Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'epsng_certd' = '%PROGRAM_FILES%\ngsrv\epsng_certd.exe -r'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'ShuttleCsp11_3003' = '%PROGRAM_FILES%\EnterSafe\ePass3003\shuttle_certd3003.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'ET199_std' = '%PROGRAM_FILES%\EnterSafe\ET199\escertd_et199.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\ngSlotD] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- '%PROGRAM_FILES%\ngsrv\ngslotd.exe' -s
- '%PROGRAM_FILES%\ngsrv\ngslotd.exe' -i
- '%PROGRAM_FILES%\ngsrv\epsng_certd.exe' -i -s
- '%PROGRAM_FILES%\ngsrv\ngslotd.exe'
- 'C:\SbsUsbkey\eps3knd.exe' /S
- '%PROGRAM_FILES%\EnterSafe\ET199\escertd_et199.exe'
- 'C:\SbsUsbkey\ET199-SimpChinese.exe' /S
- '%PROGRAM_FILES%\EnterSafe\ePass3003\shuttle_certd3003.exe'
- 'C:\SbsUsbkey\ePass3003-SimpChinese.exe' /S
Запускает на исполнение:
- '%WINDIR%\regedit.exe' /s "%PROGRAM_FILES%\EnterSafe\ePass3003\shuttleCsp11_3003_s.reg"
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\4673551D-3000-4FE7-A218-48BDAE051E2B_std\3000nd\epsng_certd.exe
- %TEMP%\4673551D-3000-4FE7-A218-48BDAE051E2B_std\3000nd\epsng_checkcsp.dll
- %TEMP%\4673551D-3000-4FE7-A218-48BDAE051E2B_std\3000nd\lang\certd_2052.lng
- %TEMP%\4673551D-3000-4FE7-A218-48BDAE051E2B_std\3000nd\ngsetup.ini
- %TEMP%\4673551D-3000-4FE7-A218-48BDAE051E2B_std\3000nd\slotmon\hidmon.dll
- %TEMP%\4673551D-3000-4FE7-A218-48BDAE051E2B_std\3000nd\tsp\tsp_eps3k_hid.dll
- %TEMP%\4673551D-3000-4FE7-A218-48BDAE051E2B_std\3000nd\lang\certd_1033.lng
- %TEMP%\4673551D-3000-4FE7-A218-48BDAE051E2B_std\3000nd\ngcsp.sig
- %TEMP%\4673551D-3000-4FE7-A218-48BDAE051E2B_std\3000nd\CSPInstaller.dll
- %TEMP%\4673551D-3000-4FE7-A218-48BDAE051E2B_std\3000nd\lang\ngcsp_2052.lng
- %TEMP%\4673551D-3000-4FE7-A218-48BDAE051E2B_std\3000nd\ngp11v211.dll
- %TEMP%\4673551D-3000-4FE7-A218-48BDAE051E2B_std\3000nd\ngslotd.exe
- %TEMP%\4673551D-3000-4FE7-A218-48BDAE051E2B_std\3000nd\ngcsp.dat
- <SYSTEM32>\ShuttleCsp11_3003.dll
- %ALLUSERSPROFILE%\Start Menu\Programs\EnterSafe\ePass3003\№ЬАн№¤ѕЯ.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\EnterSafe\ePass3003\ЕдЦГ№¤ѕЯ.lnk
- %PROGRAM_FILES%\EnterSafe\ePass3003\lang\esmgr_2052.lng
- <SYSTEM32>\ShuttleCsp11_3003.sig
- <SYSTEM32>\ShuttleCsp11_3003_s.dll
- %ALLUSERSPROFILE%\Start Menu\Programs\EnterSafe\ePass3003\Р¶ФШ.lnk
- %TEMP%\4673551D-3000-4FE7-A218-48BDAE051E2B_std\NGSetup.dll
- %TEMP%\4673551D-3000-4FE7-A218-48BDAE051E2B_std\3000ND.dat
- %WINDIR%\Temp\_!NGSetup_.log
- %TEMP%\nsg7.tmp\UserInfo.dll
- %TEMP%\nsg7.tmp\MoveOldVersion.dll
- %TEMP%\nsg7.tmp\System.dll
- %TEMP%\4673551D-3000-4FE7-A218-48BDAE051E2B_std\3000nd\lang\ngcsp_1033.lng
- <SYSTEM32>\ngcsp.dat
- <SYSTEM32>\ngcsp.sig
- %PROGRAM_FILES%\ngsrv\CSPInstaller.dll
- %PROGRAM_FILES%\ngsrv\lang\certd_1033.lng
- <SYSTEM32>\ngp11v211.dll
- %PROGRAM_FILES%\ngsrv\ngslotd.exe
- %PROGRAM_FILES%\ngsrv\lang\ngcsp_2052.lng
- %PROGRAM_FILES%\ngsrv\conf\msglog.cfg
- %WINDIR%\Temp\ngcsp.dll
- %WINDIR%\Temp\ngcsp.sgi
- %PROGRAM_FILES%\ngsrv\lang\ngcsp_1033.lng
- <SYSTEM32>\ngcsp.dll
- <SYSTEM32>\ngcsp.sgi
- %TEMP%\4673551D-3000-4FE7-A218-48BDAE051E2B_std\3000nd\_REMOVED.exe
- %TEMP%\4673551D-3000-4FE7-A218-48BDAE051E2B_std\_shfoldr.dll
- %TEMP%\nsg7.tmp\setup.ini
- %TEMP%\4673551D-3000-4FE7-A218-48BDAE051E2B_std\3000nd\ngcsp.dll
- %TEMP%\4673551D-3000-4FE7-A218-48BDAE051E2B_std\3000nd\ngcsp.sgi
- %TEMP%\4673551D-3000-4FE7-A218-48BDAE051E2B_std\3000nd\conf\msglog.cfg
- %PROGRAM_FILES%\Feitian\USBToken3000ND\uninst.exe
- %PROGRAM_FILES%\ngsrv\epsng_certd.exe
- %PROGRAM_FILES%\ngsrv\epsng_checkcsp.dll
- %PROGRAM_FILES%\ngsrv\lang\certd_2052.lng
- %ALLUSERSPROFILE%\Start Menu\Programs\USB Token\USB Token 3000ND\Р¶ФШUSB Token 3000ND.lnk
- %PROGRAM_FILES%\ngsrv\slotmon\hidmon.dll
- %PROGRAM_FILES%\ngsrv\tsp\tsp_eps3k_hid.dll
- %PROGRAM_FILES%\EnterSafe\ePass3003\lang\esmgr_1033.lng
- C:\SbsUsbkey\UsbkeyUnReg.cmd
- %TEMP%\nss3.tmp\System.dll
- %TEMP%\nss3.tmp\UserInfo.dll
- C:\SbsUsbkey\iShangWebPrint.exe
- C:\SbsUsbkey\UsbkeyReg.cmd
- C:\SbsUsbkey\SealHTMLManager.ocx
- %PROGRAM_FILES%\EnterSafe\ET199\uninst.exe
- %PROGRAM_FILES%\EnterSafe\ET199\et199.ini
- %PROGRAM_FILES%\EnterSafe\ET199\lang\escertd_1033.lng
- %PROGRAM_FILES%\EnterSafe\ET199\lang\escertd_2052.lng
- %PROGRAM_FILES%\EnterSafe\ET199\escertd_et199.exe
- %PROGRAM_FILES%\EnterSafe\ET199\esmgr_et199.exe
- %PROGRAM_FILES%\EnterSafe\ET199\ConfigTool_et199.exe
- C:\SbsUsbkey\Usbkey.html
- C:\SbsUsbkey\ShuttleCsp11_3003.dll
- C:\SbsUsbkey\et199csp11.dll
- C:\SbsUsbkey\eps1k_full.exe
- C:\SbsUsbkey\eps3knd.exe
- C:\SbsUsbkey\regsvr32.exe
- C:\SbsUsbkey\ngp11v211.dll
- C:\SbsUsbkey\MSGBOX.DLL
- C:\SbsUsbkey\OpensslLibrary.dll
- C:\SbsUsbkey\SealHtml.ocx
- C:\SbsUsbkey\Usbkey.ocx
- C:\SbsUsbkey\ePass3003-SimpChinese.exe
- C:\SbsUsbkey\ET199-SimpChinese.exe
- %PROGRAM_FILES%\EnterSafe\ET199\lang\escsp_1033.lng
- %PROGRAM_FILES%\EnterSafe\ePass3003\shuttle_certd3003.exe
- %PROGRAM_FILES%\EnterSafe\ePass3003\ePassManager_3003.exe
- %PROGRAM_FILES%\EnterSafe\ePass3003\ConfigTool_3003.exe
- %PROGRAM_FILES%\EnterSafe\ePass3003\uninst.exe
- %TEMP%\RegHidDevice.dll
- %PROGRAM_FILES%\EnterSafe\ePass3003\ShuttleCsp11_3003_s.reg
- %PROGRAM_FILES%\EnterSafe\ePass3003\ePass3003.ini
- %PROGRAM_FILES%\EnterSafe\ePass3003\lang\escsp_2052.lng
- %PROGRAM_FILES%\EnterSafe\ePass3003\lang\escfg_1033.lng
- %PROGRAM_FILES%\EnterSafe\ePass3003\lang\escfg_2052.lng
- %PROGRAM_FILES%\EnterSafe\ePass3003\lang\escertd_1033.lng
- %PROGRAM_FILES%\EnterSafe\ePass3003\lang\escertd_2052.lng
- %PROGRAM_FILES%\EnterSafe\ePass3003\lang\escsp_1033.lng
- %PROGRAM_FILES%\EnterSafe\ET199\lang\esmgr_1033.lng
- %PROGRAM_FILES%\EnterSafe\ET199\lang\esmgr_2052.lng
- <SYSTEM32>\et199csp11.sig
- %PROGRAM_FILES%\EnterSafe\ET199\lang\escsp_2052.lng
- %PROGRAM_FILES%\EnterSafe\ET199\lang\escfg_1033.lng
- %PROGRAM_FILES%\EnterSafe\ET199\lang\escfg_2052.lng
- <SYSTEM32>\et199csp11_s.dll
- %ALLUSERSPROFILE%\Start Menu\Programs\EnterSafe\ET199\卸载ET199.lnk
- %TEMP%\nsw5.tmp\System.dll
- %TEMP%\nsw5.tmp\UserInfo.dll
- <SYSTEM32>\et199csp11.dll
- %ALLUSERSPROFILE%\Start Menu\Programs\EnterSafe\ET199\ET199管理工具.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\EnterSafe\ET199\ET199配置工具.lnk
Удаляет следующие файлы:
- %TEMP%\nsw5.tmp\UserInfo.dll
- <SYSTEM32>\ngcsp.dll
- <SYSTEM32>\ngcsp.sgi
- %TEMP%\nss3.tmp\System.dll
- %TEMP%\nss3.tmp\UserInfo.dll
- %TEMP%\nsw5.tmp\System.dll
Другое:
Ищет следующие окна:
- ClassName: 'RegEdit_RegEdit' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
