Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'SunJavaUpdateSched.1' = '<Полный путь к вирусу>'
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\netsh.exe' firewall add portopening protocol = ALL port = 3309 name = SqlServers mode = ENABLE scope = ALL profile = ALL
- '<SYSTEM32>\netsh.exe' firewall add portopening protocol = TCP port = 25 name = Smtp mode = ENABLE scope = ALL profile = ALL
- '<SYSTEM32>\netsh.exe' firewall add allowedprogram program = <DRIVERS>\<Имя вируса>.exe name = \<Имя вируса>.exe mode = ENABLE scope = ALL profile = ALL
- '<SYSTEM32>\netsh.exe' firewall add allowedprogram program = <DRIVERS>\Descompacx.exe name = \Descompacx.exe mode = ENABLE scope = ALL profile = ALL
Изменения в файловой системе:
Создает следующие файлы:
- <DRIVERS>\Milks
- <DRIVERS>\BoxFile.bcc
Сетевая активность:
Подключается к:
- 'localhost':3309
- 'www.go###e.com.br':80
- 'www.mo#######belo.liveupdate.com.br':80
TCP:
Запросы HTTP GET:
- www.mo#######belo.liveupdate.com.br/caixinha.jpg
UDP:
- DNS ASK www.go###e.com.br
- DNS ASK www.mo#######belo.liveupdate.com.br
Другое:
Ищет следующие окна:
- ClassName: '(null)' WindowName: 'Banco Ita? - Feito Para Voc? - Microsoft Internet Explorer'
- ClassName: '(null)' WindowName: 'Internet Banking - Windows Internet Explorer'
- ClassName: '(null)' WindowName: 'https://www.santandernet.com.br - Internet Banking - Microsoft Internet Explorer'
- ClassName: '(null)' WindowName: 'Banco Ita? - Feito Para Voc? - Windows Internet Explorer'
- ClassName: '(null)' WindowName: 'Meu HSBC - HSBC Bank Brasil S.A. - Mozilla Firefox'
- ClassName: '(null)' WindowName: '30 Horas - Windows Internet Explorer'
- ClassName: '(null)' WindowName: '30 Horas - Microsoft Internet Explorer'
- ClassName: '(null)' WindowName: 'https://bradesconetempresa.com.br - Bradesco Net Empresa - Microsoft Internet Explorer'
- ClassName: '(null)' WindowName: 'Serasa Experian - Consulta Serasa, Cheque, CPF, CNPJ, Cr?dito e Certificado Digital - Microsoft Internet Explorer'
- ClassName: '(null)' WindowName: 'Serasa Experian - Consulta Serasa, Cheque, CPF, CNPJ, Cr?dito e Certificado Digital - Windows Internet Explorer'
- ClassName: '(null)' WindowName: 'Bradesco Net Empresa - Windows Internet Explorer'
- ClassName: '(null)' WindowName: 'https://netbanking2.banespa.com.br - Internet Banking - Microsoft Internet Explorer'
- ClassName: '(null)' WindowName: 'https://www.santandernet.com.br - Internet Banking - Mozilla Firefox'
- ClassName: '(null)' WindowName: 'https://netbanking2.banespa.com.br - Internet Banking - Mozilla Firefox'
- ClassName: '(null)' WindowName: 'https://wwwss.bradesco.com.br - Banco Bradesco S/A - Mozilla Firefox'
- ClassName: '(null)' WindowName: 'https://wwwss.bradesco.com.br - Bradesco Internet Banking - Mozilla Firefox'
- ClassName: '(null)' WindowName: 'Banco Bradesco S/A - Windows Internet Explorer'
- ClassName: '(null)' WindowName: 'https://wwwss.bradesco.com.br - Bradesco S/A - Mozilla Firefox'
- ClassName: 'Indicator' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: '(null)' WindowName: '$$$|*u3\V=_0A--29kyASrtyM,Cd.;/?KA9|712|aj923|$$$'
- ClassName: '(null)' WindowName: 'https://wwwss.bradesco.com.br - Bradesco Internet Banking - Microsoft Internet Explorer'
- ClassName: '(null)' WindowName: 'Meu HSBC - HSBC Bank Brasil S.A. - Windows Internet Explorer'
- ClassName: '(null)' WindowName: 'Meu HSBC - HSBC Bank Brasil S.A. - Microsoft Internet Explorer'
- ClassName: '(null)' WindowName: 'https://wwwss.bradesco.com.br - Banco Bradesco S/A - Microsoft Internet Explorer'
- ClassName: '(null)' WindowName: 'Bradesco S/A - Windows Internet Explorer'
- ClassName: '(null)' WindowName: 'Bradesco Internet Banking - Windows Internet Explorer'
- ClassName: '(null)' WindowName: 'https://wwwss.bradesco.com.br - Bradesco S/A - Microsoft Internet Explorer'
