Техническая информация
Вредоносные функции:
Создает и запускает на исполнение:
- '%PROGRAM_FILES%\hahagamess\ie1.exe'
- '%PROGRAM_FILES%\hahagamess\SeFastInstall2_3217.exe'
- '%PROGRAM_FILES%\hahagamess\bb.exe'
Запускает на исполнение:
- '%WINDIR%\regedit.exe' /s "%PROGRAM_FILES%\hahagamess\QQ.reg"
Изменения в файловой системе:
Создает следующие файлы:
- %PROGRAM_FILES%\hahagamess\chis.ini
- %PROGRAM_FILES%\hahagamess\ImgCache\www.tqqa.com_favicon.ico
- %PROGRAM_FILES%\hahagamess\dailytips.ini
- %PROGRAM_FILES%\hahagamess\chs.dll
- %PROGRAM_FILES%\hahagamess\ImgCache\www.taobao.com_favicon.ico
- %PROGRAM_FILES%\hahagamess\ImgCache\www.google.com_favicon.ico
- %PROGRAM_FILES%\hahagamess\ImgCache\www.google.com.hk_favicon.ico
- %PROGRAM_FILES%\hahagamess\ImgCache\www.ioage.com_favicon.ico
- %PROGRAM_FILES%\hahagamess\ImgCache\www.hao123.com_favicon.ico
- %PROGRAM_FILES%\hahagamess\twcache.ini
- %TEMP%\version.ini
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\flashplayer[1].htm
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\on86[1]
- %PROGRAM_FILES%\hahagamess\theworld.ac
- %PROGRAM_FILES%\hahagamess\ie1.ini
- %PROGRAM_FILES%\hahagamess\ie1.exe
- %PROGRAM_FILES%\hahagamess\QQ.reg
- %PROGRAM_FILES%\hahagamess\SeFastInstall2_3217.exe
- %PROGRAM_FILES%\hahagamess\ImgCache\www.go2000.com_favicon.ico
- %PROGRAM_FILES%\hahagamess\bb.exe
- %PROGRAM_FILES%\hahagamess\Baidu-Toolbar.exe
- %PROGRAM_FILES%\hahagamess\ImgCache\hb.qq.com_favicon.ico
- %PROGRAM_FILES%\hahagamess\ImgCache\easyabc.95599.cn_favicon.ico
- %PROGRAM_FILES%\hahagamess\count.htm
- %PROGRAM_FILES%\hahagamess\reopen.dll
- %PROGRAM_FILES%\hahagamess\oem.ini
- %PROGRAM_FILES%\hahagamess\uninst.exe
- %PROGRAM_FILES%\hahagamess\setup.dll
- %PROGRAM_FILES%\hahagamess\ImgCache\www.alimama.com_favicon.ico
- %PROGRAM_FILES%\hahagamess\ImgCache\www.95599.cn_favicon.ico
- %PROGRAM_FILES%\hahagamess\ImgCache\www.baidu.com_favicon.ico
- %PROGRAM_FILES%\hahagamess\ImgCache\www.ayxz.com_favicon.ico
- %PROGRAM_FILES%\hahagamess\ImgCache\www.51.la_favicon.ico
- %PROGRAM_FILES%\hahagamess\ImgCache\Thumbs.db
- %PROGRAM_FILES%\hahagamess\ImgCache\kitairu.net_favicon.ico
- %PROGRAM_FILES%\hahagamess\ImgCache\www.2548.cn_favicon.ico
- %PROGRAM_FILES%\hahagamess\ImgCache\www.231wg.com_favicon.ico
Присваивает атрибут 'скрытый' для следующих файлов:
- %PROGRAM_FILES%\hahagamess\twcache.ini
- %PROGRAM_FILES%\hahagamess\theworld.ac
- %PROGRAM_FILES%\hahagamess\ImgCache\Thumbs.db
Удаляет следующие файлы:
- %PROGRAM_FILES%\hahagamess\ie1.ini
- %PROGRAM_FILES%\hahagamess\QQ.reg
Перемещает следующие файлы:
- %PROGRAM_FILES%\hahagamess\ie1.ini.tmp в %PROGRAM_FILES%\hahagamess\ie1.ini
Сетевая активность:
Подключается к:
- 'localhost':1040
- 'do##.##ngkongjisu.com':80
- 'www.on##.com':80
- 'co####.ie.sogou.com':80
- 'localhost':1038
TCP:
Запросы HTTP GET:
- do##.##ngkongjisu.com/flashplayer.htm?fl#
- www.on##.com/
- co####.ie.sogou.com/seversion.txt?h=#######################################
UDP:
- DNS ASK do##.##ngkongjisu.com
- DNS ASK www.on##.com
- DNS ASK co####.ie.sogou.com
Другое:
Ищет следующие окна:
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'Shell DocObject View' WindowName: ''
- ClassName: 'Shell Embedding' WindowName: ''
- ClassName: 'XFrame_Wnd' WindowName: ''
- ClassName: 'Progman' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
- ClassName: 'RegEdit_RegEdit' WindowName: ''
- ClassName: 'SysListView32' WindowName: ''
- ClassName: 'SHELLDLL_DefView' WindowName: ''
