Trojan.DownLoader10.61524

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'BBplayer' = '"%PROGRAM_FILES%\BBPlayer\BBAcc.exe" -boot'

Вредоносные функции:

Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра:

[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE' = '%PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE:*:Enabled:Internet Explorer'
[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%WINDIR%\explorer.exe' = '%WINDIR%\explorer.exe:*:Enabled:Windows Explorer'
[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\BBPlayer\BobaClient.exe' = '%PROGRAM_FILES%\BBPlayer\BobaClient.exe:*:Enabled:BobaClient'
[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\BBPlayer\RunMon.exe' = '%PROGRAM_FILES%\BBPlayer\RunMon.exe:*:Enabled:RunMon'
[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\BBPlayer\BBAcc.exe' = '%PROGRAM_FILES%\BBPlayer\BBAcc.exe:*:Enabled:BBAcc'

Создает и запускает на исполнение:

'%PROGRAM_FILES%\BBPlayer\BBAcc.exe'
'%PROGRAM_FILES%\BBPlayer\BBAcc.exe' -install

Изменяет следующие настройки браузера Windows Internet Explorer:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '2000' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '2201' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1200' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1405' = '00000000'

Изменения в файловой системе:

Создает следующие файлы:

%PROGRAM_FILES%\BBPlayer\image\boba\bottom_right.bmp
%PROGRAM_FILES%\BBPlayer\image\boba\bottom_left.bmp
%PROGRAM_FILES%\BBPlayer\image\boba\bottom.bmp
%PROGRAM_FILES%\BBPlayer\image\boba\right.bmp
%PROGRAM_FILES%\BBPlayer\image\boba\left_top.bmp
%PROGRAM_FILES%\BBPlayer\image\boba\left.bmp
%PROGRAM_FILES%\BBPlayer\image\vod\skin_slider_voice_thumb.bmp
%PROGRAM_FILES%\BBPlayer\image\vod\skin_btn_voice.bmp
%PROGRAM_FILES%\BBPlayer\image\vod\skin_btn_topshow.bmp
%PROGRAM_FILES%\BBPlayer\image\vod\skin_btn_play.bmp
%PROGRAM_FILES%\BBPlayer\image\vod\skin_slider_thumb.bmp
%PROGRAM_FILES%\BBPlayer\image\vod\skin_slider_bgrd.bmp
%PROGRAM_FILES%\BBPlayer\image\vod\skin_btn_mute.bmp
%PROGRAM_FILES%\BBPlayer\image\boba\right_top.bmp
%PROGRAM_FILES%\BBPlayer\p2pacc.ini
%PROGRAM_FILES%\BBPlayer\player.ini
%HOMEPATH%\Desktop\Гв·СµзУ°МмМмїґ.lnk
%HOMEPATH%\Start Menu\Programs\µзУ°ІҐ°Ф\Жф¶ЇГв·СµзУ°МмМмїґ.lnk
%HOMEPATH%\Start Menu\Programs\µзУ°ІҐ°Ф\Р¶ФШµзУ°ІҐ°Ф.lnk
%PROGRAM_FILES%\BBPlayer\uninstall.exe
%PROGRAM_FILES%\BBPlayer\image\boba\top_right.bmp
%PROGRAM_FILES%\BBPlayer\image\boba\top_left.bmp
%PROGRAM_FILES%\BBPlayer\image\boba\top.bmp
%PROGRAM_FILES%\BBPlayer\image\boba\loading.gif
%PROGRAM_FILES%\BBPlayer\image\boba\top_right_Over.bmp
%PROGRAM_FILES%\BBPlayer\image\boba\top_right_Down.bmp
%PROGRAM_FILES%\BBPlayer\BobaBHO.dll
%PROGRAM_FILES%\BBPlayer\pncrt.dll
%PROGRAM_FILES%\BBPlayer\RealMediaSplitter.ax
%PROGRAM_FILES%\BBPlayer\codec\real\codecs\atrc.dll
%PROGRAM_FILES%\BBPlayer\boba_buffer.html
%PROGRAM_FILES%\BBPlayer\BobaClient.exe
%PROGRAM_FILES%\BBPlayer\BBAcc.exe
%PROGRAM_FILES%\BBPlayer\bbplayer.dll
%PROGRAM_FILES%\BBPlayer\boba1.ico
%TEMP%\nso2.tmp
%PROGRAM_FILES%\BBPlayer\ckcore.dll
%PROGRAM_FILES%\BBPlayer\P2PCore.dll
%PROGRAM_FILES%\BBPlayer\P2SCore.dll
%PROGRAM_FILES%\BBPlayer\codec\real\codecs\cook.dll
%PROGRAM_FILES%\BBPlayer\image\vod\skin_bgrd.bmp
%PROGRAM_FILES%\BBPlayer\codec\real\codecs\sipr.dll
%PROGRAM_FILES%\BBPlayer\codec\real\codecs\rv40.dll
%PROGRAM_FILES%\BBPlayer\image\vod\skin_btn_pause.bmp
%PROGRAM_FILES%\BBPlayer\image\vod\skin_btn_fullscreen.bmp
%PROGRAM_FILES%\BBPlayer\image\vod\skin_btn_exitfs.bmp
%PROGRAM_FILES%\BBPlayer\codec\real\codecs\rv30.dll
%PROGRAM_FILES%\BBPlayer\codec\real\codecs\drvc.dll
%PROGRAM_FILES%\BBPlayer\codec\real\codecs\drv2.dll
%PROGRAM_FILES%\BBPlayer\codec\real\codecs\drv1.dll
%PROGRAM_FILES%\BBPlayer\codec\real\codecs\rv20.dll
%PROGRAM_FILES%\BBPlayer\codec\real\codecs\rv10.dll
%PROGRAM_FILES%\BBPlayer\codec\real\codecs\raac.dll

Сетевая активность:

Подключается к:

'st##.dyboba.com':80
'localhost':1043

TCP:

Запросы HTTP GET:

st##.dyboba.com/clientaction/clickrun/bbplayer/bbacc/1.0.0.19/0/107/0/f64d6325a34f74f0c486871ee91209cd/1
st##.dyboba.com/clientaction/install/bbplayer/bbacc/1.0.0.19/0/107/0/f64d6325a34f74f0c486871ee91209cd

UDP: