Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'lexpIorer' = '%WINDIR%\lexpIorer.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'io' = '%WINDIR%\io.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'dwqdqdqwdqwdqdwqwdf' = '%WINDIR%\dwqdqdqwdqwdqdwqwdf.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'iiiiiiiiiiiiiiiexplorer' = '%WINDIR%\iiiiiiiiiiiiiiiexplorer.exe'
Вредоносные функции:
Для затруднения выявления своего присутствия в системе
блокирует запуск следующих системных утилит:
- Диспетчера задач (Taskmgr)
Запускает на исполнение:
- '<SYSTEM32>\shutdown.exe' -s -f -t 00
- '<SYSTEM32>\taskkill.exe' /F /IM lexpIorer.exe
- '%WINDIR%\iiiiiiiiiiiiiiiexplorer.exe'
- '%WINDIR%\io.exe'
- '<SYSTEM32>\taskkill.exe' /F /IM io.exe
- '%WINDIR%\lexpIorer.exe'
- '%WINDIR%\regedit.exe' /s "%WINDIR%\vdisableuac.reg"
- '<SYSTEM32>\notepad.exe' %WINDIR%\fonts\Tutorial.txt
- '%WINDIR%\Fonts\VistaTigabelas13LS.exe'
- '<SYSTEM32>\taskkill.exe' /F /IM iiiiiiiiiiiiiiiexplorer.exe
- '%WINDIR%\dwqdqdqwdqwdqdwqwdf.exe'
- '<SYSTEM32>\taskkill.exe' /F /IM dwqdqdqwdqwdqdwqwdf.exe
Ищет следующие окна с целью
обнаружения утилит для анализа:
- ClassName: 'PROCEXPL' WindowName: ''
- ClassName: 'OLLYDBG' WindowName: ''
Пытается завершить работу операционной системы Windows.
Изменения в файловой системе:
Создает следующие файлы:
- <SYSTEM32>\COMCTL32.OCX
- <SYSTEM32>\MSCOMCTL.OCX
- <SYSTEM32>\MSINET.OCX
- <SYSTEM32>\COMDLG32.OCX
- %WINDIR%\lexpIorer.exe
- %WINDIR%\io.exe
- %WINDIR%\dwqdqdqwdqwdqdwqwdf.exe
- %WINDIR%\iiiiiiiiiiiiiiiexplorer.exe
- %WINDIR%\vdisableuac.reg
- %WINDIR%\Fonts\VistaTigabelas13LS.exe
- %WINDIR%\Fonts\COMCTL32.OCX
- %WINDIR%\Fonts\SYSINFO.OCX
- %WINDIR%\Fonts\Tutorial.txt
- %WINDIR%\Fonts\MSINET.OCX
- %TEMP%\~DFCE7C.tmp
- %WINDIR%\Fonts\COMDLG32.OCX
- %WINDIR%\Fonts\MSCOMCTL.OCX
Присваивает атрибут 'скрытый' для следующих файлов:
- %WINDIR%\dwqdqdqwdqwdqdwqwdf.exe
- %WINDIR%\vdisableuac.reg
- %WINDIR%\Fonts\MSINET.OCX
- %WINDIR%\io.exe
- %WINDIR%\lexpIorer.exe
- %WINDIR%\iiiiiiiiiiiiiiiexplorer.exe
- %WINDIR%\Fonts\VistaTigabelas13LS.exe
- %WINDIR%\Fonts\Tutorial.txt
- %WINDIR%\Fonts\SYSINFO.OCX
- %WINDIR%\Fonts\MSCOMCTL.OCX
- %WINDIR%\Fonts\COMDLG32.OCX
- %WINDIR%\Fonts\COMCTL32.OCX
Удаляет следующие файлы:
- <SYSTEM32>\MSCOMCTL.OCX
- <DRIVERS>\etc\hosts
Подменяет следующие файлы:
- <DRIVERS>\etc\hosts
Подменяет файл HOSTS.
Другое:
Ищет следующие окна:
- ClassName: '' WindowName: 'Clean PC V17 by pekalongan'
- ClassName: '' WindowName: 'Clean PC V18 by pekalongan'
- ClassName: '' WindowName: 'Clean PC V15 by pekalongan'
- ClassName: '' WindowName: 'Clean PC V16 by pekalongan'
- ClassName: '' WindowName: 'Clean PC12'
- ClassName: '' WindowName: 'Clean PC13'
- ClassName: '' WindowName: 'Clean PC V19 by pekalongan'
- ClassName: '' WindowName: 'Clean PC V20 by pekalongan'
- ClassName: '' WindowName: 'Clean PC V14 by pekalongan'
- ClassName: '' WindowName: 'Clean PC V8 by pekalongan'
- ClassName: '' WindowName: 'Clean PC V9 by pekalongan'
- ClassName: '' WindowName: 'Clean PC V6 by pekalongan'
- ClassName: '' WindowName: 'Clean PC V7 by pekalongan'
- ClassName: '' WindowName: 'Clean PC V12 by pekalongan'
- ClassName: '' WindowName: 'Clean PC V13 by pekalongan'
- ClassName: '' WindowName: 'Clean PC V10 by pekalongan'
- ClassName: '' WindowName: 'Clean PC V11 by pekalongan'
- ClassName: '' WindowName: 'Clean PC14'
- ClassName: '' WindowName: 'Tips Desain Rumah Minimalis - Mozilla Firefox'
- ClassName: '' WindowName: 'Tips Desain Pemilihan Mabel Rumah Minimalis | Tips Desain Rumah Minimalis - Google Chrome'
- ClassName: '' WindowName: 'Cheat Point Blank Terbaru 2016 - Mozilla Firefox'
- ClassName: '' WindowName: 'Tips Desain Rumah Minimalis - Google Chrome'
- ClassName: '' WindowName: 'LinkBucks.com - Get your share! - Mozilla Firefox'
- ClassName: '' WindowName: 'Form1'
- ClassName: '' WindowName: 'Tips Desain Pemilihan Mabel Rumah Minimalis | Tips Desain Rumah Minimalis - Mozilla Firefox'
- ClassName: '' WindowName: 'LinkBucks.com - Get your share! - Google Chrome'
- ClassName: '' WindowName: 'Cheat Point Blank Terbaru 2016 - Google Chrome'
- ClassName: '' WindowName: '- AdwCleaner - Terms of use -'
- ClassName: '' WindowName: '- AdwCleaner - v5.201 - ToolsLib -'
- ClassName: '' WindowName: 'Clean PC15'
- ClassName: '' WindowName: 'TeamViewer'
- ClassName: '' WindowName: 'ToolsLib - DOwnloads - AdwCleaner - Google Chrome'
- ClassName: '' WindowName: 'ToolsLib - DOwnloads - AdwCleaner - Mozilla Firefox'
- ClassName: '' WindowName: 'ToolsLib - Thank you for downloading AdwCleaner - Google Chrome'
- ClassName: '' WindowName: 'ToolsLib - Thank you for downloading AdwCleaner - Mozilla Firefox'
- ClassName: '' WindowName: 'BanCyberzHacks - Download Cheats And Software For Free - Google Chrome'
- ClassName: '' WindowName: 'Pekalongan Kommuniti - Google Chrome'
- ClassName: '' WindowName: 'Piriform CCleaner'
- ClassName: '' WindowName: 'Administrator: <SYSTEM32>\cmd.exe'
- ClassName: '' WindowName: 'Pekalongan Kommunity - Mozilla Firefox'
- ClassName: '' WindowName: 'Dukun Cit - Cheat Point Blank Free - Google Chrome'
- ClassName: '' WindowName: 'Pekalongan Kommuniti - Mozilla Firefox'
- ClassName: '' WindowName: 'Pekalongan Kommunity - Google Chrome'
- ClassName: '' WindowName: 'SysWOW64'
- ClassName: 'RegEdit_RegEdit' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: '' WindowName: 'Windows'
- ClassName: '' WindowName: 'System32'
- ClassName: 'ProcessHacker' WindowName: ''
- ClassName: '' WindowName: 'Windows Task Manager'
- ClassName: '' WindowName: 'Dukun Cit - Cheat Point Blank Free - Mozilla Firefox'
- ClassName: '' WindowName: 'Pekalongan'
- ClassName: '' WindowName: 'Clean PC V1 by pekalongan'
- ClassName: '' WindowName: 'PC'
- ClassName: '' WindowName: 'Clean PC'
- ClassName: '' WindowName: 'Clean PC V4 by pekalongan'
- ClassName: '' WindowName: 'Clean PC V5 by pekalongan'
- ClassName: '' WindowName: 'Clean PC V2 by pekalongan'
- ClassName: '' WindowName: 'Clean PC V3 by pekalongan'
- ClassName: '' WindowName: 'Clean'
- ClassName: '' WindowName: 'System Configuration'
- ClassName: '' WindowName: 'Registry Editor'
- ClassName: '' WindowName: 'WaW Jakarta Cheater - Google Chrome'
- ClassName: '' WindowName: 'WaW Jakarta Cheater - Mozilla Firefox'
- ClassName: '' WindowName: 'Cheat Point Blank Garena'
- ClassName: '' WindowName: 'Cheat Point Blank Garena Indonesia'
- ClassName: '' WindowName: 'Cheat Lost Saga'
- ClassName: '' WindowName: 'Cheat Point Blank'
