Техническая информация
Для обеспечения автозапуска и распространения:
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\winmgmt] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\MSDTC] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\MSiSCSI] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\RpcSs] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\ProtectedStorage] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\SamSs] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- <SYSTEM32>\iscsiexe.exe
- C:\52dbc4b524142f83151a5e\update\update.exe /quiet /passive /norestart /n
Запускает на исполнение:
- <SYSTEM32>\msdtc.exe
Изменения в файловой системе:
Создает следующие файлы:
- <SYSTEM32>\SETA.tmp
- <SYSTEM32>\SETB.tmp
- %WINDIR%\iSCSI\SETC.tmp
- <SYSTEM32>\SET9.tmp
- <SYSTEM32>\SET6.tmp
- <SYSTEM32>\SET7.tmp
- <SYSTEM32>\SET8.tmp
- %WINDIR%\iSCSI\msiscdsm.inf
- %WINDIR%\iSCSI\SETF.tmp
- %WINDIR%\iSCSI\SET10.tmp
- %WINDIR%\iSCSI\SET11.tmp
- %WINDIR%\iSCSI\SETE.tmp
- %WINDIR%\iSCSI\SETD.tmp
- %WINDIR%\iSCSI\mpdev.inf
- %WINDIR%\iSCSI\mpio.inf
- C:\52dbc4b524142f83151a5e\$shtdwn$.req
- %WINDIR%\iscsi200.log
- %WINDIR%\iSCSIINS.LOG
- C:\52dbc4b524142f83151a5e\update\update.ver
- C:\52dbc4b524142f83151a5e\update\update_wxp.inf
- C:\52dbc4b524142f83151a5e\update\updatebr.inf
- C:\52dbc4b524142f83151a5e\update\eula.txt
- <SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem15.CAT
- <SYSTEM32>\SET3.tmp
- <SYSTEM32>\SET4.tmp
- <SYSTEM32>\SET5.tmp
- <SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\iscsi200.cat
- %WINDIR%\inf\oem15.inf
- %WINDIR%\inf\oem15.PNF
- %WINDIR%\iscsi200.cat
- %WINDIR%\iSCSI\Symbols\Dll\SET25.tmp
- %WINDIR%\iSCSI\Symbols\Dll\SET26.tmp
- %WINDIR%\iSCSI\Symbols\Exe\SET27.tmp
- %WINDIR%\iSCSI\Symbols\Dll\SET24.tmp
- %WINDIR%\iSCSI\Symbols\Dll\SET21.tmp
- %WINDIR%\iSCSI\Symbols\Dll\SET22.tmp
- %WINDIR%\iSCSI\Symbols\Dll\SET23.tmp
- %WINDIR%\iSCSI\Symbols\Exe\SET28.tmp
- %WINDIR%\iSCSI\Symbols\Sys\SET2D.tmp
- %WINDIR%\iSCSI\Symbols\Sys\SET2E.tmp
- %TEMP%\tmp2F.tmp
- %WINDIR%\iSCSI\Symbols\Sys\SET2C.tmp
- %WINDIR%\iSCSI\Symbols\Sys\SET29.tmp
- %WINDIR%\iSCSI\Symbols\Sys\SET2A.tmp
- %WINDIR%\iSCSI\Symbols\Sys\SET2B.tmp
- %WINDIR%\iSCSI\SET16.tmp
- %WINDIR%\iSCSI\SET17.tmp
- %WINDIR%\iSCSI\SET18.tmp
- %WINDIR%\iSCSI\SET15.tmp
- %WINDIR%\iSCSI\SET12.tmp
- %WINDIR%\iSCSI\SET13.tmp
- %WINDIR%\iSCSI\SET14.tmp
- %WINDIR%\iSCSI\SET19.tmp
- %WINDIR%\iSCSI\SET1E.tmp
- %WINDIR%\iSCSI\Symbols\Cpl\SET1F.tmp
- %WINDIR%\iSCSI\Symbols\Dll\SET20.tmp
- %WINDIR%\iSCSI\SET1D.tmp
- %WINDIR%\iSCSI\SET1A.tmp
- <DRIVERS>\SET1B.tmp
- %WINDIR%\iSCSI\SET1C.tmp
- C:\52dbc4b524142f83151a5e\iscsi.inf
- C:\52dbc4b524142f83151a5e\mpdev.inf
- C:\52dbc4b524142f83151a5e\mpio.inf
- C:\52dbc4b524142f83151a5e\spupdsvc.exe
- C:\52dbc4b524142f83151a5e\iscsicli.exe
- C:\52dbc4b524142f83151a5e\iscsiexe.exe
- C:\52dbc4b524142f83151a5e\spuninst.exe
- C:\52dbc4b524142f83151a5e\msiscdsm.inf
- C:\52dbc4b524142f83151a5e\iscsiprf.mof
- C:\52dbc4b524142f83151a5e\iscsirem.mof
- C:\52dbc4b524142f83151a5e\iscsicli.pdb
- C:\52dbc4b524142f83151a5e\iscsip2k.mof
- C:\52dbc4b524142f83151a5e\iscsidsc.mof
- C:\52dbc4b524142f83151a5e\iscsievt.mof
- C:\52dbc4b524142f83151a5e\iscsihba.mof
- C:\52dbc4b524142f83151a5e\iscsicpl.cpl
- C:\52dbc4b524142f83151a5e\iscsidip.dll
- C:\52dbc4b524142f83151a5e\iscsidsc.dll
- C:\52dbc4b524142f83151a5e\mpio.cat
- %TEMP%\iscsiclient.exe
- C:\52dbc4b524142f83151a5e\empty.cat
- C:\52dbc4b524142f83151a5e\iscsi.cat
- C:\52dbc4b524142f83151a5e\iscsilog.dll
- C:\52dbc4b524142f83151a5e\iscsixip.dll
- C:\52dbc4b524142f83151a5e\spmsg.dll
- C:\52dbc4b524142f83151a5e\uguide.doc
- C:\52dbc4b524142f83151a5e\iscsiwmi.dll
- C:\52dbc4b524142f83151a5e\iscsipp.dll
- C:\52dbc4b524142f83151a5e\iscsium.dll
- C:\52dbc4b524142f83151a5e\iscsiwip.dll
- C:\52dbc4b524142f83151a5e\mpspfltr.sys
- C:\52dbc4b524142f83151a5e\msiscdsm.sys
- C:\52dbc4b524142f83151a5e\msiscsi.sys
- C:\52dbc4b524142f83151a5e\mpio.sys
- C:\52dbc4b524142f83151a5e\msiscsi.pdb
- C:\52dbc4b524142f83151a5e\iscsiprt.sys
- C:\52dbc4b524142f83151a5e\mpdev.sys
- C:\52dbc4b524142f83151a5e\readme.txt
- C:\52dbc4b524142f83151a5e\update\update.exe
- C:\52dbc4b524142f83151a5e\update\update_w03.inf
- C:\52dbc4b524142f83151a5e\update\update_w2k.inf
- C:\52dbc4b524142f83151a5e\update\updspapi.dll
- C:\52dbc4b524142f83151a5e\relnotes.txt
- C:\52dbc4b524142f83151a5e\update\iscsi200.cat
- C:\52dbc4b524142f83151a5e\update\iscsiupd.dll
- C:\52dbc4b524142f83151a5e\iscsipp.pdb
- C:\52dbc4b524142f83151a5e\iscsiprt.pdb
- C:\52dbc4b524142f83151a5e\iscsium.pdb
- C:\52dbc4b524142f83151a5e\iscsiexe.pdb
- C:\52dbc4b524142f83151a5e\iscsicpl.pdb
- C:\52dbc4b524142f83151a5e\iscsidip.pdb
- C:\52dbc4b524142f83151a5e\iscsidsc.pdb
- C:\52dbc4b524142f83151a5e\iscsiupd.pdb
- C:\52dbc4b524142f83151a5e\mpio.pdb
- C:\52dbc4b524142f83151a5e\mpspfltr.pdb
- C:\52dbc4b524142f83151a5e\msiscdsm.pdb
- C:\52dbc4b524142f83151a5e\mpdev.pdb
- C:\52dbc4b524142f83151a5e\iscsiwip.pdb
- C:\52dbc4b524142f83151a5e\iscsiwmi.pdb
- C:\52dbc4b524142f83151a5e\iscsixip.pdb
Присваивает атрибут 'скрытый' для следующих файлов:
- <SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\iscsi200.cat
- <SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem15.CAT
Удаляет следующие файлы:
- %WINDIR%\_000000_.tmp.dll
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
