Техническая информация
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\DllHost.exe' /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\ish436147\css\sdk-ui\browse.css
- %TEMP%\ish436147\css\sdk-ui\button.css
- %TEMP%\ish436147\css\main.css
- %TEMP%\0006A7B3.log
- %TEMP%\ish436147\css\ie6_main.css
- %TEMP%\ish436147\css\sdk-ui\images\progress-bg.png
- %TEMP%\ish436147\css\sdk-ui\images\progress-bg2.png
- %TEMP%\ish436147\css\sdk-ui\images\progress-bg-corner.png
- %TEMP%\ish436147\css\sdk-ui\checkbox.css
- %TEMP%\ish436147\css\sdk-ui\images\button-bg.png
- %PROGRAM_FILES%\is434478.log
- %TEMP%\ish430687\images\Loader.gif
- %TEMP%\ish430687\images\Logo.png
- %TEMP%\ish430687\images\Grey_Button_Hover.png
- %TEMP%\ish430687\images\Color_Button_Hover.png
- %TEMP%\ish430687\images\Grey_Button.png
- %TEMP%\ish430687\locale\EN.locale
- %TEMP%\ish430687\bootstrap_40127.html
- %TEMP%\ish430687\images\text-bg.png
- %TEMP%\ish430687\images\Progress.png
- %TEMP%\ish430687\images\ProgressBar.png
- %TEMP%\ish436147\css\sdk-ui\progress-bar.css
- %TEMP%\ish436147\locale\EN.locale
- %TEMP%\0006AC16.log
- %TEMP%\ish436147\images\text-bg.png
- %TEMP%\ish436147\images\Progress.png
- %TEMP%\ish436147\images\ProgressBar.png
- %HOMEPATH%\Desktop\Continue FLV Player Installation.lnk
- %TEMP%\is1412836710\1765409146.cfg
- %TEMP%\ICReinstall_<Имя вируса>.exe
- %TEMP%\is1412836710\738603896.cfg
- %TEMP%\ish436147\images\Logo.png
- %TEMP%\ish436147\images\Close.png
- %TEMP%\ish436147\images\Close_Hover.png
- %TEMP%\ish436147\images\BG2.png
- %TEMP%\ish436147\csshover3.htc
- %TEMP%\ish436147\images\BG1.png
- %TEMP%\ish436147\images\Grey_Button_Hover.png
- %TEMP%\ish436147\images\Loader.gif
- %TEMP%\ish436147\images\Grey_Button.png
- %TEMP%\ish436147\images\Color_Button.png
- %TEMP%\ish436147\images\Color_Button_Hover.png
- %TEMP%\ish430687\images\Color_Button.png
- %TEMP%\ish428940\images\Close.png
- %TEMP%\ish428940\images\Close_Hover.png
- %TEMP%\ish428940\images\BG2.png
- %TEMP%\ish428940\csshover3.htc
- %TEMP%\ish428940\images\BG1.png
- %TEMP%\ish428940\images\Grey_Button_Hover.png
- %TEMP%\ish428940\images\Loader.gif
- %TEMP%\ish428940\images\Grey_Button.png
- %TEMP%\ish428940\images\Color_Button.png
- %TEMP%\ish428940\images\Color_Button_Hover.png
- %TEMP%\ish428940\css\sdk-ui\progress-bar.css
- %TEMP%\ish428940\css\sdk-ui\browse.css
- %TEMP%\ish428940\css\sdk-ui\button.css
- %TEMP%\ish428940\css\main.css
- %TEMP%\00068B7C.log
- %TEMP%\ish428940\css\ie6_main.css
- %TEMP%\ish428940\css\sdk-ui\images\progress-bg.png
- %TEMP%\ish428940\css\sdk-ui\images\progress-bg2.png
- %TEMP%\ish428940\css\sdk-ui\images\progress-bg-corner.png
- %TEMP%\ish428940\css\sdk-ui\checkbox.css
- %TEMP%\ish428940\css\sdk-ui\images\button-bg.png
- %TEMP%\ish428940\images\Logo.png
- %TEMP%\ish430687\css\sdk-ui\images\progress-bg2.png
- %TEMP%\ish430687\css\sdk-ui\progress-bar.css
- %TEMP%\ish430687\css\sdk-ui\images\progress-bg.png
- %TEMP%\ish430687\css\sdk-ui\images\button-bg.png
- %TEMP%\ish430687\css\sdk-ui\images\progress-bg-corner.png
- %TEMP%\ish430687\images\Close.png
- %TEMP%\ish430687\images\Close_Hover.png
- %TEMP%\ish430687\images\BG2.png
- %TEMP%\ish430687\csshover3.htc
- %TEMP%\ish430687\images\BG1.png
- %TEMP%\ish430687\css\sdk-ui\checkbox.css
- %TEMP%\ish428940\locale\EN.locale
- %TEMP%\00069194.log
- %TEMP%\ish428940\images\text-bg.png
- %TEMP%\ish428940\images\Progress.png
- %TEMP%\ish428940\images\ProgressBar.png
- %TEMP%\ish430687\css\sdk-ui\browse.css
- %TEMP%\ish430687\css\sdk-ui\button.css
- %TEMP%\ish430687\css\main.css
- %TEMP%\0006924F.log
- %TEMP%\ish430687\css\ie6_main.css
Удаляет следующие файлы:
- %TEMP%\ish428940\images\Loader.gif
- %TEMP%\ish428940\images\Grey_Button_Hover.png
- %TEMP%\0006924F.log
- %TEMP%\ish428940\images\Logo.png
- %TEMP%\ish428940\images\Color_Button.png
- %TEMP%\ish428940\images\Close_Hover.png
- %TEMP%\ish428940\images\Grey_Button.png
- %TEMP%\ish428940\images\Color_Button_Hover.png
- %TEMP%\0006A7B3.log
- %PROGRAM_FILES%\is434478.log
- %TEMP%\ish430687\bootstrap_40127.html
- %TEMP%\0006AC16.log
- %TEMP%\ish428940\images\ProgressBar.png
- %TEMP%\ish428940\images\Progress.png
- %TEMP%\ish428940\locale\EN.locale
- %TEMP%\ish428940\images\text-bg.png
- %TEMP%\ish428940\css\sdk-ui\button.css
- %TEMP%\ish428940\css\sdk-ui\browse.css
- %TEMP%\ish428940\css\sdk-ui\images\button-bg.png
- %TEMP%\ish428940\css\sdk-ui\checkbox.css
- %TEMP%\00069194.log
- %TEMP%\00068B7C.log
- %TEMP%\ish428940\css\main.css
- %TEMP%\ish428940\css\ie6_main.css
- %TEMP%\ish428940\images\BG1.png
- %TEMP%\ish428940\csshover3.htc
- %TEMP%\ish428940\images\Close.png
- %TEMP%\ish428940\images\BG2.png
- %TEMP%\ish428940\css\sdk-ui\images\progress-bg.png
- %TEMP%\ish428940\css\sdk-ui\images\progress-bg-corner.png
- %TEMP%\ish428940\css\sdk-ui\progress-bar.css
- %TEMP%\ish428940\css\sdk-ui\images\progress-bg2.png
Сетевая активность:
Подключается к:
- 'os#.###lflvplayer.com':80
- 'cd###.#oolflvplayer.com':80
- 'os.####flvplayer.com':80
TCP:
Запросы HTTP GET:
- cd###.#oolflvplayer.com/app/Aff/FLVPlayer-v2.cis
Запросы HTTP POST:
- os#.###lflvplayer.com/Aff-AD/?v=###############
- os.####flvplayer.com/Aff-AD/?v=###############
UDP:
- DNS ASK os#.###lflvplayer.com
- DNS ASK cd###.#oolflvplayer.com
- DNS ASK os.####flvplayer.com
Другое:
Ищет следующие окна:
- ClassName: 'OleMainThreadWndClass' WindowName: '(null)'
- ClassName: 'MS_WebCheckMonitor' WindowName: '(null)'
- ClassName: 'MS_AutodialMonitor' WindowName: '(null)'
