BackDoor.PcClient.6099

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'MWREGICBC.exe' = '"%PROGRAM_FILES%\ICBCEbankTools\MingWah\MWREGICBC.exe"'

Вредоносные функции:

Создает и запускает на исполнение:

%PROGRAM_FILES%\ICBCEbankTools\MingWah\MWREGICBC.exe

Изменяет следующие настройки браузера Windows Internet Explorer:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1208' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1405' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1001' = '00000001'

Изменения в файловой системе:

Создает следующие файлы:

%PROGRAM_FILES%\ICBCEbankTools\MingWah\MWREGICBC.exe
%ALLUSERSPROFILE%\Application Data\MingWah\lang.ini
%PROGRAM_FILES%\ICBCEbankTools\MingWah\MWICBCUKeyToolU.exe
%WINDIR%\Downloaded Program Files\mwusbkey.inf
<SYSTEM32>\icbccsps.dll
<SYSTEM32>\ICBCPkcs11_v1.DLL
%WINDIR%\Downloaded Program Files\icbc_mwusbkey.dll
%ALLUSERSPROFILE%\Start Menu\Programs\Client-end Software of ICBC Internet Banking\MingWah\Guide to USB-Shield.lnk
%PROGRAM_FILES%\ICBCEbankTools\MingWah\Uninstall.exe
%ALLUSERSPROFILE%\Start Menu\Programs\Client-end Software of ICBC Internet Banking\MingWah\Uninstall.lnk
%PROGRAM_FILES%\ICBCEbankTools\MingWah\ICBC User Manual.chm
%ALLUSERSPROFILE%\Start Menu\Programs\Client-end Software of ICBC Internet Banking\MingWah\UKey ManagerTool(Mingwah).lnk
%ALLUSERSPROFILE%\Desktop\ICBC Internet Banking.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Client-end Software of ICBC Internet Banking\MingWah\Industrial and Commercial Bank of China.url
%HOMEPATH%\Templates\MW_ICBC_Package_Install_Temp\icbc_mwusbkey_64.inf
%HOMEPATH%\Templates\MW_ICBC_Package_Install_Temp\ICBC User Manual.chm
%HOMEPATH%\Templates\MW_ICBC_Package_Install_Temp\icbccsps.dll
%HOMEPATH%\Templates\MW_ICBC_Package_Install_Temp\icbc_mwusbkey_64.dll
%HOMEPATH%\Templates\MW_ICBC_Package_Install_Temp\icbc_mwusbkey.dll
%HOMEPATH%\Templates\MW_ICBC_Package_Install_Temp\mwusbkey.inf
%HOMEPATH%\Templates\MW_ICBC_Package_Install_Temp\MWREGICBC.exe
%HOMEPATH%\Templates\MW_ICBC_Package_Install_Temp\ICBC User Manual_SC.chm
%HOMEPATH%\Templates\MW_ICBC_Package_Install_Temp\Uninstall.exe
%HOMEPATH%\Templates\MW_ICBC_Package_Install_Temp\MWICBCUKeyToolU.exe
%HOMEPATH%\Templates\MW_ICBC_Package_Install_Temp\icbcPkcs11_v1.dll
%HOMEPATH%\Templates\MW_ICBC_Package_Install_Temp\icbccsps_64.dll
%HOMEPATH%\Templates\MW_ICBC_Package_Install_Temp\icbcPkcs11_v1_64.dll