Техническая информация
Вредоносные функции:
Создает и запускает на исполнение:
- '%TEMP%\nt6hdd_d\bschk.exe' /nt60 C:
- '%TEMP%\nt6hdd_d\ConsExt.exe' /event
- '%TEMP%\nt6hdd_d\bschk.exe' /nt60 sys
- '%TEMP%\nt6hdd_d\choi.exe' /t 1 /c m0 /d m /n
- '%TEMP%\nt6hdd_d\ConsExt.exe' /crv 0
Запускает на исполнение:
- '<SYSTEM32>\chcp.com' 936
- '<SYSTEM32>\find.exe' /i "ProductName"
- '<SYSTEM32>\reg.exe' QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ProductName
- '<SYSTEM32>\find.exe' ":"
- '<SYSTEM32>\find.exe' "\\"
- '<SYSTEM32>\find.exe' "5.0"
- '<SYSTEM32>\find.exe' "5."
- '<SYSTEM32>\reg.exe' query HKCU\Console\%SystemRoot%_system32_cmd.exe /v QuickEdit
- '<SYSTEM32>\mode.com' con cols=80 lines=25
- '<SYSTEM32>\cmd.exe' /c ""%PROGRAM_FILES%\nt6\hdd\main.cmd" "
- '<SYSTEM32>\find.exe' "6."
- '<SYSTEM32>\find.exe' /i "mini"
- '<SYSTEM32>\reg.exe' query HKCU\Console /v QuickEdit
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nt6hdd_d\ConsExt.exe
- %TEMP%\nt6hdd_d\choi.exe
- %TEMP%\nt6hdd_d\main.cmd
- %TEMP%\nt6hdd_d\find5.exe
- %TEMP%\nt6hdd_d\chcp5.com
- %TEMP%\nt6hdd_d\bs2
- %TEMP%\nt6hdd_d\bs1
- %TEMP%\nt6hdd_d\bschk2
- %TEMP%\nt6hdd_d\bs3
- %TEMP%\nt6hdd_d\bs.exe
- %TEMP%\nt6hdd.tmp
- %TEMP%\nt6hdd_d\nt6hdd.tmp
- %TEMP%\nt6hdd_d\bschk.exe
- %TEMP%\nt6hdd_d\zchzr
- %TEMP%\nt6hdd_d\reg5.exe
- %TEMP%\nt6hdd_d\nt6v2.cmd
- %TEMP%\nt6hdd_d\shutdown5.exe
- %TEMP%\nt6hdd_d\sd.exe
- %PROGRAM_FILES%\nt6\hdd\find5.exe
- %PROGRAM_FILES%\nt6\hdd\chcp5.com
- %PROGRAM_FILES%\nt6\hdd\main.cmd
- %PROGRAM_FILES%\nt6\hdd\be.exe
- %PROGRAM_FILES%\nt6\hdd\attrib5.exe
- %PROGRAM_FILES%\nt6\hdd\nt6v2.cmd
- %PROGRAM_FILES%\nt6\hdd\zchzr
- %PROGRAM_FILES%\nt6\hdd\ConsExt.exe
- %PROGRAM_FILES%\nt6\hdd\reg5.exe
- %PROGRAM_FILES%\nt6\hdd\sd.exe
- %PROGRAM_FILES%\nt6\hdd\choi.exe
- %TEMP%\nt6hdd_d\be.exe
- %TEMP%\nt6hdd_d\attrib5.exe
- %PROGRAM_FILES%\nt6\hdd\shutdown5.exe
- %PROGRAM_FILES%\nt6\hdd\bs1
- %PROGRAM_FILES%\nt6\hdd\bschk2
- %PROGRAM_FILES%\nt6\hdd\bs3
- %PROGRAM_FILES%\nt6\hdd\bs2
Удаляет следующие файлы:
- %PROGRAM_FILES%\nt6\hdd\nt6v2.cmd
- %PROGRAM_FILES%\nt6\hdd\reg5.exe
- %PROGRAM_FILES%\nt6\hdd\find5.exe
- %PROGRAM_FILES%\nt6\hdd\main.cmd
- %PROGRAM_FILES%\nt6\hdd\zchzr
- %PROGRAM_FILES%\nt6\hdd\zchzr.mbr
- %PROGRAM_FILES%\nt6\hdd\sd.exe
- %PROGRAM_FILES%\nt6\hdd\shutdown5.exe
- %PROGRAM_FILES%\nt6\hdd\ConsExt.exe
- %PROGRAM_FILES%\nt6\hdd\bs1
- %PROGRAM_FILES%\nt6\hdd\bs2
- %PROGRAM_FILES%\nt6\hdd\attrib5.exe
- %PROGRAM_FILES%\nt6\hdd\be.exe
- %PROGRAM_FILES%\nt6\hdd\chcp5.com
- %PROGRAM_FILES%\nt6\hdd\choi.exe
- %PROGRAM_FILES%\nt6\hdd\bs3
- %PROGRAM_FILES%\nt6\hdd\bschk2
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
