Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %ALLUSERSPROFILE%\Start Menu\Programs\Startup\STK016 PNP Monitor.lnk
Вредоносные функции:
Создает и запускает на исполнение:
- '%PROGRAM_FILES%\STK016_V2.01\STK016M.exe'
- '%WINDIR%\STK016\STK016W2K1.exe'
- '%WINDIR%\STK016\STK016W2K2.exe' "%WINDIR%\STK016\STK016I.inf" "USB\Vid_05e1&Pid_0895"
- '%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\IKernel.exe' /REGSERVER
- '%TEMP%\pft3.tmp\Disk1\Setup.exe'
- '%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\IKernel.exe' -RegServer
- '%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\IKernel.exe' 32\IKernel.exe -Embedding
Изменения в файловой системе:
Создает следующие файлы:
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.DATA
- %PROGRAM_FILES%\InstallShield Installation Information\{D5D71581-51DA-4D0B-89B1-52671AC16B74}\Setup.ini
- %PROGRAM_FILES%\InstallShield Installation Information\{D5D71581-51DA-4D0B-89B1-52671AC16B74}\setua128.rra
- %PROGRAM_FILES%\InstallShield Installation Information\{D5D71581-51DA-4D0B-89B1-52671AC16B74}\Setua108.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING2.MAP
- %PROGRAM_FILES%\STK016_V2.01\STK0a3a8.rra
- %PROGRAM_FILES%\STK016_V2.01\STK0a3c8.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\RestorePointSize
- %PROGRAM_FILES%\STK016_V2.01\STK0a1c4.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING1.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.BTR
- %PROGRAM_FILES%\InstallShield Installation Information\{D5D71581-51DA-4D0B-89B1-52671AC16B74}\layoa04d.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\$WinMgmt.CFG
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\ComDb.Dat
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\domain.txt
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING.VER
- %PROGRAM_FILES%\InstallShield Installation Information\{D5D71581-51DA-4D0B-89B1-52671AC16B74}\Setua0e9.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.MAP
- %PROGRAM_FILES%\InstallShield Installation Information\{D5D71581-51DA-4D0B-89B1-52671AC16B74}\dataa06c.rra
- %PROGRAM_FILES%\InstallShield Installation Information\{D5D71581-51DA-4D0B-89B1-52671AC16B74}\dataa07c.rra
- %WINDIR%\STK016\STK0a7ee.rra
- %WINDIR%\STK016\STK0a84c.rra
- %WINDIR%\STK016\twuna7a0.rra
- %WINDIR%\STK016\twaia723.rra
- %WINDIR%\STK016\twaia761.rra
- %WINDIR%\inf\oem3.inf
- %WINDIR%\inf\oem3.PNF
- <SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem3.CAT
- %WINDIR%\STK016\STK0a86b.rra
- %WINDIR%\STK016\stk0a907.rra
- %WINDIR%\STK016\twuna6e4.rra
- <DRIVERS>\STK0a55e.rra
- %WINDIR%\STK016\STK0a59c.rra
- %WINDIR%\STK016\STK0a52f.rra
- %WINDIR%\STK016\STK0a4e1.rra
- <SYSTEM32>\STK0a500.rra
- %WINDIR%\STK016\Cresa658.rra
- %WINDIR%\twain_32\STK016\Cresa6a6.rra
- %WINDIR%\twain_32\STK016\Cresa619.rra
- <DRIVERS>\STK0a5bc.rra
- %WINDIR%\STK016\Cresa5ea.rra
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\core427d.rra
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\ctor43b6.rra
- %TEMP%\IEC4.tmp
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\temp.000
- %TEMP%\{D5D71581-51DA-4D0B-89B1-52671AC16B74}\setu6037.rra
- %TEMP%\{D5D71581-51DA-4D0B-89B1-52671AC16B74}\LICE618e.rra
- %CommonProgramFiles%\InstallShield\IScript\iscr4d4b.rra
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\obje47ad.rra
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\iuse4888.rra
- %TEMP%\pft3.tmp\Disk1\setup.inx
- %TEMP%\pft3.tmp\Disk1\data1.cab
- %TEMP%\pft3.tmp\Disk1\data1.hdr
- %TEMP%\pft3.tmp\pftw1.pkg
- %TEMP%\ext2.tmp
- %TEMP%\plf1.tmp
- %TEMP%\pft3.tmp\Disk1\Setup.exe
- %TEMP%\pft3.tmp\Disk1\Setup.ini
- %TEMP%\pft3.tmp\Disk1\layout.bin
- %TEMP%\pft3.tmp\Disk1\data2.cab
- %TEMP%\pft3.tmp\Disk1\ikernel.ex_
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SYSTEM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SAM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SOFTWARE
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_.DEFAULT
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SECURITY
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
- %TEMP%\{D5D71581-51DA-4D0B-89B1-52671AC16B74}\valu649c.rra
- %TEMP%\{D5D71581-51DA-4D0B-89B1-52671AC16B74}\vssv64ea.rra
- %TEMP%\{D5D71581-51DA-4D0B-89B1-52671AC16B74}\vssv6382.rra
- %TEMP%\{D5D71581-51DA-4D0B-89B1-52671AC16B74}\SETU61ec.rra
- %TEMP%\{D5D71581-51DA-4D0B-89B1-52671AC16B74}\Star6305.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\rp.log
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
- %TEMP%\{D5D71581-51DA-4D0B-89B1-52671AC16B74}\_IsR6826.rra
- %TEMP%\{D5D71581-51DA-4D0B-89B1-52671AC16B74}\isrt6603.rra
- %TEMP%\{D5D71581-51DA-4D0B-89B1-52671AC16B74}\defa672c.rra
Присваивает атрибут 'скрытый' для следующих файлов:
- <SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem3.CAT
Удаляет следующие файлы:
- %TEMP%\IEC4.tmp
- %TEMP%\{D5D71581-51DA-4D0B-89B1-52671AC16B74}\vssver.scc
- %TEMP%\ext2.tmp
- %TEMP%\pft3.tmp\pftw1.pkg
Перемещает следующие файлы:
- %WINDIR%\STK016\Cresa658.rra в %WINDIR%\STK016\Cresa648.rra
- %WINDIR%\twain_32\STK016\Cresa619.rra в %WINDIR%\twain_32\STK016\Cresds.ds
- %WINDIR%\twain_32\STK016\Cresa6a6.rra в %WINDIR%\twain_32\STK016\CresCap.dll
- %WINDIR%\STK016\twuna6e4.rra в %WINDIR%\STK016\twunk_32.exe
- %WINDIR%\STK016\twaia761.rra в %WINDIR%\STK016\twaia752.rra
- <DRIVERS>\STK0a5bc.rra в <DRIVERS>\STK016W1.sys
- %PROGRAM_FILES%\STK016_V2.01\STK0a3c8.rra в %PROGRAM_FILES%\STK016_V2.01\STK016K.exe
- %PROGRAM_FILES%\STK016_V2.01\STK0a3a8.rra в %PROGRAM_FILES%\STK016_V2.01\STK016M.exe
- <SYSTEM32>\STK0a500.rra в <SYSTEM32>\STK016P.ax
- <DRIVERS>\STK0a55e.rra в <DRIVERS>\STK016W2.sys
- %WINDIR%\STK016\STK0a52f.rra в %WINDIR%\STK016\STK0a51f.rra
- %WINDIR%\STK016\STK0a7ee.rra в %WINDIR%\STK016\STK016I.inf
- %WINDIR%\STK016\twuna7a0.rra в %WINDIR%\STK016\twunk_16.exe
- %WINDIR%\STK016\twaia752.rra в %WINDIR%\STK016\twain_32.dll
- %WINDIR%\STK016\Cresa5ea.rra в %WINDIR%\STK016\Cresds.ds
- %WINDIR%\STK016\stk0a907.rra в %WINDIR%\STK016\stk016.cat
- %WINDIR%\STK016\Cresa648.rra в %WINDIR%\STK016\CresCap.dll
- %WINDIR%\STK016\twaia723.rra в %WINDIR%\STK016\twain.dll
- %WINDIR%\STK016\STK0a59c.rra в %WINDIR%\STK016\STK016W1.sys
- %WINDIR%\STK016\STK0a4e1.rra в %WINDIR%\STK016\STK016P.ax
- %WINDIR%\STK016\STK0a51f.rra в %WINDIR%\STK016\STK016W2.sys
- %WINDIR%\STK016\STK0a86b.rra в %WINDIR%\STK016\STK016W2K2.exe
- %WINDIR%\STK016\STK0a84c.rra в %WINDIR%\STK016\STK016W2K1.exe
- %TEMP%\{D5D71581-51DA-4D0B-89B1-52671AC16B74}\LICE618e.rra в %TEMP%\{D5D71581-51DA-4D0B-89B1-52671AC16B74}\LICENSE.TXT
- %TEMP%\{D5D71581-51DA-4D0B-89B1-52671AC16B74}\setu6037.rra в %TEMP%\{D5D71581-51DA-4D0B-89B1-52671AC16B74}\setup.inx
- %TEMP%\{D5D71581-51DA-4D0B-89B1-52671AC16B74}\SETU61ec.rra в %TEMP%\{D5D71581-51DA-4D0B-89B1-52671AC16B74}\SETUP.BMP
- %TEMP%\{D5D71581-51DA-4D0B-89B1-52671AC16B74}\vssv6382.rra в %TEMP%\{D5D71581-51DA-4D0B-89B1-52671AC16B74}\vssver.scc
- %TEMP%\{D5D71581-51DA-4D0B-89B1-52671AC16B74}\Star6305.rra в %TEMP%\{D5D71581-51DA-4D0B-89B1-52671AC16B74}\Start.WAV
- %CommonProgramFiles%\InstallShield\IScript\iscr4d4b.rra в %CommonProgramFiles%\InstallShield\IScript\iscript.dll
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\core427d.rra в %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\corecomp.ini
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\temp.000 в %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\IKernel.exe
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\ctor43b6.rra в %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\ctor.dll
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\iuse4888.rra в %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\iuser.dll
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\obje47ad.rra в %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\objectps.dll
- %TEMP%\{D5D71581-51DA-4D0B-89B1-52671AC16B74}\valu649c.rra в %TEMP%\{D5D71581-51DA-4D0B-89B1-52671AC16B74}\value.shl
- %PROGRAM_FILES%\InstallShield Installation Information\{D5D71581-51DA-4D0B-89B1-52671AC16B74}\Setua0e9.rra в %PROGRAM_FILES%\InstallShield Installation Information\{D5D71581-51DA-4D0B-89B1-52671AC16B74}\Setup.exe
- %PROGRAM_FILES%\InstallShield Installation Information\{D5D71581-51DA-4D0B-89B1-52671AC16B74}\dataa07c.rra в %PROGRAM_FILES%\InstallShield Installation Information\{D5D71581-51DA-4D0B-89B1-52671AC16B74}\data1.cab
- %PROGRAM_FILES%\InstallShield Installation Information\{D5D71581-51DA-4D0B-89B1-52671AC16B74}\Setua108.rra в %PROGRAM_FILES%\InstallShield Installation Information\{D5D71581-51DA-4D0B-89B1-52671AC16B74}\Setup.ini
- %PROGRAM_FILES%\STK016_V2.01\STK0a1c4.rra в %PROGRAM_FILES%\STK016_V2.01\STK016D.exe
- %PROGRAM_FILES%\InstallShield Installation Information\{D5D71581-51DA-4D0B-89B1-52671AC16B74}\setua128.rra в %PROGRAM_FILES%\InstallShield Installation Information\{D5D71581-51DA-4D0B-89B1-52671AC16B74}\setup.inx
- %PROGRAM_FILES%\InstallShield Installation Information\{D5D71581-51DA-4D0B-89B1-52671AC16B74}\dataa06c.rra в %PROGRAM_FILES%\InstallShield Installation Information\{D5D71581-51DA-4D0B-89B1-52671AC16B74}\data1.hdr
- %TEMP%\{D5D71581-51DA-4D0B-89B1-52671AC16B74}\isrt6603.rra в %TEMP%\{D5D71581-51DA-4D0B-89B1-52671AC16B74}\isrt.dll
- %TEMP%\{D5D71581-51DA-4D0B-89B1-52671AC16B74}\vssv64ea.rra в %TEMP%\{D5D71581-51DA-4D0B-89B1-52671AC16B74}\vssver.scc
- %TEMP%\{D5D71581-51DA-4D0B-89B1-52671AC16B74}\defa672c.rra в %TEMP%\{D5D71581-51DA-4D0B-89B1-52671AC16B74}\default.pal
- %PROGRAM_FILES%\InstallShield Installation Information\{D5D71581-51DA-4D0B-89B1-52671AC16B74}\layoa04d.rra в %PROGRAM_FILES%\InstallShield Installation Information\{D5D71581-51DA-4D0B-89B1-52671AC16B74}\layout.bin
- %TEMP%\{D5D71581-51DA-4D0B-89B1-52671AC16B74}\_IsR6826.rra в %TEMP%\{D5D71581-51DA-4D0B-89B1-52671AC16B74}\_IsRes.dll
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
