Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'wextract_cleanup0' = 'rundll32.exe <SYSTEM32>\advpack.dll,DelNodeRunDLL32 ""%TEMP%\IXP000.TMP\""'
Вредоносные функции:
Создает и запускает на исполнение:
- %WINDIR%\Emcreports\bin\GetVer.exe
Запускает на исполнение:
- <SYSTEM32>\gpresult.exe /z
- <SYSTEM32>\reg.exe query "HKEY_LOCAL_MACHINE\Software\Emulex\HBAnyware" /v HBAnywareDir
- <SYSTEM32>\eventcreate.exe /t information /id 999 /l system /SO Emcreports /d "Emcreports v35 collection has started"
- <SYSTEM32>\cmd.exe /c "%TEMP%\IXP000.TMP\EMCRPT.CMD"
- <SYSTEM32>\notepad.exe "%WINDIR%\Emcreports\Bin\readme.txt"
Изменения в файловой системе:
Создает следующие файлы:
- %WINDIR%\Emcreports\bin\QLFO.dll
- %WINDIR%\Emcreports\bin\timestamp.js
- %WINDIR%\Emcreports\bin\uptime.exe
- %WINDIR%\Emcreports\bin\DumpEVT.exe
- %WINDIR%\Emcreports\bin\GetVer.exe
- %WINDIR%\Emcreports\bin\latestinq.exe
- %WINDIR%\Emcreports\bin\pstat50.exe
- %WINDIR%\Emcreports\bin\dosdev.exe
- %WINDIR%\Emcreports\bin\timestamp2.js
- %WINDIR%\Emcreports\bin\libexpat.dll
- %WINDIR%\Emcreports\bin\psloglist.exe
- %WINDIR%\Emcreports\bin\gpresult.exe
- %WINDIR%\Emcreports\bin\qlutils.dll
- %WINDIR%\Emcreports\bin\scli.exe
- %WINDIR%\Emcreports\bin\inq.exe
- %WINDIR%\Emcreports\bin\clusmps.vbs
- %WINDIR%\Emcreports\bin\devcon.exe
- %WINDIR%\Emcreports\bin\dskpart
- %WINDIR%\Emcreports\bin\debug.bat
- %WINDIR%\Emcreports\bin\hbaapi.dll
- %WINDIR%\Emcreports\bin\fcinfo.exe
- %WINDIR%\Emcreports\bin\reg.exe
- %WINDIR%\Emcreports\bin\qswdll_mt.dll
- %WINDIR%\Emcreports\bin\HBAAPI2.dll
- %WINDIR%\Emcreports\bin\SDMiSCSId.dll
- %WINDIR%\Emcreports\bin\Emulex.cmd
- %WINDIR%\Emcreports\bin\QLSDM.DLL
- \Device\LanmanRedirector\WORKGROUP*\MAILSLOT\NET\NETLOGON
- %WINDIR%\Emcreports\COLLECTION\HOST\USER-4BB09A9C02_GPRESULT.TXT
- \Device\LanmanRedirector\USER-4BB09A9C02*\MAILSLOT\NET\NETLOGON
- %WINDIR%\Emcreports\bin\sfcli.properties
- %WINDIR%\Emcreports\COLLECTION\USER-4BB09A9C02_EMCREPORTS_PROGRESS.TXT
- %WINDIR%\Emcreports\bin\srvinfo.exe
- %WINDIR%\Emcreports\bin\iscli.exe
- %WINDIR%\Emcreports\bin\menu.properties
- %WINDIR%\Emcreports\bin\vflag.exe
- %WINDIR%\Emcreports\bin\zip.exe
- %WINDIR%\Emcreports\bin\README.TXT
- %WINDIR%\Emcreports\bin\emcrpt.cmd
- %WINDIR%\Emcreports\bin\secinspect.exe
- %WINDIR%\Emcreports\bin\msvcr80.dll
- %WINDIR%\Emcreports\bin\hbatapi.dll
- %WINDIR%\Emcreports\bin\mpiolist.exe
- %TEMP%\IXP000.TMP\HBAAPI2.dll
- %TEMP%\IXP000.TMP\hbatapi.dll
- %TEMP%\IXP000.TMP\hbaapi.dll
- %TEMP%\IXP000.TMP\GetVer.exe
- %TEMP%\IXP000.TMP\gpresult.exe
- %TEMP%\IXP000.TMP\libexpat.dll
- %TEMP%\IXP000.TMP\menu.properties
- %TEMP%\IXP000.TMP\latestinq.exe
- %TEMP%\IXP000.TMP\inq.exe
- %TEMP%\IXP000.TMP\iscli.exe
- %TEMP%\IXP000.TMP\fcinfo.exe
- %TEMP%\IXP000.TMP\devcon.exe
- %TEMP%\IXP000.TMP\dmdiag.exe
- %TEMP%\IXP000.TMP\CheckSym.exe
- %TEMP%\IXP000.TMP\debug.bat
- %TEMP%\IXP000.TMP\clusmps.vbs
- %TEMP%\IXP000.TMP\emcrpt.cmd
- %TEMP%\IXP000.TMP\Emulex.cmd
- %TEMP%\IXP000.TMP\DumpEVT.exe
- %TEMP%\IXP000.TMP\dosdev.exe
- %TEMP%\IXP000.TMP\dskpart
- %TEMP%\IXP000.TMP\mpiolist.exe
- %TEMP%\IXP000.TMP\timestamp.js
- %TEMP%\IXP000.TMP\timestamp2.js
- %TEMP%\IXP000.TMP\srvinfo.exe
- %TEMP%\IXP000.TMP\secinspect.exe
- %TEMP%\IXP000.TMP\sfcli.properties
- %WINDIR%\Emcreports\bin\CheckSym.exe
- %WINDIR%\Emcreports\bin\dmdiag.exe
- %TEMP%\IXP000.TMP\zip.exe
- %TEMP%\IXP000.TMP\uptime.exe
- %TEMP%\IXP000.TMP\vflag.exe
- %TEMP%\IXP000.TMP\SDMiSCSId.dll
- %TEMP%\IXP000.TMP\QLFO.dll
- %TEMP%\IXP000.TMP\QLSDM.DLL
- %TEMP%\IXP000.TMP\pstat50.exe
- %TEMP%\IXP000.TMP\msvcr80.dll
- %TEMP%\IXP000.TMP\psloglist.exe
- %TEMP%\IXP000.TMP\reg.exe
- %TEMP%\IXP000.TMP\scli.exe
- %TEMP%\IXP000.TMP\README.TXT
- %TEMP%\IXP000.TMP\qlutils.dll
- %TEMP%\IXP000.TMP\qswdll_mt.dll
