Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '957511d6476679a.exe' = '<LS_APPDATA>\957511d6476679a.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\4ff9e275aa5aaf57] 'Start' = '00000000'
- [<HKLM>\SYSTEM\ControlSet001\Services\4ff9e275aa5aaf57] 'ImagePath' = '<DRIVERS>\4ff9e275aa5aaf57.sys'
- [<HKLM>\SYSTEM\ControlSet001\Services\22793] 'Start' = '00000001'
Вредоносные функции:
Создает и запускает на исполнение:
- <LS_APPDATA>\957511d6476679a.exe
Перехватывает следующие функции в SSDT (System Service Descriptor Table):
- NtOpenThread, драйвер-обработчик: unknown
- NtOpenProcess, драйвер-обработчик: unknown
Изменения в файловой системе:
Создает следующие файлы:
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\updatenow_back[1].png
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\calendar[1].png
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\recommendation_back[1].png
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\box100_back[1].png
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\enable_button[1].png
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\process_bar[1].png
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\apply_button[1].png
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\process_button[1].png
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\table_header[1].png
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\process_back[1].png
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\menu_proactive_defence[1].png
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\menu_firewall[1].png
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\menu_personal_security[1].png
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\menu_perform_scan[1].png
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\menu_internet_security[1].png
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\red_arrow_back[1].png
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\check_off_blue[1].png
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\hr_back[1].png
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\menu_configuration[1].png
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\header_button[1].png
- %TEMP%\VGX7.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\red_arrow_back[1].png
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\menu_configuration[1].png
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\menu_firewall[1].png
- %TEMP%\VGX6.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\orange_icon[1].png
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\red_icon[1].png
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\table_row_back[1].png
- %TEMP%\VGX8.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\leftmenu_back_h[1].png
- %TEMP%\VGX2.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\menu_internet_security[1].png
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\menu_perform_scan[1].png
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\menu_main[2].png
- %TEMP%\VGX1.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\menu_proactive_defence[1].png
- %TEMP%\VGX5.tmp
- %TEMP%\VGX4.tmp
- %TEMP%\VGX3.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\menu_personal_security[1].png
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\14[1].html
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\DD_belatedPNG[1].js
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\base.reg[1].css
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\13[1].html
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\base.reset[1].css
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\base.reset[1].css
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\base.alert[1].css
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\base.reset[1].css
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\base.index[1].css
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\scripts[1].js
- %HOMEPATH%\Start Menu\Programs\Windows Security System\Launch Windows Security System.lnk
- %HOMEPATH%\Start Menu\Programs\Windows Security System\Buy Windows Security System.lnk
- <DRIVERS>\4ff9e275aa5aaf57.sys
- <LS_APPDATA>\957511d6476679a.exe
- <DRIVERS>\22793.sys
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\alert_danger[1].html
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\serial[1].html
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\alert_reg[1].html
- %HOMEPATH%\Desktop\Buy Windows Security System.lnk
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\index[1].html
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\redcross_list[1].png
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\hralert_back[1].png
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\redalert_back[1].png
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\greenalert_back[1].png
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\alert_button[1].png
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\background[1].png
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\menu_main[1].png
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\l_t_bl[1].gif
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\keys[1].png
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\alert_button[2].png
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\style[1].css
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\l_t_bl[1].gif
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\style[2].css
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\DD_belatedPNG[1].js
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\style[1].css
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\r_b_bl[1].gif
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\greencheck_list[1].png
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\l_b_bl[1].gif
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\r_t_bl[1].gif
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\cr[1].jpg
Удаляет следующие файлы:
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\menu_personal_security[1].png
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\menu_proactive_defence[1].png
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\menu_internet_security[1].png
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\menu_main[1].png
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\menu_perform_scan[1].png
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\calendar[1].png
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\red_arrow_back[1].png
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\red_arrow_back[1].png
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\menu_firewall[1].png
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\menu_configuration[1].png
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\DD_belatedPNG[1].js
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\style[1].css
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\DD_belatedPNG[1].js
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\base.reset[1].css
- <DRIVERS>\22793.sys
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\base.reset[1].css
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\l_t_bl[1].gif
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\l_t_bl[1].gif
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\alert_button[1].png
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\style[2].css
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\greenalert_back[1].png
Самоперемещается:
- из <Полный путь к вирусу> в %TEMP%\77c16373.tmp
Самоудаляется.
Сетевая активность:
Подключается к:
- 'localhost':1039
- 'localhost':1040
- 'wi##sss.com':80
TCP:
Запросы HTTP GET:
- wi##sss.com/update.php?ve###
UDP:
- DNS ASK wi##sss.com
Другое:
Ищет следующие окна:
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'wscui_class' WindowName: 'Windows Security Center'
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'Indicator' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
