Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'MSReload' = '%WINDIR%\nics\reload.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] '{A18E757B-AD28-4B71-8E9C-C36F7A77762F}' = ''
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\NICFSFD] 'Start' = '00000000'
- [<HKLM>\SYSTEM\ControlSet001\Services\MSUpdateAgentService] 'Start' = '00000002'
Вредоносные функции:
Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%WINDIR%\Nics\RCSDeamon.exe' = '%WINDIR%\Nics\RCSDeamon.exe:*:Enabled:RCSDeamon'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%WINDIR%\Nics\SUser.exe' = '%WINDIR%\Nics\SUser.exe:*:Enabled:SUser'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%WINDIR%\Nics\csrss.exe' = '%WINDIR%\Nics\csrss.exe:*:Enabled:csrss'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%WINDIR%\Nics\AutoClientUpdate.exe' = '%WINDIR%\Nics\AutoClientUpdate.exe:*:Enabled:AutoClientUpdate'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%WINDIR%\MSUpdateAgentSvc.exe' = '%WINDIR%\MSUpdateAgentSvc.exe:*:Enabled:MSUpdateAgentSvc'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%WINDIR%\Nics\MSUpdateAgentSvc.exe' = '%WINDIR%\Nics\MSUpdateAgentSvc.exe:*:Enabled:MSUpdateAgentSvc'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%WINDIR%\Nics\SMSS.exe' = '%WINDIR%\Nics\SMSS.exe:*:Enabled:SMSS'
Создает и запускает на исполнение:
- '%WINDIR%\Nics\RegXPFW.exe'
- '%WINDIR%\Nics\extract.exe' /a /y %WINDIR%\Nics\sfilter.cab *.* /l %WINDIR%\Nics\
- '%WINDIR%\Nics\FireWallSetup.exe'
- '%WINDIR%\Nics\ParMonInst.exe' -i
- '%WINDIR%\Nics\nicfsfd_install.exe'
- '%WINDIR%\Nics\csrss.exe'
- '%WINDIR%\Nics\SMSS.exe'
- '%WINDIR%\Nics\extract.exe' /a /y %WINDIR%\Nics\2k_system.cab *.* /l <SYSTEM32>
- '%WINDIR%\Nics\extract.exe' /a /y %WINDIR%\Nics\2k_drivers.cab *.* /l <DRIVERS>
- '%WINDIR%\Nics\extract.exe' /a /y %WINDIR%\Nics\2k_nics.cab *.* /l %WINDIR%\Nics
- '%WINDIR%\Nics\AutoClientUpdate.exe'
- '%WINDIR%\MSUpdateAgentSvc.exe'
- '%WINDIR%\MSUpdateAgentSvc.exe' -service
Запускает на исполнение:
- '<SYSTEM32>\regsvr32.exe' /s %WINDIR%\\nics\\sphook.dll
Изменения в файловой системе:
Создает следующие файлы:
- %WINDIR%\Nics\2k_windows.cab
- %WINDIR%\MSVCP60.dll
- <SYSTEM32>\SafeCap.dll
- <SYSTEM32>\SafeNet.dll
- C:\ClientSetup.log
- %WINDIR%\SetupAgent.log
- %WINDIR%\Nics\MSUpdateAgentSvc.exe
- %WINDIR%\MSUpdateAgentSvc.exe
- %WINDIR%\Nics\SUser2.exe
- %WINDIR%\Nics\2k_drivers.cab
- %WINDIR%\Nics\spintro.dll
- %WINDIR%\Nics\SUser.exe
- <DRIVERS>\SafeNet.sys
- %WINDIR%\Nics\2k_system.cab
- <DRIVERS>\NICFSFD.sys
- <DRIVERS>\ParMon.sys
- %WINDIR%\Nics\9x\csrss.exe
- %WINDIR%\Nics\SafeFW.sys
- %WINDIR%\Nics\9x\sfilter.REG
- %WINDIR%\Nics\9x\sfilter.VXD
- %WINDIR%\Nics\PortDevice.log
- %WINDIR%\Nics\fw20150214.log
- %WINDIR%\Nics\csrss.exe
- C:\RegXPFW.log
- C:\SMSTestLog.log
- %WINDIR%\Nics\spfirewall.conf
- C:\LiveUpdate.log
- %WINDIR%\Nics\pcid.sys
- %WINDIR%\Nics\2000\SafeFW.sys
- %WINDIR%\Nics\2000\csrss.exe
- %WINDIR%\Nics\firewall.conf
- %WINDIR%\Nics\sfilter.cab
- %WINDIR%\Nics\sphook.dll
- %WINDIR%\Nics\msvcrt.dll
- %WINDIR%\Nics\NICFSFD.sys
- %WINDIR%\Nics\mfc42.dll
- %WINDIR%\Nics\mfc42u.dll
- %WINDIR%\Nics\nicport.ini
- %WINDIR%\Nics\ParMon.sys
- %WINDIR%\Nics\nicfsfd_install.exe
- %WINDIR%\Nics\nicfsfd_uninstall.exe
- %WINDIR%\Nics\agentversion.txt
- %WINDIR%\Nics\AutoClientUpdate.exe
- %WINDIR%\Nics\extract.exe
- %WINDIR%\Nics\2k_nics.cab
- %WINDIR%\Nics\Hackfile.dat
- %WINDIR%\Nics\IPrnAuth.dll
- %WINDIR%\Nics\FireWallSetup.exe
- %WINDIR%\Nics\FsfdNics.inf
- %WINDIR%\Nics\SafeNet.dll
- %WINDIR%\Nics\SafeNet.sys
- %WINDIR%\Nics\SafeHook.dll
- %WINDIR%\Nics\SafeHWCtrl_NTVer.dll
- %WINDIR%\Nics\Setup.dat
- %WINDIR%\Nics\SMSS.exe
- %WINDIR%\Nics\SafePC.ini
- %WINDIR%\Nics\SERMON.SYS
- %WINDIR%\Nics\RegXPFW.exe
- %WINDIR%\Nics\reload.exe
- %WINDIR%\Nics\ParMonInst.exe
- %WINDIR%\Nics\PolicyChk.exe
- %WINDIR%\Nics\ResKor.dll
- %WINDIR%\Nics\SafeCap.dll
- %WINDIR%\Nics\ResChn.dll
- %WINDIR%\Nics\ResEng.dll
Удаляет следующие файлы:
- %WINDIR%\Nics\sfilter.cab
- %WINDIR%\Nics\extract.exe
- %WINDIR%\Nics\Setup.dat.dec
Сетевая активность:
Подключается к:
- 'pc####y.lgchem.com':36637
UDP:
- DNS ASK pc####y.lgchem.com
- 'pc####y.lgchem.com':0
Другое:
Ищет следующие окна:
- ClassName: '' WindowName: 'SAFECOM'
