %TEMP%\{EDA55659-E2E1-4F2D-A802-FF1703D2A551}\setup.inx
- %TEMP%\{EDA55659-E2E1-4F2D-A802-FF1703D2A551}\setup.exe
- %TEMP%\{7A80D9C8-3CE2-4416-8596-6169394D3EC2}\0x0409.ini
- %TEMP%\{7A80D9C8-3CE2-4416-8596-6169394D3EC2}\1033.MST
- %TEMP%\{7A80D9C8-3CE2-4416-8596-6169394D3EC2}\0x0412.ini
- %TEMP%\f33f.rra
- %WINDIR%\Installer\32389.ipi
- %TEMP%\{EDA55659-E2E1-4F2D-A802-FF1703D2A551}\ISRT.dll
- %TEMP%\{EDA55659-E2E1-4F2D-A802-FF1703D2A551}\_isres_0x0409.dll
- %TEMP%\{EDA55659-E2E1-4F2D-A802-FF1703D2A551}\String1033.txt
- %TEMP%\7zS1.tmp\setup.iss
- %TEMP%\7zS1.tmp\setup.exe
- %TEMP%\7zS1.tmp\setup.log
- <SYSTEM32>\PerfStringBackup.TMP
- <SYSTEM32>\wbem\Performance\WmiApRpl.ini
- %TEMP%\{7A80D9C8-3CE2-4416-8596-6169394D3EC2}\ISSetup.dll
- %TEMP%\{7A80D9C8-3CE2-4416-8596-6169394D3EC2}\Autoway M+.msi
- %TEMP%\{7A80D9C8-3CE2-4416-8596-6169394D3EC2}\Setup.INI
- %TEMP%\7zS1.tmp\install.bat
- %TEMP%\{7A80D9C8-3CE2-4416-8596-6169394D3EC2}\_ISMSIDEL.INI
- %WINDIR%\Installer\32388.mst
- %TEMP%\_is8.tmp
- %TEMP%\_is7.tmp
- %TEMP%\_isA.tmp
- %TEMP%\_isB.tmp
- %TEMP%\~9.tmp
- %TEMP%\_is3.tmp
- %TEMP%\_is2.tmp
- %TEMP%\_is4.tmp
- %TEMP%\~5.tmp
- %TEMP%\_is6.tmp
- %WINDIR%\Installer\MSI14.tmp
- %WINDIR%\Installer\MSI11.tmp
- %WINDIR%\Installer\MSI12.tmp
- %WINDIR%\Installer\32387.msi
- C:\Config.Msi\3238a.rbs
- %TEMP%\_isD.tmp
- %TEMP%\_isC.tmp
- %TEMP%\_isE.tmp
- %TEMP%\_is10.tmp
- %TEMP%\_isF.tmp
Другое:
Ищет следующие окна:
- ClassName: 'CommunicatorMainWindowClass' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
