Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'wextract_cleanup1' = 'rundll32.exe <SYSTEM32>\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP001.TMP\"'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'wextract_cleanup0' = 'rundll32.exe <SYSTEM32>\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"'
Вредоносные функции:
Создает и запускает на исполнение:
- '%TEMP%\Babylon8.0.0\unzip.exe' -qq -o 7877.exe -d babylon7setup
- '%TEMP%\IXP000.TMP\BabylonSearch.exe'
- '%TEMP%\Babylon8.0.0\babylon7setup\Setup32.exe'
- '%TEMP%\Babylon8.0.0\BabylonInstall.exe'
- '%TEMP%\IXP000.TMP\Setup_00.exe'
- '%TEMP%\IXP001.TMP\LinkOpener.exe'
- '%TEMP%\IXP001.TMP\BabylonInstaller7877.exe'
Запускает на исполнение:
- '<SYSTEM32>\cmd.exe' /c unzip.cmd
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\Babylon8.0.0\babylon7setup\Korean.ldt
- %TEMP%\Babylon8.0.0\babylon7setup\Korean.utf8.ldt
- %TEMP%\Babylon8.0.0\babylon7setup\metaphone.dat
- %TEMP%\Babylon8.0.0\babylon7setup\Japanese.utf8.ldt
- %TEMP%\Babylon8.0.0\babylon7setup\Italian.ldt
- %TEMP%\Babylon8.0.0\babylon7setup\Japanese.euc_jp.ldt
- %TEMP%\Babylon8.0.0\babylon7setup\Japanese.shift_jis.ldt
- %TEMP%\Babylon8.0.0\babylon7setup\MyBabylonFF.exe
- %TEMP%\Babylon8.0.0\babylon7setup\Polish.iso8859_2.ldt
- %TEMP%\Babylon8.0.0\babylon7setup\Polish.utf8.ldt
- %TEMP%\Babylon8.0.0\babylon7setup\Portuguese.brazil.ldt
- %TEMP%\Babylon8.0.0\babylon7setup\notes_off.png
- %TEMP%\Babylon8.0.0\babylon7setup\MyBabylonIE.exe
- %TEMP%\Babylon8.0.0\babylon7setup\Norwegian.ldt
- %TEMP%\Babylon8.0.0\babylon7setup\notes.png
- %TEMP%\Babylon8.0.0\babylon7setup\Hungarian.ldt
- %TEMP%\Babylon8.0.0\babylon7setup\ExcludeSelect.xml
- %TEMP%\Babylon8.0.0\babylon7setup\features.dat
- %TEMP%\Babylon8.0.0\babylon7setup\FileNames.dat
- %TEMP%\Babylon8.0.0\babylon7setup\English.shlomi.ldt
- %TEMP%\Babylon8.0.0\babylon7setup\Danish.ldt
- %TEMP%\Babylon8.0.0\babylon7setup\Dutch.ldt
- %TEMP%\Babylon8.0.0\babylon7setup\English.ldt
- %TEMP%\Babylon8.0.0\babylon7setup\French.ldt
- %TEMP%\Babylon8.0.0\babylon7setup\Hebrew.utf8.ldt
- %TEMP%\Babylon8.0.0\babylon7setup\Hindi.ldt
- %TEMP%\Babylon8.0.0\babylon7setup\Hindi.utf8.ldt
- %TEMP%\Babylon8.0.0\babylon7setup\Hebrew.iso8859_8.ldt
- %TEMP%\Babylon8.0.0\babylon7setup\German.ldt
- %TEMP%\Babylon8.0.0\babylon7setup\Greek.iso8859_7.ldt
- %TEMP%\Babylon8.0.0\babylon7setup\Greek.utf8.ldt
- %TEMP%\Babylon8.0.0\babylon7setup\Thai.utf8.ldt
- %TEMP%\Babylon8.0.0\babylon7setup\translate.png
- %TEMP%\Babylon8.0.0\babylon7setup\translate_off.png
- %TEMP%\Babylon8.0.0\babylon7setup\Thai.ldt
- %TEMP%\Babylon8.0.0\babylon7setup\spelling_off.png
- %TEMP%\Babylon8.0.0\babylon7setup\Strings.dat
- %TEMP%\Babylon8.0.0\babylon7setup\Swedish.ldt
- %TEMP%\Babylon8.0.0\babylon7setup\Turkish.ldt
- %TEMP%\Babylon8.0.0\babylon7setup\units.png
- %TEMP%\Babylon8.0.0\babylon7setup\units_off.png
- %APPDATA%\Babylon\log_file.txt
- %TEMP%\Babylon8.0.0\babylon7setup\uninstbb.exe
- %TEMP%\Babylon8.0.0\babylon7setup\Turkish.utf8.ldt
- %TEMP%\Babylon8.0.0\babylon7setup\Ukrainian.koi8_u.ldt
- %TEMP%\Babylon8.0.0\babylon7setup\Ukrainian.utf8.ldt
- %TEMP%\Babylon8.0.0\babylon7setup\spelling.png
- %TEMP%\Babylon8.0.0\babylon7setup\Romanian.ldt
- %TEMP%\Babylon8.0.0\babylon7setup\Russian.iso8859_5.ldt
- %TEMP%\Babylon8.0.0\babylon7setup\Russian.koi8_r.ldt
- %TEMP%\Babylon8.0.0\babylon7setup\rates.dat
- %TEMP%\Babylon8.0.0\babylon7setup\Portuguese.europe.ldt
- %TEMP%\Babylon8.0.0\babylon7setup\purchase.png
- %TEMP%\Babylon8.0.0\babylon7setup\purchase_off.png
- %TEMP%\Babylon8.0.0\babylon7setup\Russian.utf8.ldt
- %TEMP%\Babylon8.0.0\babylon7setup\Spanish.basque.ldt
- %TEMP%\Babylon8.0.0\babylon7setup\Spanish.catalan.ldt
- %TEMP%\Babylon8.0.0\babylon7setup\Spanish.ldt
- %TEMP%\Babylon8.0.0\babylon7setup\Setup32.exe
- %TEMP%\Babylon8.0.0\babylon7setup\Russian.windows1251.ldt
- %TEMP%\Babylon8.0.0\babylon7setup\Serbian.ascii.ldt
- %TEMP%\Babylon8.0.0\babylon7setup\Serbian.cyrillic-utf8.ldt
- %TEMP%\Babylon8.0.0\babylon7setup\Babylon_Chinese_T__English_sub.BGL
- %TEMP%\Babylon8.0.0\babylon7setup\Babylon_Dutch_English_sub.BGL
- %TEMP%\Babylon8.0.0\babylon7setup\Babylon_English_Chinese_S__sub.bgl
- %TEMP%\Babylon8.0.0\babylon7setup\Babylon_Chinese_S__English_sub.BGL
- %TEMP%\Babylon8.0.0\babylon7setup\BabylonIEPI.dll
- %TEMP%\Babylon8.0.0\babylon7setup\BabylonOfficePI.dll
- %TEMP%\Babylon8.0.0\babylon7setup\BabylonRPI.api
- %TEMP%\Babylon8.0.0\babylon7setup\Babylon_English_Chinese_T__sub.bgl
- %TEMP%\Babylon8.0.0\babylon7setup\Babylon_English_Italian_sub.bgl
- %TEMP%\Babylon8.0.0\babylon7setup\Babylon_English_Japanese_sub.bgl
- %TEMP%\Babylon8.0.0\babylon7setup\Babylon_English_Korean_sub.BGL
- %TEMP%\Babylon8.0.0\babylon7setup\Babylon_English_Hebrew_sub.bgl
- %TEMP%\Babylon8.0.0\babylon7setup\Babylon_English_Dutch_sub.bgl
- %TEMP%\Babylon8.0.0\babylon7setup\Babylon_English_French_sub.bgl
- %TEMP%\Babylon8.0.0\babylon7setup\Babylon_English_German_sub.bgl
- %TEMP%\Babylon8.0.0\babylon7setup\BabylonAgent.exe
- %TEMP%\Babylon8.0.0\BabylonInstall.exe
- %TEMP%\Babylon8.0.0\7877.exe
- %TEMP%\Babylon8.0.0\unzip.exe
- %TEMP%\IXP001.TMP\BabylonInstaller7877.exe
- %TEMP%\IXP000.TMP\Setup_00.exe
- %TEMP%\IXP000.TMP\BabylonSearch.exe
- %TEMP%\IXP001.TMP\LinkOpener.exe
- %TEMP%\Babylon8.0.0\unzip.cmd
- %TEMP%\Babylon8.0.0\babylon7setup\BabyFox.dll
- %TEMP%\Babylon8.0.0\babylon7setup\Babylon.dat
- %TEMP%\Babylon8.0.0\babylon7setup\Babylon.exe
- %TEMP%\Babylon8.0.0\babylon7setup\babca.dat
- %TEMP%\Babylon8.0.0\babylon7setup\Arabic.iso8859_6.ldt
- %TEMP%\Babylon8.0.0\babylon7setup\Arabic.utf8.ldt
- %TEMP%\Babylon8.0.0\babylon7setup\Arabic.windows1256.ldt
- %TEMP%\Babylon8.0.0\babylon7setup\BDesktopAgent.dll
- %TEMP%\Babylon8.0.0\babylon7setup\BException.dll
- %TEMP%\Babylon8.0.0\babylon7setup\Bulgarian.iso8859_5.ldt
- %TEMP%\Babylon8.0.0\babylon7setup\BContentServerExt.dll
- %TEMP%\Babylon8.0.0\babylon7setup\BabyServices.dll
- %TEMP%\Babylon8.0.0\babylon7setup\bab_hlp_static.bgl
- %TEMP%\Babylon8.0.0\babylon7setup\BContentServer.dll
- %TEMP%\Babylon8.0.0\babylon7setup\Bulgarian.utf8.ldt
- %TEMP%\Babylon8.0.0\babylon7setup\CSConfig.dat
- %TEMP%\Babylon8.0.0\babylon7setup\Czech.iso8859_2.ldt
- %TEMP%\Babylon8.0.0\babylon7setup\Czech.utf8.ldt
- %TEMP%\Babylon8.0.0\babylon7setup\convert.dat
- %TEMP%\Babylon8.0.0\babylon7setup\captlib.dll
- %TEMP%\Babylon8.0.0\babylon7setup\Chinese (S).gb2312.ldt
- %TEMP%\Babylon8.0.0\babylon7setup\Chinese (T).big5.ldt
- %TEMP%\Babylon8.0.0\babylon7setup\Babylon_Spanish_English_sub.BGL
- %TEMP%\Babylon8.0.0\babylon7setup\Babylon_English_Swedish_sub.bgl
- %TEMP%\Babylon8.0.0\babylon7setup\Babylon_French_English_sub.BGL
- %TEMP%\Babylon8.0.0\babylon7setup\Babylon_German_English_sub.BGL
- %TEMP%\Babylon8.0.0\babylon7setup\Babylon_English_sub.bgl
- %TEMP%\Babylon8.0.0\babylon7setup\Babylon_English_Portuguese_sub.bgl
- %TEMP%\Babylon8.0.0\babylon7setup\Babylon_English_Russian_sub.bgl
- %TEMP%\Babylon8.0.0\babylon7setup\Babylon_English_Spanish_sub.bgl
- %TEMP%\Babylon8.0.0\babylon7setup\Babylon_Hebrew_English_sub.BGL
- %TEMP%\IXP000.TMP\readme.txt
- %TEMP%\Babylon8.0.0\babylon7setup\Babylon_Portuguese_English_sub.BGL
- %TEMP%\Babylon8.0.0\babylon7setup\Babylon_Russian_English_sub.BGL
- %TEMP%\Babylon8.0.0\babylon7setup\Babylon_Japanese_English_sub.BGL
- %TEMP%\Babylon8.0.0\babylon7setup\Babylon_Hebrew_Thesaurus_sub.BGL
- %TEMP%\Babylon8.0.0\babylon7setup\Babylon_Italian_English_sub.BGL
- %TEMP%\aut2.tmp
Удаляет следующие файлы:
- %TEMP%\aut2.tmp
- %TEMP%\IXP000.TMP\readme.txt
- %TEMP%\IXP001.TMP\BabylonInstaller7877.exe
- %TEMP%\IXP001.TMP\LinkOpener.exe
Сетевая активность:
Подключается к:
- '17#.#5.75.146':80
TCP:
Запросы HTTP GET:
- 17#.#5.75.146/loguser?id#########
Другое:
Ищет следующие окна:
- ClassName: 'Babylon' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
