Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %HOMEPATH%\Start Menu\Programs\Startup\Orbit.lnk
Вредоносные функции:
Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%ProgramFiles%\Orbitdownloader\orbitnet.exe' = '%ProgramFiles%\Orbitdo...
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%ProgramFiles%\Orbitdownloader\orbitdm.exe' = '%ProgramFiles%\Orbitdow...
Завершает или пытается завершить
следующие пользовательские процессы:
- firefox.exe
- iexplore.exe
Изменения в файловой системе:
Создает следующие файлы:
- %ProgramFiles%\Orbitdownloader\language\is-L1NSJ.tmp
- %ProgramFiles%\Orbitdownloader\language\is-BS704.tmp
- %ProgramFiles%\Orbitdownloader\language\is-VQODS.tmp
- %ProgramFiles%\Orbitdownloader\language\is-QEFR4.tmp
- %ProgramFiles%\Orbitdownloader\language\is-U7SV2.tmp
- %ProgramFiles%\Orbitdownloader\language\is-NGNR0.tmp
- %ProgramFiles%\Orbitdownloader\language\is-E4S4E.tmp
- %ProgramFiles%\Orbitdownloader\language\is-6S6RV.tmp
- %ProgramFiles%\Orbitdownloader\language\is-KDCNO.tmp
- %ProgramFiles%\Orbitdownloader\language\is-COG5G.tmp
- %ProgramFiles%\Orbitdownloader\language\is-9B7IF.tmp
- %ProgramFiles%\Orbitdownloader\language\is-0OIMB.tmp
- %ProgramFiles%\Orbitdownloader\language\is-O4HH5.tmp
- %ProgramFiles%\Orbitdownloader\language\is-T2RNI.tmp
- %ProgramFiles%\Orbitdownloader\language\is-N3BDO.tmp
- %ProgramFiles%\Orbitdownloader\language\is-18QIS.tmp
- %ProgramFiles%\Orbitdownloader\language\is-V7466.tmp
- %ProgramFiles%\Orbitdownloader\language\is-K08PI.tmp
- %ProgramFiles%\Orbitdownloader\is-F5D58.tmp
- %ProgramFiles%\Orbitdownloader\is-52A6V.tmp
- %ProgramFiles%\Orbitdownloader\is-5KMMO.tmp
- %ProgramFiles%\Orbitdownloader\is-AGIEV.tmp
- %ALLUSERSPROFILE%\Start Menu\Programs\Orbit\Orbit.lnk
- %HOMEPATH%\Desktop\Orbit.lnk
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Orbit.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Orbit\Uninstall Orbit.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Orbit\Homepage.url
- %ProgramFiles%\Orbitdownloader\language\is-RR138.tmp
- %ProgramFiles%\Orbitdownloader\language\is-LGHSO.tmp
- %ProgramFiles%\Orbitdownloader\language\is-SRPHQ.tmp
- %ProgramFiles%\Orbitdownloader\language\is-4FSC0.tmp
- %ProgramFiles%\Orbitdownloader\language\is-0UBME.tmp
- %ProgramFiles%\Orbitdownloader\addons\orbitff\is-FQ1QP.tmp
- %ProgramFiles%\Orbitdownloader\addons\orbitff\chrome\is-UQ77I.tmp
- %ProgramFiles%\Orbitdownloader\language\is-LGHQ3.tmp
- %ProgramFiles%\Orbitdownloader\addons\orbitff\is-1OHSL.tmp
- %ProgramFiles%\Orbitdownloader\language\is-6EP61.tmp
- %ProgramFiles%\Orbitdownloader\is-OEV8I.tmp
- %ProgramFiles%\Orbitdownloader\is-3040P.tmp
- %ProgramFiles%\Orbitdownloader\is-0AG6S.tmp
- %ProgramFiles%\Orbitdownloader\is-8ASQP.tmp
- %ProgramFiles%\Orbitdownloader\is-P0UQ3.tmp
- %ProgramFiles%\Orbitdownloader\is-EUKO0.tmp
- %ProgramFiles%\Orbitdownloader\is-S9CH6.tmp
- %ProgramFiles%\Orbitdownloader\is-L4RPS.tmp
- %ProgramFiles%\Orbitdownloader\is-K07V0.tmp
- %TEMP%\is-1KVSF.tmp\is-VM2J7.tmp
- %TEMP%\is-CGS8C.tmp\_isetup\_RegDLL.tmp
- %TEMP%\RarSFX0\SetupOrbit.exe
- %TEMP%\RarSFX0\Orbit_Install.exe
- %TEMP%\is-CGS8C.tmp\_isetup\_shfoldr.dll
- %ProgramFiles%\Orbitdownloader\is-88L1K.tmp
- %ProgramFiles%\Orbitdownloader\is-M0C74.tmp
- %TEMP%\is-CGS8C.tmp\saction.dll
- %APPDATA%\Orbit\Conf.dat
- %ProgramFiles%\Orbitdownloader\language\is-UVANC.tmp
- %ProgramFiles%\Orbitdownloader\language\is-0GS88.tmp
- %ProgramFiles%\Orbitdownloader\language\is-9IV4U.tmp
- %ProgramFiles%\Orbitdownloader\language\is-AQBAK.tmp
- %ProgramFiles%\Orbitdownloader\language\is-HT2IU.tmp
- %ProgramFiles%\Orbitdownloader\language\is-TQNC3.tmp
- %ProgramFiles%\Orbitdownloader\language\is-D30H7.tmp
- %ProgramFiles%\Orbitdownloader\language\is-1UJNL.tmp
- %ProgramFiles%\Orbitdownloader\language\is-4K8RH.tmp
- %ProgramFiles%\Orbitdownloader\is-D915I.tmp
- %ProgramFiles%\Orbitdownloader\is-ILV7U.tmp
- %ProgramFiles%\Orbitdownloader\is-O12SD.tmp
- %ProgramFiles%\Orbitdownloader\is-0MNMN.tmp
- %ProgramFiles%\Orbitdownloader\language\is-PE7D5.tmp
- %ProgramFiles%\Orbitdownloader\language\is-FU9U3.tmp
- %ProgramFiles%\Orbitdownloader\language\is-AQ0AR.tmp
- %ProgramFiles%\Orbitdownloader\language\is-KUH5E.tmp
- %ProgramFiles%\Orbitdownloader\language\is-29EM6.tmp
Перемещает следующие файлы:
- %ProgramFiles%\Orbitdownloader\language\is-L1NSJ.tmp в %ProgramFiles%\Orbitdownloader\language\obplk.ini
- %ProgramFiles%\Orbitdownloader\language\is-QEFR4.tmp в %ProgramFiles%\Orbitdownloader\language\obnor.ini
- %ProgramFiles%\Orbitdownloader\language\is-VQODS.tmp в %ProgramFiles%\Orbitdownloader\language\obnld.ini
- %ProgramFiles%\Orbitdownloader\language\is-BS704.tmp в %ProgramFiles%\Orbitdownloader\language\obptb.ini
- %ProgramFiles%\Orbitdownloader\language\is-KDCNO.tmp в %ProgramFiles%\Orbitdownloader\language\obrus.ini
- %ProgramFiles%\Orbitdownloader\language\is-6S6RV.tmp в %ProgramFiles%\Orbitdownloader\language\obrom.ini
- %ProgramFiles%\Orbitdownloader\language\is-U7SV2.tmp в %ProgramFiles%\Orbitdownloader\language\obptg.ini
- %ProgramFiles%\Orbitdownloader\language\is-18QIS.tmp в %ProgramFiles%\Orbitdownloader\language\obmki.ini
- %ProgramFiles%\Orbitdownloader\language\is-9B7IF.tmp в %ProgramFiles%\Orbitdownloader\language\obhun.ini
- %ProgramFiles%\Orbitdownloader\language\is-COG5G.tmp в %ProgramFiles%\Orbitdownloader\language\obhrv.ini
- %ProgramFiles%\Orbitdownloader\language\is-O4HH5.tmp в %ProgramFiles%\Orbitdownloader\language\obheb.ini
- %ProgramFiles%\Orbitdownloader\language\is-T2RNI.tmp в %ProgramFiles%\Orbitdownloader\language\obind.ini
- %ProgramFiles%\Orbitdownloader\language\is-N3BDO.tmp в %ProgramFiles%\Orbitdownloader\language\obkor.ini
- %ProgramFiles%\Orbitdownloader\language\is-K08PI.tmp в %ProgramFiles%\Orbitdownloader\language\objpn.ini
- %ProgramFiles%\Orbitdownloader\language\is-V7466.tmp в %ProgramFiles%\Orbitdownloader\language\obita.ini
- %ProgramFiles%\Orbitdownloader\addons\orbitff\chrome\is-UQ77I.tmp в %ProgramFiles%\Orbitdownloader\addons\orbitff\chrome\orbit.jar
- %ProgramFiles%\Orbitdownloader\addons\orbitff\is-FQ1QP.tmp в %ProgramFiles%\Orbitdownloader\addons\orbitff\install.rdf
- %ProgramFiles%\Orbitdownloader\addons\orbitff\is-1OHSL.tmp в %ProgramFiles%\Orbitdownloader\addons\orbitff\chrome.manifest
- %ProgramFiles%\Orbitdownloader\is-5KMMO.tmp в %ProgramFiles%\Orbitdownloader\saction.dll
- %ProgramFiles%\Orbitdownloader\is-52A6V.tmp в %ProgramFiles%\Orbitdownloader\Grab.exe
- %ProgramFiles%\Orbitdownloader\is-F5D58.tmp в %ProgramFiles%\Orbitdownloader\GrabDll.dll
- %ProgramFiles%\Orbitdownloader\is-AGIEV.tmp в %ProgramFiles%\Orbitdownloader\winfile.dll
- %ProgramFiles%\Orbitdownloader\language\is-LGHQ3.tmp в %ProgramFiles%\Orbitdownloader\language\obvit.ini
- %ProgramFiles%\Orbitdownloader\language\is-SRPHQ.tmp в %ProgramFiles%\Orbitdownloader\language\obsrb.ini
- %ProgramFiles%\Orbitdownloader\language\is-E4S4E.tmp в %ProgramFiles%\Orbitdownloader\language\obsqi.ini
- %ProgramFiles%\Orbitdownloader\language\is-NGNR0.tmp в %ProgramFiles%\Orbitdownloader\language\obsky.ini
- %ProgramFiles%\Orbitdownloader\language\is-4FSC0.tmp в %ProgramFiles%\Orbitdownloader\language\obswe.ini
- %ProgramFiles%\Orbitdownloader\language\is-0UBME.tmp в %ProgramFiles%\Orbitdownloader\language\obukr.ini
- %ProgramFiles%\Orbitdownloader\language\is-LGHSO.tmp в %ProgramFiles%\Orbitdownloader\language\obtrk.ini
- %ProgramFiles%\Orbitdownloader\language\is-RR138.tmp в %ProgramFiles%\Orbitdownloader\language\obtha.ini
- %ProgramFiles%\Orbitdownloader\language\is-0OIMB.tmp в %ProgramFiles%\Orbitdownloader\language\obfra.ini
- %ProgramFiles%\Orbitdownloader\is-S9CH6.tmp в %ProgramFiles%\Orbitdownloader\GrabKernel.dll
- %ProgramFiles%\Orbitdownloader\is-EUKO0.tmp в %ProgramFiles%\Orbitdownloader\GrabPro.dll
- %ProgramFiles%\Orbitdownloader\is-K07V0.tmp в %ProgramFiles%\Orbitdownloader\orbitcth.dll
- %ProgramFiles%\Orbitdownloader\is-O12SD.tmp в %ProgramFiles%\Orbitdownloader\Lang.ini
- %ProgramFiles%\Orbitdownloader\is-ILV7U.tmp в %ProgramFiles%\Orbitdownloader\siteinfo.ini
- %ProgramFiles%\Orbitdownloader\is-D915I.tmp в %ProgramFiles%\Orbitdownloader\banurl.ini
- %ProgramFiles%\Orbitdownloader\is-0MNMN.tmp в %ProgramFiles%\Orbitdownloader\changelog.txt
- %ProgramFiles%\Orbitdownloader\is-L4RPS.tmp в %ProgramFiles%\Orbitdownloader\orbitmxt.dll
- %ProgramFiles%\Orbitdownloader\is-0AG6S.tmp в %ProgramFiles%\Orbitdownloader\ssleay32.dll
- %ProgramFiles%\Orbitdownloader\is-M0C74.tmp в %ProgramFiles%\Orbitdownloader\libeay32.dll
- %ProgramFiles%\Orbitdownloader\is-88L1K.tmp в %ProgramFiles%\Orbitdownloader\unins000.exe
- %ProgramFiles%\Orbitdownloader\is-8ASQP.tmp в %ProgramFiles%\Orbitdownloader\orbitdm.exe
- %ProgramFiles%\Orbitdownloader\is-P0UQ3.tmp в %ProgramFiles%\Orbitdownloader\orbitnet.exe
- %ProgramFiles%\Orbitdownloader\is-3040P.tmp в %ProgramFiles%\Orbitdownloader\idht.dll
- %ProgramFiles%\Orbitdownloader\is-OEV8I.tmp в %ProgramFiles%\Orbitdownloader\download.dll
- %ProgramFiles%\Orbitdownloader\language\is-1UJNL.tmp в %ProgramFiles%\Orbitdownloader\language\obesn.ini
- %ProgramFiles%\Orbitdownloader\language\is-HT2IU.tmp в %ProgramFiles%\Orbitdownloader\language\obeng.ini
- %ProgramFiles%\Orbitdownloader\language\is-0GS88.tmp в %ProgramFiles%\Orbitdownloader\language\obell.ini
- %ProgramFiles%\Orbitdownloader\language\is-4K8RH.tmp в %ProgramFiles%\Orbitdownloader\language\obeso.ini
- %ProgramFiles%\Orbitdownloader\language\is-6EP61.tmp в %ProgramFiles%\Orbitdownloader\language\obfin.ini
- %ProgramFiles%\Orbitdownloader\language\is-D30H7.tmp в %ProgramFiles%\Orbitdownloader\language\obfar.ini
- %ProgramFiles%\Orbitdownloader\language\is-TQNC3.tmp в %ProgramFiles%\Orbitdownloader\language\obesv.ini
- %ProgramFiles%\Orbitdownloader\language\is-UVANC.tmp в %ProgramFiles%\Orbitdownloader\language\obdeu.ini
- %ProgramFiles%\Orbitdownloader\language\is-29EM6.tmp в %ProgramFiles%\Orbitdownloader\language\obbgr.ini
- %ProgramFiles%\Orbitdownloader\language\is-KUH5E.tmp в %ProgramFiles%\Orbitdownloader\language\obara.ini
- %ProgramFiles%\Orbitdownloader\language\is-PE7D5.tmp в %ProgramFiles%\Orbitdownloader\language\obafr.ini
- %ProgramFiles%\Orbitdownloader\language\is-FU9U3.tmp в %ProgramFiles%\Orbitdownloader\language\obcat.ini
- %ProgramFiles%\Orbitdownloader\language\is-AQBAK.tmp в %ProgramFiles%\Orbitdownloader\language\obcsy.ini
- %ProgramFiles%\Orbitdownloader\language\is-9IV4U.tmp в %ProgramFiles%\Orbitdownloader\language\obcht.ini
- %ProgramFiles%\Orbitdownloader\language\is-AQ0AR.tmp в %ProgramFiles%\Orbitdownloader\language\obchs.ini
Другое:
Ищет следующие окна:
- ClassName: 'orbitdm_app' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
Создает и запускает на исполнение:
- '%TEMP%\is-1KVSF.tmp\is-VM2J7.tmp' /SL4 $2010A "%TEMP%\RarSFX0\SetupOrbit.exe" 2017048 52736 /VERYSILENT
- '%TEMP%\RarSFX0\SetupOrbit.exe' /VERYSILENT
- '%TEMP%\RarSFX0\Orbit_Install.exe'
Запускает на исполнение:
- '<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles%\Orbitdownloader\orbitcth.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles%\Orbitdownloader\orbitmxt.dll"
