Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'irwftp' = '%WINDIR%\system\Isass.exe'
Вредоносные функции:
Создает и запускает на исполнение:
- %WINDIR%\system\Isass.exe
Изменения в файловой системе:
Создает следующие файлы:
- %WINDIR%\Filespro\Sales\Local\senha_GER.zip
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\senha_GER[1].html
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\teclado_CX[1].html
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\tela2_BB[1].html
- %WINDIR%\Filespro\Sales\Local\teclado_CX.zip
- %WINDIR%\Filespro\Sales\Local\senha_AMARELA.zip
- %WINDIR%\Filespro\Sales\Local\logo_BB.zip
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\logo_BB[1].html
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\logoPF[1].html
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\senha_AMARELA[1].html
- %WINDIR%\Filespro\Sales\Local\logoPF.zip
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\TV_PJ[1].html
- %WINDIR%\Filespro\Sales\Local\tela_caixa_assinatura.zip
- %WINDIR%\Filespro\Sales\Local\TV_PJ.zip
- %WINDIR%\winnavps\bbb.bck
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bbb[1].html
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\tela_caixa_assinatura[1].html
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\tela_brad_sencartao[1].html
- %WINDIR%\Filespro\Sales\Local\tela2_BB.zip
- %WINDIR%\Filespro\Sales\Local\tela_brad_sencartao.zip
- %WINDIR%\Filespro\Sales\Local\tela_Bradesco_senha.zip
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\tela_Bradesco_senha[1].html
- %WINDIR%\Filespro\Sales\Local\barra_brad.zip
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\barra_brad[1].html
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\barra_progress[1].html
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt_confirma[1].html
- %WINDIR%\Filespro\Sales\Local\barra_progress.zip
- %WINDIR%\Filespro\Sales\Local\barra2-PROGRESS.zip
- %WINDIR%\system\cartao.html
- %WINDIR%\system\Isass.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\topo2[1].html
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\barra2-PROGRESS[1].html
- %WINDIR%\Filespro\Sales\Local\topo2.zip
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\caps[1].html
- %WINDIR%\Filespro\Sales\Local\campo_CX.zip
- %WINDIR%\Filespro\Sales\Local\caps.zip
- %WINDIR%\Filespro\Sales\Local\err_bb.zip
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\err_bb[1].html
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\campo_CX[1].html
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt_retornaCX[1].html
- %WINDIR%\Filespro\Sales\Local\bt_confirma.zip
- %WINDIR%\Filespro\Sales\Local\bt_retornaCX.zip
- %WINDIR%\Filespro\Sales\Local\cadeado.zip
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\cadeado[1].html
Сетевая активность:
Подключается к:
- 'fl#######005.vila.bol.com.br':80
- 'localhost':1036
TCP:
Запросы HTTP GET:
- fl#######005.vila.bol.com.br/teclado_CX.html
- fl#######005.vila.bol.com.br/tela2_BB.html
- fl#######005.vila.bol.com.br/senha_GER.html
- fl#######005.vila.bol.com.br/logoPF.html
- fl#######005.vila.bol.com.br/senha_AMARELA.html
- fl#######005.vila.bol.com.br/TV_PJ.html
- fl#######005.vila.bol.com.br/bbb.html
- fl#######005.vila.bol.com.br/tela_caixa_assinatura.html
- fl#######005.vila.bol.com.br/tela_brad_sencartao.html
- fl#######005.vila.bol.com.br/tela_Bradesco_senha.html
- fl#######005.vila.bol.com.br/logo_BB.html
- fl#######005.vila.bol.com.br/barra_progress.html
- fl#######005.vila.bol.com.br/bt_confirma.html
- fl#######005.vila.bol.com.br/barra_brad.html
- fl#######005.vila.bol.com.br/topo2.html
- fl#######005.vila.bol.com.br/barra2-PROGRESS.html
- fl#######005.vila.bol.com.br/caps.html
- fl#######005.vila.bol.com.br/err_bb.html
- fl#######005.vila.bol.com.br/campo_CX.html
- fl#######005.vila.bol.com.br/bt_retornaCX.html
- fl#######005.vila.bol.com.br/cadeado.html
UDP:
- DNS ASK fl#######005.vila.bol.com.br
Другое:
Ищет следующие окна:
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
