Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Classes\inffile\shell\open\command] '' = '<SYSTEM32>\NOTEPAD.EXE %1'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\LDrvSvc] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\LDrvSvc] 'ImagePath' = '<SYSTEM32>\svchost.exe -k LocalDriverService'
- [<HKLM>\SYSTEM\ControlSet001\Services\LDrvSvc\Parameters] 'ServiceDll' = '%TEMP%\DriverTalent\LDrvSvc.dll'
- [<HKLM>\SYSTEM\ControlSet001\Services\AudioSrv] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\SCardSvr] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\stisvc] 'Start' = '00000002'
Вредоносные функции:
Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] '%TEMP%\DriverTalent\DriverTalent.exe' = '%TEMP%\DriverTalent\DriverTalen...
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%TEMP%\DriverTalent\DriverTalent.exe' = '%TEMP%\DriverTalent\DriverTal...
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] '%TEMP%\DriverTalent\DTLService.exe' = '%TEMP%\DriverTalent\DTLService.ex...
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%TEMP%\DriverTalent\DTLService.exe' = '%TEMP%\DriverTalent\DTLService....
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] '%TEMP%\DriverTalent\download\MiniThunderPlatform.exe' = '%TEMP%\DriverTa...
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%TEMP%\DriverTalent\download\MiniThunderPlatform.exe' = '%TEMP%\Driver...
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\DriverTalent\Autosetup\filter.proc
- %TEMP%\DriverTalent\DTLSubmit.dll
- %TEMP%\DriverTalent\DTLService.exe
- %TEMP%\DriverTalent\dtlsdkconfig.dll
- %TEMP%\DriverTalent\DtlPlug.dll
- %TEMP%\DriverTalent\DTLDrvUninst.dll
- %TEMP%\DriverTalent\DTLAutoSetup.dll
- %TEMP%\DriverTalent\DTInstUI.dll
- %TEMP%\DriverTalent\dstudp.dll
- %TEMP%\DriverTalent\drvsrc.dll
- %TEMP%\DriverTalent\drvget.dll
- %TEMP%\DriverTalent\drvcheck.dll
- %TEMP%\DriverTalent\drvbak.dll
- %TEMP%\DriverTalent\DrvAllRepair.dll
- %TEMP%\DriverTalent\drv64\SignFile.exe
- %TEMP%\DriverTalent\drv64\DrvSigner64.exe
- %TEMP%\DriverTalent\drv64\DrvSigner.exe
- %TEMP%\DriverTalent\drv64\drv64_usb.exe
- %TEMP%\DriverTalent\drv64\drv64.exe
- %TEMP%\DriverTalent\drv64\drv32_usb.exe
- %TEMP%\DriverTalent\drv64\drv32.exe
- %TEMP%\DriverTalent\drv64\DIFxAPI64.dll
- %TEMP%\DriverTalent\drv64\difxapi.dll
- %TEMP%\DriverTalent\drv64\dev64.exe
- %TEMP%\DriverTalent\drv64\dev32.exe
- %TEMP%\DriverTalent\DriverTalent.exe
- %TEMP%\DriverTalent\download\zlib1.dll
- %TEMP%\DriverTalent\download\XLBugHandler.dll
- %TEMP%\DriverTalent\download\msvcr71.dll
- %TEMP%\DriverTalent\download\msvcp71.dll
- %TEMP%\DriverTalent\download\MiniThunderPlatform.exe
- %TEMP%\DriverTalent\download\minizip.dll
- %TEMP%\DriverTalent\DTLUI.dll
- %TEMP%\DriverTalent\DTLUpdate.dll
- C:\OSTotoFolder\DriversDownLoad\DownLoadInfo.db-journal
- %APPDATA%\DriverTalent\Config\UserConfig.dat
- %TEMP%\DriverTalent\xldl.dll
- %TEMP%\DriverTalent\usbenum.dll
- %TEMP%\DriverTalent\udp.dll
- %TEMP%\DriverTalent\TrayTool.exe
- %TEMP%\DriverTalent\substat.dll
- %TEMP%\DriverTalent\sqlite3.dll
- %TEMP%\DriverTalent\sqlcache.dll
- %TEMP%\DriverTalent\pnpdrv.dll
- %TEMP%\DriverTalent\PCRepairLogic.dll
- %TEMP%\DriverTalent\PCRepairCore.dll
- %TEMP%\DriverTalent\pcioffdrv.dll
- %TEMP%\DriverTalent\pcidrv.dll
- %TEMP%\DriverTalent\pcid.dll
- %TEMP%\DriverTalent\HardWare\lan\language_HardWare.ini
- %TEMP%\DriverTalent\p2spd.dll
- %TEMP%\DriverTalent\netprtenum.dll
- %TEMP%\DriverTalent\netprtdrv.dll
- %TEMP%\DriverTalent\MonReboot.dll
- %TEMP%\DriverTalent\libcurl.dll
- %TEMP%\DriverTalent\LDrvSvc.dll
- %TEMP%\DriverTalent\LDrvProCtrl.dll
- %TEMP%\DriverTalent\InfDrvSetup.dll
- %TEMP%\DriverTalent\HardWare\HWInfo\HardwareInfo.dll
- %TEMP%\DriverTalent\HardWare\HWInfo\cpuidsdk64.dll
- %TEMP%\DriverTalent\HardWare\HWInfo\cpuidsdk.dll
- %TEMP%\DriverTalent\HardWare.exe
- %TEMP%\DriverTalent\gzipdll.dll
- %TEMP%\DriverTalent\feedback.dll
- %TEMP%\DriverTalent\download\download_engine.dll
- %TEMP%\DriverTalent\download\dl_peer_id.dll
- %TEMP%\DriverTalent\download\atl71.dll
- %TEMP%\DriverTalent\dtldrv\dtldrv1\drv2.7zz
- %TEMP%\DriverTalent\dtldrv\dtldrv1\drv1.7zz
- %TEMP%\DriverTalent\dtldrv\dtldrv1\drv0.7zz
- %TEMP%\DriverTalent\dtldrv\dtldrv0\drv6.7zz
- %TEMP%\DriverTalent\dtldrv\dtldrv0\drv5.7zz
- %TEMP%\DriverTalent\dtldrv\dtldrv0\drv4.7zz
- %TEMP%\DriverTalent\dtldrv\dtldrv0\drv3.7zz
- %TEMP%\DriverTalent\dtldrv\dtldrv0\drv2.7zz
- %TEMP%\DriverTalent\dtldrv\dtldrv0\drv1.7zz
- %TEMP%\DriverTalent\dtldrv\dtldrv0\drv0.7zz
- %TEMP%\DriverTalent\Dtlconfig\wndconfigdata.xml
- %TEMP%\DriverTalent\Dtlconfig\unsetup.xml
- %TEMP%\DriverTalent\Dtlconfig\DtlSetup.xml
- %TEMP%\DriverTalent\drv64\wndconfigdata.xml
- %TEMP%\DriverTalent\drv64\wndautodata.xml
- %TEMP%\DriverTalent\download\id.dat
- %TEMP%\DriverTalent\config\userconfig.dat
- %TEMP%\DriverTalent\config\toolbox_png_HardwareDetection_2.png
- %TEMP%\DriverTalent\config\toolbox_png_HardwareDetection_1.png
- %TEMP%\DriverTalent\config\toolbox_png_ConquerorLive_2.png
- %TEMP%\DriverTalent\config\toolbox_png_ConquerorLive_1.png
- %TEMP%\DriverTalent\config\gamelist.json
- %TEMP%\DriverTalent\config\externalappTemp.xml
- %TEMP%\DriverTalent\config\externalapp.xml
- %TEMP%\DriverTalent\cache\softico\125-5.png
- %TEMP%\DriverTalent\cache\softico\125-2.png
- %TEMP%\DriverTalent\cache\softico\125-10.png
- %TEMP%\DriverTalent\cache\softico\125-1.png
- %TEMP%\DriverTalent\dtldrv\dtldrv2\drv0.7zz
- %TEMP%\DriverTalent\dtldrv\dtldrv2\drv1.7zz
- %TEMP%\DriverTalent\dtldrv\dtldrv1\drv3.7zz
- %TEMP%\DriverTalent\dtldrv\dtldrv2\drv2.7zz
- %TEMP%\DriverTalent\DIFxAPI.dll
- %TEMP%\DriverTalent\dtldrv\dtldrv2\drv3.7zz
- %TEMP%\DriverTalent\DevCfg.dll
- %TEMP%\DriverTalent\detoured.dll
- %TEMP%\DriverTalent\CrashCatch.dll
- %TEMP%\DriverTalent\bios.dll
- %TEMP%\DriverTalent\AdModule.dll
- %TEMP%\DriverTalent\7z.dll
- %TEMP%\DriverTalent\lan\UserConfig.dat
- %TEMP%\DriverTalent\lan\systemlan.xml
- %TEMP%\DriverTalent\lan\language_UserFeedBack.ini
- %TEMP%\DriverTalent\lan\english.ini
- %TEMP%\DriverTalent\lan\chinese.ini
- %TEMP%\DriverTalent\key.dat
- %TEMP%\DriverTalent\helper_res.7zz
- %TEMP%\DriverTalent\pcidetect.dll
- C:\OSTotoFolder\DriversDownLoad\DownLoadInfo.db
- %TEMP%\DriverTalent\HardWare\HWInfo\DeviceManuf.db3
- %TEMP%\DriverTalent\dtldrv\wdmaudio\win8_x86\wdmaudio.inf
- %TEMP%\DriverTalent\dtldrv\wdmaudio\win8_x64\wdmaudio.inf
- %TEMP%\DriverTalent\dtldrv\wdmaudio\win8.1_x86\wdmaudio.inf
- %TEMP%\DriverTalent\dtldrv\wdmaudio\win8.1_x64\wdmaudio.inf
- %TEMP%\DriverTalent\dtldrv\wdmaudio\win7_x86\wdmaudio.inf
- %TEMP%\DriverTalent\dtldrv\wdmaudio\win7_x64\wdmaudio.inf
- %TEMP%\DriverTalent\dtldrv\dtldrv3\drv6.7zz
- %TEMP%\DriverTalent\dtldrv\dtldrv3\drv5.7zz
- %TEMP%\DriverTalent\dtldrv\dtldrv3\drv4.7zz
- %TEMP%\DriverTalent\dtldrv\dtldrv3\drv3.7zz
- %TEMP%\DriverTalent\dtldrv\dtldrv3\drv2.7zz
- %TEMP%\DriverTalent\dtldrv\dtldrv3\drv1.7zz
- %TEMP%\DriverTalent\dtldrv\dtldrv3\drv0.7zz
- %TEMP%\DriverTalent\HardWare\VR_INFO.xml
- %ALLUSERSPROFILE%\Application Data\DriverTalent\BackupList.dat
Удаляет следующие файлы:
- C:\OSTotoFolder\DriversDownLoad\DownLoadInfo.db-journal
Подменяет следующие файлы:
- C:\OSTotoFolder\DriversDownLoad\DownLoadInfo.db-journal
Сетевая активность:
Подключается к:
- 'wp#d':80
- 'in#.####ng.drivethelife.com':80
- 'download.windowsupdate.com':80
- 'in#.#####arch.drivethelife.com':80
- 'di######.#ntegrate.drivethelife.com':3801
TCP:
Запросы HTTP GET:
- http://11#.#11.111.1/wpad.dat via wp#d
- http://in#.####ng.drivethelife.com/api/externalapp
- http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt via download.windowsupdate.com
- http://in#.####ng.drivethelife.com/api/gamelist_component
Запросы HTTP POST:
- http://in#.#####arch.drivethelife.com/drvsearch.php
UDP:
- DNS ASK wp#d
- DNS ASK in#.####ng.drivethelife.com
- DNS ASK www.download.windowsupdate.com
- DNS ASK di######.#ntegrate.drivethelife.com
- DNS ASK in#.#pdrv.com
- DNS ASK qu###.#rivethelife.com
- DNS ASK in#.#####arch.drivethelife.com
- 'di######.#ntegrate.drivethelife.com':3800
- 'qu###.#rivethelife.com':3000
- 'qu###.#rivethelife.com':4000
Другое:
Ищет следующие окна:
- ClassName: 'TrayTool' WindowName: ''
Создает и запускает на исполнение:
- '%TEMP%\DriverTalent\DriverTalent.exe'
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe' -k LocalDriverService
- '<SYSTEM32>\rundll32.exe' "%TEMP%\DriverTalent\pcidetect.dll",HDRundllDetect
- '<SYSTEM32>\scardsvr.exe'
