Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Skype' = '"%APPDATA%\Skype\Phone\Skype.exe" /nosplash /minimized'
Вредоносные функции:
Создает и запускает на исполнение:
- %TEMP%\7365.exe
- %TEMP%\5168.exe
Запускает на исполнение:
- <SYSTEM32>\systeminfo.exe
Изменения в файловой системе:
Создает следующие файлы:
- %APPDATA%\Skype\Phone\Skype.exe
- %TEMP%\7365.exe
- %TEMP%\bm3.tmp
- %TEMP%\nsb2.tmp
- %TEMP%\5168.exe
- %APPDATA%\Microsoft\Sze\hqhmp
Удаляет следующие файлы:
- %TEMP%\5168.exe
Другое:
Ищет следующие окна:
- ClassName: ' rid=%s Wait use erries, 1 - det %f ' WindowName: ' rid=%s Wait use erries, 1 - det %f '
- ClassName: 'STALL_CAL_SW_OFF' WindowName: 'FinalPowerDown by Reneg Noise'
- ClassName: 'FinalPowerDown by Reneg Noise' WindowName: 'FinalPowerDown by Reneg Noise'
- ClassName: 'pRing Adapterface Notified ->%f dB' WindowName: 'm_TxAgcFactiverror V.90: %f (Negations Enablem not Userve_over'
- ClassName: 'ireconnel = %f' WindowName: 'm_StationPends due INFO '
- ClassName: 'pRing Adapterface Notified ->%f dB' WindowName: 'RCV_ERROR: Sends Deact net Driver'
- ClassName: 'IKMON_RSNA_INVALID_SUSPEN_EXCEEDED_LIMITTED' WindowName: 'ROAM_EV_MMAC_BEFORMANAGER_NOT_ADDRESHORT_UNEXPIRED'
- ClassName: 'm_TxAgcFactiverror V.90: %f (Negations Enablem not Userve_over' WindowName: 'Amos::dpSessage formDisable 0x%X ==> Statellation ( 1Sect'
- ClassName: 'EV_HMAC_AC_CHEDUCE_NO_STATUS' WindowName: 'EV_HMAC_AC_CHEDUCE_NO_STATUS'
- ClassName: 'The retrainstall' WindowName: ' Type=%u'
- ClassName: 'nvgart of morePrectiversion Bias: %d' WindowName: 'IKMON_RSNA_INVALID_SUSPEN_EXCEEDED_LIMITTED'
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'FinalPowerDown by Reneg Noise' WindowName: ' Type=%u'
- ClassName: 'm_StationPends due INFO ' WindowName: 'Amos::dpSetrate %d inding shold %d'
- ClassName: 'Amos::dpSetrate %d inding shold %d' WindowName: 'Amos::dpSetrate %d inding shold %d'
- ClassName: 'STALL_CAL_SW_OFF' WindowName: 'm_TxAgcFactiverror V.90: %f (Negations Enablem not Userve_over'
- ClassName: 'm_TxAgcFactiverror V.90: %f (Negations Enablem not Userve_over' WindowName: 'FinalPowerDown by Reneg Noise'
- ClassName: 'WdfFdoQueryShutdown' WindowName: 'RJPNULL'
- ClassName: 'SHADOW_INFPath}\{Current %d' WindowName: 'RJPNULL'
- ClassName: 'h2 = %f' WindowName: 'Tx-Rx Call'
- ClassName: 'Enternal Filter evel {sysdir}\{Currents' WindowName: 'RegDown convOut of ration '
- ClassName: 'On type configuration ' WindowName: 'On type configuration '
- ClassName: 'Enternal Filter evel {sysdir}\{Currents' WindowName: 'kernel'
- ClassName: 'Initoring Libration (need: invalization' WindowName: 'Tx-Rx Call'
- ClassName: 'Initoring Libration (need: invalization' WindowName: 'Initoring Libration (need: invalization'
- ClassName: 'Iller/Rx/Mse %d' WindowName: 'The carrier'
- ClassName: 'm_StationPends due INFO ' WindowName: 'FinalPowerDown by Reneg Noise'
- ClassName: 'ManageType->Disabled dB' WindowName: 'EV_HMAC_AC_CHEDUCE_NO_STATUS'
- ClassName: 'ManageType->Disabled dB' WindowName: 'm_StationPends due INFO '
- ClassName: 'RCV_ERROR: Sends Deact net Driver' WindowName: 'Amos::dpSessage formDisable 0x%X ==> Statellation ( 1Sect'
- ClassName: 'Indicator' WindowName: ''
- ClassName: 'Ignoring strue/fall' WindowName: 'Ignoring strue/fall'
- ClassName: 'pRing Adapterface Notified ->%f dB' WindowName: ' Type=%u'
- ClassName: 'pRing Adapterface Notified ->%f dB' WindowName: 'EV_HMAC_AC_CHEDUCE_NO_STATUS'
