TR/AD.TeslaCrypt.Y.176
摘要
名稱
TR/AD.TeslaCrypt.Y.176
发现日期
2016年2月12日
VDF 版本
7.12.53.104 (2016-02-04 09:26)
病毒說明
'TR' 一詞表示特洛伊木馬程式,它能夠偵察資料來侵害您的隱私,或是對系統執行有害的通知。
作業系統:Microsoft Windows。
傳播方法:透過執行受感染的檔案。
傳播方法:透過造訪受感染的網站。
此惡意程式xxx會竊取敏感性資訊。
VDF
7.12.53.104 (2016-02-04 09:26)
別名
Avast: Win32:Trojan-gen
AVG: Generic_r.HEB
Dr. Web: Trojan.Encoder.3750
McAfee: GenericR-FVV!8BA8CD6294BB
Microsoft: Ransom:Win32/Tescrypt!rfn
G Data: Trojan.Agent.BQEJ
Kaspersky Lab: Trojan-Banker.Win32.Shifu.akb
Bitdefender: Trojan.Agent.BQEJ
ESET: Win32/Filecoder.TeslaCrypt.I trojan
檔案
建立下列自身複本:
%APPDATA%\gcdyomy.exe
建立下列檔案:
%USERPROFILE%\My Documents\recover_file_voevqoook.txt
%DISKDRIVE%\492c324b9eefd9d79f77\amd64\HELP_RECOVER_instructions+cgo.png
%DISKDRIVE%\492c324b9eefd9d79f77\amd64\HELP_RECOVER_instructions+cgo.txt
%DISKDRIVE%\492c324b9eefd9d79f77\amd64\HELP_RECOVER_instructions+cgo.html
重新命名下列檔案:
%DISKDRIVE%\67edd601553864307ce739a3c57414fe\eula.1025.rtf
%DISKDRIVE%\67edd601553864307ce739a3c57414fe\eula.1028.rtf
%DISKDRIVE%\67edd601553864307ce739a3c57414fe\eula.1029.rtf
%DISKDRIVE%\67edd601553864307ce739a3c57414fe\eula.1030.rtf
%DISKDRIVE%\67edd601553864307ce739a3c57414fe\eula.1031.rtf
%DISKDRIVE%\67edd601553864307ce739a3c57414fe\eula.1032.rtf
%DISKDRIVE%\67edd601553864307ce739a3c57414fe\eula.1033.rtf
%DISKDRIVE%\67edd601553864307ce739a3c57414fe\eula.1035.rtf
%DISKDRIVE%\67edd601553864307ce739a3c57414fe\eula.1036.rtf
%DISKDRIVE%\67edd601553864307ce739a3c57414fe\eula.1037.rtf
%DISKDRIVE%\67edd601553864307ce739a3c57414fe\eula.1038.rtf
%DISKDRIVE%\67edd601553864307ce739a3c57414fe\eula.1040.rtf
%DISKDRIVE%\67edd601553864307ce739a3c57414fe\eula.1041.rtf
%DISKDRIVE%\67edd601553864307ce739a3c57414fe\eula.1042.rtf
%DISKDRIVE%\67edd601553864307ce739a3c57414fe\eula.1043.rtf
%DISKDRIVE%\67edd601553864307ce739a3c57414fe\eula.1044.rtf
%DISKDRIVE%\67edd601553864307ce739a3c57414fe\eula.1045.rtf
%DISKDRIVE%\67edd601553864307ce739a3c57414fe\eula.1046.rtf
%DISKDRIVE%\67edd601553864307ce739a3c57414fe\eula.1049.rtf
%DISKDRIVE%\67edd601553864307ce739a3c57414fe\eula.1053.rtf
%DISKDRIVE%\67edd601553864307ce739a3c57414fe\eula.1055.rtf
%DISKDRIVE%\67edd601553864307ce739a3c57414fe\eula.2052.rtf
%DISKDRIVE%\67edd601553864307ce739a3c57414fe\eula.2070.rtf
%DISKDRIVE%\67edd601553864307ce739a3c57414fe\eula.3082.rtf
%DISKDRIVE%\Documents and Settings\All Users\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma
%DISKDRIVE%\Documents and Settings\All Users\Documents\My Music\Sample Music\New Stories (Highway Blues).wma
%DISKDRIVE%\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
%DISKDRIVE%\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Sunset.jpg
%DISKDRIVE%\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Water lilies.jpg
變更下列檔案:
%DISKDRIVE%\67edd601553864307ce739a3c57414fe\eula.1025.rtf
%DISKDRIVE%\67edd601553864307ce739a3c57414fe\eula.1028.rtf
%DISKDRIVE%\67edd601553864307ce739a3c57414fe\eula.1029.rtf
%DISKDRIVE%\67edd601553864307ce739a3c57414fe\eula.1030.rtf
%DISKDRIVE%\67edd601553864307ce739a3c57414fe\eula.1031.rtf
%DISKDRIVE%\67edd601553864307ce739a3c57414fe\eula.1032.rtf
%DISKDRIVE%\67edd601553864307ce739a3c57414fe\eula.1033.rtf
%DISKDRIVE%\67edd601553864307ce739a3c57414fe\eula.1035.rtf
%DISKDRIVE%\67edd601553864307ce739a3c57414fe\eula.1036.rtf
%DISKDRIVE%\67edd601553864307ce739a3c57414fe\eula.1037.rtf
%DISKDRIVE%\67edd601553864307ce739a3c57414fe\eula.1038.rtf
%DISKDRIVE%\67edd601553864307ce739a3c57414fe\eula.1040.rtf
%DISKDRIVE%\67edd601553864307ce739a3c57414fe\eula.1041.rtf
%DISKDRIVE%\67edd601553864307ce739a3c57414fe\eula.1042.rtf
%DISKDRIVE%\67edd601553864307ce739a3c57414fe\eula.1043.rtf
%DISKDRIVE%\67edd601553864307ce739a3c57414fe\eula.1044.rtf
%DISKDRIVE%\67edd601553864307ce739a3c57414fe\eula.1045.rtf
%DISKDRIVE%\67edd601553864307ce739a3c57414fe\eula.1046.rtf
%DISKDRIVE%\67edd601553864307ce739a3c57414fe\eula.1049.rtf
%DISKDRIVE%\67edd601553864307ce739a3c57414fe\eula.1053.rtf
%DISKDRIVE%\67edd601553864307ce739a3c57414fe\eula.1055.rtf
%DISKDRIVE%\67edd601553864307ce739a3c57414fe\eula.2052.rtf
%DISKDRIVE%\67edd601553864307ce739a3c57414fe\eula.2070.rtf
%DISKDRIVE%\67edd601553864307ce739a3c57414fe\eula.3082.rtf
%DISKDRIVE%\Documents and Settings\All Users\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma
%DISKDRIVE%\Documents and Settings\All Users\Documents\My Music\Sample Music\New Stories (Highway Blues).wma
%DISKDRIVE%\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
%DISKDRIVE%\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Sunset.jpg
%DISKDRIVE%\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Water lilies.jpg
%DISKDRIVE%\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Winter.jpg
刪除下列檔案:
%temporary internet files%\Content.IE5\QH9ZEEV0\mzsys[1].htm
插入
%APPDATA%\gcdyomy.exe
登錄
新增下列登錄授權xxx:
HKEY_CURRENT_USER\Software\xxxsys ("ID": %hex values%)
HKEY_CURRENT_USER\Software\81C371DB69316EB ("data": %hex values%)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system ("EnableLinkedConnections": dword:00000001)
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run ("gatert-12010": "%APPDATA%\gcdyomy.exe")
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ("gatert-12010": "%APPDATA%\gcdyomy.exe")
HTTP 請求
southinstrument.*****emplates/protostar/less/mzsys.php
bddadmin.*****rdins.fr/js/openlayers/theme/default/img/mzsys.php
grant-pro.*****emplates/beez3/html/com_newsfeeds/categories/mzsys.php
iicsdrd.*****mp/mzsys.php