Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'wextract_cleanup0' = 'rundll32.exe <SYSTEM32>\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"'
Вредоносные функции:
Создает и запускает на исполнение:
- '<SYSTEM32>\cscript.exe' //nologo "C:\SymbiaCL\update.vbs"
Запускает на исполнение:
- '<SYSTEM32>\cmd.exe' /c cscript //nologo "C:\SymbiaCL\update.vbs"
- '<SYSTEM32>\expand.exe' /f:* "%TEMP%\IXP000.TMP\Programs.Cab" "c:\SymbiaCL\Programs"
- 'C:\SymbiaCL\setup.exe'
- 'C:\SymbiaCL\setup.exe' /s /f1C:\SymbiaCL\setup.iss
- '<SYSTEM32>\cmd.exe' /c <SYSTEM32>\expand.exe /f:* "%TEMP%\IXP000.TMP\main.Cab" "c:\SymbiaCL"
- '<SYSTEM32>\cmd.exe' /c setup.bat
- '<SYSTEM32>\cmd.exe' /c <SYSTEM32>\expand.exe /f:* "%TEMP%\IXP000.TMP\Programs.Cab" "c:\SymbiaCL\Programs"
- '<SYSTEM32>\expand.exe' /f:* "%TEMP%\IXP000.TMP\main.Cab" "c:\SymbiaCL"
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\InstallShield\Professional\RunTime\10\01\Intel32\isp5.tmp\temp.000
- %TEMP%\igd6.tmp
- %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\212d9ec1e7a0fa767a674d2b68ff822e_23ef5514-3059-436f-a4a7-4cefaab20eb1
- %TEMP%\_se7.tmp
- %CommonProgramFiles%\InstallShield\Professional\RunTime\10\01\Intel32\Dot9.tmp
- %CommonProgramFiles%\InstallShield\Professional\RunTime\10\01\Intel32\iKe8.tmp
- %TEMP%\isp4.tmp\temp.000
- %APPDATA%\Microsoft\Protect\CREDHIST
- C:\SymbiaCL\Programs\siemensLogo.GIF
- C:\SymbiaCL\Programs\printc.dll
- C:\SymbiaCL\Programs\OSDD4.OSD
- C:\SymbiaCL\Programs\license.txt
- %CommonProgramFiles%\InstallShield\Professional\RunTime\10\01\Intel32\isp2.tmp\temp.000
- %CommonProgramFiles%\InstallShield\Professional\RunTime\10\01\Intel32\set3.tmp
- %TEMP%\iss1.tmp\setup.ini
- %CommonProgramFiles%\InstallShield\Professional\RunTime\10\01\Intel32\ctoA.tmp
- %TEMP%\{47BA6F23-D6BA-4E16-9E3A-47F70CC756A7}\{D020CB5D-016B-4943-87CC-472D50ABFE56}\Fontca75.rra
- %TEMP%\{47BA6F23-D6BA-4E16-9E3A-47F70CC756A7}\coreca27.rra
- %TEMP%\{47BA6F23-D6BA-4E16-9E3A-47F70CC756A7}\{D020CB5D-016B-4943-87CC-472D50ABFE56}\licec9d9.rra
- %TEMP%\{47BA6F23-D6BA-4E16-9E3A-47F70CC756A7}\{D020CB5D-016B-4943-87CC-472D50ABFE56}\Stricab4.rra
- %TEMP%\{47BA6F23-D6BA-4E16-9E3A-47F70CC756A7}\{D020CB5D-016B-4943-87CC-472D50ABFE56}\_IsRcb9e.rra
- %TEMP%\{47BA6F23-D6BA-4E16-9E3A-47F70CC756A7}\{D020CB5D-016B-4943-87CC-472D50ABFE56}\defacb6f.rra
- %TEMP%\{47BA6F23-D6BA-4E16-9E3A-47F70CC756A7}\{D020CB5D-016B-4943-87CC-472D50ABFE56}\isrtcae2.rra
- %TEMP%\{47BA6F23-D6BA-4E16-9E3A-47F70CC756A7}\{D020CB5D-016B-4943-87CC-472D50ABFE56}\setuc98b.rra
- %CommonProgramFiles%\InstallShield\Professional\RunTime\IsPD.tmp
- %CommonProgramFiles%\InstallShield\Professional\RunTime\10\01\Intel32\iusC.tmp
- %CommonProgramFiles%\InstallShield\Professional\RunTime\10\01\Intel32\iscB.tmp
- %CommonProgramFiles%\InstallShield\Professional\RunTime\IsProBE.tlb
- %TEMP%\c380.rra
- %CommonProgramFiles%\InstallShield\Professional\RunTime\ObjE.tmp
- %CommonProgramFiles%\InstallShield\Professional\RunTime\iKernel.rgs
- C:\SymbiaCL\Programs\msvcp71.dll
- C:\SymbiaCL\OSD1BF.OSD
- C:\SymbiaCL\data2.cab
- C:\SymbiaCL\Update_Symbia.net_Shortcut.vbs
- C:\SymbiaCL\update.vbs
- C:\SymbiaCL\engine32.cab
- C:\SymbiaCL\setup.exe
- C:\SymbiaCL\data1.cab
- C:\SymbiaCL\setup.iss
- %TEMP%\IXP000.TMP\Programs.CAB
- %TEMP%\IXP000.TMP\Main.CAB
- %TEMP%\IXP000.TMP\setup.bat
- C:\SymbiaCL\setup.inx
- C:\SymbiaCL\setup.ini
- C:\SymbiaCL\setup.ibt
- C:\SymbiaCL\setup.log
- C:\SymbiaCL\data1.hdr
- C:\SymbiaCL\Programs\scres.dll
- C:\SymbiaCL\Programs\pbr.dll
- C:\SymbiaCL\Programs\sndc.dll
- C:\SymbiaCL\Programs\dc.dll
- C:\SymbiaCL\Programs\filec.dll
- C:\SymbiaCL\Programs\upc.dll
- C:\SymbiaCL\Programs\msvcr71.dll
- C:\SymbiaCL\Programs\cplc.dll
- C:\SymbiaCL\Programs\cs.dll
- C:\SymbiaCL\layout.bin
- C:\SymbiaCL\setup.isn
- C:\SymbiaCL\Programs\clipc.dll
- C:\SymbiaCL\Programs\sc.dll
- C:\SymbiaCL\Programs\QuickPDFDLL.dll
- C:\SymbiaCL\Programs\Symbia.exe
Удаляет следующие файлы:
- %CommonProgramFiles%\InstallShield\Professional\RunTime\IsPD.tmp
- C:\SymbiaCL\setup.log
- %TEMP%\_se7.tmp
- %CommonProgramFiles%\InstallShield\Professional\RunTime\10\01\Intel32\set3.tmp
- %TEMP%\igd6.tmp
Перемещает следующие файлы:
- %TEMP%\{47BA6F23-D6BA-4E16-9E3A-47F70CC756A7}\{D020CB5D-016B-4943-87CC-472D50ABFE56}\licec9d9.rra в %TEMP%\{47BA6F23-D6BA-4E16-9E3A-47F70CC756A7}\{D020CB5D-016B-4943-87CC-472D50ABFE56}\license.txt
- %TEMP%\{47BA6F23-D6BA-4E16-9E3A-47F70CC756A7}\coreca27.rra в %TEMP%\{47BA6F23-D6BA-4E16-9E3A-47F70CC756A7}\corecomp.ini
- %CommonProgramFiles%\InstallShield\Professional\RunTime\ObjE.tmp в %CommonProgramFiles%\InstallShield\Professional\RunTime\Objectps.dll
- %TEMP%\{47BA6F23-D6BA-4E16-9E3A-47F70CC756A7}\{D020CB5D-016B-4943-87CC-472D50ABFE56}\setuc98b.rra в %TEMP%\{47BA6F23-D6BA-4E16-9E3A-47F70CC756A7}\{D020CB5D-016B-4943-87CC-472D50ABFE56}\setup.inx
- %TEMP%\{47BA6F23-D6BA-4E16-9E3A-47F70CC756A7}\{D020CB5D-016B-4943-87CC-472D50ABFE56}\Fontca75.rra в %TEMP%\{47BA6F23-D6BA-4E16-9E3A-47F70CC756A7}\{D020CB5D-016B-4943-87CC-472D50ABFE56}\FontData.ini
- %TEMP%\{47BA6F23-D6BA-4E16-9E3A-47F70CC756A7}\{D020CB5D-016B-4943-87CC-472D50ABFE56}\defacb6f.rra в %TEMP%\{47BA6F23-D6BA-4E16-9E3A-47F70CC756A7}\{D020CB5D-016B-4943-87CC-472D50ABFE56}\default.pal
- %TEMP%\{47BA6F23-D6BA-4E16-9E3A-47F70CC756A7}\{D020CB5D-016B-4943-87CC-472D50ABFE56}\_IsRcb9e.rra в %TEMP%\{47BA6F23-D6BA-4E16-9E3A-47F70CC756A7}\{D020CB5D-016B-4943-87CC-472D50ABFE56}\_IsRes.dll
- %TEMP%\{47BA6F23-D6BA-4E16-9E3A-47F70CC756A7}\{D020CB5D-016B-4943-87CC-472D50ABFE56}\Stricab4.rra в %TEMP%\{47BA6F23-D6BA-4E16-9E3A-47F70CC756A7}\{D020CB5D-016B-4943-87CC-472D50ABFE56}\StringTable-0009-English.ips
- %TEMP%\{47BA6F23-D6BA-4E16-9E3A-47F70CC756A7}\{D020CB5D-016B-4943-87CC-472D50ABFE56}\isrtcae2.rra в %TEMP%\{47BA6F23-D6BA-4E16-9E3A-47F70CC756A7}\{D020CB5D-016B-4943-87CC-472D50ABFE56}\isrt.dll
- %CommonProgramFiles%\InstallShield\Professional\RunTime\10\01\Intel32\iusC.tmp в %CommonProgramFiles%\InstallShield\Professional\RunTime\10\01\Intel32\iuser.dll
- %CommonProgramFiles%\InstallShield\Professional\RunTime\10\01\Intel32\isp5.tmp\temp.000 в %CommonProgramFiles%\InstallShield\Professional\RunTime\10\01\Intel32\isp5.tmp\IGdi.dll
- %CommonProgramFiles%\InstallShield\Professional\RunTime\10\01\Intel32\isp5.tmp\IGdi.dll в %CommonProgramFiles%\InstallShield\Professional\RunTime\10\01\Intel32\iGdi.dll
- %CommonProgramFiles%\InstallShield\Professional\RunTime\10\01\Intel32\isp2.tmp\temp.000 в %CommonProgramFiles%\InstallShield\Professional\RunTime\10\01\Intel32\isp2.tmp\setup.dll
- %CommonProgramFiles%\InstallShield\Professional\RunTime\10\01\Intel32\isp2.tmp\setup.dll в %CommonProgramFiles%\InstallShield\Professional\RunTime\10\01\Intel32\setup.dll
- %TEMP%\isp4.tmp\temp.000 в %TEMP%\isp4.tmp\_Setup.dll
- %CommonProgramFiles%\InstallShield\Professional\RunTime\10\01\Intel32\ctoA.tmp в %CommonProgramFiles%\InstallShield\Professional\RunTime\10\01\Intel32\ctor.dll
- %CommonProgramFiles%\InstallShield\Professional\RunTime\10\01\Intel32\iscB.tmp в %CommonProgramFiles%\InstallShield\Professional\RunTime\10\01\Intel32\iscript.dll
- %CommonProgramFiles%\InstallShield\Professional\RunTime\10\01\Intel32\iKe8.tmp в %CommonProgramFiles%\InstallShield\Professional\RunTime\10\01\Intel32\iKernel.dll
- %CommonProgramFiles%\InstallShield\Professional\RunTime\10\01\Intel32\Dot9.tmp в %CommonProgramFiles%\InstallShield\Professional\RunTime\10\01\Intel32\DotNetInstaller.exe
Подменяет следующие файлы:
- C:\SymbiaCL\setup.log
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
