Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'iemgr' = '%PROGRAM_FILES%\shopcash\IEMGR.EXE'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Fastkey' = ''
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'WindowDV' = '%PROGRAM_FILES%\WindowDV\WindowDV.exe'
Вредоносные функции:
Создает и запускает на исполнение:
- '%PROGRAM_FILES%\shopcash\INSTALLER.exe' unregagent
- '%PROGRAM_FILES%\shopcash\INSTALLER.exe' makeuserfile
- '%PROGRAM_FILES%\shopcash\IEMGR.exe'
- '%PROGRAM_FILES%\shopcash\INSTALLER.exe' install
- '%TEMP%\shopcash_setup.exe'
- '%TEMP%\WindowDVInstall.exe'
- '%TEMP%\daum1.exe'
- '%TEMP%\Setup_Fast.exe'
- '%PROGRAM_FILES%\WindowDV\WindowDV.exe'
Запускает на исполнение:
- '<SYSTEM32>\regsvr32.exe' /s "%PROGRAM_FILES%\WindowDV\WindowDV.dll"
Изменения в файловой системе:
Создает следующие файлы:
- %PROGRAM_FILES%\shopcash\except.dat
- %PROGRAM_FILES%\shopcash\ignore.dat
- %PROGRAM_FILES%\shopcash\configver.dat
- %PROGRAM_FILES%\shopcash\config.dat
- %PROGRAM_FILES%\shopcash\reword.dat
- %PROGRAM_FILES%\Fastkey\uninst.exe
- %PROGRAM_FILES%\Fastkey\FastKey.exe
- %TEMP%\nsx4.tmp\System.dll
- %TEMP%\NSISHLP\WFDLL.dll
- %PROGRAM_FILES%\shopcash\IEMGR.exe
- %PROGRAM_FILES%\WindowDV\WindowDV.ini
- %PROGRAM_FILES%\shopcash\MSIEEXT.DLL
- %PROGRAM_FILES%\shopcash\uninst.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\WindowDV[1].ini
- %PROGRAM_FILES%\shopcash\version.dat
- %PROGRAM_FILES%\shopcash\INSTALLER.exe
- %PROGRAM_FILES%\shopcash\user.dat
- %PROGRAM_FILES%\shopcash\MSIEEXT.MOD
- %PROGRAM_FILES%\WindowDV\Install.ini
- %WINDIR%\daum1.dat
- %PROGRAM_FILES%\WindowDV\WindowDV.exe
- %PROGRAM_FILES%\WindowDV\WindowDV.dll
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\daum1[1].dat
- %TEMP%\WindowDVInstall.exe
- %TEMP%\daum1.exe
- %TEMP%\shopcash_setup.exe
- %TEMP%\Setup_Fast.exe
- %PROGRAM_FILES%\Fastkey\MSINET.OCX
- %PROGRAM_FILES%\Fastkey\msvbvm60.dll
- %PROGRAM_FILES%\Fastkey\FastKeyUpdater.exe
- %PROGRAM_FILES%\Fastkey\MSCOMCTL.OCX
- %PROGRAM_FILES%\Fastkey\scrrun.dll
- %PROGRAM_FILES%\Fastkey\VB6KO.DLL
- %PROGRAM_FILES%\WindowDV\uninstall.exe
- %PROGRAM_FILES%\Fastkey\TABCTL32.OCX
- %PROGRAM_FILES%\Fastkey\toro_yr.ico
Удаляет следующие файлы:
- %TEMP%\Setup_Fast.exe
- %TEMP%\WindowDVInstall.exe
- %PROGRAM_FILES%\shopcash\MSIEEXT.MOD
- %TEMP%\shopcash_setup.exe
- %TEMP%\daum1.exe
- %PROGRAM_FILES%\WindowDV\Install.ini
- %WINDIR%\daum1.dat
- %TEMP%\nsx4.tmp\System.dll
- %PROGRAM_FILES%\WindowDV\WindowDV.ini
Сетевая активность:
Подключается к:
- 'up#.###dowsdriver.co.kr':80
- 'ko###kernel.com':80
- 'pa####edia.co.kr':80
- 'localhost':1036
- 'in#####.cleardisk-plus.com':80
- 'fa######ount.speenus.com':80
TCP:
Запросы HTTP GET:
- ko###kernel.com/install.php?mc############
- ko###kernel.com/loading.php?mc############
- pa####edia.co.kr/shopcash_updatever.txt
- in#####.cleardisk-plus.com/tdplus/pid/daum1/daum1.dat
- fa######ount.speenus.com/wdriver/log_install.php?iM####################################
- up#.###dowsdriver.co.kr/Update/WindowDV.ini
UDP:
- DNS ASK ko###kernel.com
- DNS ASK pa####edia.co.kr
- DNS ASK up#.###dowsdriver.co.kr
- DNS ASK in#####.cleardisk-plus.com
- DNS ASK fa######ount.speenus.com
Другое:
Ищет следующие окна:
- ClassName: 'MS_WebcheckMonitor' WindowName: '(null)'
- ClassName: 'MS_AutodialMonitor' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
