Техническая информация
Вредоносные функции:
Создает и запускает на исполнение:
- '%TEMP%\{10C15868-2355-4995-BC49-18F915701258}\{0B696E24-DB80-424D-BC7E-54B1FDF85273}\SPA.exe' -d
- '%TEMP%\{10C15868-2355-4995-BC49-18F915701258}\{0B696E24-DB80-424D-BC7E-54B1FDF85273}\AgentSoftEnv.exe'
- '<SYSTEM32>\TGFULLA_A_A_AAA.EXE'
- '<SYSTEM32>\TGFULLA_A_A_AAA.EXE' -deleter
Запускает на исполнение:
- '<SYSTEM32>\wbem\wmiadap.exe' /R /T
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\{10C15868-2355-4995-BC49-18F915701258}\{0B696E24-DB80-424D-BC7E-54B1FDF85273}\SysPca80.rra
- %TEMP%\{10C15868-2355-4995-BC49-18F915701258}\{0B696E24-DB80-424D-BC7E-54B1FDF85273}\Intrca32.rra
- %TEMP%\{10C15868-2355-4995-BC49-18F915701258}\{0B696E24-DB80-424D-BC7E-54B1FDF85273}\TGFWc9f3.rra
- %TEMP%\{10C15868-2355-4995-BC49-18F915701258}\{0B696E24-DB80-424D-BC7E-54B1FDF85273}\Trancbd8.rra
- %TEMP%\{10C15868-2355-4995-BC49-18F915701258}\{0B696E24-DB80-424D-BC7E-54B1FDF85273}\Agencb99.rra
- %TEMP%\{10C15868-2355-4995-BC49-18F915701258}\{0B696E24-DB80-424D-BC7E-54B1FDF85273}\Agencace.rra
- %TEMP%\{10C15868-2355-4995-BC49-18F915701258}\{0B696E24-DB80-424D-BC7E-54B1FDF85273}\SPAc9a5.rra
- %CommonProgramFiles%\InstallShield\Professional\RunTime\IsProBE.tlb
- %CommonProgramFiles%\InstallShield\Professional\RunTime\IsPE.tmp
- %CommonProgramFiles%\InstallShield\Professional\RunTime\10\50\Intel32\iusD.tmp
- %TEMP%\{10C15868-2355-4995-BC49-18F915701258}\{0B696E24-DB80-424D-BC7E-54B1FDF85273}\setuc938.rra
- %CommonProgramFiles%\InstallShield\Professional\RunTime\ObjF.tmp
- %CommonProgramFiles%\InstallShield\Professional\RunTime\iKernel.rgs
- %TEMP%\{10C15868-2355-4995-BC49-18F915701258}\{05db82d8-b1b1-454c-bd83-57652bbcbf2a}\Setud00e.rra
- %TEMP%\{10C15868-2355-4995-BC49-18F915701258}\{0B696E24-DB80-424D-BC7E-54B1FDF85273}\_IsRcf81.rra
- %TEMP%\{10C15868-2355-4995-BC49-18F915701258}\{0B696E24-DB80-424D-BC7E-54B1FDF85273}\defacf23.rra
- %TEMP%\{10C15868-2355-4995-BC49-18F915701258}\{05db82d8-b1b1-454c-bd83-57652bbcbf2a}\MMObd1c3.rra
- %TEMP%\{10C15868-2355-4995-BC49-18F915701258}\{05db82d8-b1b1-454c-bd83-57652bbcbf2a}\Strid194.rra
- %TEMP%\{10C15868-2355-4995-BC49-18F915701258}\{05db82d8-b1b1-454c-bd83-57652bbcbf2a}\_Isrd0c9.rra
- %TEMP%\{10C15868-2355-4995-BC49-18F915701258}\{05db82d8-b1b1-454c-bd83-57652bbcbf2a}\Defacee5.rra
- %TEMP%\{10C15868-2355-4995-BC49-18F915701258}\{0B696E24-DB80-424D-BC7E-54B1FDF85273}\Fontcd20.rra
- %TEMP%\{10C15868-2355-4995-BC49-18F915701258}\coreccd2.rra
- %TEMP%\{10C15868-2355-4995-BC49-18F915701258}\{0B696E24-DB80-424D-BC7E-54B1FDF85273}\_ISUcc26.rra
- %TEMP%\{10C15868-2355-4995-BC49-18F915701258}\{0B696E24-DB80-424D-BC7E-54B1FDF85273}\isrtce68.rra
- %TEMP%\{10C15868-2355-4995-BC49-18F915701258}\{05db82d8-b1b1-454c-bd83-57652bbcbf2a}\Isrtcdcc.rra
- %TEMP%\{10C15868-2355-4995-BC49-18F915701258}\{0B696E24-DB80-424D-BC7E-54B1FDF85273}\Stricd5e.rra
- %TEMP%\bye1.tmp\Disk1\setup.ibt
- %TEMP%\bye1.tmp\Disk1\setup.exe
- %TEMP%\bye1.tmp\Disk1\layout.bin
- %TEMP%\bye1.tmp\MsiStub\{5814CAAF-3904-4E70-B811-F3A6FF0BCF9C}\LinkTrust IntraSec Agent.msi
- %TEMP%\bye1.tmp\Disk1\setup.inx
- %TEMP%\bye1.tmp\Disk1\setup.ini
- %TEMP%\bye1.tmp\Disk1\engine32.cab
- <SYSTEM32>\AGENTSOFTENV.XML
- <SYSTEM32>\AGENTLOCALCONF.XML
- <SYSTEM32>\TGFULLA_A_A_AAA.EXE
- %TEMP%\bye1.tmp\Disk1\data1.hdr
- %TEMP%\bye1.tmp\Disk1\data1.cab
- %TEMP%\ISPackFiles.ini
- %CommonProgramFiles%\InstallShield\Professional\RunTime\10\50\Intel32\iKe9.tmp
- %TEMP%\isp5.tmp\temp.000
- %TEMP%\_se8.tmp
- %CommonProgramFiles%\InstallShield\Professional\RunTime\10\50\Intel32\iscC.tmp
- %CommonProgramFiles%\InstallShield\Professional\RunTime\10\50\Intel32\ctoB.tmp
- %CommonProgramFiles%\InstallShield\Professional\RunTime\10\50\Intel32\DotA.tmp
- %CommonProgramFiles%\InstallShield\Professional\RunTime\10\50\Intel32\isp6.tmp\temp.000
- %CommonProgramFiles%\InstallShield\Professional\RunTime\10\50\Intel32\isp3.tmp\temp.000
- %CommonProgramFiles%\InstallShield\Professional\RunTime\10\50\Intel32\set4.tmp
- %TEMP%\iss2.tmp\setup.ini
- %TEMP%\igd7.tmp
- %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\1d5c3db60a99514927c147dcd72b6be1_23ef5514-3059-436f-a4a7-4cefaab20eb1
Удаляет следующие файлы:
- %CommonProgramFiles%\InstallShield\Professional\RunTime\IsPE.tmp
- <SYSTEM32>\wbem\Performance\WmiApRpl.ini
- <SYSTEM32>\PerfStringBackup.TMP
- %CommonProgramFiles%\InstallShield\Professional\RunTime\10\50\Intel32\set4.tmp
- %TEMP%\igd7.tmp
- %TEMP%\_se8.tmp
Перемещает следующие файлы:
- %TEMP%\{10C15868-2355-4995-BC49-18F915701258}\{0B696E24-DB80-424D-BC7E-54B1FDF85273}\Stricd5e.rra в %TEMP%\{10C15868-2355-4995-BC49-18F915701258}\{0B696E24-DB80-424D-BC7E-54B1FDF85273}\StringTable-0804-Chinese (Simplified).ips
- %TEMP%\{10C15868-2355-4995-BC49-18F915701258}\{0B696E24-DB80-424D-BC7E-54B1FDF85273}\Fontcd20.rra в %TEMP%\{10C15868-2355-4995-BC49-18F915701258}\{0B696E24-DB80-424D-BC7E-54B1FDF85273}\FontData.ini
- %TEMP%\{10C15868-2355-4995-BC49-18F915701258}\{0B696E24-DB80-424D-BC7E-54B1FDF85273}\isrtce68.rra в %TEMP%\{10C15868-2355-4995-BC49-18F915701258}\{0B696E24-DB80-424D-BC7E-54B1FDF85273}\isrt.dll
- %TEMP%\{10C15868-2355-4995-BC49-18F915701258}\{05db82d8-b1b1-454c-bd83-57652bbcbf2a}\Isrtcdcc.rra в %TEMP%\{10C15868-2355-4995-BC49-18F915701258}\{05db82d8-b1b1-454c-bd83-57652bbcbf2a}\Isrtcdbc.rra
- %TEMP%\{10C15868-2355-4995-BC49-18F915701258}\{0B696E24-DB80-424D-BC7E-54B1FDF85273}\Trancbd8.rra в %TEMP%\{10C15868-2355-4995-BC49-18F915701258}\{0B696E24-DB80-424D-BC7E-54B1FDF85273}\TransformTheXMLs.exe
- %TEMP%\{10C15868-2355-4995-BC49-18F915701258}\{0B696E24-DB80-424D-BC7E-54B1FDF85273}\Agencb99.rra в %TEMP%\{10C15868-2355-4995-BC49-18F915701258}\{0B696E24-DB80-424D-BC7E-54B1FDF85273}\AgentSoftEnv.exe
- %TEMP%\{10C15868-2355-4995-BC49-18F915701258}\coreccd2.rra в %TEMP%\{10C15868-2355-4995-BC49-18F915701258}\corecomp.ini
- %TEMP%\{10C15868-2355-4995-BC49-18F915701258}\{0B696E24-DB80-424D-BC7E-54B1FDF85273}\_ISUcc26.rra в %TEMP%\{10C15868-2355-4995-BC49-18F915701258}\{0B696E24-DB80-424D-BC7E-54B1FDF85273}\_ISUser.dll
- %TEMP%\{10C15868-2355-4995-BC49-18F915701258}\{05db82d8-b1b1-454c-bd83-57652bbcbf2a}\Defacee5.rra в %TEMP%\{10C15868-2355-4995-BC49-18F915701258}\{05db82d8-b1b1-454c-bd83-57652bbcbf2a}\Defaced5.rra
- %TEMP%\{10C15868-2355-4995-BC49-18F915701258}\{05db82d8-b1b1-454c-bd83-57652bbcbf2a}\_Isrd0c9.rra в %TEMP%\{10C15868-2355-4995-BC49-18F915701258}\{05db82d8-b1b1-454c-bd83-57652bbcbf2a}\_Isres.dll
- %TEMP%\{10C15868-2355-4995-BC49-18F915701258}\{05db82d8-b1b1-454c-bd83-57652bbcbf2a}\Defaced5.rra в %TEMP%\{10C15868-2355-4995-BC49-18F915701258}\{05db82d8-b1b1-454c-bd83-57652bbcbf2a}\Default.pal
- %TEMP%\{10C15868-2355-4995-BC49-18F915701258}\{05db82d8-b1b1-454c-bd83-57652bbcbf2a}\MMObd1c3.rra в %TEMP%\{10C15868-2355-4995-BC49-18F915701258}\{05db82d8-b1b1-454c-bd83-57652bbcbf2a}\MMObjHelper.dll
- %TEMP%\{10C15868-2355-4995-BC49-18F915701258}\{05db82d8-b1b1-454c-bd83-57652bbcbf2a}\Strid194.rra в %TEMP%\{10C15868-2355-4995-BC49-18F915701258}\{05db82d8-b1b1-454c-bd83-57652bbcbf2a}\StringTable-0009-English.ips
- %TEMP%\{10C15868-2355-4995-BC49-18F915701258}\{0B696E24-DB80-424D-BC7E-54B1FDF85273}\_IsRcf81.rra в %TEMP%\{10C15868-2355-4995-BC49-18F915701258}\{0B696E24-DB80-424D-BC7E-54B1FDF85273}\_IsRes.dll
- %TEMP%\{10C15868-2355-4995-BC49-18F915701258}\{0B696E24-DB80-424D-BC7E-54B1FDF85273}\defacf23.rra в %TEMP%\{10C15868-2355-4995-BC49-18F915701258}\{0B696E24-DB80-424D-BC7E-54B1FDF85273}\default.pal
- %TEMP%\{10C15868-2355-4995-BC49-18F915701258}\{05db82d8-b1b1-454c-bd83-57652bbcbf2a}\Isrtcdbc.rra в %TEMP%\{10C15868-2355-4995-BC49-18F915701258}\{05db82d8-b1b1-454c-bd83-57652bbcbf2a}\Isrt.dll
- %TEMP%\{10C15868-2355-4995-BC49-18F915701258}\{05db82d8-b1b1-454c-bd83-57652bbcbf2a}\Setud00e.rra в %TEMP%\{10C15868-2355-4995-BC49-18F915701258}\{05db82d8-b1b1-454c-bd83-57652bbcbf2a}\Setup.inx
- %CommonProgramFiles%\InstallShield\Professional\RunTime\10\50\Intel32\iKe9.tmp в %CommonProgramFiles%\InstallShield\Professional\RunTime\10\50\Intel32\iKernel.dll
- %TEMP%\isp5.tmp\temp.000 в %TEMP%\isp5.tmp\_Setup.dll
- %CommonProgramFiles%\InstallShield\Professional\RunTime\10\50\Intel32\ctoB.tmp в %CommonProgramFiles%\InstallShield\Professional\RunTime\10\50\Intel32\ctor.dll
- %CommonProgramFiles%\InstallShield\Professional\RunTime\10\50\Intel32\DotA.tmp в %CommonProgramFiles%\InstallShield\Professional\RunTime\10\50\Intel32\DotNetInstaller.exe
- %CommonProgramFiles%\InstallShield\Professional\RunTime\10\50\Intel32\isp3.tmp\setup.dll в %CommonProgramFiles%\InstallShield\Professional\RunTime\10\50\Intel32\setup.dll
- %CommonProgramFiles%\InstallShield\Professional\RunTime\10\50\Intel32\isp3.tmp\temp.000 в %CommonProgramFiles%\InstallShield\Professional\RunTime\10\50\Intel32\isp3.tmp\setup.dll
- %CommonProgramFiles%\InstallShield\Professional\RunTime\10\50\Intel32\isp6.tmp\IGdi.dll в %CommonProgramFiles%\InstallShield\Professional\RunTime\10\50\Intel32\iGdi.dll
- %CommonProgramFiles%\InstallShield\Professional\RunTime\10\50\Intel32\isp6.tmp\temp.000 в %CommonProgramFiles%\InstallShield\Professional\RunTime\10\50\Intel32\isp6.tmp\IGdi.dll
- %CommonProgramFiles%\InstallShield\Professional\RunTime\10\50\Intel32\iscC.tmp в %CommonProgramFiles%\InstallShield\Professional\RunTime\10\50\Intel32\iscript.dll
- %TEMP%\{10C15868-2355-4995-BC49-18F915701258}\{0B696E24-DB80-424D-BC7E-54B1FDF85273}\Intrca32.rra в %TEMP%\{10C15868-2355-4995-BC49-18F915701258}\{0B696E24-DB80-424D-BC7E-54B1FDF85273}\IntraSecBuild.ini
- %TEMP%\{10C15868-2355-4995-BC49-18F915701258}\{0B696E24-DB80-424D-BC7E-54B1FDF85273}\TGFWc9f3.rra в %TEMP%\{10C15868-2355-4995-BC49-18F915701258}\{0B696E24-DB80-424D-BC7E-54B1FDF85273}\TGFWInstall.exe
- %TEMP%\{10C15868-2355-4995-BC49-18F915701258}\{0B696E24-DB80-424D-BC7E-54B1FDF85273}\Agencace.rra в %TEMP%\{10C15868-2355-4995-BC49-18F915701258}\{0B696E24-DB80-424D-BC7E-54B1FDF85273}\AgentEnv.exe
- %TEMP%\{10C15868-2355-4995-BC49-18F915701258}\{0B696E24-DB80-424D-BC7E-54B1FDF85273}\SysPca80.rra в %TEMP%\{10C15868-2355-4995-BC49-18F915701258}\{0B696E24-DB80-424D-BC7E-54B1FDF85273}\SysProtectConf.exe
- %CommonProgramFiles%\InstallShield\Professional\RunTime\ObjF.tmp в %CommonProgramFiles%\InstallShield\Professional\RunTime\Objectps.dll
- %CommonProgramFiles%\InstallShield\Professional\RunTime\10\50\Intel32\iusD.tmp в %CommonProgramFiles%\InstallShield\Professional\RunTime\10\50\Intel32\iuser.dll
- %TEMP%\{10C15868-2355-4995-BC49-18F915701258}\{0B696E24-DB80-424D-BC7E-54B1FDF85273}\SPAc9a5.rra в %TEMP%\{10C15868-2355-4995-BC49-18F915701258}\{0B696E24-DB80-424D-BC7E-54B1FDF85273}\SPA.exe
- %TEMP%\{10C15868-2355-4995-BC49-18F915701258}\{0B696E24-DB80-424D-BC7E-54B1FDF85273}\setuc938.rra в %TEMP%\{10C15868-2355-4995-BC49-18F915701258}\{0B696E24-DB80-424D-BC7E-54B1FDF85273}\setup.inx
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
