Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] '' = ''
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'GrpConv' = 'grpconv -o'
- [<HKLM>\SOFTWARE\Classes\MSProgramGroup\Shell\Open\Command] '' = '<SYSTEM32>\grpconv.exe %1'
- [<HKLM>\SOFTWARE\Classes\cmdfile\shell\open\command] '' = '"%1" %*'
- [<HKLM>\SOFTWARE\Classes\comfile\shell\open\command] '' = '"%1" %*'
- [<HKLM>\SOFTWARE\Classes\exefile\shell\open\command] '' = '"%1" %*'
- [<HKLM>\SOFTWARE\Classes\batfile\shell\open\command] '' = '"%1" %*'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\PROCEXP90] 'ImagePath' = '<DRIVERS>\PROCEXP90.SYS'
Вредоносные функции:
Создает и запускает на исполнение:
- C:\327882R2FWJFW\swreg.cfexe acl "hklm\software\microsoft\windows nt\currentversion\windows" /DE:F /Q query "hklm\software\microsoft\windows nt\currentversion\windows" acl "hklm\software\microsoft\windows nt\currentversion\windows" /RE:F /Q
- C:\<Имя вируса>\grep.cfexe -qi ".CFEXE;" -qi "\.CFEXE;"
- <SYSTEM32>\CF3222.exe /S /D /c" ECHO..cfexe;.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH" /S /D /c" SET PATHEXT" /S /D /c" ECHO.0409" /S /D /c" DIR /AD/B C:\* " /f:off /d /c call Start_.cmd /k c.bat
- C:\327882R2FWJFW\Findstr.cfexe -LIXC:"<Имя вируса>" dirname00 -IVX ComboFix
- C:\<Имя вируса>\swreg.cfexe query "HKLM\System\CurrentControlSet\Control\NLS\Language" /V InstallLanguage query "HKLM\System\CurrentControlSet\Control\NLS\CodePage" /V ACP
- C:\<Имя вируса>\Findstr.cfexe -E "0A" -E "10" -E "05" -IV "\\detoured\.dll" -E "04" -E "13" -E "0C" -E "07" -E "16" -E "0B"
- C:\<Имя вируса>\pv.cfexe -m CF3222.exe -q -e
- C:\<Имя вируса>\sed.cfexe -r "1d; /\t$/!d; s/.*\t(.:\\.*)\t.*/\1/;" "/.*\t/!d; s///"
- C:\<Имя вируса>\mtee.cfexe NlsLang
- C:\327882R2FWJFW\grep.cfexe -sq "currentversion.* 6.0" osVer00 -isqx "FileName=[-[:alnum:]@.]*" FileName
- C:\327882R2FWJFW\swreg.exe add "hklm\software\microsoft\windows\currentversion\app paths\combofix.exe" /ve /d "<Полный путь к вирусу>" acl "hklm\software\microsoft\windows nt\currentversion\windows" /de:f /q import 327882R2FWJFW\EXE.reg
- C:\327882R2FWJFW\handle.cfexe
- C:\327882R2FWJFW\nircmd.com exec hide 327882R2FWJFW\prep.cmd >Bug.txt exec hide 327882R2FWJFW\SWREG.exe acl "hklm\software\microsoft\windows nt\currentversion\windows" /de:f /q shexec install 327882R2FWJFW\nircmd.inf
- C:\327882R2FWJFW\hidec.exe 327882R2FWJFW\swreg.exe import 327882R2FWJFW\EXE.reg
- C:\327882R2FWJFW\sed.cfexe "/\t.*\\nircmd\.inf$/!d; s///; s/./@pv -kfi &/" -r "/<Non-existant Process> pid: ([0-9]*) .*/!d; s//@Nircmd KillProcess \/\1/"
- C:\327882R2FWJFW\Attrib.cfexe +R "C:\327882R2FWJFW\*.com" +R "C:\327882R2FWJFW\*.cfexe"
- C:\327882R2FWJFW\swxcacls.cfexe "<SYSTEM32>\cmd.exe" /P /GA:F /GS:F /GP:X /GU:X /Q "<SYSTEM32>\cmd.exe" /OA /Q
- C:\327882R2FWJFW\pv.cfexe -o"%i\t%l"
- C:\327882R2FWJFW\NirCmd.cfexe exec hide "<SYSTEM32>\CF3222.exe" /f:off /d /c call Start_.cmd execmd DEL "\327882R2FWJFW\prep.cmd" win close class "#32770" win close ititle "ComboFix"
Запускает на исполнение:
- <SYSTEM32>\find.exe "Windows XP" temp00
- <SYSTEM32>\grpconv.exe -o
- <SYSTEM32>\chcp.com 1251
- <SYSTEM32>\attrib.exe +R "<Полный путь к вирусу>"
- <SYSTEM32>\runonce.exe -r
- <SYSTEM32>\rundll32.exe setupapi,InstallHinfSection DefaultInstall 132 C:\327882R2FWJFW\nircmd.inf
- <SYSTEM32>\find.exe "Microsoft Windows [Version 5.2.3790]" temp00
- <SYSTEM32>\cmd.exe /c 327882R2FWJFW\prep.cmd >Bug.txt
Изменения в файловой системе:
Создает следующие файлы:
- C:\327882R2FWJFW\safeboot.def.vista.dat
- C:\327882R2FWJFW\SafeBootRepair.bat
- C:\327882R2FWJFW\sed.cfexe
- C:\327882R2FWJFW\safeboot.def.dat
- C:\327882R2FWJFW\rogues.dat
- C:\327882R2FWJFW\run2.sed
- C:\327882R2FWJFW\safeboot.dat
- C:\327882R2FWJFW\SetEnvmt.bat
- C:\327882R2FWJFW\svchost.dat
- C:\327882R2FWJFW\svchost.vista.dat
- C:\327882R2FWJFW\svclist.sed
- C:\327882R2FWJFW\SvcDrv.vbs
- C:\327882R2FWJFW\setpath.cfexe
- C:\327882R2FWJFW\SF.cfexe
- C:\327882R2FWJFW\srizbi.md5
- C:\327882R2FWJFW\OSid.vbs
- C:\327882R2FWJFW\Policies.dat
- C:\327882R2FWJFW\Prep.cmd
- C:\327882R2FWJFW\NirCmdC.cfexe
- C:\327882R2FWJFW\NirCmd.cfexe
- C:\327882R2FWJFW\nircmd.com
- C:\327882R2FWJFW\NirCmd.inf
- C:\327882R2FWJFW\psexec.cfexe
- C:\327882R2FWJFW\region.dat
- C:\327882R2FWJFW\RestoreO4.bat
- C:\327882R2FWJFW\restore_pt.vbs
- C:\327882R2FWJFW\RegDo.sed
- C:\327882R2FWJFW\Purity.dat
- C:\327882R2FWJFW\pv.cfexe
- C:\327882R2FWJFW\Qoo.bat
- C:\327882R2FWJFW\svc_wht.dat
- C:\327882R2FWJFW\FileName
- C:\327882R2FWJFW\dirname00
- C:\327882R2FWJFW\MWindows.dat
- <SYSTEM32>\CF3222.exe
- C:\327882R2FWJFW\swreg.cfexe
- C:\327882R2FWJFW\Findstr.cfexe
- C:\327882R2FWJFW\Attrib.cfexe
- C:\Start_.cmd
- C:\<Имя вируса>\NULL
- C:\<Имя вируса>\Lang01
- C:\<Имя вируса>\NlsLang
- C:\<Имя вируса>\chcp.bat
- C:\<Имя вируса>\kmd.dat
- C:\<Имя вируса>\erunt.dat
- C:\<Имя вируса>\lang00
- C:\327882R2FWJFW\toolbar.sed
- C:\327882R2FWJFW\vfind.cfexe
- C:\327882R2FWJFW\whitedirB.dat
- C:\327882R2FWJFW\system_ini.dat
- C:\327882R2FWJFW\swreg.exe
- C:\327882R2FWJFW\swsc.cfexe
- C:\327882R2FWJFW\swxcacls.cfexe
- C:\327882R2FWJFW\WhiteLegacy.dat
- C:\327882R2FWJFW\temp00
- C:\327882R2FWJFW\NULL
- <DRIVERS>\PROCEXP90.SYS
- C:\Bug.txt
- C:\327882R2FWJFW\zDomain.dat
- C:\327882R2FWJFW\zhsvc.dat
- C:\327882R2FWJFW\zip.cfexe
- C:\327882R2FWJFW\DPF.sed
- C:\327882R2FWJFW\DPF.str
- C:\327882R2FWJFW\dumphive.cfexe
- C:\327882R2FWJFW\Disclaimer.bat
- C:\327882R2FWJFW\CregC.dat
- C:\327882R2FWJFW\dd.cfexe
- C:\327882R2FWJFW\DelClsid.bat
- C:\327882R2FWJFW\embedded.sed
- C:\327882R2FWJFW\ERUNT.LOC
- C:\327882R2FWJFW\Exe.reg
- C:\327882R2FWJFW\executables.dat
- C:\327882R2FWJFW\ERUNT.cfexe
- C:\327882R2FWJFW\ERDNT.e_e
- C:\327882R2FWJFW\ERDNTDOS.LOC
- C:\327882R2FWJFW\ERDNTWIN.LOC
- C:\327882R2FWJFW\Boot.bat
- C:\327882R2FWJFW\BootSect
- C:\327882R2FWJFW\C.bat
- C:\327882R2FWJFW\badclsid
- C:\327882R2FWJFW\023.dat
- C:\327882R2FWJFW\023v.dat
- C:\327882R2FWJFW\Assoc.cmd
- C:\327882R2FWJFW\catchme.cfexe
- C:\327882R2FWJFW\Comspec.bat
- C:\327882R2FWJFW\Creg.dat
- C:\327882R2FWJFW\CregC.cmd
- C:\327882R2FWJFW\ComboFix-Download.exe
- C:\327882R2FWJFW\clsid.dat
- C:\327882R2FWJFW\Combo-Fix.sys
- C:\327882R2FWJFW\Combobatch.bat
- C:\327882R2FWJFW\extract.cfexe
- C:\327882R2FWJFW\md5deep.cfexe
- C:\327882R2FWJFW\moveex.cfexe
- C:\327882R2FWJFW\MoveIt.bat
- C:\327882R2FWJFW\LocalSystemNetworkRestricted.dat
- C:\327882R2FWJFW\LocalDrive.vbs
- C:\327882R2FWJFW\LocalService.dat
- C:\327882R2FWJFW\LocalServiceNetworkRestricted.dat
- C:\327882R2FWJFW\mtee.cfexe
- C:\327882R2FWJFW\netsvc.vista.dat
- C:\327882R2FWJFW\netsvc.xp.dat
- C:\327882R2FWJFW\NetworkService.dat
- C:\327882R2FWJFW\netsvc.dat
- C:\327882R2FWJFW\ndis_combofix.dat
- C:\327882R2FWJFW\ND_.bat
- C:\327882R2FWJFW\netsvc.bad.dat
- C:\327882R2FWJFW\FProps.vbs
- C:\327882R2FWJFW\grep.cfexe
- C:\327882R2FWJFW\gsar.cfexe
- C:\327882R2FWJFW\FIXLSP.bat
- C:\327882R2FWJFW\fdsv.cfexe
- C:\327882R2FWJFW\Fin.dat
- C:\327882R2FWJFW\FIND3M.bat
- C:\327882R2FWJFW\handle.cfexe
- C:\327882R2FWJFW\LFN.vbs
- C:\327882R2FWJFW\List-C.bat
- C:\327882R2FWJFW\lnkread.vbs
- C:\327882R2FWJFW\Lang.bat
- C:\327882R2FWJFW\hidec.exe
- C:\327882R2FWJFW\history.bat
- C:\327882R2FWJFW\image001.gif
Удаляет следующие файлы:
- C:\Start_.cmd
- C:\327882R2FWJFW\Prep.cmd
- C:\Bug.txt
- C:\<Имя вируса>\Lang01
- C:\<Имя вируса>\lang00
- C:\327882R2FWJFW\temp00
- <DRIVERS>\PROCEXP90.SYS
- C:\327882R2FWJFW\NirCmd.inf
- C:\327882R2FWJFW\dirname00
- C:\327882R2FWJFW\FileName
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
