Windows

특정 설치프로그램에 종속되어 설치되는 스폰서프로그램이 또다른 악성코드를 설치한다.

주로 생성되는 대표적인 디렉토리는 아래 세곳이며, 배포하는 사용자마다 파일경로는 약간 다르다.
C:\Documents and Settings\Username\Application Data\
C:\Documents and Settings\Username\Application Data\(파일명과 동일한 폴더명)\
C:\WINDOWS\system32\
C:\WINDOWS\system32\Temp\

시작프로그램에 등록된 값은 숫자와 영자로 조합되고 랜덤으로 등록된다. 20자이상.

그중 일부다.
b3b1bab6a9bdbcf0bba6bb
c3b2bac2a9bdaegkbba6ea
bac2a9bdaegk3jy6hfdf0fesf
h6a9brtyrty53dbcf09bdaegk
9bdaegk3jy6hfdtyrty53db6k
e38gk3jy6hfd35tyr82tylm46

msconfig에서 해당값을 체크해제하고, 해당 파일을 제거한다.


지금까지 확인한 프로세스다. 파일명도 랜덤이라 프로세스를 확인하기도 어렵다.
이전에 작성한 악성코드와는 달리 이번것은 파일명이 모두 4자리로 구성되어 있다.

aajd.exe
abdj.exe
abgf.exe
abir.exe
abnw.exe
acco.exe
acyx.exe
aefb.exe
aenm.exe
afbe.exe
afuy.exe
agdp.exe
aghs.exe
agti.exe
agul.exe
agut.exe
agvh.exe
ahet.exe
ahhw.exe
ahku.exe
ahoe.exe
ahrp.exe
airq.exe
ajww.exe
akfa.exe
akot.exe
algk.exe
amgo.exe
amjb.exe
amun.exe
amvo.exe
amxt.exe
aogo.exe
aomj.exe
aopn.exe
apaj.exe
apxg.exe
aqjs.exe
aqpa.exe
aqqb.exe
aqug.exe
arbg.exe
asbr.exe
ases.exe
asnj.exe
asws.exe
asxp.exe
atht.exe
atmn.exe
atna.exe
atok.exe
atuc.exe
auli.exe
autf.exe
avwy.exe
avxp.exe
axds.exe
axkq.exe
axlb.exe
axlc.exe
axtc.exe
ayay.exe
ayds.exe
aynr.exe
babu.exe
bajb.exe
bapi.exe
bavc.exe
bawg.exe
bawi.exe
bbns.exe
bccb.exe
bcmk.exe
bcvg.exe
bcvh.exe
bdet.exe
bdmg.exe
bdnx.exe
befh.exe
bemc.exe
benw.exe
besp.exe
bfuk.exe
bgek.exe
bgfh.exe
bgmx.exe
bide.exe
bigv.exe
biht.exe
bjmp.exe
bknk.exe
bkwd.exe
blvn.exe
bmgm.exe
bmtd.exe
bmvj.exe
bnaj.exe
bnqy.exe
bnwk.exe
bnxj.exe
bnxy.exe
bpgd.exe
bpht.exe
bpin.exe
brmm.exe
brtm.exe
bsdi.exe
bsxs.exe
btcp.exe
bteh.exe
btno.exe
btpd.exe
btqv.exe
btrc.exe
bujd.exe
bvmh.exe
bvsc.exe
bxsb.exe
bxsf.exe
bywv.exe
caid.exe
caof.exe
cckc.exe
cckp.exe
ccmg.exe
cdvi.exe
cebo.exe
cefi.exe
cewb.exe
cgem.exe
cgoy.exe
chqj.exe
chxh.exe
ciak.exe
cigw.exe
cipa.exe
ciuh.exe
civw.exe
cjwp.exe
ckst.exe
ckxt.exe
cldh.exe
clqf.exe
clwp.exe
cmah.exe
cmmp.exe
cmuc.exe
cmxc.exe
cnbj.exe
coye.exe
cqeh.exe
cqil.exe
cqsf.exe
cscl.exe
csco.exe
ctkm.exe
ctsl.exe
cwlc.exe
cxqo.exe
cycf.exe
cyqn.exe
dabp.exe
daow.exe
datb.exe
dbxk.exe
dcey.exe
dcpi.exe
dcub.exe
dcwn.exe
dddo.exe
ddsv.exe
dehw.exe
dfeu.exe
dfmg.exe
dgpo.exe
dhxi.exe
dhxq.exe
difq.exe
dinf.exe
diwb.exe
dkam.exe
dkpk.exe
dlkf.exe
dlsn.exe
dmie.exe
dmql.exe
dmrs.exe
dmrx.exe
dmsg.exe
dmyt.exe
dnns.exe
dnrk.exe
dntm.exe
dnxp.exe
docl.exe
dolj.exe
douq.exe
dsik.exe
dsrr.exe
dtdr.exe
dtko.exe
dtmp.exe
ducu.exe
duwa.exe
dvvw.exe
dwac.exe
dwjf.exe
dwsv.exe
dygn.exe
dylc.exe
eamg.exe
eaww.exe
edjd.exe
edqb.exe
edsc.exe
efrq.exe
egaq.exe
egfo.exe
eglk.exe
egxq.exe
ehpc.exe
eiki.exe
eikt.exe
einl.exe
einw.exe
eiur.exe
ejug.exe
ekfm.exe
empp.exe
enko.exe
eovc.exe
eovu.exe
epfg.exe
epmc.exe
eppt.exe
eqgf.exe
eqmb.exe
eqxu.exe
erbq.exe
ernv.exe
etiw.exe
etlx.exe
etxw.exe
euad.exe
eusp.exe
evrw.exe
evux.exe
ewsp.exe
ewth.exe
exrh.exe
extx.exe
eylo.exe
eyok.exe
fbmx.exe
fcwa.exe
fdai.exe
fdar.exe
fdgh.exe
fdmy.exe
fdqq.exe
feio.exe
fewt.exe
ffap.exe
ffas.exe
ffee.exe
ffok.exe
ffqx.exe
ffyu.exe
fghk.exe
fhdj.exe
fhkf.exe
fima.exe
fjni.exe
fjqi.exe
fkbf.exe
fkiv.exe
fkna.exe
fknb.exe
fkrp.exe
flau.exe
flwe.exe
fmhl.exe
fnlw.exe
food.exe
fpaa.exe
fpoc.exe
fqcw.exe
fqpt.exe
fqpy.exe
fqvm.exe
frio.exe
fskm.exe
ftfd.exe
ftqe.exe
fuhg.exe
fuqp.exe
fuyt.exe
fvgh.exe
fvyr.exe
fvys.exe
fwow.exe
fwuq.exe
fwxn.exe
fxaj.exe
fxbp.exe
fxbw.exe
fxdq.exe
fxqn.exe
fxyc.exe
fyau.exe
fydu.exe
fymw.exe
fyuh.exe
gamh.exe
gavb.exe
gavj.exe
gbam.exe
gbmt.exe
gbyd.exe
gdcp.exe
gdff.exe
gduu.exe
gesn.exe
gewc.exe
gfkv.exe
ggtx.exe
ghfs.exe
ghkw.exe
ghrr.exe
ghxt.exe
gijd.exe
gjag.exe
gjni.exe
gken.exe
glud.exe
gmvs.exe
gmwv.exe
gnbm.exe
gnfb.exe
gnsl.exe
gogb.exe
gogs.exe
gojb.exe
goww.exe
gpek.exe
gpkf.exe
gqgv.exe
gqjn.exe
gsli.exe
gume.exe
gumy.exe
gvjt.exe
gvmf.exe
gwbh.exe
gwdi.exe
gwdo.exe
gwlu.exe
gxds.exe
gxif.exe
gxlq.exe
gxyr.exe
gyds.exe
gyxp.exe
hajl.exe
hbds.exe
hbfs.exe
hbqc.exe
hcgm.exe
hckw.exe
hcqi.exe
hddb.exe
hebu.exe
hely.exe
hfdh.exe
hfqe.exe
hfwg.exe
hfxx.exe
hgfd.exe
hgte.exe
hhgc.exe
hhrm.exe
hisw.exe
hkdx.exe
hkyt.exe
hlow.exe
hlvm.exe
hmai.exe
hmlh.exe
hnnu.exe
hnqm.exe
hnvo.exe
hoxk.exe
hpfb.exe
hpha.exe
hqqj.exe
hrmb.exe
hsev.exe
hsge.exe
hsgt.exe
hsug.exe
htcq.exe
htv.exe
hulx.exe
huxh.exe
hvbw.exe
hvdb.exe
hviq.exe
hvxt.exe
hwcb.exe
hwrv.exe
hwwa.exe
hxew.exe
hxfy.exe
hxrm.exe
hygd.exe
hynv.exe
iann.exe
iapj.exe
ibmc.exe
ibpo.exe
ibpq.exe
ibsq.exe
icps.exe
ictv.exe
idld.exe
ieir.exe
iemb.exe
ievc.exe
iexc.exe
ifkm.exe
iftj.exe
igay.exe
igjl.exe
ihac.exe
ihii.exe
ihuc.exe
ihym.exe
ihyn.exe
iigv.exe
ijns.exe
ijoq.exe
ijwv.exe
iksi.exe
iktv.exe
ilea.exe
ilnw.exe
imru.exe
imvs.exe
indq.exe
inyb.exe
ipdk.exe
ippe.exe
iprf.exe
ipuv.exe
iqnk.exe
irdv.exe
irub.exe
iuas.exe
iunq.exe
iupm.exe
iuue.exe
iuww.exe
ivno.exe
ivsi.exe
ivxb.exe
iybm.exe
japw.exe
jbbq.exe
jbhl.exe
jbyr.exe
jdlx.exe
jevu.exe
jflb.exe
jfxg.exe
jfyi.exe
jgaf.exe
jglt.exe
jgui.exe
jhnu.exe
jhuu.exe
jilp.exe
jjkc.exe
jjrb.exe
jjvm.exe
jjwn.exe
jjxe.exe
jlgt.exe
jljn.exe
jlpp.exe
jmtb.exe
jnsp.exe
jnts.exe
jnyh.exe
jocw.exe
jorn.exe
jpsr.exe
jqal.exe
jrqv.exe
jryf.exe
jshc.exe
jsie.exe
jtfj.exe
jtja.exe
jurt.exe
juuc.exe
jvtb.exe
jwfl.exe
jxdh.exe
jykd.exe
jytq.exe
kaws.exe
kbam.exe
kbie.exe
kbmb.exe
kbqo.exe
kbyp.exe
kcak.exe
kceh.exe
kdhq.exe
kdtw.exe
kegw.exe
keha.exe
kepo.exe
kfol.exe
kfpi.exe
kguf.exe
khuu.exe
kife.exe
kixt.exe
kjtx.exe
klrj.exe
knjd.exe
knrd.exe
knrt.exe
knrw.exe
knty.exe
kodj.exe
kokk.exe
kort.exe
koxj.exe
kpod.exe
kptu.exe
kpyi.exe
kqtn.exe
krld.exe
krrs.exe
ksno.exe
ktae.exe
kthm.exe
ktoo.exe
ktwu.exe
kuca.exe
kufr.exe
kuhm.exe
kujj.exe
kurg.exe
kuvb.exe
kvfi.exe
kvne.exe
kvwp.exe
kwan.exe
kwik.exe
kwjy.exe
kwwu.exe
kxff.exe
kxpu.exe
lbmj.exe
lcgu.exe
lcne.exe
lcoo.exe
lcul.exe
ldqb.exe
ldwp.exe
leqo.exe
lerr.exe
lfjo.exe
lfuj.exe
lgwo.exe
lgyb.exe
ljvs.exe
lkqk.exe
lkvo.exe
llma.exe
lmfp.exe
lnap.exe
lnus.exe
lnwe.exe
loef.exe
lolb.exe
lotr.exe
lpfs.exe
lpgp.exe
lqmk.exe
lqse.exe
lrdn.exe
lrjh.exe
lujy.exe
lurf.exe
luyp.exe
lvgv.exe
lwkd.exe
lwrv.exe
lxdf.exe
lxhi.exe
lxho.exe
lymn.exe
lyxj.exe
mawi.exe
mbhi.exe
mbur.exe
mcqq.exe
mcwo.exe
mdbs.exe
menb.exe
meyr.exe
meys.exe
mfcx.exe
mfdc.exe
mfgd.exe
mfxb.exe
mgkv.exe
mgva.exe
mgwo.exe
mhgc.exe
mhsn.exe
milw.exe
mjgl.exe
mjwy.exe
mkle.exe
mktc.exe
mkuj.exe
mlaq.exe
mljo.exe
mmgn.exe
mmwp.exe
mnis.exe
mnjc.exe
mnws.exe
moab.exe
mokd.exe
moub.exe
moxp.exe
mqnu.exe
mrod.exe
mrrx.exe
msdy.exe
mtgj.exe
mtig.exe
mtqk.exe
mtwg.exe
mubb.exe
much.exe
muee.exe
mujh.exe
muqr.exe
mutx.exe
mvnl.exe
mvve.exe
mvys.exe
mwhn.exe
mwmc.exe
mxdb.exe
mxjf.exe
mxlq.exe
mxqo.exe
mxuy.exe
mxww.exe
myrg.exe
mywa.exe
myxe.exe
myxk.exe
naem.exe
naio.exe
napw.exe
nati.exe
navv.exe
nbdt.exe
nbjx.exe
nbyk.exe
ncfe.exe
ncqs.exe
nddk.exe
ndff.exe
ndhq.exe
nebv.exe
neih.exe
nekx.exe
nfdf.exe
ngli.exe
nhrm.exe
nhwi.exe
nigl.exe
nimu.exe
nipt.exe
njeq.exe
njrc.exe
njyu.exe
nkkv.exe
nksm.exe
nkvo.exe
nlba.exe
nlqr.exe
nmmi.exe
nmre.exe
nnfe.exe
nnpv.exe
nnwq.exe
noen.exe
noes.exe
nonw.exe
noto.exe
npnq.exe
nsev.exe
nsjv.exe
nskr.exe
ntgp.exe
ntmg.exe
ntnl.exe
ntwu.exe
nuej.exe
nuey.exe
nuxl.exe
nvbg.exe
nvcr.exe
nvel.exe
nwap.exe
nwep.exe
nwlj.exe
nwmj.exe
nxkf.exe
ocvu.exe
odeo.exe
odhi.exe
odxc.exe
oead.exe
oejy.exe
oepm.exe
ofdp.exe
ofhb.exe
ogay.exe
ogtr.exe
ogyj.exe
ohjt.exe
oijl.exe
oiqt.exe
ojng.exe
ojws.exe
okdn.exe
oklx.exe
olfm.exe
olww.exe
onbc.exe
onfg.exe
onrc.exe
oosy.exe
opxo.exe
oqkc.exe
oqma.exe
oqmq.exe
orms.exe
orou.exe
otlu.exe
otok.exe
ovsb.exe
owsb.exe
oxna.exe
oxws.exe
oxxf.exe
oyfd.exe
oymw.exe
parv.exe
pawr.exe
paxp.exe
pbwo.exe
pcai.exe
pcij.exe
pcok.exe
pcoq.exe
pddf.exe
peal.exe
pend.exe
pfhw.exe
pfsi.exe
pgfe.exe
pgin.exe
pgrn.exe
phxr.exe
piqn.exe
piym.exe
pjan.exe
pjeq.exe
pjih.exe
pjrp.exe
pjtf.exe
pkbs.exe
pkgf.exe
pkux.exe
pkvs.exe
plmq.exe
plpi.exe
pluf.exe
pmdg.exe
pmrj.exe
polg.exe
poun.exe
ppha.exe
pqmq.exe
prhv.exe
prkj.exe
prpp.exe
pswx.exe
ptai.exe
pteh.exe
ptvf.exe
ptxo.exe
pufc.exe
pula.exe
pvls.exe
pvpe.exe
pvrl.exe
pvul.exe
pwke.exe
pwpg.exe
pwyt.exe
pxad.exe
pxln.exe
pyia.exe
qaor.exe
qaww.exe
qbeo.exe
qbpe.exe
qcif.exe
qcrd.exe
qcsv.exe
qcxt.exe
qdga.exe
qdgu.exe
qedw.exe
qeua.exe
qeyb.exe
qfjw.exe
qgfc.exe
qgok.exe
qhie.exe
qhnd.exe
qjkd.exe
qkud.exe
qkun.exe
qlck.exe
qljo.exe
qlvp.exe
qmae.exe
qmmu.exe
qnqi.exe
qofj.exe
qohe.exe
qolp.exe
qoqo.exe
qouh.exe
qoyd.exe
qpff.exe
qpgm.exe
qpma.exe
qrsf.exe
qrss.exe
qrxn.exe
qtqy.exe
quev.exe
quhm.exe
quie.exe
quxi.exe
qvbo.exe
qvdy.exe
qvfv.exe
qwbl.exe
qwbt.exe
qxbj.exe
qxda.exe
qxjq.exe
qxle.exe
qysf.exe
qywp.exe
qyxh.exe
racx.exe
rata.exe
rbdu.exe
rbmk.exe
reql.exe
rewi.exe
reyi.exe
rfmn.exe
rfpp.exe
rgdt.exe
rgke.exe
rglq.exe
rgrm.exe
rhfb.exe
rhkc.exe
rihv.exe
riow.exe
rjac.exe
rjbn.exe
rjgs.exe
rjnc.exe
rjoc.exe
rjso.exe
rjxa.exe
rkrg.exe
rlof.exe
rlon.exe
rmjm.exe
rmop.exe
rmvs.exe
rnag.exe
rntg.exe
roiv.exe
romd.exe
rpku.exe
rprv.exe
rqec.exe
rqpm.exe
rrae.exe
rrvh.exe
rsbt.exe
rsgt.exe
rtgr.exe
rtok.exe
rtsf.exe
rulj.exe
rumo.exe
ruyd.exe
rvbx.exe
rvjy.exe
rwol.exe
rwug.exe
rxgr.exe
rxiv.exe
ryop.exe
rytv.exe
ryuj.exe
ryvi.exe
sbbn.exe
sbic.exe
sbya.exe
sdhp.exe
sdij.exe
sebn.exe
sged.exe
sgml.exe
shen.exe
sigd.exe
sjah.exe
sjgt.exe
slbd.exe
slfj.exe
smef.exe
smld.exe
snlu.exe
snmc.exe
soji.exe
sojr.exe
solk.exe
sotf.exe
soxd.exe
spqy.exe
sqno.exe
srcm.exe
srcw.exe
srdr.exe
srmo.exe
sshi.exe
stiy.exe
suha.exe
sxcx.exe
sxsa.exe
sycn.exe
synx.exe
sypy.exe
syqf.exe
tang.exe
tbci.exe
tbkc.exe
tbxb.exe
tcep.exe
tclj.exe
tcxn.exe
tdfk.exe
tdiw.exe
tdjw.exe
tdyj.exe
tefq.exe
tejg.exe
tejl.exe
temk.exe
tfff.exe
tfvu.exe
thdh.exe
thtl.exe
tiio.exe
tisa.exe
tiuq.exe
tjhq.exe
tjty.exe
tkax.exe
tkfg.exe
tlnp.exe
tlrv.exe
tlsk.exe
tndi.exe
tnlb.exe
tnle.exe
tpby.exe
tpij.exe
tpvq.exe
tqhq.exe
trau.exe
trdg.exe
trlj.exe
trvj.exe
trwj.exe
trxw.exe
tsbw.exe
tsjh.exe
tucr.exe
tugl.exe
tukl.exe
turc.exe
tuvu.exe
tuxe.exe
tvhl.exe
twbv.exe
twnc.exe
txcs.exe
txfh.exe
txwi.exe
tyap.exe
tykb.exe
tylj.exe
tyqg.exe
tyyd.exe
uaex.exe
uakm.exe
uaxl.exe
ubbf.exe
ubdj.exe
ubjm.exe
ubpw.exe
ubpy.exe
uciq.exe
ucjd.exe
ucjp.exe
ucpu.exe
ucut.exe
udep.exe
udqv.exe
ueas.exe
uelp.exe
ufbl.exe
ugrf.exe
uguf.exe
ugui.exe
uhav.exe
uird.exe
ujjw.exe
ukfl.exe
ukjp.exe
ukso.exe
uldi.exe
ulyp.exe
unmb.exe
uobt.exe
uogx.exe
uoiq.exe
uopa.exe
uoxn.exe
uqdp.exe
uqkr.exe
uqmt.exe
uqom.exe
uqyw.exe
urgc.exe
urhn.exe
urhu.exe
urhy.exe
uror.exe
urwf.exe
usfs.exe
uswa.exe
usyn.exe
uvbl.exe
uvpx.exe
uvqu.exe
uwgf.exe
uwti.exe
uxhh.exe
uxxg.exe
vbvg.exe
vcmv.exe
vcrk.exe
vdga.exe
vdkh.exe
vfhl.exe
vfkx.exe
vfpa.exe
vghl.exe
vhak.exe
vhef.exe
vhpl.exe
visp.exe
vjds.exe
vjmw.exe
vkig.exe
vlhy.exe
vltu.exe
vmeu.exe
vmjc.exe
vmxf.exe
vnvk.exe
voeu.exe
vpgs.exe
vplw.exe
vprs.exe
vqar.exe
vqji.exe
vqkv.exe
vqle.exe
vrrg.exe
vryb.exe
vscu.exe
vsrk.exe
vswm.exe
vtnb.exe
vtqg.exe
vvio.exe
vvsv.exe
vwlp.exe
vwpr.exe
vwqp.exe
vxji.exe
vyfa.exe
vyls.exe
vyoi.exe
wbnm.exe
wcun.exe
wdkq.exe
wdnk.exe
wejx.exe
wgrr.exe
whgh.exe
whww.exe
wifm.exe
wivf.exe
wjac.exe
wjig.exe
wjla.exe
wjth.exe
wkcc.exe
wlva.exe
wlvk.exe
wmil.exe
wmtg.exe
wncm.exe
wnpb.exe
wnps.exe
wols.exe
wonp.exe
worq.exe
wpic.exe
wqcg.exe
wqqf.exe
wqsx.exe
wrfy.exe
wssp.exe
wswe.exe
wtft.exe
wued.exe
wuqe.exe
wutg.exe
wuyu.exe
wvaj.exe
wveh.exe
wvhs.exe
wvue.exe
wwjl.exe
wwxa.exe
wwxo.exe
wxpj.exe
wxru.exe
wxsd.exe
wxsn.exe
wxsy.exe
wxtj.exe
wypd.exe
xayg.exe
xbmg.exe
xcam.exe
xdih.exe
xdww.exe
xecr.exe
xeib.exe
xgcj.exe
xgga.exe
xhxj.exe
xiaj.exe
xigm.exe
xink.exe
xiwg.exe
xjcv.exe
xjjt.exe
xjmq.exe
xjrt.exe
xjwd.exe
xldq.exe
xljd.exe
xlnh.exe
xmqe.exe
xmst.exe
xotj.exe
xpmb.exe
xppy.exe
xqcy.exe
xqit.exe
xrfe.exe
xsdj.exe
xspc.exe
xstj.exe
xstr.exe
xsyg.exe
xtig.exe
xtji.exe
xtju.exe
xugn.exe
xumr.exe
xuon.exe
xvai.exe
xvia.exe
xweq.exe
xwrp.exe
xxdf.exe
xxeo.exe
xxfk.exe
xxiu.exe
xxwd.exe
xxwx.exe
xynf.exe
xypn.exe
xywf.exe
yasc.exe
ybic.exe
ybiu.exe
ybmy.exe
ycbi.exe
ycbq.exe
ydbg.exe
ydim.exe
yedq.exe
yegh.exe
yeph.exe
yevl.exe
yflo.exe
yfpo.exe
ygau.exe
ygwr.exe
yheo.exe
yheq.exe
yhoa.exe
yify.exe
yjhd.exe
yjmr.exe
ykgc.exe
yldk.exe
ylpk.exe
ylxn.exe
ymbf.exe
yngm.exe
ynmo.exe
yojv.exe
yope.exe
ypem.exe
ypix.exe
ypsl.exe
yqjc.exe
yqlc.exe
yqxu.exe
yroh.exe
yshk.exe
ysqe.exe
ysuv.exe
ytpm.exe
yuyf.exe
yvwf.exe
ywhe.exe
ywhm.exe
yxdv.exe
yxrx.exe
yyhs.exe
yyoa.exe