Техническая информация
Вредоносные функции:
Создает и запускает на исполнение:
- '%TEMP%\RarSFX0\setup.exe'
Запускает на исполнение:
- '<SYSTEM32>\vssvc.exe'
- '<SYSTEM32>\svchost.exe' -k swprv
- '<SYSTEM32>\msiexec.exe' /V
- '<SYSTEM32>\MsiExec.exe' -Embedding 0E4EC1711731D0F134913DD405C4A4CE C
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\{ECCC4786-5480-4BBE-A1D7-DE5B3477744A}\rpc2.dll
- %TEMP%\{ECCC4786-5480-4BBE-A1D7-DE5B3477744A}\SIM.dll
- %TEMP%\{ECCC4786-5480-4BBE-A1D7-DE5B3477744A}\bullet.png
- %TEMP%\{ECCC4786-5480-4BBE-A1D7-DE5B3477744A}\SKUtil.dll
- %TEMP%\{ECCC4786-5480-4BBE-A1D7-DE5B3477744A}\lic_1043.txt
- %TEMP%\{ECCC4786-5480-4BBE-A1D7-DE5B3477744A}\lic_1042.txt
- %TEMP%\{ECCC4786-5480-4BBE-A1D7-DE5B3477744A}\lic_2052.txt
- %TEMP%\{ECCC4786-5480-4BBE-A1D7-DE5B3477744A}\GgRC_Nld.dll
- %TEMP%\{ECCC4786-5480-4BBE-A1D7-DE5B3477744A}\cl.png
- %TEMP%\{ECCC4786-5480-4BBE-A1D7-DE5B3477744A}\GetDxVer.dll
- %TEMP%\{ECCC4786-5480-4BBE-A1D7-DE5B3477744A}\gdiplus_98.dll
- %TEMP%\{ECCC4786-5480-4BBE-A1D7-DE5B3477744A}\GgRC_Chs_98.dll
- %TEMP%\{ECCC4786-5480-4BBE-A1D7-DE5B3477744A}\GgRC_Chs.dll
- %TEMP%\{ECCC4786-5480-4BBE-A1D7-DE5B3477744A}\GgRC_Nld_98.dll
- %TEMP%\{ECCC4786-5480-4BBE-A1D7-DE5B3477744A}\CL_.png
- %TEMP%\{ECCC4786-5480-4BBE-A1D7-DE5B3477744A}\gdiplus.dll
- %TEMP%\{ECCC4786-5480-4BBE-A1D7-DE5B3477744A}\CLScan.dll
- %TEMP%\MSIAC45.tmp
- %TEMP%\{ECCC4786-5480-4BBE-A1D7-DE5B3477744A}\String1033.txt
- %TEMP%\{ECCC4786-5480-4BBE-A1D7-DE5B3477744A}\lic_1028.txt
- %TEMP%\{ECCC4786-5480-4BBE-A1D7-DE5B3477744A}\GgRC_Kor.dll
- %TEMP%\{ECCC4786-5480-4BBE-A1D7-DE5B3477744A}\ISRT.dll
- %TEMP%\{ECCC4786-5480-4BBE-A1D7-DE5B3477744A}\setup.inx
- %TEMP%\{ECCC4786-5480-4BBE-A1D7-DE5B3477744A}\_isres.dll
- %TEMP%\{ECCC4786-5480-4BBE-A1D7-DE5B3477744A}\setup.exe
- %TEMP%\{ECCC4786-5480-4BBE-A1D7-DE5B3477744A}\RegKey64Bit.dll
- %TEMP%\{ECCC4786-5480-4BBE-A1D7-DE5B3477744A}\GgRC_Kor_98.dll
- %TEMP%\{ECCC4786-5480-4BBE-A1D7-DE5B3477744A}\lic_1036.txt
- %TEMP%\{ECCC4786-5480-4BBE-A1D7-DE5B3477744A}\lic_1041.txt
- %TEMP%\{ECCC4786-5480-4BBE-A1D7-DE5B3477744A}\lic_1040.txt
- %TEMP%\{ECCC4786-5480-4BBE-A1D7-DE5B3477744A}\lic_1031.txt
- %TEMP%\{ECCC4786-5480-4BBE-A1D7-DE5B3477744A}\lic_1030.txt
- %TEMP%\{ECCC4786-5480-4BBE-A1D7-DE5B3477744A}\lic_1034.txt
- %TEMP%\{ECCC4786-5480-4BBE-A1D7-DE5B3477744A}\lic_1033.txt
- %TEMP%\{ECCC4786-5480-4BBE-A1D7-DE5B3477744A}\GgRC_Cht.dll
- %TEMP%\{ECCC4786-5480-4BBE-A1D7-DE5B3477744A}\Helper.dll
- %TEMP%\{ECCC4786-5480-4BBE-A1D7-DE5B3477744A}\gtapi_98.dll
- %TEMP%\b940.rra
- %TEMP%\MSIB895.tmp
- %TEMP%\{ECCC4786-5480-4BBE-A1D7-DE5B3477744A}\BIOSLOCK.EXE
- %TEMP%\{ECCC4786-5480-4BBE-A1D7-DE5B3477744A}\BiosLock.dll
- %TEMP%\{ECCC4786-5480-4BBE-A1D7-DE5B3477744A}\gtapi.dll
- %TEMP%\{ECCC4786-5480-4BBE-A1D7-DE5B3477744A}\Bioslock.PIF
- %TEMP%\isprb97e.rra
- %TEMP%\{ECCC4786-5480-4BBE-A1D7-DE5B3477744A}\Define.ini
- %TEMP%\{ECCC4786-5480-4BBE-A1D7-DE5B3477744A}\Defia10f.rra
- %TEMP%\MSIbb721.LOG
- C:\ProgramData\CyberLink\SPInfo.ini
- %BOOT_VOL%\Boot\BCD
- %TEMP%\{ECCC4786-5480-4BBE-A1D7-DE5B3477744A}\skinb99e.rra
- C:\ProgramData\Temp\{5DB1DF0C-AABC-4362-8A6D-CEFDFB036E41}\Posta0f0.rra
- C:\System Volume Information\Syscache.hve
- %TEMP%\{ECCC4786-5480-4BBE-A1D7-DE5B3477744A}\GgRC_Enu_98.dll
- %TEMP%\{ECCC4786-5480-4BBE-A1D7-DE5B3477744A}\GgRC_Enu.dll
- %TEMP%\{ECCC4786-5480-4BBE-A1D7-DE5B3477744A}\GgRC_Esp_98.dll
- %TEMP%\{ECCC4786-5480-4BBE-A1D7-DE5B3477744A}\GgRC_Esp.dll
- %TEMP%\{ECCC4786-5480-4BBE-A1D7-DE5B3477744A}\GgRC_Deu.dll
- %TEMP%\{ECCC4786-5480-4BBE-A1D7-DE5B3477744A}\GgRC_Cht_98.dll
- %TEMP%\{ECCC4786-5480-4BBE-A1D7-DE5B3477744A}\GgRC_Deu_98.dll
- %TEMP%\{ECCC4786-5480-4BBE-A1D7-DE5B3477744A}\GoogleDLG.exe
- %TEMP%\{ECCC4786-5480-4BBE-A1D7-DE5B3477744A}\GgRC_Fra.dll
- %TEMP%\{ECCC4786-5480-4BBE-A1D7-DE5B3477744A}\GgRC_Jpn_98.dll
- %TEMP%\{ECCC4786-5480-4BBE-A1D7-DE5B3477744A}\GoogleDLG_98.exe
- %TEMP%\{ECCC4786-5480-4BBE-A1D7-DE5B3477744A}\MsiZap.exe
- %TEMP%\{ECCC4786-5480-4BBE-A1D7-DE5B3477744A}\PostBuild.exe
- %TEMP%\{ECCC4786-5480-4BBE-A1D7-DE5B3477744A}\GgRC_Ita.dll
- %TEMP%\{ECCC4786-5480-4BBE-A1D7-DE5B3477744A}\GgRC_Fra_98.dll
- %TEMP%\{ECCC4786-5480-4BBE-A1D7-DE5B3477744A}\GgRC_Jpn.dll
- %TEMP%\{ECCC4786-5480-4BBE-A1D7-DE5B3477744A}\GgRC_Ita_98.dll
- %TEMP%\RarSFX0\WVEditor\Define.ini
- %TEMP%\RarSFX0\Define.ini
- %TEMP%\RarSFX0\WVEditor\info.ini
- %TEMP%\RarSFX0\info.ini
- %TEMP%\RarSFX0\WVEditor\0x1004.ini
- %TEMP%\RarSFX0\WVEditor\0x0804.ini
- %TEMP%\RarSFX0\WVEditor\Custom.ini
- %TEMP%\RarSFX0\Custom.ini
- %TEMP%\RarSFX0\WVEditor\Product.ini
- %TEMP%\RarSFX0\instmsiw.exe
- %TEMP%\RarSFX0\AUTORUN.INF
- %TEMP%\RarSFX0\WVEditor\setup.exe
- %TEMP%\RarSFX0\setup.exe
- %TEMP%\RarSFX0\Setup.ini
- %TEMP%\RarSFX0\WVEditor\Setup.ini
- %TEMP%\RarSFX0\ureg.ini
- %TEMP%\RarSFX0\WVEditor\ureg.ini
- %TEMP%\RarSFX0\WVEditor\0x0409.ini
- %TEMP%\RarSFX0\0x0409.ini
- %TEMP%\RarSFX0\WVEditor\0x040a.ini
- %TEMP%\RarSFX0\0x040a.ini
- %TEMP%\RarSFX0\WVEditor\0x0404.ini
- %TEMP%\RarSFX0\0x0404.ini
- %TEMP%\RarSFX0\WVEditor\0x0407.ini
- %TEMP%\RarSFX0\0x0407.ini
- %TEMP%\RarSFX0\0x040c.ini
- %TEMP%\RarSFX0\0x0412.ini
- %TEMP%\RarSFX0\WVEditor\0x0411.ini
- %TEMP%\RarSFX0\0x0804.ini
- %TEMP%\RarSFX0\WVEditor\0x0412.ini
- %TEMP%\RarSFX0\0x0410.ini
- %TEMP%\RarSFX0\WVEditor\0x040c.ini
- %TEMP%\RarSFX0\0x0411.ini
- %TEMP%\RarSFX0\WVEditor\0x0410.ini
- %TEMP%\RarSFX0\WVEditor\vcredist_x86.exe
- %TEMP%\RarSFX0\WVEditor\1040.mst
- %TEMP%\RarSFX0\1040.mst
- %TEMP%\RarSFX0\WVEditor\1041.mst
- %TEMP%\RarSFX0\1041.mst
- %TEMP%\RarSFX0\WVEditor\1034.mst
- %TEMP%\RarSFX0\1034.mst
- %TEMP%\RarSFX0\WVEditor\1036.mst
- %TEMP%\RarSFX0\1036.mst
- %TEMP%\RarSFX0\1042.mst
- %TEMP%\RarSFX0\WVEditor\Default.reg
- %TEMP%\RarSFX0\WVEditor\~Unreg.reg
- %TEMP%\RarSFX0\CyberMania.exe
- %TEMP%\RarSFX0\WVEditor\Data1.cab
- %TEMP%\RarSFX0\2052.mst
- %TEMP%\RarSFX0\WVEditor\1042.mst
- %TEMP%\RarSFX0\WVEditor\4100.mst
- %TEMP%\RarSFX0\WVEditor\2052.mst
- %TEMP%\RarSFX0\WVEditor\SKUtil2008.dll
- %TEMP%\RarSFX0\WVEditor\SKUtil.dll
- %TEMP%\RarSFX0\setup.isn
- %TEMP%\RarSFX0\CyberLink.ico
- %TEMP%\RarSFX0\ISSetup.dll
- %TEMP%\RarSFX0\WVEditor\ShareFiles\Share\cldsc.dll
- %TEMP%\RarSFX0\SKUtil.dll
- %TEMP%\RarSFX0\WVEditor\ISSetup.dll
- %TEMP%\RarSFX0\WVEditor\setup.isn
- %TEMP%\RarSFX0\WVEditor\1031.mst
- %TEMP%\RarSFX0\1031.mst
- %TEMP%\RarSFX0\WVEditor\1033.mst
- %TEMP%\RarSFX0\1033.mst
- %TEMP%\RarSFX0\WVEditor\WaveEditor.msi
- %TEMP%\RarSFX0\Suite.msi
- %TEMP%\RarSFX0\WVEditor\1028.mst
- %TEMP%\RarSFX0\1028.mst
Удаляет следующие файлы:
- %TEMP%\{ECCC4786-5480-4BBE-A1D7-DE5B3477744A}\skinb99e.rra
- %TEMP%\MSIB895.tmp
- %TEMP%\MSIAC45.tmp
Перемещает следующие файлы:
- %TEMP%\{ECCC4786-5480-4BBE-A1D7-DE5B3477744A}\Defia10f.rra в %TEMP%\{ECCC4786-5480-4BBE-A1D7-DE5B3477744A}\Define.ini
- C:\ProgramData\Temp\{5DB1DF0C-AABC-4362-8A6D-CEFDFB036E41}\Posta0f0.rra в C:\ProgramData\Temp\{5DB1DF0C-AABC-4362-8A6D-CEFDFB036E41}\PostBuild.exe
Другое:
Ищет следующие окна:
- ClassName: 'EDIT' WindowName: ''
