Техническая информация
Для обеспечения автозапуска и распространения:
Подменяет следующие исполняемые системные файлы:
- <SYSTEM32>\dllcache\midimap.dll файлом <SYSTEM32>\dllcache\midimap.dll
- <SYSTEM32>\midimap.dll файлом <SYSTEM32>\midimap.dll
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\sc.exe' delete cryptsvc
- '<SYSTEM32>\net1.exe' stop cryptsvc
- '<SYSTEM32>\net.exe' stop cryptsvc
- '<SYSTEM32>\sc.exe' config cryptsvc start= disabled
Внедряет код в
следующие системные процессы:
- %WINDIR%\Explorer.EXE
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\3WCNu66oQV360ii.dll
- %TEMP%\6waiHB4FaP3iKKo.dll
- %TEMP%\98C4eU8grJ3KX4v.dll
- %TEMP%\7Df3K92N3j3aeyq.dll
- %TEMP%\wIB91uf6Y29kg0m.dll
- %TEMP%\0afTbysWcv9M7be.dll
- %TEMP%\32Bpx4wx0p3yRLk.dll
- %TEMP%\Qmpc1mUh8g3J5Wx.dll
- %TEMP%\T6DyNqh8Ba3vWG4.dll
- %TEMP%\WHpJyvlfZa4Xdtw.dll
- %TEMP%\MMDPehQUkn3hkur.dll
- %TEMP%\DRaHEZD62D3wshn.dll
- %TEMP%\GrCcbdHdJ73YDXt.dll
- %TEMP%\J4a54cL5at35d30.dll
- %TEMP%\t7fvdpbmA898Z8f.dll
- %TEMP%\Sodd8okNyG8CUDS.dll
- %TEMP%\VE20a74oGA8op4Y.dll
- %TEMP%\YWdK558FQ48Q3aQ.dll
- %TEMP%\Pb2Cljg4pM8a3bM.dll
- %TEMP%\FaOIRbZm7m8pAUH.dll
- %TEMP%\Is1eofdDOg8RbEN.dll
- %TEMP%\LJP6BeceXa85wqT.dll
- %TEMP%\j43nETOUaY9Oa9b.dll
- %TEMP%\mNe8oXSvjR91nmh.dll
- %TEMP%\pf4ZBkWM8L9c8cf.dll
- %TEMP%\feefrOJ5Ie9mFPb.dll
- %TEMP%\cj2XXA6fh593NQW.dll
- %TEMP%\f9etuEA6rk9eh3c.dll
- %TEMP%\cS3EVJFd8e9AunV.dll
- %TEMP%\Od8bnkMF375QnxT.dll
- %TEMP%\RqVxAoRY68630aZ.dll
- %TEMP%\UG8IctV0U26eKKR.dll
- %TEMP%\KLUOQf4ofD5oS7N.dll
- %TEMP%\BQsU8JwW4d54Z8I.dll
- %TEMP%\EcUbTN2xEd5aukO.dll
- %TEMP%\Hvs4qa6ObJ5C8bV.dll
- %TEMP%\egWytPl8WP6clgc.dll
- %TEMP%\i096GTqfn4686Wa.dll
- %TEMP%\lPWXqYu7x56kW9a.dll
- %TEMP%\bU9dW6hhMV61e3c.dll
- %TEMP%\XZVd7yaPdh6AfwX.dll
- %TEMP%\bl8rZ4eqvb6mshe.dll
- %TEMP%\e4VCw8dH5b6ODJW.dll
- %TEMP%\70U3WEs6mj5R8OQ.dll
- %TEMP%\hvEm7R8oby4VHS6.dll
- %TEMP%\k8q7TV6Fss48UD6.dll
- %TEMP%\neEY5aAg3e4dpp5.dll
- %TEMP%\ddqeeM4NR54txq7.dll
- %TEMP%\aiDeK1q6cU435d3.dll
- %TEMP%\d1pshCuW1A4fPF9.dll
- %TEMP%\aDED3H0x344Hc71.dll
- %TEMP%\45r967fhC35bGP8.dll
- %TEMP%\8VTMh5j8Lv5Da2E.dll
- %TEMP%\4hrh49ofdp5p2lK.dll
- %TEMP%\1mTnk2aHuG563eF.dll
- %TEMP%\qrquQfF6JY4FAfB.dll
- %TEMP%\u3T8neXPTS4rNC3.dll
- %TEMP%\xZrSNwcqlM4Ti39.dll
- %TEMP%\ZUY2v4R4QJ4aWXX.dll
- %TEMP%\du48W9VbaD4Cr3d.dll
- %TEMP%\a7YasSi2r74o5uV.dll
- %TEMP%\WC3aY6Nd9P455hR.dll
- %TEMP%\MGXg9r9ZYp4DDiM.dll
- %TEMP%\QZvtjwE1bj4peKS.dll
- %TEMP%\T0XE62ID0d4S04Y.dll
- %TEMP%\ql5A9j5Bta5mcFg.dll
- %TEMP%\u4ZNco3cBU5Op7e.dll
- %TEMP%\xG5jyt7vKO51Ace.dll
- %TEMP%\nLZpff1kka5AIda.dll
- %TEMP%\dP4vFWmS285QPWb.dll
- %TEMP%\hqYGpbrtI253kGb.dll
- %TEMP%\k94UCavKSh5exta.dll
- %TEMP%\J5vKmm59Av4b7xU.dll
- <SYSTEM32>\dllcache\ksuser.dll
- %TEMP%\smtBM0Kry43f23A.dll
- %TEMP%\wCHPj5PIG53H8mG.dll
- <SYSTEM32>\ksuser.dll
- <SYSTEM32>\CRNJEUFU32.dll
- <SYSTEM32>\CRNJEUFU.ime
- <SYSTEM32>\yumidimap.dll
- %TEMP%\93WQSQxkfL4r7yP.dll
- %TEMP%\DLuepV3BjF4TKbI.dll
- %TEMP%\GeX0Qi7c8246fLO.dll
- %TEMP%\6cu67MfJIS3Fm8J.dll
- %TEMP%\0Vtk63TbPy3tZP9.dll
- %TEMP%\3hW5g7Y2hs3Vu9F.dll
- %TEMP%\78uX3CcSre38FlL.dll
- %TEMP%\ocN93hibo27tKYB.dll
- %TEMP%\rolaOmn36v7VXJ4.dll
- %TEMP%\v8NilrrSFb78rvA.dll
- %TEMP%\l5koRde4f87H0w5.dll
- %TEMP%\bOMu8GWmwX7X7j8.dll
- %TEMP%\ebkFcLbDDD73RZ7.dll
- %TEMP%\itMS6efeN77fe66.dll
- %TEMP%\5f1O9MLUVC86IVD.dll
- %TEMP%\8xOkURQvfy8bd8J.dll
- %TEMP%\CO15rWUMws8D5rP.dll
- %TEMP%\9SO4XIH48J8T5eK.dll
- %TEMP%\yX03Lvvfdb7dCfG.dll
- %TEMP%\2jNUi116hV7FPI8.dll
- %TEMP%\530q56Cd5P7rk9E.dll
- %TEMP%\eykZfCSLmd7vf72.dll
- %TEMP%\7uiPFOb4am6ybBh.dll
- %TEMP%\A66lcTgbeY6a2on.dll
- %TEMP%\Ediy5Yk33S66Met.dll
- %TEMP%\4b65tKddDs5MURp.dll
- %TEMP%\1gh4Z5CLc45cbSk.dll
- %TEMP%\405VvAGmm558i6d.dll
- %TEMP%\8BidIFKD3y5k3pj.dll
- %TEMP%\U4LfL4744p65n1w.dll
- %TEMP%\XTj1i95ULj6h8k3.dll
- %TEMP%\bfM7I7NvVd6JKM9.dll
- %TEMP%\RkjD003cu46ZSN5.dll
- %TEMP%\Hp7JfdpS5M6iZA1.dll
- %TEMP%\K8jf2bttTG6Ku2s.dll
- %TEMP%\OY77OuyKcA6wFdy.dll
Присваивает атрибут 'скрытый' для следующих файлов:
- <SYSTEM32>\CRNJEUFU32.dll
Удаляет следующие файлы:
- %TEMP%\MMDPehQUkn3hkur.dll
- %TEMP%\GrCcbdHdJ73YDXt.dll
- %TEMP%\98C4eU8grJ3KX4v.dll
- %TEMP%\aDED3H0x344Hc71.dll
- %TEMP%\aiDeK1q6cU435d3.dll
- %TEMP%\T6DyNqh8Ba3vWG4.dll
- %TEMP%\pf4ZBkWM8L9c8cf.dll
- %TEMP%\feefrOJ5Ie9mFPb.dll
- %TEMP%\f9etuEA6rk9eh3c.dll
- %TEMP%\3WCNu66oQV360ii.dll
- %TEMP%\32Bpx4wx0p3yRLk.dll
- %TEMP%\t7fvdpbmA898Z8f.dll
- %TEMP%\UG8IctV0U26eKKR.dll
- %TEMP%\Od8bnkMF375QnxT.dll
- %TEMP%\Hvs4qa6ObJ5C8bV.dll
- %TEMP%\i096GTqfn4686Wa.dll
- %TEMP%\bU9dW6hhMV61e3c.dll
- %TEMP%\bl8rZ4eqvb6mshe.dll
- %TEMP%\u3T8neXPTS4rNC3.dll
- %TEMP%\neEY5aAg3e4dpp5.dll
- %TEMP%\hvEm7R8oby4VHS6.dll
- %TEMP%\BQsU8JwW4d54Z8I.dll
- %TEMP%\4hrh49ofdp5p2lK.dll
- %TEMP%\45r967fhC35bGP8.dll
- %TEMP%\nLZpff1kka5AIda.dll
- %TEMP%\hqYGpbrtI253kGb.dll
- %TEMP%\a7YasSi2r74o5uV.dll
- %TEMP%\4b65tKddDs5MURp.dll
- %TEMP%\8BidIFKD3y5k3pj.dll
- %TEMP%\xG5jyt7vKO51Ace.dll
- %TEMP%\wCHPj5PIG53H8mG.dll
- <SYSTEM32>\dllcache\midimap.dll
- <SYSTEM32>\midimap.dll
- %TEMP%\du48W9VbaD4Cr3d.dll
- %TEMP%\T0XE62ID0d4S04Y.dll
- %TEMP%\DLuepV3BjF4TKbI.dll
- %TEMP%\Is1eofdDOg8RbEN.dll
- %TEMP%\CO15rWUMws8D5rP.dll
- %TEMP%\rolaOmn36v7VXJ4.dll
- %TEMP%\YWdK558FQ48Q3aQ.dll
- %TEMP%\Sodd8okNyG8CUDS.dll
- %TEMP%\LJP6BeceXa85wqT.dll
- %TEMP%\RkjD003cu46ZSN5.dll
- %TEMP%\Hp7JfdpS5M6iZA1.dll
- %TEMP%\A66lcTgbeY6a2on.dll
- %TEMP%\l5koRde4f87H0w5.dll
- %TEMP%\bfM7I7NvVd6JKM9.dll
- %TEMP%\XTj1i95ULj6h8k3.dll
Самоперемещается:
- из <Полный путь к вирусу> в C:\RECYCLER\186921.tmp
Другое:
Ищет следующие окна:
- ClassName: 'CicLoaderWndClass' WindowName: ''
