Техническая информация
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\wscript.exe' "%PROGRAM_FILES%\soft180109\b_1809.vbe"
- '%PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE' http://www.ad##ma.cn/g/?kk#
Изменения в файловой системе:
Создает следующие файлы:
- %PROGRAM_FILES%\FlashE\tabs\TabNormal_L.bmp
- %PROGRAM_FILES%\FlashE\tabs\TabNormal_C.bmp
- %PROGRAM_FILES%\FlashE\tabs\TabNormal_R.bmp
- %PROGRAM_FILES%\FlashE\tabs\TabbaseT.bmp
- %PROGRAM_FILES%\FlashE\tabs\TabbaseB.bmp
- %PROGRAM_FILES%\FlashE\tabs\TabActive_R.bmp
- %PROGRAM_FILES%\FlashE\tabs\tabsDown\Thumbs.db
- %PROGRAM_FILES%\FlashE\tabs\tabsDown\TabNormal_R.bmp
- %PROGRAM_FILES%\FlashE\tabs\tabsDown\tabs.ini
- %PROGRAM_FILES%\FlashE\tabs\TabActive_L.bmp
- %PROGRAM_FILES%\FlashE\tabs\TabActive_C.bmp
- %PROGRAM_FILES%\soft180109\B_0920110903090916010918090909.txt
- %PROGRAM_FILES%\soft180109\w_1809.exe
- %PROGRAM_FILES%\soft180109\C_0920110903090916010918090909.txt
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\g[1]
- %PROGRAM_FILES%\soft180109\0920110903090916010918090909.txt
- %PROGRAM_FILES%\soft180109\smes.exe
- %PROGRAM_FILES%\FlashE\tabs\tabs.ini
- %PROGRAM_FILES%\FlashE\tabs\Thumbs.db
- %ALLUSERSPROFILE%\Desktop\ Intornet Explarer .lnk
- %PROGRAM_FILES%\soft180109\a
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\ Intornet Explarer .lnk
- %PROGRAM_FILES%\FlashE\tabs\tabsDown\TabNormal_L.bmp
- %PROGRAM_FILES%\FlashE\inc\NoHide.gif
- %PROGRAM_FILES%\FlashE\inc\Hide.gif
- %PROGRAM_FILES%\FlashE\inc\Progress.bmp
- %PROGRAM_FILES%\FlashE\inc\cls.jpg
- %PROGRAM_FILES%\FlashE\inc\Thumbs.db
- %PROGRAM_FILES%\FlashE\lexplorer.ini
- %PROGRAM_FILES%\FlashE\Config.dat
- %TEMP%\nsr2.tmp\System.dll
- %PROGRAM_FILES%\FlashE\CrCom.dll
- %PROGRAM_FILES%\FlashE\LCmnCtrl32.dll
- %PROGRAM_FILES%\FlashE\FlashE.exe
- %PROGRAM_FILES%\FlashE\tabs\tabsDown\TabActive_C.bmp
- %PROGRAM_FILES%\FlashE\Plugin\GetWebSnap\GetWebSnap.ini
- %PROGRAM_FILES%\FlashE\tabs\tabsDown\TabActive_L.bmp
- %PROGRAM_FILES%\FlashE\tabs\tabsDown\TabNormal_C.bmp
- %PROGRAM_FILES%\FlashE\tabs\tabsDown\TabActive_R.bmp
- %PROGRAM_FILES%\FlashE\Plugin\GetWebSnap\GetWebSnap.dll
- %PROGRAM_FILES%\FlashE\inc\nocls.jpg
- %PROGRAM_FILES%\FlashE\inc\msg.jpg
- %PROGRAM_FILES%\FlashE\inc\nomsg.jpg
- %PROGRAM_FILES%\FlashE\search\searchs.ini
- %PROGRAM_FILES%\FlashE\search\mul.ini
Перемещает следующие файлы:
- %PROGRAM_FILES%\soft180109\C_0920110903090916010918090909.txt в %PROGRAM_FILES%\soft180109\300.reg
- %PROGRAM_FILES%\soft180109\0920110903090916010918090909.txt в %PROGRAM_FILES%\soft180109\b_1809.vbe
- %PROGRAM_FILES%\soft180109\B_0920110903090916010918090909.txt в %PROGRAM_FILES%\soft180109\300.bat
- %PROGRAM_FILES%\soft180109\a в %PROGRAM_FILES%\soft180109\180109.txt
- %PROGRAM_FILES%\soft180109\smes.exe в %PROGRAM_FILES%\soft180109\w_1809.exe
Сетевая активность:
Подключается к:
- 'www.ad##ma.cn':80
- 'localhost':1035
TCP:
Запросы HTTP GET:
- www.ad##ma.cn/g/?kk#
UDP:
- DNS ASK www.ad##ma.cn
Другое:
Ищет следующие окна:
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: '' WindowName: ''
