Техническая информация
Для обеспечения автозапуска и распространения:
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Network Connectivity Manager] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- '%ALLUSERSPROFILE%\Application Data\Microsoft FXcop\service.exe'
- '%ALLUSERSPROFILE%\Application Data\Microsoft FXcop\netscp.exe' -u
Запускает на исполнение:
- '<SYSTEM32>\sc.exe' start "Network Connectivity Manager"
- '<SYSTEM32>\sc.exe' config "Network Connectivity Manager" start= auto
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\csc.exe' /noconfig /fullpaths @"%WINDIR%\TEMP\jb2micwb.cmdline"
- '<SYSTEM32>\wbem\wmiadap.exe' /R /T
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%WINDIR%\TEMP\RES4.tmp" "%WINDIR%\Temp\CSC3.tmp"
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2.tmp" "%TEMP%\CSC1.tmp"
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\ko-yn9q9.cmdline"
- '<SYSTEM32>\sc.exe' create "Network Connectivity Manager" binpath= "%ALLUSERSPROFILE%\Application Data\Microsoft FXcop\service.exe" displayname= "Network Connectivity Manager"
- '<SYSTEM32>\sc.exe' description "Network Connectivity Manager" "Manage networked devices and services that use the SSDP discovery protocol, such as UPnP devices. Also announces SSDP devices and services running on the local computer. If this service is stopped, SSDP-based devices will not be discovered. If this service is disabled, any services that explicitly depend on it will fail to start"
- '<SYSTEM32>\sc.exe' create "Network Connectivity Manager" binpath= %ALLUSERSPROFILE%\Application Data\Microsoft FXcop\service.exe" displayname= "Network Connectivity Manager
Изменения в файловой системе:
Создает следующие файлы:
- %ALLUSERSPROFILE%\Application Data\Microsoft\Internet Explorer\SQP4H9Z2_A.tmp
- %WINDIR%\Temp\jb2micwb.0.cs
- %ALLUSERSPROFILE%\Application Data\Microsoft FXcop\tfg.tmp
- %TEMP%\RES2.tmp
- %TEMP%\ko-yn9q9.dll
- %WINDIR%\Temp\RES4.tmp
- %WINDIR%\Temp\jb2micwb.dll
- %WINDIR%\Temp\CSC3.tmp
- %WINDIR%\Temp\jb2micwb.cmdline
- %WINDIR%\Temp\jb2micwb.out
- %TEMP%\CSC1.tmp
- %ALLUSERSPROFILE%\Application Data\Microsoft FXcop\MainModule.dll
- %ALLUSERSPROFILE%\Application Data\Microsoft FXcop\TimerModule.tmd
- %ALLUSERSPROFILE%\Application Data\Microsoft FXcop\gn.tmp
- %ALLUSERSPROFILE%\Application Data\Microsoft FXcop\netscp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft FXcop\service.exe
- %TEMP%\ko-yn9q9.cmdline
- %TEMP%\ko-yn9q9.out
- %TEMP%\ko-yn9q9.0.cs
- %ALLUSERSPROFILE%\Application Data\Microsoft FXcop\WebServiceConnector.tmd
- %ALLUSERSPROFILE%\Application Data\Microsoft FXcop\c4febf31-f8bd-g26b.tmp
Удаляет следующие файлы:
- %WINDIR%\Temp\jb2micwb.out
- %WINDIR%\Temp\jb2micwb.cmdline
- %WINDIR%\Temp\CSC3.tmp
- %WINDIR%\Temp\jb2micwb.0.cs
- <SYSTEM32>\PerfStringBackup.TMP
- <SYSTEM32>\wbem\Performance\WmiApRpl.ini
- %WINDIR%\Temp\jb2micwb.dll
- %TEMP%\ko-yn9q9.dll
- %TEMP%\CSC1.tmp
- %TEMP%\RES2.tmp
- %TEMP%\ko-yn9q9.cmdline
- %WINDIR%\Temp\RES4.tmp
- %TEMP%\ko-yn9q9.out
- %TEMP%\ko-yn9q9.0.cs
Сетевая активность:
Подключается к:
- 'mi######tactiveservices.com':80
- '20#.#6.232.182':80
- 'wp#d':80
TCP:
Запросы HTTP GET:
- 20#.#6.232.182/
- wp#d/wpad.dat
Запросы HTTP POST:
- mi######tactiveservices.com/checkupdate.asmx
UDP:
- DNS ASK mi######tactiveservices.com
- DNS ASK www.microsoft.com
- DNS ASK wp#d
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
