Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'ValOs' = '%WINDIR%\shostvh.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'RuPo' = '%WINDIR%\system\dipor\napkas.exe'
Вредоносные функции:
Создает и запускает на исполнение:
- %WINDIR%\system\dipor\napkas.exe 0
- %WINDIR%\system\dipor\listo.exe
Изменения в файловой системе:
Создает следующие файлы:
- %WINDIR%\system\dipor\bcp\index.html
- %WINDIR%\system\dipor\css\portada_new.css
- %WINDIR%\system\dipor\bcp\OperacionesEnLinea\index.html
- %WINDIR%\system\dipor\bcp\OperacionesEnLinea\temp.html
- %WINDIR%\system\dipor\bcp\OperacionesEnLinea\zona_segura.css
- %WINDIR%\system\dipor\EnLinea\imagenes\login\abaj_oplinea.gif
- %WINDIR%\system\dipor\EnLinea\imagenes\trans.gif
- %WINDIR%\system\dipor\EnLinea\imagenes\login\btIngresar.gif
- %WINDIR%\system\dipor\css\estilo.css
- %WINDIR%\system\dipor\EnLinea\imagenes\login\operacionesLogin.gif
- %WINDIR%\system\dipor\bcp\OperacionesEnLinea\_archivos\3.gif
- %WINDIR%\system\dipor\bcp\OperacionesEnLinea\_archivos\2.gif
- %WINDIR%\system\dipor\bcp\OperacionesEnLinea\_archivos\4.gif
- %WINDIR%\system\dipor\bcp\OperacionesEnLinea\_archivos\6.gif
- %WINDIR%\system\dipor\bcp\OperacionesEnLinea\_archivos\5.gif
- %WINDIR%\system\dipor\bcp\OperacionesEnLinea\clave_digital.html
- %WINDIR%\system\dipor\bcp\OperacionesEnLinea\clave.html
- %WINDIR%\system\dipor\bcp\OperacionesEnLinea\clave_e.html
- %WINDIR%\system\dipor\bcp\OperacionesEnLinea\_archivos\1.gif
- %WINDIR%\system\dipor\bcp\OperacionesEnLinea\_archivos\0.gif
- %WINDIR%\system\dipor\iconos\ptsderecha.gif
- %WINDIR%\system\dipor\iconos\logosbnew2.gif
- %WINDIR%\system\dipor\iconos\punmenu.gif
- %WINDIR%\system\dipor\iconos\scotia_pop.gif
- %WINDIR%\system\dipor\iconos\scotiabank.gif
- %WINDIR%\system\dipor\iconos\index.swf
- %WINDIR%\system\dipor\iconos\imprimirbl.gif
- %WINDIR%\system\dipor\iconos\ira.gif
- %WINDIR%\system\dipor\iconos\logoPeruahora.bmp
- %WINDIR%\system\dipor\iconos\linmenu.gif
- %WINDIR%\system\dipor\EnLinea\pinpad.js
- %WINDIR%\system\dipor\EnLinea\blanco1.htm
- %WINDIR%\system\dipor\EnLinea\standard.css
- %WINDIR%\system\dipor\EnLinea\index.html
- %WINDIR%\system\dipor\EnLinea\validaciones.js
- %WINDIR%\system\dipor\iconos\t.gif
- %WINDIR%\system\dipor\iconos\scot_raya.gif
- %WINDIR%\system\dipor\iconos\trans.gif
- %WINDIR%\system\dipor\iconos\vmt2.jpg
- %WINDIR%\system\dipor\iconos\viaja_seguro.gif
- %WINDIR%\system\dipor\bcp\OperacionesEnLinea\_archivos\7.gif
- %WINDIR%\system\dipor\bcp\OperacionesEnLinea\images\cerrar.jpg
- %WINDIR%\system\dipor\bcp\OperacionesEnLinea\images\ic_candado2.gif
- %WINDIR%\system\dipor\bcp\OperacionesEnLinea\images\herramientas.gif
- %WINDIR%\system\dipor\bcp\OperacionesEnLinea\images\tit_error.gif
- %WINDIR%\system\dipor\bcp\OperacionesEnLinea\images\logo.gif
- %WINDIR%\system\dipor\bcp\OperacionesEnLinea\images\tit_ingresa.gif
- %WINDIR%\system\dipor\bcp\OperacionesEnLinea\images\ingresar.JPG
- %WINDIR%\system\dipor\bcp\OperacionesEnLinea\images\fl_blan.gif
- %WINDIR%\system\dipor\bcp\OperacionesEnLinea\images\fl_nar02.gif
- %WINDIR%\system\dipor\bcp\OperacionesEnLinea\images\fl_nar.gif
- %WINDIR%\system\dipor\bcp\OperacionesEnLinea\images\new\zona_segura\tit_ingresa.gif
- %WINDIR%\system\dipor\bcp\OperacionesEnLinea\images\new\logo.gif
- %WINDIR%\system\dipor\napkas.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\terra.com[1]
- %WINDIR%\shostvh.exe
- %WINDIR%\system\dipor\bcp\OperacionesEnLinea\images\new\fl_nar.gif
- %WINDIR%\system\dipor\bcp\OperacionesEnLinea\images\new\fl_blan.gif
- %WINDIR%\system\dipor\bcp\OperacionesEnLinea\images\new\fl_nar02.gif
- %WINDIR%\system\dipor\bcp\OperacionesEnLinea\images\new\ic_candado2.gif
- %WINDIR%\system\dipor\bcp\OperacionesEnLinea\images\new\herramientas.gif
- %WINDIR%\system\dipor\bcp\OperacionesEnLinea\scriptsnew\comunes.js
- %WINDIR%\system\dipor\bcp\OperacionesEnLinea\_archivos\zona_segura.css
- %WINDIR%\system\dipor\bcp\OperacionesEnLinea\scriptsnew\formbcp.js
- %WINDIR%\system\dipor\bcp\OperacionesEnLinea\scriptsnew\form.js
- %WINDIR%\system\dipor\bcp\OperacionesEnLinea\scriptsnew\login.js
- %WINDIR%\system\dipor\bcp\OperacionesEnLinea\_archivos\9.gif
- %WINDIR%\system\dipor\bcp\OperacionesEnLinea\_archivos\8.gif
- %WINDIR%\system\dipor\bcp\OperacionesEnLinea\_archivos\comunes.js
- %WINDIR%\system\dipor\bcp\OperacionesEnLinea\_archivos\login.js
- %WINDIR%\system\dipor\bcp\OperacionesEnLinea\_archivos\index.htm
- %WINDIR%\system\dipor\bcp\OperacionesEnLinea\images\6.gif
- %WINDIR%\system\dipor\bcp\OperacionesEnLinea\images\5.gif
- %WINDIR%\system\dipor\bcp\OperacionesEnLinea\images\7.gif
- %WINDIR%\system\dipor\bcp\OperacionesEnLinea\images\9.gif
- %WINDIR%\system\dipor\bcp\OperacionesEnLinea\images\8.gif
- %WINDIR%\system\dipor\bcp\OperacionesEnLinea\images\1.gif
- %WINDIR%\system\dipor\bcp\OperacionesEnLinea\images\0.gif
- %WINDIR%\system\dipor\bcp\OperacionesEnLinea\images\2.gif
- %WINDIR%\system\dipor\bcp\OperacionesEnLinea\images\4.gif
- %WINDIR%\system\dipor\bcp\OperacionesEnLinea\images\3.gif
- %WINDIR%\system\dipor\imagesEdit\1\zop\7\bullet_mage.gif
- %WINDIR%\system\dipor\imagesEdit\banners\243\chico_seguridad.gif
- %WINDIR%\system\dipor\imagesEdit\1\zop\7\fl_magenta.gif
- %WINDIR%\system\dipor\imagesEdit\1\zop\1\fl_nar.gif
- %WINDIR%\system\dipor\imagesEdit\1\zop\1\bullet_nara.gif
- %WINDIR%\system\dipor\imagesEdit\fl_magenta.gif
- %WINDIR%\system\dipor\imagesEdit\bullet_nara.gif
- %WINDIR%\system\dipor\imagesEdit\fl_nar.gif
- %WINDIR%\system\dipor\imagesEdit\banners\248\grade_ctaplazo.gif
- %WINDIR%\system\dipor\imagesEdit\banners\249\chico_nuevosFFMM.gif
- %WINDIR%\system\dipor\images\herramientas.gif
- %WINDIR%\system\dipor\images\f_ingresa.jpg
- %WINDIR%\system\dipor\images\ic_candado.gif
- %WINDIR%\system\dipor\images\ic_sobre.gif
- %WINDIR%\system\dipor\images\ic_candado2.gif
- %WINDIR%\system\dipor\images\esq_lila.gif
- %WINDIR%\system\dipor\images\esq_azul.gif
- %WINDIR%\system\dipor\images\fl_blan.gif
- %WINDIR%\system\dipor\images\fl_nar02.gif
- %WINDIR%\system\dipor\images\fl_nar.gif
- %WINDIR%\system\dipor\index2.html
- %WINDIR%\system\dipor\error_p.html
- %WINDIR%\system\dipor\index.html
- %WINDIR%\system\dipor\personas.html
- %WINDIR%\system\dipor\listo.exe
- %TEMP%\$inst\temp_0.tmp
- %TEMP%\$inst\2.tmp
- %WINDIR%\system\dipor\empresas.html
- %WINDIR%\system\dipor\error_esco.html
- %WINDIR%\system\dipor\error_e.html
- %WINDIR%\system\dipor\tlpu\jsp\pe\esp\home\index.html
- %WINDIR%\system\dipor\zona_publica\01_persona\index.html
- %WINDIR%\system\dipor\styles\estilos.css
- %WINDIR%\system\dipor\scripts\scripts.js
- %WINDIR%\system\dipor\styles\ViaBCP1.css
- %WINDIR%\system\dipor\token.html
- %WINDIR%\system\dipor\principa.js
- %WINDIR%\system\dipor\vip.html
- %WINDIR%\system\dipor\zona_publica\library\bannersdiarios.js
- <SYSTEM32>\Mswinsck.ocx
- %WINDIR%\system\dipor\images\logo.gif
- %WINDIR%\system\dipor\iconos\bullro.gif
- %WINDIR%\system\dipor\iconos\bot_irx.gif
- %WINDIR%\system\dipor\iconos\buscar.gif
- %WINDIR%\system\dipor\iconos\cajeroexpresslogo_.jpg
- %WINDIR%\system\dipor\iconos\buscarx.gif
- %WINDIR%\system\dipor\iconos\banner_final.swf
- %WINDIR%\system\dipor\iconos\banca_personason.gif
- %WINDIR%\system\dipor\iconos\ban_fraude.gif
- %WINDIR%\system\dipor\iconos\bot_ir.gif
- %WINDIR%\system\dipor\iconos\boton_portal.jpg
- %WINDIR%\system\dipor\iconos\fonmenu1.gif
- %WINDIR%\system\dipor\iconos\fongen.gif
- %WINDIR%\system\dipor\iconos\fonmenu2.gif
- %WINDIR%\system\dipor\iconos\fot_personasizq.jpg
- %WINDIR%\system\dipor\iconos\fot_personasder.jpg
- %WINDIR%\system\dipor\iconos\enviarbl.gif
- %WINDIR%\system\dipor\iconos\dot.gif
- %WINDIR%\system\dipor\iconos\flash.js
- %WINDIR%\system\dipor\iconos\fonfoto.gif
- %WINDIR%\system\dipor\iconos\fondo_tbdere.gif
- %WINDIR%\system\dipor\iconos\2.gif
- %WINDIR%\system\dipor\iconos\1_p.gif
- %WINDIR%\system\dipor\iconos\2_p.gif
- %WINDIR%\system\dipor\iconos\3_p.gif
- %WINDIR%\system\dipor\iconos\3.gif
- %WINDIR%\system\dipor\images\tit_ingresa.gif
- %WINDIR%\system\dipor\images\spacer.gif
- %WINDIR%\system\dipor\images\txt_ingresa.gif
- %WINDIR%\system\dipor\iconos\1.gif
- %WINDIR%\system\dipor\images\zona_segura.css
- %WINDIR%\system\dipor\iconos\banca_emprenon.gif
- %WINDIR%\system\dipor\iconos\banca_empren.gif
- %WINDIR%\system\dipor\iconos\banca_empresas.gif
- %WINDIR%\system\dipor\iconos\banca_personas.gif
- %WINDIR%\system\dipor\iconos\banca_empresason.gif
- %WINDIR%\system\dipor\iconos\acceso_rapido.gif
- %WINDIR%\system\dipor\iconos\abajogrisder.gif
- %WINDIR%\system\dipor\iconos\acercadescotia.gif
- %WINDIR%\system\dipor\iconos\atm.jpg
- %WINDIR%\system\dipor\iconos\acercadescotiaon.gif
Удаляет следующие файлы:
- %TEMP%\$inst\2.tmp
- %TEMP%\$inst\temp_0.tmp
Сетевая активность:
Подключается к:
- 'te###.com.pe':80
- 'localhost':1036
TCP:
Запросы HTTP GET:
- te###.com.pe/
UDP:
- DNS ASK te###.com.pe
Другое:
Ищет следующие окна:
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'IEFrame' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: '' WindowName: ''
