Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\win.ini
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\SOE Wrap Send Service] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\SOE Wrap Send Service] 'ImagePath' = '<SYSTEM32>\SndServ.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\SysExec] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\SysExec] 'ImagePath' = '<SYSTEM32>\sysexec.exe'
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\sysexec.exe'
- 'C:\apps_pub\dpc2ak12\seinst.exe'
- '<SYSTEM32>\SndServ.exe'
- 'C:\apps_pub\dpc2ak12\sninst.exe'
- '%TEMP%\dpc2\ladmin.exe' C:\apps_pub\commands
- '%TEMP%\dpc2\ladmin.exe' C:\apps_pub
- '%TEMP%\dpc2\wbat.exe' wbat `%TEMP%\dpc2\dpc2inst.wbt`
- '%TEMP%\dpc2\tsync32.exe' %TEMP%\dpc2 C:\apps_pub\dpc2ak12
- '%TEMP%\dpc2\ladmin.exe' C:\apps_pub\dpc2ak12
Изменения в файловой системе:
Создает следующие файлы:
- C:\apps_pub\dpc2ak12\GetPkg.exe
- C:\apps_pub\dpc2ak12\icat.exe
- C:\apps_pub\dpc2ak12\dpc2.cmd
- C:\apps_pub\dpc2ak12\dpc2inst.wbt
- C:\apps_pub\dpc2ak12\dpc2x.exe
- C:\apps_pub\dpc2ak12\postinv.exe
- C:\apps_pub\dpc2ak12\rstart.exe
- C:\apps_pub\dpc2ak12\ladmin.exe
- C:\apps_pub\dpc2ak12\pcidGen.exe
- C:\apps_pub\dpc2ak12\dbcon.exe
- C:\apps_pub\dpc2ak12\bsadmin\setup.wbt
- C:\apps_pub\dpc2ak12\bsadmin\install.wbt
- C:\apps_pub\dpc2ak12\bsadmin\insttest.wbt
- C:\apps_pub\dpc2ak12\bsadmin\log.wbt
- C:\apps_pub\dpc2ak12\admintest.wbt
- C:\apps_pub\dpc2ak12\bsgrp32.exe
- C:\apps_pub\dpc2ak12\dpc.exe
- C:\apps_pub\dpc2ak12\bsadmin\readme.txt
- C:\apps_pub\dpc2ak12\bsadmin\remove.wbt
- C:\apps_pub\dpc2ak12\seinst.exe
- C:\apps_pub\dpc2ak12\tsync32.exe
- C:\apps_pub\dpc2ak12\wbat.exe
- C:\apps_pub\dpc2ak12\spcl.exe
- C:\apps_pub\dpc2ak12\sysexec.exe
- C:\apps_pub\dpc2ak12\vping.exe
- <SYSTEM32>\sysexec.exe
- <SYSTEM32>\SndServ.exe
- C:\apps_pub\dpc2ak12\weblogin.exe
- C:\apps_pub\dpc2ak12\wbatsh.exe
- C:\apps_pub\dpc2ak12\srvtype.exe
- C:\apps_pub\dpc2ak12\sgetpkg.cmd
- C:\apps_pub\dpc2ak12\SndServ.exe
- C:\apps_pub\dpc2ak12\rstartw.exe
- C:\apps_pub\dpc2ak12\seinstw.exe
- C:\apps_pub\dpc2ak12\sninst.exe
- C:\apps_pub\dpc2ak12\soesfx.ini
- C:\apps_pub\dpc2ak12\spac.exe
- C:\apps_pub\dpc2ak12\sgetpkg.wbt
- C:\apps_pub\dpc2ak12\soemsg.dll
- C:\apps_pub\dpc2ak12\bsadmin\params.ini
- %TEMP%\dpc2\dpc2.cmd
- %TEMP%\dpc2\dpc2inst.wbt
- %TEMP%\dpc2\dbcon.exe
- %TEMP%\dpc2\dpc.exe
- %TEMP%\dpc2\dpc2x.exe
- %TEMP%\dpc2\ladmin.exe
- %TEMP%\dpc2\pcidGen.exe
- %TEMP%\dpc2\GetPkg.exe
- %TEMP%\dpc2\icat.exe
- %TEMP%\dpc2\bsgrp32.exe
- %TEMP%\dpc2\bsadmin\install.wbt
- %TEMP%\dpc2\bsadmin\insttest.wbt
- %TEMP%\soesfx.ini
- %TEMP%\dpc2\admintest.wbt
- %TEMP%\dpc2\bsadmin\log.wbt
- %TEMP%\dpc2\bsadmin\remove.wbt
- %TEMP%\dpc2\bsadmin\setup.wbt
- %TEMP%\dpc2\bsadmin\params.ini
- %TEMP%\dpc2\bsadmin\readme.txt
- %TEMP%\dpc2\postinv.exe
- %TEMP%\dpc2\srvtype.exe
- %TEMP%\dpc2\sysexec.exe
- %TEMP%\dpc2\spac.exe
- %TEMP%\dpc2\spcl.exe
- %TEMP%\dpc2\tsync32.exe
- %TEMP%\dpc2\wbatsh.exe
- %TEMP%\dpc2\weblogin.exe
- %TEMP%\dpc2\vping.exe
- %TEMP%\dpc2\wbat.exe
- %TEMP%\dpc2\soesfx.ini
- %TEMP%\dpc2\seinst.exe
- %TEMP%\dpc2\seinstw.exe
- %TEMP%\dpc2\rstart.exe
- %TEMP%\dpc2\rstartw.exe
- %TEMP%\dpc2\sgetpkg.cmd
- %TEMP%\dpc2\sninst.exe
- %TEMP%\dpc2\soemsg.dll
- %TEMP%\dpc2\sgetpkg.wbt
- %TEMP%\dpc2\SndServ.exe
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
