Техническая информация
Для обеспечения автозапуска и распространения:
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\HPGate] 'ImagePath' = 'System32\Drivers\HPGate.sys'
- [<HKLM>\SYSTEM\ControlSet001\Services\HPGate] 'Start' = '00000002'
Вредоносные функции:
Запускает на исполнение:
- '%ProgramFiles%\HP\e-DiagTools for Windows\Brain16W.Exe' /REGSERVER
- '%ProgramFiles%\HP\e-DiagTools for Windows\Brain16W.Exe'
- '%TEMP%\{38e71fa0-59b0-11d4-bb75-00500478b0f5}\DrvReg.exe' System32\Drivers\HPGate.sys
- '%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\IKernel.exe' /REGSERVER
- '%TEMP%\pft3~tmp\Setup.exe'
- '%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\IKernel.exe' -RegServer
- '%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\IKernel.exe' 32\IKernel.exe -Embedding
Изменения в файловой системе:
Создает следующие файлы:
- %ProgramFiles%\InstallShield Installation Information\{38E71FA0-59B0-11D4-BB75-00500478B0F5}\setuc6ff.rra
- %ProgramFiles%\InstallShield Installation Information\{38E71FA0-59B0-11D4-BB75-00500478B0F5}\Setup.ini
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING1.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING.VER
- %ProgramFiles%\InstallShield Installation Information\{38E71FA0-59B0-11D4-BB75-00500478B0F5}\Setuc6d0.rra
- %ProgramFiles%\HP\e-DiagTools for Windows\eDTWc818.rra
- <SYSTEM32>\Mscoc8a5.rra
- %ProgramFiles%\HP\e-DiagTools for Windows\EDTWc7da.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING2.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.DATA
- %ProgramFiles%\InstallShield Installation Information\{38E71FA0-59B0-11D4-BB75-00500478B0F5}\Setuc6b1.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\domain.txt
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\$WinMgmt.CFG
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\ComDb.Dat
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SYSTEM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SAM
- %ProgramFiles%\InstallShield Installation Information\{38E71FA0-59B0-11D4-BB75-00500478B0F5}\datac653.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.MAP
- %ProgramFiles%\InstallShield Installation Information\{38E71FA0-59B0-11D4-BB75-00500478B0F5}\datac634.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.BTR
- %ProgramFiles%\InstallShield Installation Information\{38E71FA0-59B0-11D4-BB75-00500478B0F5}\layoc615.rra
- %ProgramFiles%\HP\e-DiagTools for Windows\Braicd77.rra
- <SYSTEM32>\edtlcda6.rra
- %ProgramFiles%\HP\e-DiagTools for Windows\eDTWcd68.rra
- %ProgramFiles%\HP\e-DiagTools for Windows\IDOBcd39.rra
- %ProgramFiles%\HP\e-DiagTools for Windows\eDTWcd49.rra
- <SYSTEM32>\Msvccf2d.rra
- %ProgramFiles%\HP\e-DiagTools for Windows\Readcfc9.rra
- %ProgramFiles%\HP\e-DiagTools for Windows\HPBicf0e.rra
- <SYSTEM32>\HpHicdc6.rra
- <DRIVERS>\Hpgacedf.rra
- %ProgramFiles%\HP\e-DiagTools for Windows\Idobcd1a.rra
- %ALLUSERSPROFILE%\Start Menu\Programs\Hewlett-Packard\notebook\HP e-DiagTools\e-DiagTools for Windows.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Hewlett-Packard\notebook\HP e-DiagTools\Readme.lnk
- <SYSTEM32>\Comcca0c.rra
- <SYSTEM32>\Comdc9ce.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.MAP
- %ProgramFiles%\HP\e-DiagTools for Windows\BIOSccdb.rra
- %ProgramFiles%\HP\e-DiagTools for Windows\IDVEccfa.rra
- %ProgramFiles%\HP\e-DiagTools for Windows\Itegcccc.rra
- %ProgramFiles%\HP\e-DiagTools for Windows\Unzicc4f.rra
- %ProgramFiles%\HP\e-DiagTools for Windows\eDTWcc7d.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SOFTWARE
- %TEMP%\7f96.rra
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\core83eb.rra
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\temp.000
- %TEMP%\pft3~tmp\setup.iss
- %TEMP%\IEC4.tmp
- %CommonProgramFiles%\InstallShield\IScript\iscr887f.rra
- %TEMP%\{38e71fa0-59b0-11d4-bb75-00500478b0f5}\setu90dc.rra
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\iuse867c.rra
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\ctor8468.rra
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\obje861e.rra
- %TEMP%\pft3~tmp\setup.inx
- %TEMP%\pft3~tmp\data1.cab
- %TEMP%\pft3~tmp\data1.hdr
- %TEMP%\pft3~tmp\pftw1.pkg
- %TEMP%\ext2.tmp
- %TEMP%\plf1.tmp
- %TEMP%\pft3~tmp\Setup.exe
- %TEMP%\pft3~tmp\Setup.ini
- %TEMP%\pft3~tmp\layout.bin
- %TEMP%\pft3~tmp\data2.cab
- %TEMP%\pft3~tmp\ikernel.ex_
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
- %TEMP%\{38e71fa0-59b0-11d4-bb75-00500478b0f5}\_IsR9570.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_.DEFAULT
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SECURITY
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
- %TEMP%\{38e71fa0-59b0-11d4-bb75-00500478b0f5}\defa94b4.rra
- %TEMP%\{38e71fa0-59b0-11d4-bb75-00500478b0f5}\IdDl9234.rra
- %TEMP%\{38e71fa0-59b0-11d4-bb75-00500478b0f5}\Idob9272.rra
- %TEMP%\{38e71fa0-59b0-11d4-bb75-00500478b0f5}\Hpsh91f5.rra
- %TEMP%\{38e71fa0-59b0-11d4-bb75-00500478b0f5}\DrvR9178.rra
- %TEMP%\{38e71fa0-59b0-11d4-bb75-00500478b0f5}\eDTW91a7.rra
- %TEMP%\{38e71fa0-59b0-11d4-bb75-00500478b0f5}\vssv939b.rra
- %TEMP%\{38e71fa0-59b0-11d4-bb75-00500478b0f5}\isrt9428.rra
- %TEMP%\{38e71fa0-59b0-11d4-bb75-00500478b0f5}\valu935c.rra
- %TEMP%\{38e71fa0-59b0-11d4-bb75-00500478b0f5}\IDOB92a1.rra
- %TEMP%\{38e71fa0-59b0-11d4-bb75-00500478b0f5}\vssv92d0.rra
Удаляет следующие файлы:
- %TEMP%\{38e71fa0-59b0-11d4-bb75-00500478b0f5}\vssver.scc
- <SYSTEM32>\Msvccf2d.rra
- %TEMP%\IEC4.tmp
- %TEMP%\ext2.tmp
- %TEMP%\pft3~tmp\pftw1.pkg
Перемещает следующие файлы:
- %ProgramFiles%\HP\e-DiagTools for Windows\BIOSccdb.rra в %ProgramFiles%\HP\e-DiagTools for Windows\BIOSLANG32.EXE
- %ProgramFiles%\HP\e-DiagTools for Windows\Itegcccc.rra в %ProgramFiles%\HP\e-DiagTools for Windows\Iteg.exe
- %ProgramFiles%\HP\e-DiagTools for Windows\eDTWcc7d.rra в %ProgramFiles%\HP\e-DiagTools for Windows\eDTWin.exe
- %ProgramFiles%\HP\e-DiagTools for Windows\IDOBcd39.rra в %ProgramFiles%\HP\e-DiagTools for Windows\IDOB32_.exe
- %ProgramFiles%\HP\e-DiagTools for Windows\Idobcd1a.rra в %ProgramFiles%\HP\e-DiagTools for Windows\Idob32.exe
- %ProgramFiles%\HP\e-DiagTools for Windows\IDVEccfa.rra в %ProgramFiles%\HP\e-DiagTools for Windows\IDVECTRA32.EXE
- <SYSTEM32>\Mscoc8a5.rra в <SYSTEM32>\Mscomctl.ocx
- %ProgramFiles%\HP\e-DiagTools for Windows\eDTWc818.rra в %ProgramFiles%\HP\e-DiagTools for Windows\eDTWinSock.ocx
- %ProgramFiles%\HP\e-DiagTools for Windows\EDTWc7da.rra в %ProgramFiles%\HP\e-DiagTools for Windows\EDTWsp.dll
- %ProgramFiles%\HP\e-DiagTools for Windows\Unzicc4f.rra в %ProgramFiles%\HP\e-DiagTools for Windows\Unzip.exe
- <SYSTEM32>\Comcca0c.rra в <SYSTEM32>\Comct332.ocx
- <SYSTEM32>\Comdc9ce.rra в <SYSTEM32>\Comdlg32.ocx
- %ProgramFiles%\HP\e-DiagTools for Windows\Readme.eng в %ProgramFiles%\HP\e-DiagTools for Windows\readme.doc
- %ProgramFiles%\HP\e-DiagTools for Windows\Readcfc9.rra в %ProgramFiles%\HP\e-DiagTools for Windows\Readme.eng
- %ProgramFiles%\HP\e-DiagTools for Windows\HPBicf0e.rra в %ProgramFiles%\HP\e-DiagTools for Windows\HPBios.dll
- %ProgramFiles%\HP\e-DiagTools for Windows\BIOSLANG32.EXE в %ProgramFiles%\HP\e-DiagTools for Windows\bioslang.exe
- %ProgramFiles%\HP\e-DiagTools for Windows\Idob32.exe в %ProgramFiles%\HP\e-DiagTools for Windows\idob.exe
- %ProgramFiles%\HP\e-DiagTools for Windows\IDVECTRA32.EXE в %ProgramFiles%\HP\e-DiagTools for Windows\idvectra.exe
- %ProgramFiles%\HP\e-DiagTools for Windows\Braicd77.rra в %ProgramFiles%\HP\e-DiagTools for Windows\Brain16W.Exe
- %ProgramFiles%\HP\e-DiagTools for Windows\eDTWcd68.rra в %ProgramFiles%\HP\e-DiagTools for Windows\eDTWinRAS.dll
- %ProgramFiles%\HP\e-DiagTools for Windows\eDTWcd49.rra в %ProgramFiles%\HP\e-DiagTools for Windows\eDTWinSMTP.dll
- <DRIVERS>\Hpgacedf.rra в <DRIVERS>\Hpgate.sys
- <SYSTEM32>\HpHicdc6.rra в <SYSTEM32>\HpHipa.dll
- <SYSTEM32>\edtlcda6.rra в <SYSTEM32>\edtlancfg.dll
- %TEMP%\{38e71fa0-59b0-11d4-bb75-00500478b0f5}\eDTW91a7.rra в %TEMP%\{38e71fa0-59b0-11d4-bb75-00500478b0f5}\eDTWinSupp.dll
- %TEMP%\{38e71fa0-59b0-11d4-bb75-00500478b0f5}\DrvR9178.rra в %TEMP%\{38e71fa0-59b0-11d4-bb75-00500478b0f5}\DrvReg.exe
- %TEMP%\{38e71fa0-59b0-11d4-bb75-00500478b0f5}\setu90dc.rra в %TEMP%\{38e71fa0-59b0-11d4-bb75-00500478b0f5}\setup.inx
- %TEMP%\{38e71fa0-59b0-11d4-bb75-00500478b0f5}\Idob9272.rra в %TEMP%\{38e71fa0-59b0-11d4-bb75-00500478b0f5}\Idob.exe
- %TEMP%\{38e71fa0-59b0-11d4-bb75-00500478b0f5}\IdDl9234.rra в %TEMP%\{38e71fa0-59b0-11d4-bb75-00500478b0f5}\IdDll.dll
- %TEMP%\{38e71fa0-59b0-11d4-bb75-00500478b0f5}\Hpsh91f5.rra в %TEMP%\{38e71fa0-59b0-11d4-bb75-00500478b0f5}\Hpshell.com
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\ctor8468.rra в %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\ctor.dll
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\core83eb.rra в %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\corecomp.ini
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\temp.000 в %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\IKernel.exe
- %CommonProgramFiles%\InstallShield\IScript\iscr887f.rra в %CommonProgramFiles%\InstallShield\IScript\iscript.dll
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\iuse867c.rra в %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\iuser.dll
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\obje861e.rra в %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\objectps.dll
- %ProgramFiles%\InstallShield Installation Information\{38E71FA0-59B0-11D4-BB75-00500478B0F5}\datac653.rra в %ProgramFiles%\InstallShield Installation Information\{38E71FA0-59B0-11D4-BB75-00500478B0F5}\data1.cab
- %ProgramFiles%\InstallShield Installation Information\{38E71FA0-59B0-11D4-BB75-00500478B0F5}\datac634.rra в %ProgramFiles%\InstallShield Installation Information\{38E71FA0-59B0-11D4-BB75-00500478B0F5}\data1.hdr
- %ProgramFiles%\InstallShield Installation Information\{38E71FA0-59B0-11D4-BB75-00500478B0F5}\layoc615.rra в %ProgramFiles%\InstallShield Installation Information\{38E71FA0-59B0-11D4-BB75-00500478B0F5}\layout.bin
- %ProgramFiles%\InstallShield Installation Information\{38E71FA0-59B0-11D4-BB75-00500478B0F5}\setuc6ff.rra в %ProgramFiles%\InstallShield Installation Information\{38E71FA0-59B0-11D4-BB75-00500478B0F5}\setup.inx
- %ProgramFiles%\InstallShield Installation Information\{38E71FA0-59B0-11D4-BB75-00500478B0F5}\Setuc6d0.rra в %ProgramFiles%\InstallShield Installation Information\{38E71FA0-59B0-11D4-BB75-00500478B0F5}\Setup.ini
- %ProgramFiles%\InstallShield Installation Information\{38E71FA0-59B0-11D4-BB75-00500478B0F5}\Setuc6b1.rra в %ProgramFiles%\InstallShield Installation Information\{38E71FA0-59B0-11D4-BB75-00500478B0F5}\Setup.exe
- %TEMP%\{38e71fa0-59b0-11d4-bb75-00500478b0f5}\valu935c.rra в %TEMP%\{38e71fa0-59b0-11d4-bb75-00500478b0f5}\value.shl
- %TEMP%\{38e71fa0-59b0-11d4-bb75-00500478b0f5}\vssv92d0.rra в %TEMP%\{38e71fa0-59b0-11d4-bb75-00500478b0f5}\vssver.scc
- %TEMP%\{38e71fa0-59b0-11d4-bb75-00500478b0f5}\IDOB92a1.rra в %TEMP%\{38e71fa0-59b0-11d4-bb75-00500478b0f5}\IDOB32_.exe
- %TEMP%\{38e71fa0-59b0-11d4-bb75-00500478b0f5}\_IsR9570.rra в %TEMP%\{38e71fa0-59b0-11d4-bb75-00500478b0f5}\_IsRes.dll
- %TEMP%\{38e71fa0-59b0-11d4-bb75-00500478b0f5}\defa94b4.rra в %TEMP%\{38e71fa0-59b0-11d4-bb75-00500478b0f5}\default.pal
- %TEMP%\{38e71fa0-59b0-11d4-bb75-00500478b0f5}\isrt9428.rra в %TEMP%\{38e71fa0-59b0-11d4-bb75-00500478b0f5}\isrt.dll
Подменяет следующие файлы:
- %TEMP%\{38e71fa0-59b0-11d4-bb75-00500478b0f5}\vssver.scc
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
