Техническая информация
Вредоносные функции:
Создает и запускает на исполнение:
- '%TEMP%\RarSFX0\UExtract.exe' -y -gm2 -fm0
- '%TEMP%\RarSFX0\boomer.exe' boomer.cmd
Запускает на исполнение:
- '<SYSTEM32>\wbem\wmiadap.exe' /R /T
- '<SYSTEM32>\rundll32.exe' advpack,LaunchINFSection UExtr_en.inf,DefaultInstall,0
- '<SYSTEM32>\cmd.exe' /c boomer.cmd
Изменения в файловой системе:
Создает следующие файлы:
- %PROGRAM_FILES%\Universal Extractor\bin\InstExpl.dll
- %PROGRAM_FILES%\Universal Extractor\bin\stuffit5.engine-5.1.dll
- %PROGRAM_FILES%\Universal Extractor\bin\ForceLibrary.dll
- %PROGRAM_FILES%\Universal Extractor\bin\xace.exe
- %PROGRAM_FILES%\Universal Extractor\bin\7z.dll
- %PROGRAM_FILES%\Universal Extractor\UExtr_en.inf
- %PROGRAM_FILES%\Universal Extractor\UExtr_ru.inf
- %PROGRAM_FILES%\Universal Extractor\bin\ZD55131.DLL
- %PROGRAM_FILES%\Universal Extractor\bin\ZD50149.DLL
- %PROGRAM_FILES%\Universal Extractor\bin\ZD51145.DLL
- %PROGRAM_FILES%\Universal Extractor\bin\UnRAR.exe
- %PROGRAM_FILES%\Universal Extractor\bin\UNUHARC06.EXE
- %PROGRAM_FILES%\Universal Extractor\bin\unlzx.exe
- %PROGRAM_FILES%\Universal Extractor\bin\UHARC04.EXE
- %PROGRAM_FILES%\Universal Extractor\UniExtract.exe
- %PROGRAM_FILES%\Universal Extractor\bin\WDOSXLE.EXE
- %PROGRAM_FILES%\Universal Extractor\bin\WUN.exe
- %PROGRAM_FILES%\Universal Extractor\bin\uudeview.exe
- %PROGRAM_FILES%\Universal Extractor\bin\unzip.exe
- %PROGRAM_FILES%\Universal Extractor\bin\upx.exe
- %PROGRAM_FILES%\Universal Extractor\bin\InstExpl.wcx
- %PROGRAM_FILES%\Universal Extractor\bin\MHTUnp.wcx
- %PROGRAM_FILES%\Universal Extractor\bin\dbxplug.wcx
- %PROGRAM_FILES%\Universal Extractor\bin\Unp\pkware.unp
- %PROGRAM_FILES%\Universal Extractor\bin\Unp\vise.unp
- %ALLUSERSPROFILE%\Start Menu\Programs\Utilities\UniExtractor.lnk
- %HOMEPATH%\SendTo\Universal Extractor.lnk
- %WINDIR%\inf\UExtr_en.PNF
- %PROGRAM_FILES%\Universal Extractor\bin\msi.wcx
- %PROGRAM_FILES%\Universal Extractor\bin\PDunSIS.wcx
- %PROGRAM_FILES%\Universal Extractor\bin\Unp\Bzip2_3.unp
- %PROGRAM_FILES%\Universal Extractor\bin\Unp\Eschalon.unp
- %PROGRAM_FILES%\Universal Extractor\bin\Unp\Bzip2_2.unp
- %PROGRAM_FILES%\Universal Extractor\bin\TrIDDefs.TRD
- %PROGRAM_FILES%\Universal Extractor\bin\Unp\Bzip2_1.unp
- %PROGRAM_FILES%\Universal Extractor\bin\Unp\inflate3.unp
- %PROGRAM_FILES%\Universal Extractor\bin\Unp\lzma.unp
- %PROGRAM_FILES%\Universal Extractor\bin\Unp\inflate2.unp
- %PROGRAM_FILES%\Universal Extractor\bin\Unp\Gentee.unp
- %PROGRAM_FILES%\Universal Extractor\bin\Unp\inflate1.unp
- %PROGRAM_FILES%\Universal Extractor\bin\bin2iso.exe
- %PROGRAM_FILES%\Universal Extractor\bin\BOOZ.EXE
- %PROGRAM_FILES%\Universal Extractor\bin\AspackDie.exe
- %PROGRAM_FILES%\Universal Extractor\bin\arc.exe
- %PROGRAM_FILES%\Universal Extractor\bin\arj.exe
- %PROGRAM_FILES%\Universal Extractor\bin\Expander.exe
- %PROGRAM_FILES%\Universal Extractor\bin\EXTRACT.EXE
- %PROGRAM_FILES%\Universal Extractor\bin\cmdTotal.exe
- %PROGRAM_FILES%\Universal Extractor\bin\cdirip.exe
- %PROGRAM_FILES%\Universal Extractor\bin\clit.exe
- %TEMP%\RarSFX0\usde.ru.url
- %PROGRAM_FILES%\Universal Extractor\bin\userdb.txt
- %TEMP%\RarSFX0\UExtract.exe
- %TEMP%\RarSFX0\boomer.cmd
- %TEMP%\RarSFX0\boomer.exe
- %PROGRAM_FILES%\Universal Extractor\UniExtract.ini
- %PROGRAM_FILES%\Universal Extractor\bin\7z.exe
- %PROGRAM_FILES%\Universal Extractor\lang\Russian.ini
- %PROGRAM_FILES%\Universal Extractor\English.ini
- %PROGRAM_FILES%\Universal Extractor\bin\E_WISE.INI
- %PROGRAM_FILES%\Universal Extractor\bin\pea.exe
- %PROGRAM_FILES%\Universal Extractor\bin\PEiD.exe
- %PROGRAM_FILES%\Universal Extractor\bin\nrg2iso.exe
- %PROGRAM_FILES%\Universal Extractor\bin\MsiX.exe
- %PROGRAM_FILES%\Universal Extractor\bin\NBHextract.exe
- %PROGRAM_FILES%\Universal Extractor\bin\trid.exe
- %PROGRAM_FILES%\Universal Extractor\bin\UHARC02.EXE
- %PROGRAM_FILES%\Universal Extractor\bin\tee.exe
- %PROGRAM_FILES%\Universal Extractor\bin\RAIU.EXE
- %PROGRAM_FILES%\Universal Extractor\bin\STIX_D.EXE
- %PROGRAM_FILES%\Universal Extractor\bin\i3comp.exe
- %PROGRAM_FILES%\Universal Extractor\bin\i5comp.exe
- %PROGRAM_FILES%\Universal Extractor\bin\helpdeco.exe
- %PROGRAM_FILES%\Universal Extractor\bin\extractMHT.exe
- %PROGRAM_FILES%\Universal Extractor\bin\E_WISE_W.EXE
- %PROGRAM_FILES%\Universal Extractor\bin\kgb_arch_decompress.exe
- %PROGRAM_FILES%\Universal Extractor\bin\lzop.exe
- %PROGRAM_FILES%\Universal Extractor\bin\IsXunpack.exe
- %PROGRAM_FILES%\Universal Extractor\bin\i6comp.exe
- %PROGRAM_FILES%\Universal Extractor\bin\innounp.exe
Удаляет следующие файлы:
- <SYSTEM32>\PerfStringBackup.TMP
- %PROGRAM_FILES%\Universal Extractor\UExtr_ru.inf
- <SYSTEM32>\wbem\Performance\WmiApRpl.ini
Перемещает следующие файлы:
- %PROGRAM_FILES%\Universal Extractor\UExtr_en.inf в %WINDIR%\inf\UExtr_en.inf
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
