Техническая информация
Вредоносные функции:
Создает и запускает на исполнение:
- 'C:\tmp\del.exe' /pid=3332
- 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "C:\Documents and Settings\Default User\Templates\winword2.doc.RaR" "C:\Documents and Settings\Default User\Templates\winword2.doc"
- 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%APPDATA%\Microsoft\Internet Explorer\brndlog.txt.RaR" "%APPDATA%\Microsoft\Internet Explorer\brndlog.txt"
- 'C:\tmp\Rar.exe'
- 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "C:\Documents and Settings\Default User\Templates\excel4.xls.RaR" "C:\Documents and Settings\Default User\Templates\excel4.xls"
- 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "C:\Documents and Settings\Default User\Templates\powerpnt.ppt.RaR" "C:\Documents and Settings\Default User\Templates\powerpnt.ppt"
- 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "C:\Documents and Settings\Default User\Templates\winword.doc.RaR" "C:\Documents and Settings\Default User\Templates\winword.doc"
- 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "<LS_APPDATA>\Microsoft\Windows Media\9.0\WMSDKNS.XML.RaR" "<LS_APPDATA>\Microsoft\Windows Media\9.0\WMSDKNS.XML"
- 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "C:\Far2\Addons\README.TXT.RaR" "C:\Far2\Addons\README.TXT"
- 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "C:\Far2\Documentation\eng\Arc.Support.txt.RaR" "C:\Far2\Documentation\eng\Arc.Support.txt"
- 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "C:\Far2\Documentation\eng\Bug.Report.txt.RaR" "C:\Far2\Documentation\eng\Bug.Report.txt"
- 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%HOMEPATH%\Templates\winword.doc.RaR" "%HOMEPATH%\Templates\winword.doc"
- 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%HOMEPATH%\Templates\excel.xls.RaR" "%HOMEPATH%\Templates\excel.xls"
- 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%HOMEPATH%\Templates\excel4.xls.RaR" "%HOMEPATH%\Templates\excel4.xls"
- 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%HOMEPATH%\Templates\powerpnt.ppt.RaR" "%HOMEPATH%\Templates\powerpnt.ppt"
- 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "C:\Documents and Settings\Default User\Templates\excel.xls.RaR" "C:\Documents and Settings\Default User\Templates\excel.xls"
- 'C:\tmp\ss.exe'
- 'C:\tmp\moar.exe'
- 'C:\tmp\ssencrypt.exe' public.key kii.hiew
- 'C:\tmp\mouse.exe'
- 'C:\tmp\push.exe'
- 'C:\tmp\error.exe'
- 'C:\tmp\bbs.exe'
- 'C:\tmp\fidonet.exe'
- 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Winter.jpg.RaR" "%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Winter.jpg"
- 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\brndlog.txt.RaR" "C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\brndlog.txt"
- 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\WMSDKNS.XML.RaR" "C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\WMSDKNS.XML"
- 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Water lilies.jpg.RaR" "%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Water lilies.jpg"
- 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Blue hills.jpg.RaR" "%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Blue hills.jpg"
- 'C:\tmp\del.exe'
- 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Sunset.jpg.RaR" "%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Sunset.jpg"
Запускает на исполнение:
- '<SYSTEM32>\cmd.exe' /c del.bat
- '<SYSTEM32>\cmd.exe' /c rename.bat
- '<SYSTEM32>\cmd.exe' /c rocket.bat
Внедряет код в
следующие системные процессы:
- <SYSTEM32>\cmd.exe
Изменения в файловой системе:
Создает следующие файлы:
- C:\Documents and Settings\Default User\Templates\_Фaйлы зaшифpoванны.Txt
- C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\_4pass_%USERNAME%.pwd
- %APPDATA%\Microsoft\Internet Explorer\_Фaйлы зaшифpoванны.Txt
- C:\Documents and Settings\Default User\Templates\_4pass_%USERNAME%.pwd
- C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\_Фaйлы зaшифpoванны.Txt
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\_4pass_%USERNAME%.pwd
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\_4pass_.pwd
- C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\_4pass_%USERNAME%.pwd
- C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\_Фaйлы зaшифpoванны.Txt
- C:\Far2\Addons\_4pass_%USERNAME%.pwd
- C:\Far2\Addons\_Фaйлы зaшифpoванны.Txt
- C:\Far2\Documentation\eng\_4pass_%USERNAME%.pwd
- C:\Far2\Documentation\eng\_Фaйлы зaшифpoванны.Txt
- %HOMEPATH%\Templates\_4pass_%USERNAME%.pwd
- <LS_APPDATA>\Microsoft\Windows Media\9.0\_Фaйлы зaшифpoванны.Txt
- %APPDATA%\Microsoft\Internet Explorer\_4pass_%USERNAME%.pwd
- %HOMEPATH%\Templates\_Фaйлы зaшифpoванны.Txt
- <LS_APPDATA>\Microsoft\Windows Media\9.0\_4pass_%USERNAME%.pwd
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\_Фaйлы зaшифpoванны.Txt
- C:\tmp\mouse.exe
- C:\tmp\moar.exe
- C:\tmp\push.exe
- C:\tmp\public.key
- C:\tmp\fidonet.exe
- C:\tmp\del.bat
- C:\tmp\bbs.exe
- C:\tmp\error.exe
- C:\tmp\del.exe
- C:\tmp\kii.hiew
- C:\tmp\names.hiew
- C:\wintmp\29195
- C:\tmp\29195
- C:\tmp\ssencrypt.exe
- C:\tmp\rename.bat
- C:\tmp\Rar.exe
- C:\tmp\ss.exe
- C:\tmp\rocket.bat
Удаляет следующие файлы:
- C:\tmp\kii.hiew
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
