Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'Intel(R) Common User Interface' = '"%APPDATA%\Roaming\ICQM\ICQ\smiles\store\stickers\108\7\igfxpers.exe"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'AppExtender' = '"%PROGRAM_FILES%\DVD Maker\Shared\DvdStyles\Performance\AppExtB.exe"'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Bluetooth Software' = '"%APPDATA%\Roaming\ICQM\ICQ\smiles\store\stickers\108\8\BtvStack.exe"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'IntelAPMClient' = '"%PROGRAM_FILES%\Google\Update\Install\amclient.exe"'
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\schtasks.exe' /CREATE /F /SC ONLOGON /TN "ComAgent" /TR "\"%PROGRAM_FILES%\Google\Chrome\ComAgent.exe\""
- '<SYSTEM32>\conhost.exe' /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
- '<SYSTEM32>\schtasks.exe' /pid=0xc28 /log
- '<SYSTEM32>\schtasks.exe' /CREATE /F /RL HIGHEST /SC MINUTE /MO 6 /TN "AppExtender" /TR "\"%PROGRAM_FILES%\DVD Maker\Shared\DvdStyles\Performance\AppExtB.exe\""
- '<SYSTEM32>\schtasks.exe' /CREATE /F /RL HIGHEST /SC MINUTE /MO 11 /TN "Bluetooth Software" /TR "\"%APPDATA%\Roaming\ICQM\ICQ\smiles\store\stickers\108\8\BtvStack.exe\""
- '<SYSTEM32>\schtasks.exe' /CREATE /F /RL HIGHEST /SC MINUTE /MO 25 /TN "IntelAPMClient" /TR "\"%PROGRAM_FILES%\Google\Update\Install\amclient.exe\""
- '<SYSTEM32>\schtasks.exe' /CREATE /F /RL HIGHEST /SC MINUTE /MO 12 /TN "Intel(R) Common User Interface" /TR "\"%APPDATA%\Roaming\ICQM\ICQ\smiles\store\stickers\108\7\igfxpers.exe\""
Изменения в файловой системе:
Создает следующие файлы:
- %PROGRAM_FILES%\Google\Chrome\~gwreyln.tmp
- %PROGRAM_FILES%\Google\Chrome\ComAgent.exe
- <SYSTEM32>\Tasks\ComAgent
- %PROGRAM_FILES%\DVD Maker\Shared\DvdStyles\Performance\~qxjjqmc.tmp
- %PROGRAM_FILES%\DVD Maker\Shared\DvdStyles\Performance\AppExtB.exe
- <SYSTEM32>\Tasks\AppExtender
- %TEMP%\~jdsjnnu.tmp
- %TEMP%\~d64e92ac.tmp
- <Служебный элемент>
- %PROGRAM_FILES%\Steam\appcache\httpcache\7c\~hutbtoz.tmp
- %PROGRAM_FILES%\Steam\appcache\httpcache\7c\almon.exe
- %TEMP%\aut8F34.tmp
- %APPDATA%\Roaming\ICQM\ICQ\smiles\store\stickers\108\8\~xnpwbkg.tmp
- %APPDATA%\Roaming\ICQM\ICQ\smiles\store\stickers\108\8\BtvStack.exe
- <SYSTEM32>\Tasks\Bluetooth Software
- %APPDATA%\Roaming\Microsoft\Windows\Printer Shortcuts\~ezdcywn.tmp
- %APPDATA%\Roaming\Microsoft\Windows\Printer Shortcuts\ccSetMgr.exe
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ccSetMgr.exe
- %APPDATA%\Roaming\ICQM\ICQ\smiles\store\stickers\108\7\~hydrvba.tmp
- %APPDATA%\Roaming\ICQM\ICQ\smiles\store\stickers\108\7\igfxpers.exe
- <SYSTEM32>\Tasks\Intel(R) Common User Interface
- %PROGRAM_FILES%\Google\Update\Install\~itpcfpq.tmp
- %PROGRAM_FILES%\Google\Update\Install\amclient.exe
- <SYSTEM32>\Tasks\IntelAPMClient
Удаляет следующие файлы:
- %PROGRAM_FILES%\Google\Chrome\~gwreyln.tmp
- %PROGRAM_FILES%\Google\Chrome\ComAgent.exe
- %PROGRAM_FILES%\DVD Maker\Shared\DvdStyles\Performance\~qxjjqmc.tmp
- %PROGRAM_FILES%\DVD Maker\Shared\DvdStyles\Performance\AppExtB.exe
- %TEMP%\aut8F34.tmp
- %TEMP%\~jdsjnnu.tmp
- %PROGRAM_FILES%\Steam\appcache\httpcache\7c\~hutbtoz.tmp
- %PROGRAM_FILES%\Steam\appcache\httpcache\7c\almon.exe
- %APPDATA%\Roaming\ICQM\ICQ\smiles\store\stickers\108\7\igfxpers.exe
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ccSetMgr.exe
- %APPDATA%\Roaming\ICQM\ICQ\smiles\store\stickers\108\8\~xnpwbkg.tmp
- %APPDATA%\Roaming\Microsoft\Windows\Printer Shortcuts\~ezdcywn.tmp
- %APPDATA%\Roaming\Microsoft\Windows\Printer Shortcuts\ccSetMgr.exe
- %PROGRAM_FILES%\Google\Update\Install\amclient.exe
- %APPDATA%\Roaming\ICQM\ICQ\smiles\store\stickers\108\7\~hydrvba.tmp
- %APPDATA%\Roaming\ICQM\ICQ\smiles\store\stickers\108\8\BtvStack.exe
- %PROGRAM_FILES%\Google\Update\Install\~itpcfpq.tmp
Сетевая активность:
UDP:
- DNS ASK gp##xy.com
- DNS ASK dn#.##ftncsi.com
- DNS ASK up####.gpr0xy.com
Другое:
Ищет следующие окна:
- ClassName: 'Indicator' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
