Техническая информация
Вредоносные функции:
Создает и запускает на исполнение:
- %WINDIR%\Temp\spoolsv.exe /c 1.bat
Запускает на исполнение:
- <SYSTEM32>\xcopy.exe smss_cz smss.exe /h /r /c /k /y
- <SYSTEM32>\xcopy.exe spoolsv_cz spoolsv.exe /h /r /c /k /y
- <SYSTEM32>\xcopy.exe svchost_cz svchost.exe /h /r /c /k /y
- <SYSTEM32>\xcopy.exe mssearch_cz mssearch.exe /h /r /c /k /y
- <SYSTEM32>\xcopy.exe csrss_cz csrss.exe /h /r /c /k /y
- <SYSTEM32>\xcopy.exe explorer_cz explorer.exe /h /r /c /k /y
- <SYSTEM32>\xcopy.exe lsuss_cz lsuss.exe /h /r /c /k /y
- <SYSTEM32>\cscript.exe //nologo "%TEMP%\_ST0101_.VBS"
- <SYSTEM32>\cmd.exe /c ""%WINDIR%\temp\stop.bat" "
- <SYSTEM32>\wscript.exe "%WINDIR%\temp\1_.vbs"
- <SYSTEM32>\xcopy.exe svchost._cz svchost..exe /h /r /c /k /y
- <SYSTEM32>\xcopy.exe taskmgr_cz taskmgr.exe /h /r /c /k /y
- <SYSTEM32>\xcopy.exe userinit_cz userinit.exe /h /r /c /k /y
- <SYSTEM32>\xcopy.exe wuauclt_cz wuauclt.exe /h /r /c /k /y
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\_ST0101_.VBS
- %WINDIR%\Temp\wuauclt_cz
- %WINDIR%\Temp\wuauclt.exe
- %WINDIR%\Temp\svchost..exe
- %WINDIR%\Temp\userinit_cz
- %WINDIR%\Temp\svchost_cz
- %WINDIR%\Temp\svchost._cz
- %WINDIR%\Temp\url.sys
- %WINDIR%\Temp\taskmgr_cz
- %WINDIR%\Temp\lsuss.exe
- %WINDIR%\Temp\mssearch.exe
- %WINDIR%\Temp\csrss.exe
- %WINDIR%\Temp\explorer.exe
- %WINDIR%\Temp\smss.exe
- %WINDIR%\Temp\taskmgr.exe
- %WINDIR%\Temp\userinit.exe
- %WINDIR%\Temp\spoolsv.exe
- %WINDIR%\Temp\svchost.exe
- %WINDIR%\Temp\1_.vbs
- %WINDIR%\Temp\SQL.BAT
- %WINDIR%\Temp\_tmp_
- %WINDIR%\Temp\_sqlup_
- %WINDIR%\Temp\MS.BAT
- %WINDIR%\Temp\STOP.BAT
- %WINDIR%\Temp\_p_
- %WINDIR%\Temp\LST.BAT
- %WINDIR%\Temp\1.BAT
- %WINDIR%\Temp\ntwdblib.dll
- %WINDIR%\Temp\mssearch_cz
- %WINDIR%\Temp\spoolsv_cz
- %WINDIR%\Temp\smss_cz
- %WINDIR%\Temp\lsuss_cz
- %WINDIR%\Temp\dbnmpntw.dll
- %WINDIR%\Temp\csrss_cz
- %WINDIR%\Temp\explorer_cz
- %WINDIR%\Temp\desktop.ini
Присваивает атрибут 'скрытый' для следующих файлов:
- %WINDIR%\Temp\ntwdblib.dll
- %WINDIR%\Temp\smss_cz
- %WINDIR%\Temp\spoolsv_cz
- %WINDIR%\Temp\explorer_cz
- %WINDIR%\Temp\lsuss_cz
- %WINDIR%\Temp\mssearch_cz
- %WINDIR%\Temp\url.sys
- %WINDIR%\Temp\userinit_cz
- %WINDIR%\Temp\wuauclt_cz
- %WINDIR%\Temp\svchost._cz
- %WINDIR%\Temp\svchost_cz
- %WINDIR%\Temp\taskmgr_cz
- %WINDIR%\Temp\LST.BAT
- %WINDIR%\Temp\MS.BAT
- %WINDIR%\Temp\SQL.BAT
- %WINDIR%\Temp\_p_
- %WINDIR%\Temp\STOP.BAT
- %WINDIR%\Temp\1.BAT
- %WINDIR%\Temp\csrss_cz
- %WINDIR%\Temp\dbnmpntw.dll
- %WINDIR%\Temp\desktop.ini
- %WINDIR%\Temp\1_.vbs
- %WINDIR%\Temp\_sqlup_
- %WINDIR%\Temp\_tmp_
Удаляет следующие файлы:
- %WINDIR%\Temp\svchost_cz
- %WINDIR%\Temp\svchost._cz
- %WINDIR%\Temp\spoolsv_cz
- %WINDIR%\Temp\wuauclt_cz
- %WINDIR%\Temp\userinit_cz
- %WINDIR%\Temp\taskmgr_cz
- %WINDIR%\Temp\explorer_cz
- %WINDIR%\Temp\csrss_cz
- %TEMP%\_ST0101_.VBS
- %WINDIR%\Temp\smss_cz
- %WINDIR%\Temp\mssearch_cz
- %WINDIR%\Temp\lsuss_cz
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
