Техническая информация
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\taskkill.exe' %TEMP%\The_Patch_15.3.0.2.635012\The_Patch_15.3.0.2.635012
- '<SYSTEM32>\taskkill.exe' %TEMP%\The_Patch_15.3.0.2.635012
- '<SYSTEM32>\conhost.exe' /F /IM %TEMP%\The_Patch_15.3.0.2.635012\The_Patch_15.3.0.2.635012\setup.cmd /T
- '<SYSTEM32>\taskkill.exe' /F /IM %TEMP%\The_Patch_15.3.0.2.635012\The_Patch_15.3.0.2.635012\setup.cmd /T
- '<SYSTEM32>\conhost.exe' -secured -Embedding
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Classes\Installer\Products\4F0481B9739C9934CBC522AC49B6EAB1" /f
- '<SYSTEM32>\attrib.exe' +h +s +r /d /s "%TEMP%\The_Patch_15.3.0.2.635012"
- '<SYSTEM32>\attrib.exe' +h +s +r "%TEMP%\The_Patch_15.3.0.2.635012"
- '<SYSTEM32>\attrib.exe' +h +s +r "%TEMP%\The_Patch_15.3.0.2.635012\*.*"
- '<SYSTEM32>\PING.EXE' -n 3 -w 100 google.com
- '<SYSTEM32>\attrib.exe' +h +s +r /d /s "%TEMP%\The_Patch_15.3.0.2.635012\*.*"
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\The_Patch_15.3.0.2.635012\The_Patch_15.3.0.2.635012\Formats\z.fmt
- %TEMP%\The_Patch_15.3.0.2.635012\The_Patch_15.3.0.2.635012\Rar.exe
- %TEMP%\The_Patch_15.3.0.2.635012\The_Patch_15.3.0.2.635012\RarExt.dll
- %TEMP%\The_Patch_15.3.0.2.635012\The_Patch_15.3.0.2.635012\Formats\uue.fmt
- %TEMP%\The_Patch_15.3.0.2.635012\The_Patch_15.3.0.2.635012\Formats\lzh.fmt
- %TEMP%\The_Patch_15.3.0.2.635012\The_Patch_15.3.0.2.635012\Formats\tar.fmt
- %TEMP%\The_Patch_15.3.0.2.635012\The_Patch_15.3.0.2.635012\Formats\UNACEV2.DLL
- %TEMP%\The_Patch_15.3.0.2.635012\The_Patch_15.3.0.2.635012\RarExt64.dll
- %TEMP%\The_Patch_15.3.0.2.635012\The_Patch_15.3.0.2.635012\winrar.rcf
- \Device\Mup\BVNSEUHJ*\MAILSLOT\NET\NETLOGON
- <Служебный элемент>
- %TEMP%\The_Patch_15.3.0.2.635012\The_Patch_15.3.0.2.635012\WinRAR.exe
- %TEMP%\The_Patch_15.3.0.2.635012\The_Patch_15.3.0.2.635012\RarExtLoader.exe
- %TEMP%\The_Patch_15.3.0.2.635012\The_Patch_15.3.0.2.635012\RarFiles.lst
- %TEMP%\The_Patch_15.3.0.2.635012\The_Patch_15.3.0.2.635012\UnRAR.exe
- %TEMP%\The_Patch_15.3.0.2.635012\The_Patch_15.3.0.2.635012\install.rar
- %TEMP%\The_Patch_15.3.0.2.635012\The_Patch_15.3.0.2.635012\Descript.ion
- %TEMP%\The_Patch_15.3.0.2.635012\The_Patch_15.3.0.2.635012\File_Id.diz
- %TEMP%\The_Patch_15.3.0.2.635012\The_Patch_15.3.0.2.635012\install.vbs
- %TEMP%\$inst\2.tmp
- %TEMP%\$inst\temp_0.tmp
- %TEMP%\The_Patch_15.3.0.2.635012\The_Patch_15.3.0.2.635012\setup.cmd
- %TEMP%\The_Patch_15.3.0.2.635012\The_Patch_15.3.0.2.635012\Formats\7z.fmt
- %TEMP%\The_Patch_15.3.0.2.635012\The_Patch_15.3.0.2.635012\Formats\cab.fmt
- %TEMP%\The_Patch_15.3.0.2.635012\The_Patch_15.3.0.2.635012\Formats\gz.fmt
- %TEMP%\The_Patch_15.3.0.2.635012\The_Patch_15.3.0.2.635012\Formats\iso.fmt
- %TEMP%\The_Patch_15.3.0.2.635012\The_Patch_15.3.0.2.635012\Formats\bz2.fmt
- %TEMP%\The_Patch_15.3.0.2.635012\The_Patch_15.3.0.2.635012\Formats\7zxa.dll
- %TEMP%\The_Patch_15.3.0.2.635012\The_Patch_15.3.0.2.635012\Formats\ace.fmt
- %TEMP%\The_Patch_15.3.0.2.635012\The_Patch_15.3.0.2.635012\Formats\arj.fmt
Присваивает атрибут 'скрытый' для следующих файлов:
- %TEMP%\The_Patch_15.3.0.2.635012\The_Patch_15.3.0.2.635012\install.vbs
- %TEMP%\The_Patch_15.3.0.2.635012\The_Patch_15.3.0.2.635012\Rar.exe
- %TEMP%\The_Patch_15.3.0.2.635012\The_Patch_15.3.0.2.635012\RarExt.dll
- %TEMP%\The_Patch_15.3.0.2.635012\The_Patch_15.3.0.2.635012\Descript.ion
- %TEMP%\The_Patch_15.3.0.2.635012\The_Patch_15.3.0.2.635012\File_Id.diz
- %TEMP%\The_Patch_15.3.0.2.635012\The_Patch_15.3.0.2.635012\install.rar
- %TEMP%\The_Patch_15.3.0.2.635012\The_Patch_15.3.0.2.635012\RarExt64.dll
- %TEMP%\The_Patch_15.3.0.2.635012\The_Patch_15.3.0.2.635012\UnRAR.exe
- %TEMP%\The_Patch_15.3.0.2.635012\The_Patch_15.3.0.2.635012\WinRAR.exe
- %TEMP%\The_Patch_15.3.0.2.635012\The_Patch_15.3.0.2.635012\winrar.rcf
- %TEMP%\The_Patch_15.3.0.2.635012\The_Patch_15.3.0.2.635012\RarExtLoader.exe
- %TEMP%\The_Patch_15.3.0.2.635012\The_Patch_15.3.0.2.635012\RarFiles.lst
- %TEMP%\The_Patch_15.3.0.2.635012\The_Patch_15.3.0.2.635012\setup.cmd
- %TEMP%\The_Patch_15.3.0.2.635012\The_Patch_15.3.0.2.635012\Formats\arj.fmt
- %TEMP%\The_Patch_15.3.0.2.635012\The_Patch_15.3.0.2.635012\Formats\bz2.fmt
- %TEMP%\The_Patch_15.3.0.2.635012\The_Patch_15.3.0.2.635012\Formats\cab.fmt
- %TEMP%\The_Patch_15.3.0.2.635012\The_Patch_15.3.0.2.635012\Formats\7z.fmt
- %TEMP%\The_Patch_15.3.0.2.635012\The_Patch_15.3.0.2.635012\Formats\7zxa.dll
- %TEMP%\The_Patch_15.3.0.2.635012\The_Patch_15.3.0.2.635012\Formats\ace.fmt
- %TEMP%\The_Patch_15.3.0.2.635012\The_Patch_15.3.0.2.635012\Formats\gz.fmt
- %TEMP%\The_Patch_15.3.0.2.635012\The_Patch_15.3.0.2.635012\Formats\UNACEV2.DLL
- %TEMP%\The_Patch_15.3.0.2.635012\The_Patch_15.3.0.2.635012\Formats\uue.fmt
- %TEMP%\The_Patch_15.3.0.2.635012\The_Patch_15.3.0.2.635012\Formats\z.fmt
- %TEMP%\The_Patch_15.3.0.2.635012\The_Patch_15.3.0.2.635012\Formats\iso.fmt
- %TEMP%\The_Patch_15.3.0.2.635012\The_Patch_15.3.0.2.635012\Formats\lzh.fmt
- %TEMP%\The_Patch_15.3.0.2.635012\The_Patch_15.3.0.2.635012\Formats\tar.fmt
Удаляет следующие файлы:
- %TEMP%\The_Patch_15.3.0.2.635012\The_Patch_15.3.0.2.635012\install.vbs
- %TEMP%\The_Patch_15.3.0.2.635012\The_Patch_15.3.0.2.635012\Rar.exe
- %TEMP%\The_Patch_15.3.0.2.635012\The_Patch_15.3.0.2.635012\RarExt.dll
- %TEMP%\The_Patch_15.3.0.2.635012\The_Patch_15.3.0.2.635012\install.rar
- %TEMP%\The_Patch_15.3.0.2.635012\The_Patch_15.3.0.2.635012\Formats\UNACEV2.DLL
- %TEMP%\The_Patch_15.3.0.2.635012\The_Patch_15.3.0.2.635012\Formats\uue.fmt
- %TEMP%\The_Patch_15.3.0.2.635012\The_Patch_15.3.0.2.635012\Formats\z.fmt
- %TEMP%\The_Patch_15.3.0.2.635012\The_Patch_15.3.0.2.635012\UnRAR.exe
- %TEMP%\The_Patch_15.3.0.2.635012\The_Patch_15.3.0.2.635012\WinRAR.exe
- %TEMP%\The_Patch_15.3.0.2.635012\The_Patch_15.3.0.2.635012\winrar.rcf
- %TEMP%\The_Patch_15.3.0.2.635012\The_Patch_15.3.0.2.635012\setup.cmd
- %TEMP%\The_Patch_15.3.0.2.635012\The_Patch_15.3.0.2.635012\RarExt64.dll
- %TEMP%\The_Patch_15.3.0.2.635012\The_Patch_15.3.0.2.635012\RarExtLoader.exe
- %TEMP%\The_Patch_15.3.0.2.635012\The_Patch_15.3.0.2.635012\RarFiles.lst
- %TEMP%\The_Patch_15.3.0.2.635012\The_Patch_15.3.0.2.635012\Formats\7z.fmt
- %TEMP%\The_Patch_15.3.0.2.635012\The_Patch_15.3.0.2.635012\Formats\7zxa.dll
- %TEMP%\The_Patch_15.3.0.2.635012\The_Patch_15.3.0.2.635012\Formats\ace.fmt
- %TEMP%\The_Patch_15.3.0.2.635012\The_Patch_15.3.0.2.635012\File_Id.diz
- %TEMP%\$inst\temp_0.tmp
- %TEMP%\$inst\2.tmp
- %TEMP%\The_Patch_15.3.0.2.635012\The_Patch_15.3.0.2.635012\Descript.ion
- %TEMP%\The_Patch_15.3.0.2.635012\The_Patch_15.3.0.2.635012\Formats\iso.fmt
- %TEMP%\The_Patch_15.3.0.2.635012\The_Patch_15.3.0.2.635012\Formats\lzh.fmt
- %TEMP%\The_Patch_15.3.0.2.635012\The_Patch_15.3.0.2.635012\Formats\tar.fmt
- %TEMP%\The_Patch_15.3.0.2.635012\The_Patch_15.3.0.2.635012\Formats\gz.fmt
- %TEMP%\The_Patch_15.3.0.2.635012\The_Patch_15.3.0.2.635012\Formats\arj.fmt
- %TEMP%\The_Patch_15.3.0.2.635012\The_Patch_15.3.0.2.635012\Formats\bz2.fmt
- %TEMP%\The_Patch_15.3.0.2.635012\The_Patch_15.3.0.2.635012\Formats\cab.fmt
Сетевая активность:
UDP:
- DNS ASK dn#.##ftncsi.com
- DNS ASK google.com
Другое:
Ищет следующие окна:
- ClassName: '' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
