Техническая информация
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\taskkill.exe' /f /im rutserv.exe
- '<SYSTEM32>\taskkill.exe' /f /im rfusclient.exe
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\$inst\2.tmp
- %ProgramFiles%\GreenTree Applications\YTD Video Downloader\plugins\audio_mixer\is-CHNRV.tmp
- %ProgramFiles%\GreenTree Applications\YTD Video Downloader\plugins\audio_output\is-BM428.tmp
- %ProgramFiles%\GreenTree Applications\YTD Video Downloader\plugins\codec\is-7883S.tmp
- %ProgramFiles%\GreenTree Applications\YTD Video Downloader\plugins\video_filter\is-TQ7N8.tmp
- %ProgramFiles%\GreenTree Applications\YTD Video Downloader\plugins\video_output\is-OS6GF.tmp
- %ProgramFiles%\GreenTree Applications\YTD Video Downloader\plugins\video_output\is-GEC7N.tmp
- %ProgramFiles%\GreenTree Applications\YTD Video Downloader\plugins\video_output\is-GKBQB.tmp
- %ProgramFiles%\GreenTree Applications\YTD Video Downloader\plugins\video_output\is-AG0EK.tmp
- %ProgramFiles%\GreenTree Applications\YTD Video Downloader\is-AE18B.tmp
- %ProgramFiles%\GreenTree Applications\YTD Video Downloader\is-L3DE6.tmp
- %ProgramFiles%\GreenTree Applications\YTD Video Downloader\is-2NR5J.tmp
- %TEMP%\is-J75FH.tmp\InstallerImage.png
- %ProgramFiles%\GreenTree Applications\YTD Video Downloader\is-FFRTR.tmp
- %ProgramFiles%\GreenTree Applications\YTD Video Downloader\is-2BS8B.tmp
- %ProgramFiles%\GreenTree Applications\YTD Video Downloader\is-SEL3B.tmp
- %ProgramFiles%\GreenTree Applications\YTD Video Downloader\is-VRCPK.tmp
- %ProgramFiles%\GreenTree Applications\YTD Video Downloader\is-KCKLA.tmp
- %ProgramFiles%\GreenTree Applications\YTD Video Downloader\is-EEQSU.tmp
- %ProgramFiles%\GreenTree Applications\YTD Video Downloader\is-1QSLC.tmp
- %ProgramFiles%\GreenTree Applications\YTD Video Downloader\is-GMQAO.tmp
- %ProgramFiles%\GreenTree Applications\YTD Video Downloader\is-53UTS.tmp
- %ALLUSERSPROFILE%\Start Menu\Programs\YTD Video Downloader\YTD Video Downloader.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\YTD Video Downloader\Visit YTD Video Downloader.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\YTD Video Downloader\Удалить YTD Video Downloader.lnk
- %ProgramFiles%\GreenTree Applications\YTD Video Downloader\plugins\audio_filter\is-3U78D.tmp
- %ProgramFiles%\GreenTree Applications\YTD Video Downloader\plugins\audio_mixer\is-TIDMV.tmp
- %ProgramFiles%\GreenTree Applications\YTD Video Downloader\plugins\audio_filter\is-E7NUU.tmp
- %ProgramFiles%\GreenTree Applications\YTD Video Downloader\plugins\audio_filter\is-PFKB3.tmp
- %ProgramFiles%\GreenTree Applications\YTD Video Downloader\plugins\access\is-HPN0V.tmp
- <DRIVERS>\install.cmd
- <DRIVERS>\install.exe
- <DRIVERS>\svchоst.exe
- %TEMP%\YTD Video Downloader\5.9.4.1\setup.cmd
- %TEMP%\YTD Video Downloader\5.9.4.1\setup.exe
- %TEMP%\$inst\0001.tmp
- %TEMP%\is-GL42J.tmp\setup.tmp
- %TEMP%\is-J75FH.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-J75FH.tmp\isgsg.dll
- %TEMP%\is-J75FH.tmp\innocallback.dll
- %TEMP%\is-J75FH.tmp\ru.png
- %ALLUSERSPROFILE%\Desktop\YTD Video Downloader.lnk
- %ProgramFiles%\GreenTree Applications\YTD Video Downloader\is-DCK7C.tmp
- %TEMP%\is-J75FH.tmp\en.png
- %TEMP%\is-J75FH.tmp\DirImage.png
- %TEMP%\is-J75FH.tmp\GroupImage.png
- %TEMP%\is-J75FH.tmp\b2p.dll
- %TEMP%\is-J75FH.tmp\botva2.dll
- %TEMP%\is-J75FH.tmp\Icon.png
- %TEMP%\is-J75FH.tmp\Logo.png
- %TEMP%\is-J75FH.tmp\Splash.png
- %ProgramFiles%\GreenTree Applications\YTD Video Downloader\is-9BASJ.tmp
- %ProgramFiles%\GreenTree Applications\YTD Video Downloader\is-CD824.tmp
- %ProgramFiles%\GreenTree Applications\YTD Video Downloader\Lang\is-C4CJ3.tmp
- %ProgramFiles%\GreenTree Applications\YTD Video Downloader\Lang\is-OP8I7.tmp
- %TEMP%\$inst\temp_0.tmp
- %TEMP%\is-J75FH.tmp\PortableImage.png
- %ProgramFiles%\GreenTree Applications\YTD Video Downloader\unins000.dat
Присваивает атрибут 'скрытый' для следующих файлов:
- %ProgramFiles%\GreenTree Applications\YTD Video Downloader\UninstallSmallImage.bmp
Удаляет следующие файлы:
- %TEMP%\$inst\temp_0.tmp
- %TEMP%\$inst\0001.tmp
- %TEMP%\$inst\2.tmp
Перемещает следующие файлы:
- %ProgramFiles%\GreenTree Applications\YTD Video Downloader\is-9BASJ.tmp в %ProgramFiles%\GreenTree Applications\YTD Video Downloader\unins000.exe
- %ProgramFiles%\GreenTree Applications\YTD Video Downloader\is-1QSLC.tmp в %ProgramFiles%\GreenTree Applications\YTD Video Downloader\ytd.exe
- %ProgramFiles%\GreenTree Applications\YTD Video Downloader\is-EEQSU.tmp в %ProgramFiles%\GreenTree Applications\YTD Video Downloader\scripts.yds
- %ProgramFiles%\GreenTree Applications\YTD Video Downloader\is-KCKLA.tmp в %ProgramFiles%\GreenTree Applications\YTD Video Downloader\manual.bat
- %ProgramFiles%\GreenTree Applications\YTD Video Downloader\is-VRCPK.tmp в %ProgramFiles%\GreenTree Applications\YTD Video Downloader\LICENSE
- %ProgramFiles%\GreenTree Applications\YTD Video Downloader\is-SEL3B.tmp в %ProgramFiles%\GreenTree Applications\YTD Video Downloader\libvlccore.dll
- %ProgramFiles%\GreenTree Applications\YTD Video Downloader\is-2BS8B.tmp в %ProgramFiles%\GreenTree Applications\YTD Video Downloader\libvlc.dll
- %ProgramFiles%\GreenTree Applications\YTD Video Downloader\is-DCK7C.tmp в %ProgramFiles%\GreenTree Applications\YTD Video Downloader\librtmp.dll
- %ProgramFiles%\GreenTree Applications\YTD Video Downloader\is-FFRTR.tmp в %ProgramFiles%\GreenTree Applications\YTD Video Downloader\FFMPEG.EXE
- %ProgramFiles%\GreenTree Applications\YTD Video Downloader\is-2NR5J.tmp в %ProgramFiles%\GreenTree Applications\YTD Video Downloader\COPYING.LGPLv3
- %ProgramFiles%\GreenTree Applications\YTD Video Downloader\is-L3DE6.tmp в %ProgramFiles%\GreenTree Applications\YTD Video Downloader\COPYING.LGPLv2
- %ProgramFiles%\GreenTree Applications\YTD Video Downloader\is-AE18B.tmp в %ProgramFiles%\GreenTree Applications\YTD Video Downloader\COPYING.Apachev2
- %ProgramFiles%\GreenTree Applications\YTD Video Downloader\plugins\video_output\is-AG0EK.tmp в %ProgramFiles%\GreenTree Applications\YTD Video Downloader\plugins\video_output\libwingdi_plugin.dll
- %ProgramFiles%\GreenTree Applications\YTD Video Downloader\plugins\video_output\is-GKBQB.tmp в %ProgramFiles%\GreenTree Applications\YTD Video Downloader\plugins\video_output\libvmem_plugin.dll
- %ProgramFiles%\GreenTree Applications\YTD Video Downloader\plugins\video_output\is-GEC7N.tmp в %ProgramFiles%\GreenTree Applications\YTD Video Downloader\plugins\video_output\libdrawable_plugin.dll
- %ProgramFiles%\GreenTree Applications\YTD Video Downloader\plugins\video_output\is-OS6GF.tmp в %ProgramFiles%\GreenTree Applications\YTD Video Downloader\plugins\video_output\libdirect3d_plugin.dll
- %ProgramFiles%\GreenTree Applications\YTD Video Downloader\plugins\video_filter\is-TQ7N8.tmp в %ProgramFiles%\GreenTree Applications\YTD Video Downloader\plugins\video_filter\libswscale_plugin.dll
- %ProgramFiles%\GreenTree Applications\YTD Video Downloader\plugins\codec\is-7883S.tmp в %ProgramFiles%\GreenTree Applications\YTD Video Downloader\plugins\codec\libavcodec_plugin.dll
- %ProgramFiles%\GreenTree Applications\YTD Video Downloader\plugins\audio_output\is-BM428.tmp в %ProgramFiles%\GreenTree Applications\YTD Video Downloader\plugins\audio_output\libdirectsound_plugin.dll
- %ProgramFiles%\GreenTree Applications\YTD Video Downloader\plugins\audio_mixer\is-CHNRV.tmp в %ProgramFiles%\GreenTree Applications\YTD Video Downloader\plugins\audio_mixer\libinteger_mixer_plugin.dll
- %ProgramFiles%\GreenTree Applications\YTD Video Downloader\plugins\audio_mixer\is-TIDMV.tmp в %ProgramFiles%\GreenTree Applications\YTD Video Downloader\plugins\audio_mixer\libfloat_mixer_plugin.dll
- %ProgramFiles%\GreenTree Applications\YTD Video Downloader\plugins\audio_filter\is-3U78D.tmp в %ProgramFiles%\GreenTree Applications\YTD Video Downloader\plugins\audio_filter\libugly_resampler_plugin.dll
- %ProgramFiles%\GreenTree Applications\YTD Video Downloader\plugins\audio_filter\is-E7NUU.tmp в %ProgramFiles%\GreenTree Applications\YTD Video Downloader\plugins\audio_filter\libtrivial_channel_mixer_plugin.dll
- %ProgramFiles%\GreenTree Applications\YTD Video Downloader\plugins\audio_filter\is-PFKB3.tmp в %ProgramFiles%\GreenTree Applications\YTD Video Downloader\plugins\audio_filter\libaudio_format_plugin.dll
- %ProgramFiles%\GreenTree Applications\YTD Video Downloader\plugins\access\is-HPN0V.tmp в %ProgramFiles%\GreenTree Applications\YTD Video Downloader\plugins\access\libfilesystem_plugin.dll
- %ProgramFiles%\GreenTree Applications\YTD Video Downloader\Lang\is-OP8I7.tmp в %ProgramFiles%\GreenTree Applications\YTD Video Downloader\Lang\res1049.ini
- %ProgramFiles%\GreenTree Applications\YTD Video Downloader\Lang\is-C4CJ3.tmp в %ProgramFiles%\GreenTree Applications\YTD Video Downloader\Lang\res1033.ini
- %ProgramFiles%\GreenTree Applications\YTD Video Downloader\is-CD824.tmp в %ProgramFiles%\GreenTree Applications\YTD Video Downloader\UninstallSmallImage.bmp
- %ProgramFiles%\GreenTree Applications\YTD Video Downloader\is-GMQAO.tmp в %ProgramFiles%\GreenTree Applications\YTD Video Downloader\Website.url
- %ProgramFiles%\GreenTree Applications\YTD Video Downloader\is-53UTS.tmp в %ProgramFiles%\GreenTree Applications\YTD Video Downloader\Home.ico
Другое:
Ищет следующие окна:
- ClassName: '' WindowName: ''
Создает и запускает на исполнение:
- '%TEMP%\YTD Video Downloader\5.9.4.1\setup.exe' /VERYSILENT /I /RU
- '%TEMP%\is-GL42J.tmp\setup.tmp' /SL5="$1013A,8958259,203776,%TEMP%\YTD Video Downloader\5.9.4.1\setup.exe" /VERYSILENT /I /RU
Запускает на исполнение:
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\YTD Video Downloader\5.9.4.1\setup.cmd" "
- '<SYSTEM32>\cmd.exe' /c ""<DRIVERS>\install.cmd" "
- '<SYSTEM32>\chcp.com' 1251
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\Remote Manipulator System" /f
