Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'duoduobox' = '%PROGRAM_FILES%\duoduobox\duoduotray.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\DODO_SERVICE] 'Start' = '00000002'
Вредоносные функции:
Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '"%TEMP%\flashget_93591_1.exe"' = '"%TEMP%\flashget_93591_1.exe:*:Enabled:fg_ol_setup"'
Создает и запускает на исполнение:
- %PROGRAM_FILES%\duoduobox\OPDriver.exe -install
- %PROGRAM_FILES%\duoduobox\DuoDuoBox.exe
- %PROGRAM_FILES%\duoduobox\ddserver.exe -install -rename -rebho
- "%TEMP%\PPTV(pplive)_forqd507.exe" (загружен из сети Интернет)
Запускает на исполнение:
- <SYSTEM32>\regsvr32.exe "%PROGRAM_FILES%\duoduobox\CopyPathExt.dll" /s
- <SYSTEM32>\regsvr32.exe "%PROGRAM_FILES%\duoduobox\IEHelper.dll" /s
- <SYSTEM32>\regsvr32.exe /s Radio.dll
- <SYSTEM32>\netsh.exe advfirewall firewall add rule name = "duoduobox" dir=in program = "%PROGRAM_FILES%\duoduobox\duoduobox.exe" action=allow
Изменения в файловой системе:
Создает следующие файлы:
- %PROGRAM_FILES%\duoduobox\res\dialogbutton.bmp
- %PROGRAM_FILES%\duoduobox\res\dialog.bmp
- %PROGRAM_FILES%\duoduobox\res\filter.bmp
- %PROGRAM_FILES%\duoduobox\res\jump.bmp
- %PROGRAM_FILES%\duoduobox\res\icon.ico
- %PROGRAM_FILES%\duoduobox\res\btn_local.bmp
- %PROGRAM_FILES%\duoduobox\res\btn_indisp.bmp
- %PROGRAM_FILES%\duoduobox\res\btn_remote.bmp
- %PROGRAM_FILES%\duoduobox\res\checker.bmp
- %PROGRAM_FILES%\duoduobox\res\btn_restore.bmp
- %PROGRAM_FILES%\duoduobox\res\nook_buttons.bmp
- %PROGRAM_FILES%\duoduobox\res\update.bmp
- %PROGRAM_FILES%\duoduobox\res\topbar.bmp
- %PROGRAM_FILES%\duoduobox\res\ani\scan_0.ico
- %PROGRAM_FILES%\duoduobox\res\ani\scan_2.ico
- %PROGRAM_FILES%\duoduobox\res\ani\scan_1.ico
- %PROGRAM_FILES%\duoduobox\res\scan.bmp
- %PROGRAM_FILES%\duoduobox\res\off_button.bmp
- %PROGRAM_FILES%\duoduobox\res\skip_button.bmp
- %PROGRAM_FILES%\duoduobox\res\tipimage.bmp
- %PROGRAM_FILES%\duoduobox\res\tipbar.bmp
- %PROGRAM_FILES%\duoduobox\res\border_right.bmp
- %PROGRAM_FILES%\duoduobox\feature_app.dll
- %PROGRAM_FILES%\duoduobox\duoduotray.exe
- %PROGRAM_FILES%\duoduobox\ico.bmp
- %PROGRAM_FILES%\duoduobox\LoginModle.dll
- %PROGRAM_FILES%\duoduobox\inject_impl.dll
- %PROGRAM_FILES%\duoduobox\default.ico
- %PROGRAM_FILES%\duoduobox\default.bmp
- %PROGRAM_FILES%\duoduobox\download-complete.wav
- %PROGRAM_FILES%\duoduobox\DuoDuoBox.exe
- %PROGRAM_FILES%\duoduobox\DownLoader.dll
- %PROGRAM_FILES%\duoduobox\md5.dll
- %PROGRAM_FILES%\duoduobox\UserFace.dll
- %PROGRAM_FILES%\duoduobox\userface.cfg
- %PROGRAM_FILES%\duoduobox\version.dat
- %PROGRAM_FILES%\duoduobox\res\border_left.bmp
- %PROGRAM_FILES%\duoduobox\res\basebar.bmp
- %PROGRAM_FILES%\duoduobox\sqlite3.dll
- %PROGRAM_FILES%\duoduobox\SFilter.sys
- %PROGRAM_FILES%\duoduobox\StubHook.dll
- %PROGRAM_FILES%\duoduobox\update_install.exe
- %PROGRAM_FILES%\duoduobox\update.dll
- %PROGRAM_FILES%\duoduobox\db\hy_name.db3
- %PROGRAM_FILES%\duoduobox\db\hy_code.db3
- %PROGRAM_FILES%\duoduobox\db\lcc_code.db3
- %PROGRAM_FILES%\duoduobox\autoinstl\auto_installer.dll
- %PROGRAM_FILES%\duoduobox\db\lcc_name.db3
- %PROGRAM_FILES%\duoduobox\db\app_feature.db3
- %PROGRAM_FILES%\duoduobox\res\ani\working_9.ico
- %PROGRAM_FILES%\duoduobox\db\db_list.dd
- %PROGRAM_FILES%\duoduobox\db\fwc_name.db3
- %PROGRAM_FILES%\duoduobox\db\fwc_code.db3
- %PROGRAM_FILES%\duoduobox\autoinstl\interpreter.exe
- %TEMP%\tmp8.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\get_info[1].php
- %HOMEPATH%\Start Menu\Programs\¶а¶аД§·ЁК¦\Р¶ФШ.lnk
- %TEMP%\DuoDuoBox.Log
- %PROGRAM_FILES%\duoduobox\uninst.exe
- %PROGRAM_FILES%\duoduobox\license.txt
- %PROGRAM_FILES%\duoduobox\autoinstl\parasitism.dll
- %TEMP%\nsw4.tmp\nsExec.dll
- %TEMP%\jguwrusc.exe
- %TEMP%\nsw4.tmp\ns7.tmp
- %PROGRAM_FILES%\duoduobox\res\ani\working_8.ico
- %PROGRAM_FILES%\duoduobox\res\ani\scan_9.ico
- %PROGRAM_FILES%\duoduobox\res\ani\scan_8.ico
- %PROGRAM_FILES%\duoduobox\res\ani\scan_10.ico
- %PROGRAM_FILES%\duoduobox\res\ani\tray_working_0.ico
- %PROGRAM_FILES%\duoduobox\res\ani\scan_11.ico
- %PROGRAM_FILES%\duoduobox\res\ani\scan_4.ico
- %PROGRAM_FILES%\duoduobox\res\ani\scan_3.ico
- %PROGRAM_FILES%\duoduobox\res\ani\scan_5.ico
- %PROGRAM_FILES%\duoduobox\res\ani\scan_7.ico
- %PROGRAM_FILES%\duoduobox\res\ani\scan_6.ico
- %PROGRAM_FILES%\duoduobox\res\ani\tray_working_1.ico
- %PROGRAM_FILES%\duoduobox\res\ani\working_4.ico
- %PROGRAM_FILES%\duoduobox\res\ani\working_3.ico
- %PROGRAM_FILES%\duoduobox\res\ani\working_5.ico
- %PROGRAM_FILES%\duoduobox\res\ani\working_7.ico
- %PROGRAM_FILES%\duoduobox\res\ani\working_6.ico
- %PROGRAM_FILES%\duoduobox\res\ani\working_1.ico
- %PROGRAM_FILES%\duoduobox\res\ani\working_0.ico
- %PROGRAM_FILES%\duoduobox\res\ani\working_10.ico
- %PROGRAM_FILES%\duoduobox\res\ani\working_2.ico
- %PROGRAM_FILES%\duoduobox\res\ani\working_11.ico
- %PROGRAM_FILES%\duoduobox\CopyPathExt.dll
- %PROGRAM_FILES%\TingTing\skin\RightArrowNor.png
- %PROGRAM_FILES%\TingTing\skin\RightArrowMouseIn.png
- %PROGRAM_FILES%\TingTing\skin\RightFrame.png
- %PROGRAM_FILES%\TingTing\skin\Thumbs.db
- %PROGRAM_FILES%\TingTing\skin\Rightv.png
- %PROGRAM_FILES%\TingTing\skin\LeftArrowMouseIn.png
- %PROGRAM_FILES%\TingTing\skin\HScrollThumb_normal.png
- %PROGRAM_FILES%\TingTing\skin\LeftArrowNor.png
- %PROGRAM_FILES%\TingTing\skin\NumBt.png
- %PROGRAM_FILES%\TingTing\skin\Leftv.png
- %PROGRAM_FILES%\TingTing\skin\VScrollThumb_down.png
- %PROGRAM_FILES%\TingTing\skin\ico1.png
- %PROGRAM_FILES%\TingTing\skin\downArrowNor.png
- %PROGRAM_FILES%\TingTing\skin\leftFrame.png
- %PROGRAM_FILES%\TingTing\skin\menu_sel.png
- %PROGRAM_FILES%\TingTing\skin\max.png
- %PROGRAM_FILES%\TingTing\skin\bottomFrame.png
- %PROGRAM_FILES%\TingTing\skin\VScrollThumb_normal.png
- %PROGRAM_FILES%\TingTing\skin\btbkg.png
- %PROGRAM_FILES%\TingTing\skin\downArrowMouseIn.png
- %PROGRAM_FILES%\TingTing\skin\close.png
- %PROGRAM_FILES%\TingTing\skin\HScrollThumb_down.png
- %TEMP%\TTRadio_Slient.exe
- %TEMP%\nsw4.tmp\Processes.dll
- %TEMP%\nsn6.tmp
- %HOMEPATH%\Start Menu\Programs\¶а¶аД§·ЁК¦\¶а¶аД§·ЁК¦.lnk
- %PROGRAM_FILES%\TingTing\main.xml
- %TEMP%\Loader_forqd507.exe
- %TEMP%\nsw2.tmp\System.dll
- %TEMP%\DuoDuoBoxSetup.exe
- %TEMP%\yy.exe
- %TEMP%\flashget_93591_1.exe
- %HOMEPATH%\Desktop\¶а¶аД§·ЁК¦.lnk
- %PROGRAM_FILES%\TingTing\TingTing.exe
- %PROGRAM_FILES%\TingTing\Tree.xml
- %PROGRAM_FILES%\TingTing\skin\1.ico
- %PROGRAM_FILES%\TingTing\skin\Ctrlbk.png
- %PROGRAM_FILES%\TingTing\skin\Bk.png
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\PPTV(pplive)_forqd507[1].exe
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\¶а¶аД§·ЁК¦.lnk
- %TEMP%\PPTV(pplive)_forqd507.exe
- %PROGRAM_FILES%\TingTing\config.xml
- %HOMEPATH%\Start Menu\Programs\МэМэНшВзКХТф»ъ\МэМэНшВзКХТф»ъ.lnk
- %PROGRAM_FILES%\TingTing\skin\topFrame.png
- %PROGRAM_FILES%\TingTing\skin\top.png
- %PROGRAM_FILES%\TingTing\skin\un.png
- %PROGRAM_FILES%\TingTing\skin\upArrowNor.png
- %PROGRAM_FILES%\TingTing\skin\upArrowMouseIn.png
- %PROGRAM_FILES%\TingTing\skin\siderbar.png
- %PROGRAM_FILES%\TingTing\skin\sideract.png
- %PROGRAM_FILES%\TingTing\skin\siderbk.png
- %PROGRAM_FILES%\TingTing\skin\stop.png
- %PROGRAM_FILES%\TingTing\skin\stop-1.png
- %PROGRAM_FILES%\TingTing\skin\vod.png
- %PROGRAM_FILES%\duoduobox\IEHelper.dll
- %PROGRAM_FILES%\TingTing\uninst.exe
- %PROGRAM_FILES%\duoduobox\ddst.dll
- %PROGRAM_FILES%\duoduobox\clinfo_impl.dll
- %PROGRAM_FILES%\duoduobox\OPDriver.exe
- %PROGRAM_FILES%\TingTing\skin\volmaxbt.png
- %PROGRAM_FILES%\TingTing\skin\vodbottom.png
- %PROGRAM_FILES%\TingTing\skin\volminbt.png
- <SYSTEM32>\Radio.dll
- %PROGRAM_FILES%\TingTing\skins\8946657815CC6DD868C1A28A8EF7E4E0.jpg
- %PROGRAM_FILES%\TingTing\skin\sider.png
- %PROGRAM_FILES%\TingTing\skin\operateBt.png
- %PROGRAM_FILES%\duoduobox\ddserver.exe
- %PROGRAM_FILES%\TingTing\skin\par.png
- %PROGRAM_FILES%\TingTing\skin\play.png
- %PROGRAM_FILES%\TingTing\skin\play-1.png
- %PROGRAM_FILES%\TingTing\skin\next-1.png
- %PROGRAM_FILES%\TingTing\skin\min.png
- %PROGRAM_FILES%\TingTing\skin\next.png
- %PROGRAM_FILES%\TingTing\skin\open.png
- %PROGRAM_FILES%\TingTing\skin\open-1.png
- %PROGRAM_FILES%\TingTing\skin\playname.png
- %PROGRAM_FILES%\TingTing\skin\rightWindowRight.png
- %PROGRAM_FILES%\TingTing\skin\rightWindowLeft.png
- %PROGRAM_FILES%\TingTing\skin\rightWindowbottom.png
- %PROGRAM_FILES%\TingTing\skin\sel.png
- %PROGRAM_FILES%\TingTing\skin\rightwindowTop.png
- %PROGRAM_FILES%\TingTing\skin\prev-1.png
- %PROGRAM_FILES%\TingTing\skin\playstatus.png
- %PROGRAM_FILES%\TingTing\skin\prev.png
- %PROGRAM_FILES%\TingTing\skin\rightTop2.png
- %PROGRAM_FILES%\TingTing\skin\rightBt.png
Удаляет следующие файлы:
- %TEMP%\tmp8.tmp
- %TEMP%\nsw4.tmp\nsExec.dll
- %TEMP%\nsw4.tmp\Processes.dll
- %TEMP%\nsw2.tmp\System.dll
- %TEMP%\nsw4.tmp\ns7.tmp
- %TEMP%\jguwrusc.exe
Сетевая активность:
Подключается к:
- 'dn#.#wbww.com':80
- 'localhost':1044
- 'du###obox.com':80
- 'ol####.flashget.com':80
- 'localhost':1035
- 'do####ad.pplive.com':80
- 's4.##ashget.com':80
TCP:
Запросы HTTP GET:
- du###obox.com/getinfo/get_info.php?ac####################################################
- du###obox.com/version/version.txt
- dn#.#wbww.com/images/ld709.txt
- do####ad.pplive.com/PPTV(pplive)_forqd507.exe
- ol####.flashget.com/ver7/35A00A0A2754B02304C49EE1BB2B2665/4986FB35FF6A8EDF9AA0FD7DB2DD5146/clickrun/93591/PST|flashget_93591_1.exe|<Служебное имя>.exe|<Служебное имя>.exe|
Запросы HTTP POST:
- s4.##ashget.comhttp://s4.flashget.com/fg4/sul
UDP:
- DNS ASK ol####.flashget.com
- DNS ASK dn#.#wbww.com
- DNS ASK du###obox.com
- DNS ASK p2#####gji.flashget.com
- DNS ASK do####ad.pplive.com
- DNS ASK s4.##ashget.com
- 'p2#####gji.flashget.com':5555
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
