Техническая информация
Для обеспечения автозапуска и распространения:
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\RunAsSysSvc9] 'ImagePath' = '%TEMP%\SupremoRemoteDesktop\SupremoSystem.exe'
Вредоносные функции:
Запускает на исполнение:
- '%TEMP%\SupremoRemoteDesktop\SupremoSystem.exe' "C:\Programmi\Hackers Computer Utility\Supremo.exe" "/SYSRUN"
- '%TEMP%\SupremoRemoteDesktop\SupremoSystem.exe'
- 'C:\Programmi\Hackers Computer Utility\Supremo.exe' /SYSRUN
- '<SYSTEM32>\net.exe' stop SupremoService
- '<SYSTEM32>\net1.exe' stop SupremoService
- 'C:\Programmi\Hackers Computer Utility\Supremo.exe'
Изменения в файловой системе:
Создает следующие файлы:
- %ALLUSERSPROFILE%\Application Data\SupremoRemoteDesktop\Languages\Supremo.it.lng
- %ALLUSERSPROFILE%\Application Data\SupremoRemoteDesktop\Languages\Supremo.lt.lng
- %ALLUSERSPROFILE%\Application Data\SupremoRemoteDesktop\Languages\Supremo.nl.lng
- %ALLUSERSPROFILE%\Application Data\SupremoRemoteDesktop\Languages\Supremo.fr.lng
- %ALLUSERSPROFILE%\Application Data\SupremoRemoteDesktop\Languages\Supremo.hr.lng
- %ALLUSERSPROFILE%\Application Data\SupremoRemoteDesktop\Languages\Supremo.hy.lng
- %ALLUSERSPROFILE%\Application Data\SupremoRemoteDesktop\Languages\Supremo.no.lng
- %ALLUSERSPROFILE%\Application Data\SupremoRemoteDesktop\Languages\Supremo.ru.lng
- %ALLUSERSPROFILE%\Application Data\SupremoRemoteDesktop\Languages\Supremo.sv.lng
- %ALLUSERSPROFILE%\Application Data\SupremoRemoteDesktop\Languages\Supremo.uk.lng
- %ALLUSERSPROFILE%\Application Data\SupremoRemoteDesktop\Languages\Supremo.pl.lng
- %ALLUSERSPROFILE%\Application Data\SupremoRemoteDesktop\Languages\Supremo.pt.lng
- %ALLUSERSPROFILE%\Application Data\SupremoRemoteDesktop\Languages\Supremo.ro.lng
- %ALLUSERSPROFILE%\Application Data\SupremoRemoteDesktop\Languages\Supremo.et.lng
- %TEMP%\SupremoRemoteDesktop\SupremoSystem.exe
- %ALLUSERSPROFILE%\Application Data\SupremoRemoteDesktop\Languages\Supremo.bg.lng
- %ALLUSERSPROFILE%\Application Data\SupremoRemoteDesktop\Languages\Supremo.br.lng
- C:\Programmi\Hackers Computer Utility\Supremo.exe
- C:\Programmi\Hackers Computer Utility\icon1.ico
- %HOMEPATH%\Desktop\Teleassitenza Hackers.lnk
- %ALLUSERSPROFILE%\Application Data\SupremoRemoteDesktop\Languages\Supremo.bs.lng
- %ALLUSERSPROFILE%\Application Data\SupremoRemoteDesktop\Languages\Supremo.el.lng
- %ALLUSERSPROFILE%\Application Data\SupremoRemoteDesktop\Languages\Supremo.en.lng
- %ALLUSERSPROFILE%\Application Data\SupremoRemoteDesktop\Languages\Supremo.es.lng
- %ALLUSERSPROFILE%\Application Data\SupremoRemoteDesktop\Languages\Supremo.ca.lng
- %ALLUSERSPROFILE%\Application Data\SupremoRemoteDesktop\Languages\Supremo.cs.lng
- %ALLUSERSPROFILE%\Application Data\SupremoRemoteDesktop\Languages\Supremo.de.lng
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
