Техническая информация
Вредоносные функции:
Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%WINDIR%\Temp\pandascan\EXPLORER.EXE' = '%WINDIR%\Temp\pandascan\EXPLORER.EXE:*:Enabled:pscan.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%WINDIR%\Temp\pandascan\ncftpget.exe' = '%WINDIR%\Temp\pandascan\ncftpget.exe:*:Enabled:ncftpget.exe'
Создает и запускает на исполнение:
- '%WINDIR%\Temp\pandascan\EXPLORER.EXE'
Запускает на исполнение:
- '<SYSTEM32>\netsh.exe' firewall set allowedprogram program = EXPLORER.EXE name = pscan.exe enable
- '<SYSTEM32>\netsh.exe' firewall add allowedprogram program = %WINDIR%\Temp\pandascan\ncftpget.exe name = ncftpget.exe enable
Изменения в файловой системе:
Создает следующие файлы:
- %WINDIR%\Temp\pandascan\PandaBeagleLauncher\DllVentanaProgressBar.dll
- %WINDIR%\Temp\pandascan\PandaBeagleLauncher\Data2.ini
- %WINDIR%\Temp\pandascan\PandaBeagleLauncher\Engine.dll
- %WINDIR%\Temp\pandascan\PandaBeagleLauncher\EncAnalyse.ini
- %WINDIR%\Temp\pandascan\PandaBeagleLauncher\DasBootS.sys
- %WINDIR%\Temp\pandascan\PandaBeagleLauncher\DasBootK.sys
- %WINDIR%\Temp\pandascan\PandaBeagleLauncher\Data1.ini
- %WINDIR%\Temp\pandascan\PandaBeagleLauncher\data.ini
- %WINDIR%\Temp\pandascan\PandaBeagleLauncher\msvcr90.dll
- %WINDIR%\Temp\pandascan\PandaBeagleLauncher\msvcp90.dll
- %WINDIR%\Temp\pandascan\PandaBeagleLauncher\PavBckZp.dll
- %WINDIR%\Temp\pandascan\PandaBeagleLauncher\svchost.exe
- %WINDIR%\Temp\pandascan\PandaBeagleLauncher\HttpConnection.dll
- %WINDIR%\Temp\pandascan\PandaBeagleLauncher\estyle.css
- %WINDIR%\Temp\pandascan\PandaBeagleLauncher\Microsoft.VC90.CRT.manifest
- %WINDIR%\Temp\pandascan\PandaBeagleLauncher\libxml2.dll
- %WINDIR%\Temp\pandascan\CONFIG.INI
- %WINDIR%\Temp\pandascan\MSVCR71.DLL
- %WINDIR%\Temp\pandascan\version.ini
- %WINDIR%\Temp\pandascan\PandaBeagleExtractor\svchost.exe
- %WINDIR%\Temp\pandascan\psnahk.dll
- %WINDIR%\Temp\pandascan\psnfc.dll
- %WINDIR%\Temp\pandascan\scremlsp.exe
- %WINDIR%\Temp\pandascan\RKPavProc64.sys
- %WINDIR%\Temp\pandascan\PandaBeagleLauncher\DasBootE.sys
- %WINDIR%\Temp\pandascan\PandaBeagleLauncher\DasBootD.SYS
- %WINDIR%\Temp\pandascan\PandaBeagleLauncher\DasBootI.sys
- %WINDIR%\Temp\pandascan\PandaBeagleLauncher\DasBootF.sys
- %WINDIR%\Temp\pandascan\PandaBeagleLauncher\CommonCODEC.dll
- %WINDIR%\Temp\pandascan\PandaBeagleLauncher\Backend.dll
- %WINDIR%\Temp\pandascan\PandaBeagleLauncher\DasBoot.sys
- %WINDIR%\Temp\pandascan\PandaBeagleLauncher\CommonLibrary.dll
- %TEMP%\aut3.tmp
- %WINDIR%\Temp\pandascan\ncftpget.exe
- %TEMP%\aut4.tmp
- %WINDIR%\Temp\pandascan\sfk\svchost.exe
- %WINDIR%\Temp\pandascan\processlog.log
- %WINDIR%\Temp\pandascan\md5hash.dll
- %TEMP%\aut2.tmp
- %WINDIR%\Temp\pandascan\custinfo.ini
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\config3[1].zip
- %WINDIR%\Temp\pandascan\7za\svchost.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\pcheck[1].exe
- %WINDIR%\Temp\pandascan\config3.zip
- %TEMP%\aut5.tmp
- %WINDIR%\Temp\pandascan\upload\svchost.exe
- %TEMP%\aut6.tmp
- %WINDIR%\Temp\pandascan\upload\credentials.dat
- %WINDIR%\Temp\pandascan\PandaBeagleLauncher\PRFIH.dll
- %WINDIR%\Temp\pandascan\PandaBeagleLauncher\PRExcHash.dll
- %WINDIR%\Temp\pandascan\PandaBeagleLauncher\PRSBDrvr.sys
- %WINDIR%\Temp\pandascan\PandaBeagleLauncher\ProgressBar.htm
- %WINDIR%\Temp\pandascan\PandaBeagleLauncher\pavVTS.dat
- %WINDIR%\Temp\pandascan\PandaBeagleLauncher\PavVT.dll
- %WINDIR%\Temp\pandascan\PandaBeagleLauncher\popup.css
- %WINDIR%\Temp\pandascan\PandaBeagleLauncher\phdt.bin
- %WINDIR%\Temp\pandascan\PandaBeagleLauncher\Tucan.dll
- %WINDIR%\Temp\pandascan\PandaBeagleLauncher\StatisticsManager.dll
- %TEMP%\aut1.tmp
- %WINDIR%\Temp\pandascan\EXPLORER.EXE
- %WINDIR%\Temp\pandascan\PandaBeagleLauncher\PSNEngAvWrapper.dll
- %WINDIR%\Temp\pandascan\PandaBeagleLauncher\PRSBLib.dll
- %WINDIR%\Temp\pandascan\PandaBeagleLauncher\Snapshot.dll
- %WINDIR%\Temp\pandascan\PandaBeagleLauncher\SecureBootLauncher.dll
- %WINDIR%\Temp\pandascan\psnflg.dll
- %WINDIR%\Temp\pandascan\pskcmp.dll
- %WINDIR%\Temp\pandascan\RKPavProc.sys
- %WINDIR%\Temp\pandascan\pskscs.dll
- %WINDIR%\Temp\pandascan\pskas.dll
- %WINDIR%\Temp\pandascan\pskfss.dll
- %WINDIR%\Temp\pandascan\pavcl.lng
- %WINDIR%\Temp\pandascan\pskvm.dll
- %WINDIR%\Temp\pandascan\pskahk.dll
- %WINDIR%\Temp\pandascan\pskalloc.dll
- %WINDIR%\Temp\pandascan\psknc.dll
- %WINDIR%\Temp\pandascan\pskvfs.dll
- %WINDIR%\Temp\pandascan\Pavsddl.dll
- %WINDIR%\Temp\pandascan\vplatdis.dll
- %WINDIR%\Temp\pandascan\vplatprc.dll
- %WINDIR%\Temp\pandascan\libcomm.dll
- %WINDIR%\Temp\pandascan\pscommcl.dll
- %WINDIR%\Temp\pandascan\languages\German\Panda.chp
- %WINDIR%\Temp\pandascan\languages\French\Panda.chp
- %WINDIR%\Temp\pandascan\languages\Japanese\Panda.chp
- %WINDIR%\Temp\pandascan\languages\Italian\Panda.chp
- %WINDIR%\Temp\pandascan\PandaBeagleExtractor\PavBckZp.dll
- %WINDIR%\Temp\pandascan\svchost.exe
- %WINDIR%\Temp\pandascan\languages\English\panda.chp
- %WINDIR%\Temp\pandascan\languages\Chinese_Simplified\Panda.chp
- %WINDIR%\Temp\pandascan\pavboot64.sys
- %WINDIR%\Temp\pandascan\pavboot.sys
- %WINDIR%\Temp\pandascan\psscan.dll
- %WINDIR%\Temp\pandascan\pskavs.dll
- %WINDIR%\Temp\pandascan\languages\Spanish\Panda.chp
- %WINDIR%\Temp\pandascan\languages\Portuguese_Portugal\Panda.chp
- %WINDIR%\Temp\pandascan\pcheck.exe
- %WINDIR%\Temp\pandascan\Reg.sig
- %WINDIR%\Temp\pandascan\psnden.dll
- %WINDIR%\Temp\pandascan\psnengav.dll
- %WINDIR%\Temp\pandascan\pssarf.dll
- %WINDIR%\Temp\pandascan\pskmdfs.dll
- %WINDIR%\Temp\pandascan\pskhtml.dll
- %WINDIR%\Temp\pandascan\Psscommobject.dll
- %WINDIR%\Temp\pandascan\pskpack.dll
- %WINDIR%\Temp\pandascan\pskdr.exe
- %WINDIR%\Temp\pandascan\psnxprs.dll
- %WINDIR%\Temp\pandascan\psndsk.dll
- %WINDIR%\Temp\pandascan\psnhsh.dll
- %WINDIR%\Temp\pandascan\psnpen.dll
- %WINDIR%\Temp\pandascan\PutXML.dll
- %WINDIR%\Temp\pandascan\pssuts.dll
- %WINDIR%\Temp\pandascan\psnkrnl.dll
- %WINDIR%\Temp\pandascan\psnjidsign.dll
- %WINDIR%\Temp\pandascan\searchfilecab.gif
- %WINDIR%\Temp\pandascan\mail1.gif
- %WINDIR%\Temp\pandascan\tag.gif
- %WINDIR%\Temp\pandascan\search.gif
- %WINDIR%\Temp\pandascan\psnengav.nsc
- %WINDIR%\Temp\pandascan\pskutil.dll
- %WINDIR%\Temp\pandascan\Clear.bat
- %WINDIR%\Temp\pandascan\psnglkntex.dll
- %WINDIR%\Temp\pandascan\Scanner.bat
- %WINDIR%\Temp\pandascan\i4.gif
- %WINDIR%\Temp\pandascan\pskvfile.dll
- %WINDIR%\Temp\pandascan\00IM_onestep.gif
- %WINDIR%\Temp\pandascan\refresh.gif
- %WINDIR%\Temp\pandascan\malwspecialist.gif
- %WINDIR%\Temp\pandascan\KillTDSS.bat
- %WINDIR%\Temp\pandascan\search1.gif
Удаляет следующие файлы:
- %TEMP%\aut5.tmp
- %TEMP%\aut6.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\config3[1].zip
- %TEMP%\aut4.tmp
- %TEMP%\aut1.tmp
- %TEMP%\aut2.tmp
- %TEMP%\aut3.tmp
Сетевая активность:
Подключается к:
- '21#.#.79.112':80
TCP:
Запросы HTTP GET:
- 21#.#.79.112/downloads/pcheck.exe
- 21#.#.79.112/downloads/config3.zip
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'EDIT' WindowName: '(null)'
