Троянец, предназначенный для «накрутки» количества переходов по рекламным ссылкам. Распространяется в рамках партнерской программы Installmonster (также известной как Zipmonster) под наименованием Ad Expert Browser.
После установки и успешного запуска Trojan.Click3.9243 создает в системе скрытый рабочий стол с именем mntdesktop55 и запускает в нем собственный процесс:
Desktop: mntdesktop55
X=0,Y=0,WIDTH=1024,HIGHT=768
------------------------------------------------
hwnd: 0001017C
title: ""
class: "tooltips_class32"
exstype: 000000A8 WS_EX_TOPMOST WS_EX_TRANSPARENT WS_EX_TOOLWINDOW
style: 84800002 WS_POPUP WS_CLIPSIBLINGS WS_CAPTION WS_BORDER
pid: 00000938 aeb.exe
x=0,y=0,width=132,hight=38
------------------------------------------------
hwnd: 00030180
title: ".NET-BroadcastEventWindow.4.0.0.0.9c43c1.0"
class: ".NET-BroadcastEventWindow.4.0.0.0.9c43c1.0"
exstype: 00000000
style: 84000000 WS_POPUP WS_CLIPSIBLINGS
pid: 00000938 aeb.exe
x=0,y=0,width=0,hight=0
------------------------------------------------
hwnd: 0003016C
title: ""
class: "Chrome_SystemMessageWindow"
exstype: 00000100 WS_EX_WINDOWEDGE
style: 04C00000 WS_CLIPSIBLINGS WS_CAPTION WS_BORDER WS_DLGFRAME
pid: 00000938 aeb.exe
x=0,y=0,width=132,hight=38
------------------------------------------------
hwnd: 00020158
title: "Ads Expert Browser"
class: "HwndWrapper[aeb.exe;;635cae48-2fd5-4c19-b97b-7812d5dca4d7]"
exstype: 00000180 WS_EX_TOOLWINDOW WS_EX_WINDOWEDGE
style: 26CF0000 WS_MINIMIZE WS_CLIPSIBLINGS WS_CLIPCHILDREN WS_CAPTION
WS_BORDER WS_DLGFRAME WS_SYSMENU WS_THICKFRAME WS_GROUP WS_TABSTOP
WS_MINIMIZEBOX WS_MAXIMIZEBOX
pid: 00000938 aeb.exe
x=0,y=701,width=160,hight=27
------------------------------------------------
hwnd: 0002013A
title: "Hidden Window"
class: "HwndWrapper[aeb.exe;;4ed1725d-405f-47a5-bdde-785d013e0b65]"
exstype: 00000100 WS_EX_WINDOWEDGE
style: 06CF0000 WS_CLIPSIBLINGS WS_CLIPCHILDREN WS_CAPTION WS_BORDER
WS_DLGFRAME WS_SYSMENU WS_THICKFRAME WS_GROUP WS_TABSTOP WS_MINIMIZEBOX
WS_MAXIMIZEBOX
pid: 00000938 aeb.exe
x=25,y=25,width=768,hight=526
------------------------------------------------
hwnd: 00040136
title: "SystemResourceNotifyWindow"
class: "HwndWrapper[aeb.exe;;c7e6d7e4-37fe-4f1e-93bf-315d897ceec3]"
exstype: 00000000
style: 8C000000 WS_POPUP WS_DISABLED WS_CLIPSIBLINGS
pid: 00000938 aeb.exe
x=0,y=0,width=0,hight=0
------------------------------------------------
hwnd: 00050134
title: "MediaContextNotificationWindow"
class: "HwndWrapper[aeb.exe;;acb0ad30-c08a-4059-9835-bb0a141092cb]"
exstype: 00000000
style: 84000000 WS_POPUP WS_CLIPSIBLINGS
pid: 00000938 aeb.exe
x=0,y=0,width=0,hight=0
------------------------------------------------
hwnd: 00010178
title: ""
class: "HwndWrapper[aeb.exe;;e4d0e45d-c3f1-4cbd-a399-6d92ae6c18df]"
exstype: 00000100 WS_EX_WINDOWEDGE
style: 04C00000 WS_CLIPSIBLINGS WS_CAPTION WS_BORDER WS_DLGFRAME
pid: 00000938 aeb.exe
x=0,y=0,width=132,hight=38
------------------------------------------------
hwnd: 0001017A
title: "Default IME"
class: "IME"
exstype: 00000000
style: 8C000000 WS_POPUP WS_DISABLED WS_CLIPSIBLINGS
pid: 00000938 aeb.exe
x=0,y=0,width=0,hight=0
В скрытом режиме имитирует действия пользователя, эмулируя движения курсора мыши, щелкая по рекламным баннерам, прокручивая веб-страницы, загружая видеоролики (благодаря присутствию набора кодеков). Содержит набор значений user-agent:
namespace Ads_Expert_Browser
{
public class MainWindow : Window, IResourceInterceptor, IComponentConnector
{
private static bool IsMainWindow = false;
private static string subid = "";
public static RegistryKey softwareKey = Registry.CurrentUser.OpenSubKey("Software", true);
public static readonly ILog log = LogManager.GetLogger(typeof (MainWindow));
private string[] user_7 = new string[4]
{
"Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML like Gecko)
Chrome/35.0.1916.114 Safari/537.36",
"Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML like Gecko)
Chrome/35.0.1870.2 Safari/537.36",
"Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML like Gecko)
Chrome/35.0.1862.2 Safari/537.36",
"Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML like Gecko)
Chrome/35.0.1916.86 Safari/537.36"
};
private string[] user_7_64 = new string[5]
{
"Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML like Gecko)
Chrome/35.0.1916.114 Safari/537.36",
"Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML like Gecko)
Chrome/35.0.1862.2 Safari/537.36",
"Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML like Gecko)
Chrome/35.0.1870.2 Safari/537.36",
"Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML like Gecko)
Chrome/35.0.1916.27 Safari/537.36",
"Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML like Gecko)
Chrome/35.0.1916.47 Safari/537.36"
};
private string[] user_8 = new string[3]
{
"Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML like Gecko)
Chrome/35.0.1916.114 Safari/537.36",
"Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML like Gecko)
Chrome/35.0.1862.2 Safari/537.36",
"Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML like Gecko)
Chrome/35.0.1870.2 Safari/537.36"
};
private string[] user_8_64 = new string[4]
{
"Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML like Gecko)
Chrome/35.0.1916.114 Safari/537.36",
"Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML like Gecko)
Chrome/35.0.1870.2 Safari/537.36",
"Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML like Gecko)
Chrome/35.0.1897.2 Safari/537.36",
"Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML like Gecko)
Chrome/35.0.1862.2 Safari/537.36"
};
private string[] user_8_1 = new string[4]
{
"Mozilla/5.0 (Windows NT 6.3) AppleWebKit/537.36 (KHTML like Gecko)
Chrome/35.0.1916.114 Safari/537.36",
"Mozilla/5.0 (Windows NT 6.3) AppleWebKit/537.36 (KHTML like Gecko)
Chrome/35.0.1862.2 Safari/537.36",
"Mozilla/5.0 (Windows NT 6.3) AppleWebKit/537.36 (KHTML like Gecko)
Chrome/35.0.1916.69 Safari/537.36",
"Mozilla/5.0 (Windows NT 6.3) AppleWebKit/537.36 (KHTML like Gecko)
Chrome/35.0.1916.27 Safari/537.36"
};
private string[] user_8_1_64 = new string[4]
{
"Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML like Gecko)
Chrome/35.0.1916.114 Safari/537.36",
"Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML like Gecko)
Chrome/35.0.1916.27 Safari/537.36",
"Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML like Gecko)
Chrome/35.0.1916.69 Safari/537.36",
"Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML like Gecko)
Chrome/35.0.1862.2 Safari/537.36"
};
private string[] urls_list = new string[35]
{
"Google.com",
"Facebook.com",
"Youtube.com",
"Yahoo.com",
"Wikipedia.org",
"Twitter.com",
"Amazon.com",
"Live.com",
"Linkedin.com",
"Tmall.com",
"Bing.com",
"Wordpress.com",
"Pinterest.com",
"Ebay.com",
"Instagram.com",
"Ask.com",
"Imdb.com",
"Craigslist.org",
"Reddit.com",
"Blogger.com",
"Aliexpress.com",
"Cnn.com",
"Vube.com",
"Fifa.com",
"Booking.com",
"Vimeo.com",
"Weather.com",
"Forbes.com",
"Businessinsider.com",
"Chase.com",
"Walmart.com",
"Indeed.com",
"Foxnews.com",
"Tripadvisor.com",
"Ikea.com"
};
private int TimeForRestart = 60;
private int repeat = 5;
private int clickCount = 5;
private int repeatAtPage = 5;
private int time = 360;
private string startURL = "http://www.grimfullarop.com/";
private int WaitForLoad = 120;
private string id = "";
public string s_date = "";
private object TimeLocker = new object();
private object ErrorLocker = new object();
private const string app = "Awesomium Renderer";
private ulong number_s;
private Thread thr;
private Thread Thr_download_page;
private int number_strartN;
private Thread thr_control;
private Thread thr_check;
private int number;
private bool debug;
private int tickClick;
private static XDocument doc;
public static RegistryKey hkMine;
private bool isTimefromMoveExit;
internal Grid grid;
internal WebControl webControl1;
private bool _contentLoaded;
В процессе своей работы Trojan.Click3.9243 отправляет на сервер злоумышленников перечень запущенных на инфицированном ПК процессов и сведения о нагрузке на процессор компьютера. Файлы троянца имеют цифровую подпись:
Signers:
Mayris Corporation
COMODO Code Signing CA 2
UTN-USERFirst-Object
AddTrust External CA Root
Signing date: 18:37 01.07.2014
