Trojan.KeyLogger.38003

Техническая информация

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\net1.exe' start w32time
'<SYSTEM32>\regsvr32.exe' atl.dll /s
'<SYSTEM32>\cmd.exe' /c <SYSTEM32>\cmd.bat
'<SYSTEM32>\net.exe' start w32time

Устанавливает процедуры перхвата сообщений

о нажатии клавиш клавиатуры:

Библиотека-обработчик для всех процессов: <Текущая директория>\cfgdll.dll

Изменения в файловой системе:

Создает следующие файлы:

%WINDIR%\inf\j8.bmp
%WINDIR%\inf\j9.bmp
%WINDIR%\inf\j11.bmp
%WINDIR%\inf\9.bmp
%WINDIR%\inf\qd.bmp
%WINDIR%\inf\j9.2.bmp
%WINDIR%\inf\15.bmp
%WINDIR%\inf\ben6.bmp
%WINDIR%\inf\jksd.bmp
%WINDIR%\inf\j12sd.bmp
%WINDIR%\inf\s12sd.bmp
%WINDIR%\inf\10.bmp
%WINDIR%\inf\11.bmp
%WINDIR%\inf\8.bmp
%WINDIR%\inf\5.bmp
%WINDIR%\inf\7.bmp
%WINDIR%\inf\12.bmp
%WINDIR%\inf\18.bmp
%WINDIR%\inf\2.bmp
%WINDIR%\inf\17.bmp
%WINDIR%\inf\13.bmp
%WINDIR%\inf\14.bmp
%WINDIR%\inf\jwl.bmp
%WINDIR%\inf\jws.bmp
%WINDIR%\inf\jst.bmp
%WINDIR%\inf\jpk.bmp
%WINDIR%\inf\jpz.bmp
%WINDIR%\inf\jyz.bmp
%WINDIR%\inf\jb_fashi3.bmp
%WINDIR%\inf\jb_fashi4.bmp
%WINDIR%\inf\jb_fashi2.bmp
%WINDIR%\inf\jzd.bmp
%WINDIR%\inf\jb_fashi1.bmp
%WINDIR%\inf\bens8.bmp
%WINDIR%\inf\bens9.bmp
%WINDIR%\inf\bens7.bmp
%WINDIR%\inf\tree.bmp
%WINDIR%\inf\bens6.bmp
%WINDIR%\inf\bens10.bmp
%WINDIR%\inf\jgb.bmp
%WINDIR%\inf\jnw.bmp
%WINDIR%\inf\jfs.bmp
%WINDIR%\inf\star.bmp
%WINDIR%\inf\jfl.bmp
%WINDIR%\inf\4.bmp
%WINDIR%\inf\xlgj.bmp
%WINDIR%\inf\xlgjs.bmp
%WINDIR%\inf\x10.bmp
%WINDIR%\inf\x8.bmp
%WINDIR%\inf\x9.bmp
%WINDIR%\inf\xlhm.bmp
%WINDIR%\inf\yk2.bmp
%WINDIR%\inf\yk3.bmp
%WINDIR%\inf\yk1.bmp
%WINDIR%\inf\xljd.bmp
%WINDIR%\inf\xlymr.bmp
%WINDIR%\inf\sui.bmp
%WINDIR%\inf\sya1.bmp
%WINDIR%\inf\sl2.bmp
%WINDIR%\inf\sk.bmp
%WINDIR%\inf\sl.bmp
%WINDIR%\inf\sya2.bmp
%WINDIR%\inf\syb3.bmp
%WINDIR%\inf\syb4.bmp
%WINDIR%\inf\syb2.bmp
%WINDIR%\inf\sya3.bmp
%WINDIR%\inf\syb1.bmp
%WINDIR%\inf\sk11.bmp
%WINDIR%\inf\sk11.1.bmp
%WINDIR%\inf\sk10.bmp
%WINDIR%\inf\zengyuan.bmp
%WINDIR%\inf\zy.bmp
%WINDIR%\inf\ss9.bmp
%WINDIR%\inf\1.bmp
%WINDIR%\inf\3.bmp
%WINDIR%\inf\ss8.bmp
%WINDIR%\inf\ss10.bmp
%WINDIR%\inf\ss11.bmp
%WINDIR%\inf\yk7.bmp
%WINDIR%\inf\ymrw1.bmp
%WINDIR%\inf\yk6.bmp
%WINDIR%\inf\yk4.bmp
%WINDIR%\inf\yk5.bmp
%WINDIR%\inf\ymrw2.bmp
%WINDIR%\inf\zbymr2.bmp
%WINDIR%\inf\zdjb.bmp
%WINDIR%\inf\zbymr.bmp
%WINDIR%\inf\yuancheng.bmp
%WINDIR%\inf\yxzrjdt.bmp
%WINDIR%\inf\jb_feilong1.bmp
%WINDIR%\inf\xx.bmp
%WINDIR%\inf\wz_ahxly.bmp
%WINDIR%\inf\cocQuit_OK.bmp
%WINDIR%\inf\cocIcon.bmp
%WINDIR%\inf\cocDelete.bmp
%WINDIR%\inf\wz_blcb.bmp
%WINDIR%\inf\wz_gjnh.bmp
%WINDIR%\inf\wz_xly.bmp
%WINDIR%\inf\wz_fsgc.bmp
%WINDIR%\inf\wz_by.bmp
%WINDIR%\inf\wz_dby.bmp
%WINDIR%\inf\hycjq_2.bmp
%WINDIR%\inf\hycjq_3.bmp
%WINDIR%\inf\hycjq_1.bmp
%WINDIR%\inf\hycjq5-1.bmp
%WINDIR%\inf\hycjq6-1.bmp
%WINDIR%\inf\mszy.bmp
%WINDIR%\inf\ln1.bmp
%WINDIR%\inf\sj.bmp
%WINDIR%\inf\ztDYTa.bmp
%WINDIR%\inf\bs.bmp
%WINDIR%\inf\xlyts.bmp
%WINDIR%\inf\fq2.bmp
%WINDIR%\inf\jszd.bmp
%WINDIR%\inf\fq.bmp
%WINDIR%\inf\6.bmp
%WINDIR%\inf\16.bmp
%WINDIR%\inf\jszd2.bmp
%WINDIR%\inf\pj6.bmp
%WINDIR%\inf\pj8.bmp
%WINDIR%\inf\queding.bmp
%WINDIR%\inf\jb2.bmp
%WINDIR%\inf\jb_gongjian3.bmp
%WINDIR%\inf\blcb_5.bmp
%WINDIR%\inf\jb_sui.bmp
%WINDIR%\inf\fsgc_sdys.bmp
%WINDIR%\inf\wz_ymrw.bmp
%WINDIR%\inf\jqq.bmp
%WINDIR%\inf\zhiyu.bmp
%WINDIR%\inf\bt2c.bmp
%WINDIR%\inf\bt3c.bmp
%WINDIR%\inf\bt1c.bmp
%WINDIR%\inf\fsgc_bdys.bmp
%WINDIR%\inf\bdys.bmp
%WINDIR%\inf\hycjq3.bmp
%WINDIR%\inf\jb_tianshi2.bmp
%WINDIR%\inf\jb_tianshi3.bmp
%WINDIR%\inf\jb_tianshi1.bmp
%WINDIR%\inf\jb_tiangou2.bmp
%WINDIR%\inf\jb_tiangou3.bmp
%WINDIR%\inf\jb_wangling1.bmp
%WINDIR%\inf\jhm.bmp
%WINDIR%\inf\jb_gongjian1.bmp
%WINDIR%\inf\jb_yezhu1.bmp
%WINDIR%\inf\jb_wangling2.bmp
%WINDIR%\inf\jb_wushen1.bmp
%WINDIR%\inf\jb_pika2.bmp
%WINDIR%\inf\jb_pika3.bmp
%WINDIR%\inf\jb_pika1.bmp
%WINDIR%\inf\jb_feilong2.bmp
%WINDIR%\inf\jb_nvwu1.bmp
%WINDIR%\inf\jb_pz1.bmp
%WINDIR%\inf\jb_shitou1.bmp
%WINDIR%\inf\jb_tiangou1.bmp
%WINDIR%\inf\jb_qiqiu2.bmp
%WINDIR%\inf\jb_pz2.bmp
%WINDIR%\inf\jb_qiqiu1.bmp
%WINDIR%\inf\fs7.bmp
%WINDIR%\inf\qbcxbz.bmp
%WINDIR%\inf\fs6.bmp
%WINDIR%\inf\syxjycxbz.bmp
%WINDIR%\inf\shebei.bmp
%WINDIR%\inf\ztXNu.bmp
%WINDIR%\inf\fsgc_zlys.bmp
%WINDIR%\inf\hycjq2.bmp
%WINDIR%\inf\fsgc_kbys.bmp
%WINDIR%\inf\kbys.bmp
%WINDIR%\inf\zlys.bmp
%WINDIR%\inf\jb_gongjian6.bmp
%WINDIR%\inf\jb_gongjian7.bmp
%WINDIR%\inf\jb_gongjian5.bmp
%WINDIR%\inf\jb_gongjian2.bmp
%WINDIR%\inf\jb_gongjian4.bmp
%WINDIR%\inf\jb_gongjian8.bmp
%WINDIR%\inf\yxth_sx.bmp
%WINDIR%\inf\yxth_yx.bmp
%WINDIR%\inf\bs_lkwc.bmp
%WINDIR%\inf\jb_gongjian9.bmp
%WINDIR%\inf\qxts.bmp
%WINDIR%\inf\sjq2.bmp
<Текущая директория>\ЕдЦГ\10±ѕґтУгІ»јУЛЩ.ini
%WINDIR%\inf\4q1.bmp
<Текущая директория>\ЕдЦГ\10±ѕІ»јУЛЩЅрЛ®.ini
<Текущая директория>\ЕдЦГ\9±ѕґїЧКФґґтУгЕдЦГ.ini
<Текущая директория>\ЕдЦГ\10±ѕ1јУЛЩґтЗ®јж№ЛЧКФґ.ini
%WINDIR%\inf\5q1.bmp
%WINDIR%\inf\9q1.bmp
%WINDIR%\inf\10q1.bmp
%WINDIR%\inf\8q1.bmp
%WINDIR%\inf\6q1.bmp
%WINDIR%\inf\7q1.bmp
<Текущая директория>\ЕдЦГ\8±ѕ2јУЛЩґтУгЕдЦГ.ini
<Текущая директория>\ЕдЦГ\8±ѕ4јУЛЩґтУгЕдЦГ.ini
<Текущая директория>\ЕдЦГ\8±ѕ1јУЛЩґтУгЕдЦГ.ini
<Текущая директория>\ЕдЦГ\јУЛЩ-9±ѕ6јУЛЩґтЧКФґ.ini
<Текущая директория>\ЕдЦГ\І»јУЛЩ-10±ѕРЎж¤ЧЁУГґтЧКФґ.ini
<Текущая директория>\ЕдЦГ\8±ѕІ»јУЛЩґтЅрЛ®єЪ.ini
<Текущая директория>\ЕдЦГ\9±ѕІ»јУЛЩґтєЪЕдЦГ.ini
<Текущая директория>\ЕдЦГ\9±ѕІ»јУЛЩґтЧКФґ.ini
<Текущая директория>\ЕдЦГ\9±ѕ5јУЛЩЕдЦГ.ini
<Текущая директория>\ЕдЦГ\8±ѕІ»јУЛЩґтУгЕдЦГ.ini
<Текущая директория>\ЕдЦГ\9±ѕ1јУЛЩЕдЦГ.ini
%WINDIR%\inf\ben10.bmp
%WINDIR%\inf\bl.bmp
%WINDIR%\inf\ben9.bmp
%WINDIR%\inf\ben7.bmp
%WINDIR%\inf\ben8.bmp
%WINDIR%\inf\blcb2.bmp
%WINDIR%\inf\blcb6.bmp
%WINDIR%\inf\bt1a.bmp
%WINDIR%\inf\blcb5.bmp
%WINDIR%\inf\blcb3.bmp
%WINDIR%\inf\blcb4.bmp
%WINDIR%\inf\akjgj.bmp
%WINDIR%\inf\ax1.bmp
%WINDIR%\inf\11q2.bmp
%WINDIR%\inf\10q2.bmp
%WINDIR%\inf\11q.bmp
%WINDIR%\inf\ax2.bmp
%WINDIR%\inf\ax6.bmp
%WINDIR%\inf\baiyun.bmp
%WINDIR%\inf\ax5.bmp
%WINDIR%\inf\ax3.bmp
%WINDIR%\inf\ax4.bmp
<Текущая директория>\ЕдЦГ\јУЛЩ-10±ѕ5јУЛЩґтєЪ-CЎ¦ РЎж¤ЎўЗлЙ§µИ.ini
<Текущая директория>\cfgdll.dll
<Текущая директория>\ShieldModule.dat
%TEMP%\BackGround.bmp
<Текущая директория>\plugin\PIC.DLL
%TEMP%\mymacro.zip
%APPDATA%\mymacro\qdisp.dll
%APPDATA%\qmacro\shield\SD002.dat
%APPDATA%\qmacro\shield\SD003.dat
%APPDATA%\qmacro\shield\SD001.dat
%TEMP%\6dd3.tmp
%APPDATA%\qmacro\shield\SD000.dat
%TEMP%\plugin.zip
<Текущая директория>\plugin\GETSYSINFO.DLL
%TEMP%\mac2.tmp
%TEMP%\mymacro_errinfo.exe
%TEMP%\mac1.tmp
<Текущая директория>\plugin\MSG.DLL
<Текущая директория>\plugin\FILE.DLL
<Текущая директория>\plugin\SYS.DLL
<Текущая директория>\plugin\REGDLL.DLL
<Текущая директория>\plugin\WINDOW.DLL
<Текущая директория>\plugin\AJJL.DLL
<Текущая директория>\plugin\FILE.ini
<SYSTEM32>\cmd.bat
<Текущая директория>\browsebox_dir.ico
<Текущая директория>\radiobox_disabled_unchecked.ico
<Текущая директория>\browsebox_file.ico
<Текущая директория>\plugin\SYS.ini
<Текущая директория>\ЕдЦГ\јУЛЩ-10±ѕґтУгЈЁЅрЛ®єЪ¶јУРЈ©.ini
<Текущая директория>\ЕдЦГ\јУЛЩ-9±ѕјУЛЩЅрЛ®6000W-Yuexiz.ini
<Текущая директория>\ЕдЦГ\јУЛЩ-9±ѕ10ІФУ¬Л«4000W.ini
<Текущая директория>\ЕдЦГ\І»јУЛЩ-9±ѕЧЁґтєЪЈЁ»ЁЗ§С°Ј©·ЦПн.ini
<Текущая директория>\ЕдЦГ\І»јУЛЩ-10±ѕґтєЪ.ini
<Текущая директория>\timer_icon.ico
<Текущая директория>\checkbox_checked.ico
<Текущая директория>\<Имя вируса>.ini
%APPDATA%\qmacro\shield\SD004.dat
%APPDATA%\qmacro\shield\Shield.ini
<Текущая директория>\checkbox_unchecked.ico
<Текущая директория>\radiobox_unchecked.ico
<Текущая директория>\radiobox_disabled_checked.ico
<Текущая директория>\radiobox_checked.ico
<Текущая директория>\checkbox_disabled_checked.ico
<Текущая директория>\checkbox_disabled_unchecked.ico
%WINDIR%\inf\bt1b.bmp
%WINDIR%\inf\luo.bmp
%WINDIR%\inf\m.bmp
%WINDIR%\inf\ln4.bmp
%WINDIR%\inf\ln2.bmp
%WINDIR%\inf\ln3.bmp
%WINDIR%\inf\mei.bmp
%WINDIR%\inf\nhjn.bmp
%WINDIR%\inf\pingfen.bmp
%WINDIR%\inf\n.bmp
%WINDIR%\inf\mei2.bmp
%WINDIR%\inf\moren.bmp
%WINDIR%\inf\j.bmp
%WINDIR%\inf\j1.bmp
%WINDIR%\inf\hy.bmp
%WINDIR%\inf\hx.bmp
%WINDIR%\inf\hx2.bmp
%WINDIR%\inf\j10.bmp
%WINDIR%\inf\jk11.bmp
%WINDIR%\inf\jrhm.bmp
%WINDIR%\inf\jk10.bmp
%WINDIR%\inf\jb.bmp
%WINDIR%\inf\jgj.bmp
%WINDIR%\inf\s11j3.bmp
%WINDIR%\inf\s11j4.bmp
%WINDIR%\inf\s11j2.bmp
%WINDIR%\inf\s11.bmp
%WINDIR%\inf\s11j1.bmp
%WINDIR%\inf\sa.bmp
%WINDIR%\inf\sjq.bmp
%WINDIR%\inf\sjq1.bmp
%WINDIR%\inf\sidai.bmp
%WINDIR%\inf\sdys.bmp
%WINDIR%\inf\shou.bmp
%WINDIR%\inf\rwjn.bmp
%WINDIR%\inf\s.bmp
%WINDIR%\inf\qiang.bmp
%WINDIR%\inf\pj7.bmp
%WINDIR%\inf\pzfs.bmp
%WINDIR%\inf\s8.bmp
%WINDIR%\inf\s10j1.bmp
%WINDIR%\inf\s10j2.bmp
%WINDIR%\inf\s10.bmp
%WINDIR%\inf\s8j1.bmp
%WINDIR%\inf\s9.bmp
%WINDIR%\inf\hui.bmp
%WINDIR%\inf\by8.bmp
%WINDIR%\inf\chu.bmp
%WINDIR%\inf\by7.bmp
%WINDIR%\inf\by5.bmp
%WINDIR%\inf\by6.bmp
%WINDIR%\inf\csbsb1.bmp
%WINDIR%\inf\deng.bmp
%WINDIR%\inf\dhk.bmp
%WINDIR%\inf\dam.bmp
%WINDIR%\inf\csbsb2.bmp
%WINDIR%\inf\csbsb3.bmp
%WINDIR%\inf\bt3b.bmp
%WINDIR%\inf\buxian.bmp
%WINDIR%\inf\bt3a.bmp
%WINDIR%\inf\bt2a.bmp
%WINDIR%\inf\bt2b.bmp
%WINDIR%\inf\buyao.bmp
%WINDIR%\inf\by3.bmp
%WINDIR%\inf\by4.bmp
%WINDIR%\inf\by2.bmp
%WINDIR%\inf\bxjl.bmp
%WINDIR%\inf\by.bmp
%WINDIR%\inf\gong.bmp
%WINDIR%\inf\gong2.bmp
%WINDIR%\inf\gjnh2.bmp
%WINDIR%\inf\gb.bmp
%WINDIR%\inf\gjnh1.bmp
%WINDIR%\inf\gr.bmp
%WINDIR%\inf\hou.bmp
%WINDIR%\inf\hsym.bmp
%WINDIR%\inf\hm.bmp
%WINDIR%\inf\haiyang.bmp
%WINDIR%\inf\hf.bmp
%WINDIR%\inf\fsgc.bmp
%WINDIR%\inf\fsu1.bmp
%WINDIR%\inf\fs8.bmp
%WINDIR%\inf\dou.bmp
%WINDIR%\inf\fen.bmp
%WINDIR%\inf\fsu2.bmp
%WINDIR%\inf\g1.bmp
%WINDIR%\inf\g2.bmp
%WINDIR%\inf\fsu5.bmp
%WINDIR%\inf\fsu3.bmp
%WINDIR%\inf\fsu4.bmp

Удаляет следующие файлы:

<Текущая директория>\radiobox_unchecked.ico
<Текущая директория>\radiobox_checked.ico
<Текущая директория>\checkbox_disabled_unchecked.ico
<Текущая директория>\radiobox_disabled_checked.ico
<Текущая директория>\browsebox_dir.ico
<Текущая директория>\browsebox_file.ico
<Текущая директория>\radiobox_disabled_unchecked.ico
<Текущая директория>\ShieldModule.dat
%TEMP%\mymacro.zip
%TEMP%\plugin.zip
<Текущая директория>\timer_icon.ico
<Текущая директория>\checkbox_disabled_checked.ico
<Текущая директория>\checkbox_unchecked.ico
<Текущая директория>\checkbox_checked.ico

Перемещает следующие файлы:

%TEMP%\BackGround.bmp в %TEMP%\b38background.bmp

Другое:

Ищет следующие окна:

ClassName: 'Shell_TrayWnd' WindowName: ''

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней