Техническая информация
Для обеспечения автозапуска и распространения:
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\kaccore] 'Start' = '00000002'
Вредоносные функции:
Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\Kingsoft\KAC\Service\kaccore.exe' = '%PROGRAM_FILES%\Kingsoft\KAC\Service\kaccore.exe:*:Enabled:Kingsoft Uplive Service'
Создает и запускает на исполнение:
- %PROGRAM_FILES%\Kingsoft\KAC\KSA\ksamain.exe -install
- %PROGRAM_FILES%\Kingsoft\KAC\Service\kaccore.exe /service
Запускает на исполнение:
- %WINDIR%\regedit.exe /s "%PROGRAM_FILES%\Kingsoft\KAC\Service\regall.reg"
Изменения в файловой системе:
Создает следующие файлы:
- %ALLUSERSPROFILE%\Application Data\Kingsoft\KAC\webpage\ksa\images\is-P6DOC.tmp
- %ALLUSERSPROFILE%\Application Data\Kingsoft\KAC\webpage\ksa\js\is-AJK20.tmp
- %ALLUSERSPROFILE%\Application Data\Kingsoft\KAC\webpage\ksa\images\is-ABRBI.tmp
- %ALLUSERSPROFILE%\Application Data\Kingsoft\KAC\webpage\ksa\images\is-6EIUG.tmp
- %ALLUSERSPROFILE%\Application Data\Kingsoft\KAC\webpage\ksa\js\is-GJSRC.tmp
- %ALLUSERSPROFILE%\Application Data\Kingsoft\KAC\webpage\ksa\js\intf\is-KEQ2U.tmp
- %ALLUSERSPROFILE%\Application Data\Kingsoft\KAC\webpage\ksa\js\intf\is-K2OF4.tmp
- %ALLUSERSPROFILE%\Application Data\Kingsoft\KAC\webpage\ksa\js\is-VTV8H.tmp
- %ALLUSERSPROFILE%\Application Data\Kingsoft\KAC\webpage\ksa\js\is-BI3HI.tmp
- %ALLUSERSPROFILE%\Application Data\Kingsoft\KAC\webpage\ksa\images\is-76QBE.tmp
- %ALLUSERSPROFILE%\Application Data\Kingsoft\KAC\webpage\ksa\images\is-VB2GQ.tmp
- %ALLUSERSPROFILE%\Application Data\Kingsoft\KAC\webpage\ksa\images\is-NKOIN.tmp
- %ALLUSERSPROFILE%\Application Data\Kingsoft\KAC\webpage\ksa\images\is-MO4Q8.tmp
- %ALLUSERSPROFILE%\Application Data\Kingsoft\KAC\webpage\ksa\images\is-HMB2F.tmp
- %ALLUSERSPROFILE%\Application Data\Kingsoft\KAC\webpage\ksa\images\is-KHIVF.tmp
- %ALLUSERSPROFILE%\Application Data\Kingsoft\KAC\webpage\ksa\images\is-ORIEF.tmp
- %ALLUSERSPROFILE%\Application Data\Kingsoft\KAC\webpage\ksa\images\is-8B3H8.tmp
- %ALLUSERSPROFILE%\Application Data\Kingsoft\KAC\webpage\ksa\images\is-PARFG.tmp
- %ALLUSERSPROFILE%\Application Data\Kingsoft\KAC\webpage\ksa\images\is-FF4GV.tmp
- %ALLUSERSPROFILE%\Application Data\Kingsoft\KAC\webpage\ksa\js\lang\is-8PSMA.tmp
- %PROGRAM_FILES%\Kingsoft\KAC\KSA\unins000.dat
- %PROGRAM_FILES%\Kingsoft\KAC\Service\update\service\safecenter.xml.dt!
- %ALLUSERSPROFILE%\Start Menu\Programs\ЅрЙЅВ©¶ґЙЁГи\Р¶ФШЅрЙЅВ©¶ґРЮёґ.lnk
- %PROGRAM_FILES%\Kingsoft\KAC\Service\installapp.ini
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\default[1].htm
- %PROGRAM_FILES%\Kingsoft\KAC\KSA\ksadata.tmp
- %PROGRAM_FILES%\Kingsoft\KAC\KSA\ksadata.ini
- %PROGRAM_FILES%\Kingsoft\KAC\KSA\ksadata0.dat-journal
- %PROGRAM_FILES%\Kingsoft\KAC\KSA\ksadata0.dat
- %ALLUSERSPROFILE%\Start Menu\Programs\ЅрЙЅВ©¶ґЙЁГи\ЅрЙЅВ©¶ґРЮёґ.lnk
- %ALLUSERSPROFILE%\Application Data\Kingsoft\KAC\webpage\ksa\js\mod\is-G0D9J.tmp
- %ALLUSERSPROFILE%\Application Data\Kingsoft\KAC\webpage\ksa\js\mod\is-N4ULL.tmp
- %ALLUSERSPROFILE%\Application Data\Kingsoft\KAC\webpage\ksa\js\lang\is-S0NDI.tmp
- %ALLUSERSPROFILE%\Application Data\Kingsoft\KAC\webpage\ksa\js\lib\is-2U121.tmp
- %ALLUSERSPROFILE%\Application Data\Kingsoft\KAC\webpage\ksa\is-M52H5.tmp
- %ALLUSERSPROFILE%\Application Data\Kingsoft\KAC\webpage\ksa\is-1NKO7.tmp
- %ALLUSERSPROFILE%\Desktop\ЅрЙЅВ©¶ґРЮёґ.lnk
- %ALLUSERSPROFILE%\Application Data\Kingsoft\KAC\webpage\ksa\is-PRUN0.tmp
- %ALLUSERSPROFILE%\Application Data\Kingsoft\KAC\webpage\ksa\is-1201G.tmp
- %PROGRAM_FILES%\Kingsoft\KAC\Service\is-MDEL6.tmp
- %PROGRAM_FILES%\Kingsoft\KAC\Service\is-KS2LE.tmp
- %PROGRAM_FILES%\Kingsoft\KAC\Service\is-UD447.tmp
- %PROGRAM_FILES%\Kingsoft\KAC\Service\is-BH4V0.tmp
- %PROGRAM_FILES%\Kingsoft\KAC\Service\is-U40CR.tmp
- %PROGRAM_FILES%\Kingsoft\KAC\KSA\is-CBPPD.tmp
- %PROGRAM_FILES%\Kingsoft\KAC\KSA\is-QBEBO.tmp
- %PROGRAM_FILES%\Kingsoft\KAC\Service\is-L3TH5.tmp
- %PROGRAM_FILES%\Kingsoft\KAC\Service\is-VK1J0.tmp
- %PROGRAM_FILES%\Kingsoft\KAC\Service\is-0JS5T.tmp
- %TEMP%\is-PJ0KH.tmp\_isetup\_RegDLL.tmp
- %TEMP%\is-PJ0KH.tmp\_isetup\_shfoldr.dll
- %TEMP%\ksa88.exe
- %TEMP%\is-ICMAG.tmp\ksa88.exe.tmp
- %TEMP%\is-PJ0KH.tmp\inst.bmp
- %PROGRAM_FILES%\Kingsoft\KAC\Service\is-2I33D.tmp
- %PROGRAM_FILES%\Kingsoft\KAC\Service\is-6QFO9.tmp
- %PROGRAM_FILES%\Kingsoft\KAC\KSA\is-JAP43.tmp
- %PROGRAM_FILES%\Kingsoft\KAC\Service\is-DTVG3.tmp
- %PROGRAM_FILES%\Kingsoft\KAC\KSA\is-PG72L.tmp
- %ALLUSERSPROFILE%\Application Data\Kingsoft\KAC\webpage\ksa\images\is-VQ9Q3.tmp
- %ALLUSERSPROFILE%\Application Data\Kingsoft\KAC\webpage\ksa\images\is-U31OS.tmp
- %ALLUSERSPROFILE%\Application Data\Kingsoft\KAC\webpage\ksa\images\is-A0QRH.tmp
- %ALLUSERSPROFILE%\Application Data\Kingsoft\KAC\webpage\ksa\images\is-KMJMJ.tmp
- %ALLUSERSPROFILE%\Application Data\Kingsoft\KAC\webpage\ksa\images\is-1JGL0.tmp
- %ALLUSERSPROFILE%\Application Data\Kingsoft\KAC\webpage\ksa\images\is-KV34B.tmp
- %ALLUSERSPROFILE%\Application Data\Kingsoft\KAC\webpage\ksa\images\is-4OI9F.tmp
- %ALLUSERSPROFILE%\Application Data\Kingsoft\KAC\webpage\ksa\images\is-D7MCS.tmp
- %ALLUSERSPROFILE%\Application Data\Kingsoft\KAC\webpage\ksa\images\is-493SJ.tmp
- %ALLUSERSPROFILE%\Application Data\Kingsoft\KAC\webpage\ksa\images\is-HQHFI.tmp
- %PROGRAM_FILES%\Kingsoft\KAC\KSA\is-AJA6L.tmp
- %ALLUSERSPROFILE%\Application Data\Kingsoft\KAC\webpage\ksa\css\is-C36G7.tmp
- %PROGRAM_FILES%\Kingsoft\KAC\KSA\is-KC3TE.tmp
- %PROGRAM_FILES%\Kingsoft\KAC\KSA\is-3S2CJ.tmp
- %ALLUSERSPROFILE%\Application Data\Kingsoft\KAC\webpage\ksa\images\is-3C648.tmp
- %ALLUSERSPROFILE%\Application Data\Kingsoft\KAC\webpage\ksa\images\is-90HAJ.tmp
- %ALLUSERSPROFILE%\Application Data\Kingsoft\KAC\webpage\ksa\images\is-BFBR7.tmp
- %ALLUSERSPROFILE%\Application Data\Kingsoft\KAC\webpage\ksa\images\is-156TN.tmp
- %ALLUSERSPROFILE%\Application Data\Kingsoft\KAC\webpage\ksa\images\is-GS07B.tmp
Удаляет следующие файлы:
- %TEMP%\is-ICMAG.tmp\ksa88.exe.tmp
- %TEMP%\is-PJ0KH.tmp\_isetup\_shfoldr.dll
- %PROGRAM_FILES%\Kingsoft\KAC\KSA\ksadata.tmp
- %PROGRAM_FILES%\Kingsoft\KAC\KSA\ksadata0.dat-journal
- %PROGRAM_FILES%\Kingsoft\KAC\KSA\safecenter.xml
- %PROGRAM_FILES%\Kingsoft\KAC\Service\regall.reg
- %TEMP%\is-PJ0KH.tmp\_isetup\_RegDLL.tmp
- %TEMP%\is-PJ0KH.tmp\inst.bmp
Сетевая активность:
Подключается к:
- 'localhost':1044
- 'cu###.www.duba.net':80
- 'an#####.db.kingsoft.com':58168
- 'localhost':9090
TCP:
Запросы HTTP GET:
- cu###.www.duba.net/duba/tools/kac/service/safecenter.xml
UDP:
- DNS ASK cu###.www.duba.net
- DNS ASK an#####.db.kingsoft.com
Другое:
Ищет следующие окна:
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'Internet Explorer_Server' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'RegEdit_RegEdit' WindowName: ''
