Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Crypted' = 'wscript.exe //B "%TEMP%\Crypted.vbs"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Crypted' = 'wscript.exe //B "%TEMP%\Crypted.vbs"'
Создает или изменяет следующие файлы:
- %HOMEPATH%\Start Menu\Programs\Startup\Crypted.vbs
Создает следующие файлы на съемном носителе:
- <Имя диска съемного носителя>:\Crypted.vbs
Вредоносные функции:
Создает и запускает на исполнение:
- '%TEMP%\ir_ext_temp_0\autorun.exe' "SFXSOURCE:%PROGRAM_FILES%\Algerian Newspapers.exe"
- '%PROGRAM_FILES%\Algerian Newspapers.exe'
Запускает на исполнение:
- '<SYSTEM32>\wscript.exe' //B "%TEMP%\Crypted.vbs"
- '<SYSTEM32>\wscript.exe' "%WINDIR%\Crypted.vbs"
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\logo1.PNG
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\logo_liberte_algerie.gif
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\logoblue_1.jpg
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\logo-aps-ar.png
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\logo_lebuteur.gif
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\logo_2.gif
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\logo.png
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\logo_edit_493367128.jpg
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\logo_3.png
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\еЦЎнђ-„Ў‘Ў‘Ґб-ТЂЎЖг.jpg
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\official_1.jpg
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\pdf.jpg
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\oldpics_logo-Soir_963806599.gif
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\miror-uk.jpg
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\logo-liberation-150.png
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\logoGF.png
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\mainpicture.jpg
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\logo-original1.png
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\logo.gif
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\large_news_le-monde.jpg
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\la-depeche-de-la-kabylie.jpg
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\le-jour.jpg
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\le-financier.jpg
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\jhyhj.bmp
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\independent_masthead.png
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\images.jpg
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\infosoir-logo_2.gif
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\independent-uk.jpg
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\logo (1)j.gif
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\Logo (1)_1.png
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\logo (3).png
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\logo (2).png
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\Logo (1).png
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\le-temps-d-algerie_1.jpg
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\le-midi-libre.jpg
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\loggfh.png
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\lnr_logo.png
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\PicsArt_1371689365726.jpg
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\twitter-icon_tcm313-225549.png
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\tsa-algerie-logo.png
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\wdf.gif
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\une01PT.jpg
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\top1.png
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\titre_4667649.png
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\Thumbs.db
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\top_header.jpg
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\titre_4855232.png
- %TEMP%\ir_ext_temp_0\autorun.exe
- %TEMP%\ir_ext_temp_0\AutoPlay\Videos\Thumbs.db
- %TEMP%\ir_ext_temp_0\lua51.dll
- %TEMP%\ir_ext_temp_0\lua5.1.dll
- %TEMP%\ir_ext_temp_0\AutoPlay\Plugins\Vista.cjstyles
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\webl0006_1.jpg
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\webl0002_1.jpg
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\webl0010_1.jpg
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\webl0009.jpg
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\start_now.png
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\PicsArt_1371946298591.jpg
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\PicsArt_1371946142610.jpg
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\s5_logo.png
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\rfg.png
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\PicsArt_1371946089289.jpg
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\PicsArt_1371689448230.jpg
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\PicsArt_1371689400279.jpg
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\PicsArt_1371945958501.jpg
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\PicsArt_1371689578702.jpg
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\Screen Capture #007.png
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\Screen Capture #006.png
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\sot-alahrar.jpg
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\siteon0.jpg
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\Screen Capture #005.png
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\Sans titrettt.bmp
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\Sans titre.JPG
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\Screen Capture #003.png
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\Screen Capture #002_1.png
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\20-06.jpg
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\18-10-Une-Algerie.jpg
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\2125_3226_128_exit_power_quit_icon.png
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\200px-Almodjahid.jpg
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\11949844171677658659newspaper_aubanel_monnie_01.svg.hi.png
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\%D8%AC%D8%B1%D9%8A%D8%AF%D8%A9_%D8%B5%D9%88%D8%AA_%D8%A7%D9%84%D8%A3%D8%AD%D8%B1%D8%A7%D8%B1.gif
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\%20%D8%AA%D9%84%D8%BA%D8%B1%D8%A7%D9%81.jpg
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\1.PNG
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\068192.jpg
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\akhersaa.jpg
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\ ‘нЎкЂҐ‘-300x224.jpg
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\albilad.jpg
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\al%20fadjr.JPG
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\983950_178307648998389_1624951247_n.png
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\74640755.png
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\630_1.png
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\98.jpg
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\74640755_6.png
- %TEMP%\ir_ext_temp_0\AutoPlay\Icons\Thumbs.db
- %TEMP%\ir_ext_temp_0\11949844171677658659newspaper_aubanel_monnie_01.svg.hi.ico
- %PROGRAM_FILES%\Fathi Zidan\Algerian newspapers\Uninstall.ini
- %TEMP%\ir_ext_temp_0\AutoPlay\Audio\High1.ogg
- %TEMP%\ir_ext_temp_0\AutoPlay\Audio\Click1.ogg
- %PROGRAM_FILES%\Fathi Zidan\Algerian newspapers\Uninstall.exe
- %TEMP%\$inst\temp_0.tmp
- %TEMP%\$inst\2.tmp
- %PROGRAM_FILES%\Algerian Newspapers.exe
- %WINDIR%\Crypted.vbs
- %TEMP%\ir_ext_temp_0\AutoPlay\Flash\horloge live1.swf
- %TEMP%\ir_ext_temp_0\AutoPlay\Buttons\1044_0050.btn
- %TEMP%\ir_ext_temp_0\AutoPlay\Icons\11949844171677658659newspaper_aubanel_monnie_01.svg.hi.ico
- %TEMP%\ir_ext_temp_0\AutoPlay\Flash\Untitled_21.swf
- %TEMP%\ir_ext_temp_0\AutoPlay\Buttons\0004-luna.btn
- %TEMP%\ir_ext_temp_0\AutoPlay\Buttons\0001-windows-7.btn
- %TEMP%\ir_ext_temp_0\AutoPlay\autorun.cdd
- %TEMP%\ir_ext_temp_0\AutoPlay\Buttons\0003-office-2007.btn
- %TEMP%\ir_ext_temp_0\AutoPlay\Buttons\0002-royale.btn
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\alseyassi_07.gif
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\gfwjhie2415.jpg
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\g.gif
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\Go_Forward_Icon.png
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\gh.jpg
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\files.png
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\expression.jpg
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\ENNAHAR_LOGO_SOL1_108750270.jpg
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\fhdf.png
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\facebook_icon.1287526277.png
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\Home.png
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\hf.bmp
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\images (1).jpg
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\IconsLandVistaElementsIconsDemo-PNG-256x256-InfoBox.png-256x256.png
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\header_1.jpg
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\Guardian_Logo-250x175.jpg
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\Go_Forward_Icon_1.png
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\header.png
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\header.jpg
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\elwatan_3.jpg
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\customLogo.png
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\Courrier-logo2.jpg
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\DK-news.png
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\df.png
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\coollogo_com-2172110440.png
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\bn_1.bmp
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\annasr.jpg
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\competition-logo.png
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\Ђ ЖаЂҐ.JPG
- %TEMP%\Crypted.vbs
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\elkhabar.jpg
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\elmassa28032010.jpg
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\elkhabar-sport_1.jpg
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\eldjoumhouria.png
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\echo-d-oran.jpg
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\echaab.jpg
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\El_Acil.jpg
- %TEMP%\ir_ext_temp_0\AutoPlay\Images\echourouk.jpg
Присваивает атрибут 'скрытый' для следующих файлов:
- <Имя диска съемного носителя>:\Crypted.vbs
Удаляет следующие файлы:
- %TEMP%\$inst\2.tmp
- %TEMP%\$inst\temp_0.tmp
Сетевая активность:
Подключается к:
- 'sk####r2.no-ip.biz':1990
- 'localhost':1038
UDP:
- DNS ASK sk####r2.no-ip.biz
Другое:
Ищет следующие окна:
- ClassName: 'Indicator' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
