Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'PowerSuite' = '"%APPDATA%\powersuiteapp\launcher.exe" delay 20000 -m'
Вредоносные функции:
Создает и запускает на исполнение:
- '%APPDATA%\powersuiteapp\powersuite.exe'
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\aut34.tmp
- %APPDATA%\powersuiteapp\Third Party Terms\python-changes.txt
- %TEMP%\aut35.tmp
- %APPDATA%\powersuiteapp\Third Party Terms\python.txt
- %TEMP%\aut33.tmp
- %APPDATA%\powersuiteapp\Third Party Terms\ordereddict.py.txt
- %TEMP%\aut31.tmp
- %APPDATA%\powersuiteapp\Third Party Terms\py2exe.txt
- %TEMP%\aut32.tmp
- %APPDATA%\powersuiteapp\Third Party Terms\simplejson.txt
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\thickbox[1].css
- %APPDATA%\Uniblue\PowerSuite\settings.dat
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\ui.theme[1].css
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ui.dialog[1].css
- %APPDATA%\Uniblue\PowerSuite\state.sqlite
- %APPDATA%\powersuiteapp\Third Party Terms\wmi.txt
- %TEMP%\aut36.tmp
- %APPDATA%\Uniblue\PowerSuite\state.sqlite-journal
- %APPDATA%\Uniblue\PowerSuite\error.log
- %APPDATA%\powersuiteapp\locale\se\se.dll
- %TEMP%\aut2A.tmp
- %APPDATA%\powersuiteapp\locale\se\LC_MESSAGES\messages.mo
- %TEMP%\aut2B.tmp
- %APPDATA%\powersuiteapp\locale\ru\LC_MESSAGES\messages.mo
- %TEMP%\aut28.tmp
- %APPDATA%\powersuiteapp\locale\pt\LC_MESSAGES\messages.mo
- %TEMP%\aut29.tmp
- %APPDATA%\powersuiteapp\locale\ru\ru.dll
- %TEMP%\aut2C.tmp
- %APPDATA%\powersuiteapp\Third Party Terms\cwebpage.dll.html
- %TEMP%\aut2F.tmp
- %APPDATA%\powersuiteapp\Third Party Terms\decorator.py.txt
- %TEMP%\aut30.tmp
- %APPDATA%\powersuiteapp\Third Party Terms\comtypes.txt
- %TEMP%\aut2D.tmp
- %APPDATA%\powersuiteapp\locale\tr\tr.dll
- %TEMP%\aut2E.tmp
- %APPDATA%\powersuiteapp\locale\tr\LC_MESSAGES\messages.mo
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\ui.core[1].css
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\spacer[1].gif
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\brushedsteel[1].png
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\overview_md[1].gif
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\loading[1].gif
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\overview_sp[1].gif
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\button-grey[1].jpg
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\checkbox_off[1].gif
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\radiobutton_off[1].jpg
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\button-blue[1].jpg
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\overview_ds[1].gif
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\prog-blue-end[1].png
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\prog-back[1].png
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\prog-green[1].gif
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\prog-blue[1].gif
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\attention[1].gif
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\brushedsteel-dark[1].png
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\brushedsteel-light[1].png
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\button-green[1].jpg
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\mainmenu_on[1].jpg
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\thickbox[1].js
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\ui.dialog[1].js
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\powersuite[1].js
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\index-functions[1].js
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ui.core[1].js
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\jquery[1].js
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\gui[1].css
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\gui[1].js
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\functions[1].js
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\nag_close_blue[1].gif
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\minimize[1].gif
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\outer_rounded_bottom_left[1].gif
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\mainmenu_off[1].jpg
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\close[1].gif
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\outer_rounded_bottom_right[1].gif
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\nag_close[1].gif
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\frame[1].jpg
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\overview_tab[1].htm
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\about-back[1].jpg
- %APPDATA%\powersuiteapp\locale\br\LC_MESSAGES\messages.mo
- %TEMP%\autD.tmp
- %APPDATA%\powersuiteapp\locale\de\de.dll
- %TEMP%\autE.tmp
- %APPDATA%\powersuiteapp\locale\br\br.dll
- %TEMP%\autB.tmp
- %APPDATA%\powersuiteapp\splash.jpg
- %TEMP%\autC.tmp
- %APPDATA%\powersuiteapp\views.dat
- %TEMP%\autF.tmp
- %APPDATA%\powersuiteapp\locale\en\en.dll
- %TEMP%\aut12.tmp
- %APPDATA%\powersuiteapp\locale\en\LC_MESSAGES\messages.mo
- %TEMP%\aut13.tmp
- %APPDATA%\powersuiteapp\locale\dk\LC_MESSAGES\messages.mo
- %TEMP%\aut10.tmp
- %APPDATA%\powersuiteapp\locale\de\LC_MESSAGES\messages.mo
- %TEMP%\aut11.tmp
- %APPDATA%\powersuiteapp\locale\dk\dk.dll
- %TEMP%\aut4.tmp
- %APPDATA%\powersuiteapp\intermediate_views.dat
- %TEMP%\aut5.tmp
- %APPDATA%\powersuiteapp\Launcher.exe
- %TEMP%\aut3.tmp
- %APPDATA%\powersuiteapp\cwebpage.dll
- %TEMP%\aut1.tmp
- %APPDATA%\powersuiteapp\InstallerExtensions.dll
- %TEMP%\aut2.tmp
- %APPDATA%\powersuiteapp\library.dat
- %TEMP%\aut9.tmp
- %APPDATA%\powersuiteapp\msvcr90.dll
- %TEMP%\autA.tmp
- %APPDATA%\powersuiteapp\powersuite.exe
- %TEMP%\aut8.tmp
- %APPDATA%\powersuiteapp\Microsoft.VC90.CRT.manifest
- %TEMP%\aut6.tmp
- %APPDATA%\powersuiteapp\msvcp90.dll
- %TEMP%\aut7.tmp
- %TEMP%\aut14.tmp
- %TEMP%\aut21.tmp
- %APPDATA%\powersuiteapp\locale\nl\nl.dll
- %TEMP%\aut22.tmp
- %APPDATA%\powersuiteapp\locale\nl\LC_MESSAGES\messages.mo
- %TEMP%\aut20.tmp
- %APPDATA%\powersuiteapp\locale\jp\jp.dll
- %TEMP%\aut1E.tmp
- %APPDATA%\powersuiteapp\locale\jp\LC_MESSAGES\messages.mo
- %TEMP%\aut1F.tmp
- %APPDATA%\powersuiteapp\locale\no\no.dll
- %TEMP%\aut26.tmp
- %APPDATA%\powersuiteapp\locale\pl\LC_MESSAGES\messages.mo
- %TEMP%\aut27.tmp
- %APPDATA%\powersuiteapp\locale\pt\pt.dll
- %TEMP%\aut25.tmp
- %APPDATA%\powersuiteapp\locale\no\LC_MESSAGES\messages.mo
- %TEMP%\aut23.tmp
- %APPDATA%\powersuiteapp\locale\pl\pl.dll
- %TEMP%\aut24.tmp
- %APPDATA%\powersuiteapp\locale\fi\LC_MESSAGES\messages.mo
- %TEMP%\aut17.tmp
- %APPDATA%\powersuiteapp\locale\fr\fr.dll
- %TEMP%\aut18.tmp
- %APPDATA%\powersuiteapp\locale\fi\fi.dll
- %TEMP%\aut15.tmp
- %APPDATA%\powersuiteapp\locale\es\es.dll
- %TEMP%\aut16.tmp
- %APPDATA%\powersuiteapp\locale\es\LC_MESSAGES\messages.mo
- %TEMP%\aut19.tmp
- %APPDATA%\powersuiteapp\locale\it\it.dll
- %TEMP%\aut1C.tmp
- %APPDATA%\powersuiteapp\locale\it\LC_MESSAGES\messages.mo
- %TEMP%\aut1D.tmp
- %APPDATA%\powersuiteapp\locale\gr\LC_MESSAGES\messages.mo
- %TEMP%\aut1A.tmp
- %APPDATA%\powersuiteapp\locale\fr\LC_MESSAGES\messages.mo
- %TEMP%\aut1B.tmp
- %APPDATA%\powersuiteapp\locale\gr\gr.dll
Удаляет следующие файлы:
- %TEMP%\aut26.tmp
- %TEMP%\aut25.tmp
- %TEMP%\aut24.tmp
- %TEMP%\aut27.tmp
- %TEMP%\aut2A.tmp
- %TEMP%\aut29.tmp
- %TEMP%\aut28.tmp
- %TEMP%\aut1F.tmp
- %TEMP%\aut1E.tmp
- %TEMP%\aut1D.tmp
- %TEMP%\aut20.tmp
- %TEMP%\aut23.tmp
- %TEMP%\aut22.tmp
- %TEMP%\aut21.tmp
- %TEMP%\aut34.tmp
- %TEMP%\aut33.tmp
- %TEMP%\aut32.tmp
- %TEMP%\aut35.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\overview_tab[1].htm
- %APPDATA%\Uniblue\PowerSuite\state.sqlite-journal
- %TEMP%\aut36.tmp
- %TEMP%\aut2D.tmp
- %TEMP%\aut2C.tmp
- %TEMP%\aut2B.tmp
- %TEMP%\aut2E.tmp
- %TEMP%\aut31.tmp
- %TEMP%\aut30.tmp
- %TEMP%\aut2F.tmp
- %TEMP%\autA.tmp
- %TEMP%\aut9.tmp
- %TEMP%\aut8.tmp
- %TEMP%\autB.tmp
- %TEMP%\autE.tmp
- %TEMP%\autD.tmp
- %TEMP%\autC.tmp
- %TEMP%\aut3.tmp
- %TEMP%\aut2.tmp
- %TEMP%\aut1.tmp
- %TEMP%\aut4.tmp
- %TEMP%\aut7.tmp
- %TEMP%\aut6.tmp
- %TEMP%\aut5.tmp
- %TEMP%\aut18.tmp
- %TEMP%\aut17.tmp
- %TEMP%\aut16.tmp
- %TEMP%\aut19.tmp
- %TEMP%\aut1C.tmp
- %TEMP%\aut1B.tmp
- %TEMP%\aut1A.tmp
- %TEMP%\aut11.tmp
- %TEMP%\aut10.tmp
- %TEMP%\autF.tmp
- %TEMP%\aut12.tmp
- %TEMP%\aut15.tmp
- %TEMP%\aut14.tmp
- %TEMP%\aut13.tmp
Сетевая активность:
Подключается к:
- 'localhost':1040
- 'localhost':10438
- 'ps.######e.com.s3.amazonaws.com':80
TCP:
Запросы HTTP GET:
- ps.######e.com.s3.amazonaws.com/latest_updates/application.txt
UDP:
- DNS ASK ps.######e.com.s3.amazonaws.com
Другое:
Ищет следующие окна:
- ClassName: 'SpeedUpMyPC' WindowName: '(null)'
- ClassName: 'MS_WebcheckMonitor' WindowName: '(null)'
- ClassName: 'DSWINDOW' WindowName: '(null)'
- ClassName: 'UNIBLUEMDWINDOW' WindowName: '(null)'
- ClassName: 'PSWINDOW' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'MS_AutodialMonitor' WindowName: '(null)'
- ClassName: 'Indicator' WindowName: '(null)'
