Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %HOMEPATH%\Start Menu\Programs\Startup\2.com.url
Вредоносные функции:
Запускает на исполнение:
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe'
Внедряет код в
следующие системные процессы:
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
Изменения в файловой системе:
Создает следующие файлы:
- %ALLUSERSPROFILE%\Application Data\2.exe
- <Текущая директория>\Example.txt
Удаляет следующие файлы:
- <Текущая директория>\Example.txt
Другое:
Ищет следующие окна:
- ClassName: '_J_IcUR__I_qz_fd_y_' WindowName: '__pr__'
- ClassName: '_D_' WindowName: 'Q__'
- ClassName: 'jF___QBU_s' WindowName: '__x_B__b'
- ClassName: '_K_C' WindowName: 'ZG__kf_Wbz_'
- ClassName: 'nd___GvTll_zLT_m_' WindowName: '_________z'
- ClassName: 'R_FJ_dEK_viP_D_u____b' WindowName: 'BIbEz'
- ClassName: 'qSpxdu__N__R_Q_e___g' WindowName: '__m__Z_F_n_'
- ClassName: 'Rqgte______Ev__z' WindowName: '__Dt'
- ClassName: '_C__IPy_____T' WindowName: '_R__Z_mx__EGx___'
- ClassName: 'c_Me_f' WindowName: 'va_GI___N____x_CyCol'
- ClassName: 'KM__l_w__wZuj___Tq_kG_PMs' WindowName: '_ceO______X_E'
- ClassName: '_Sq__di_a_K___nW_U' WindowName: '__G_NM_iM__n_w__okV_Kreu'
- ClassName: '___W_' WindowName: '__Taw____fr_R_C'
- ClassName: 'ocq____YI__D__L_DY_Og' WindowName: '_P_T_H_Z_a__q____'
- ClassName: 'nESIZ___rzX__gVR__L__s__' WindowName: '____q_d__U_______'
- ClassName: 'QL___VM' WindowName: '___E'
- ClassName: '_E_W__i___y_W_dmpL' WindowName: 'bKhX_GQ_ba_GCU___JVC_ta'
- ClassName: 'eH_Y_' WindowName: '_'
- ClassName: 'm_E__U_L__Q_' WindowName: '_Rrb_U_'
- ClassName: '______l_OO_' WindowName: '_m_____A____Xxl_w_UwUFi'
- ClassName: '_' WindowName: 'F___N_____Uf_y___sA_c_k'
- ClassName: '_nF' WindowName: '___w_____jP_'
- ClassName: '_BC__rV____ESu' WindowName: '_ZsY___Jw'
- ClassName: '__QW__z__C__' WindowName: 'lqZ_Ih__GdOr__'
- ClassName: 'ibLd_eTlBMLV' WindowName: 'Nc__Z_KC__p_wn_fS__K___l'
- ClassName: '___GgMP' WindowName: '_c____b___N__'
- ClassName: '_' WindowName: '_R__D_ny_n__A____u_R_Oh'
- ClassName: '_U__PpBb___Z_xpd__Vq__' WindowName: 'X__NIL_F_TnFD__ei__u_e_o'
- ClassName: '_l_K_HFJq_lC' WindowName: 'f__sG'
- ClassName: 'wQ__Ny__BuFn__Z_VON__W_' WindowName: 'FwBrE__go__vb_____H'
- ClassName: '_vGaee__PF' WindowName: 'BA__XgHMS'
- ClassName: '_A' WindowName: '_t_Tj_cp___E___n_Ia__Y_'
- ClassName: 'Ze__s_tOHt______Vq__V' WindowName: 'G_Hf__t_____YOD_h_'
- ClassName: 'wH_wM________L' WindowName: '___P_a_f_g__'
- ClassName: '__o_U_T_' WindowName: 'UV_fQ__v___P_qaV__b_C'
- ClassName: 'u___' WindowName: '__w_qYP__nD_APa'
- ClassName: 'qp___' WindowName: 'H'
- ClassName: 'j__i_A_B____Hq_f' WindowName: '__F_Rr__hkA_c____LC_a'
- ClassName: 'I_O_nLBNe' WindowName: 'Lu_Wz_P_G____sRP'
- ClassName: 's_B__ScnU_b____' WindowName: '__M_oat_p__xI______RA__'
- ClassName: 'kG___vG_A_L_j_NVH__bu_b_Q' WindowName: 'm_N_EPBvtP_s__z'
- ClassName: '____rFXrz_i' WindowName: 'J__VOc___a___c'
- ClassName: 'K___SEV__l_RHaF_O_Pp_' WindowName: '_L__h_PyI_Ek'
- ClassName: '__WY___k_J_____k_Fn_WNi__' WindowName: 'HY'
- ClassName: 'M_ws_K__kM_' WindowName: 'l__Y_E___ai_y_V___'
- ClassName: 'u___K_Xu_jeL_e' WindowName: 'NnIk____ol_l_oY_____'
- ClassName: '_i_Jsrq__g_' WindowName: '_L_ZI__Lv__W'
- ClassName: '____HEwd_L_l' WindowName: '_Z_o__'
- ClassName: 'C_f_Hr____bp_A__' WindowName: 'h_M__qQUYs_RdQFtZ'
- ClassName: '_sl__c____L_f' WindowName: 'h_o___E'
- ClassName: 'WmV_' WindowName: '_____v_B_FpQq_F_Z_'
- ClassName: '_F__PR____CO_EMT_l_T_' WindowName: 'y__B_Py_Q__t_'
- ClassName: '_OCMvp___fG___Y' WindowName: '___Y____v_Xx____hy_'
- ClassName: '__lc_rN_fzf__FS_Pv' WindowName: 'C_mRjA_jU____FtPff_th_RxD'
- ClassName: '_____zb_tWNGUutz___Pv__T' WindowName: '_u_rUG_Yu_P__F__t_'
- ClassName: 'fc_ygs_Swr_EylX___xs' WindowName: 'R_CbIqXOO_g'
- ClassName: '_skRHH_e_IdR_E_u_' WindowName: '_____VIs__kdNEtOL'
- ClassName: 'hvc_wW__' WindowName: '__v_'
- ClassName: '___PVrznmf_L_Kj' WindowName: 'Jl__w_d_____hAp__wm_p'
- ClassName: '__F____T__M_H_PaVDAw_b' WindowName: 'qzotny__U___eHh____u__E'
