Техническая информация
Вредоносные функции:
Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] '%ProgramFiles%\Kuai8\K8GM.exe' = '%ProgramFiles%\Kuai8\K8GM.exe:*:Enable...
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%ProgramFiles%\Kuai8\K8GM.exe' = '%ProgramFiles%\Kuai8\K8GM.exe:*:Enab...
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] '%ProgramFiles%\Kuai8\K8Flash.exe' = '%ProgramFiles%\Kuai8\K8Flash.exe:*:...
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%ProgramFiles%\Kuai8\K8Flash.exe' = '%ProgramFiles%\Kuai8\K8Flash.exe:...
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] '%ProgramFiles%\Kuai8\K8DLPlatform.exe' = '%ProgramFiles%\Kuai8\K8DLPlatf...
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%ProgramFiles%\Kuai8\K8DLPlatform.exe' = '%ProgramFiles%\Kuai8\K8DLPla...
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] '%ProgramFiles%\Kuai8\tool\K8RTLFix.exe' = '%ProgramFiles%\Kuai8\tool\K8R...
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%ProgramFiles%\Kuai8\tool\K8RTLFix.exe' = '%ProgramFiles%\Kuai8\tool\K...
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] '%ProgramFiles%\Kuai8\tool\K8PluginFix.exe' = '%ProgramFiles%\Kuai8\tool\...
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%ProgramFiles%\Kuai8\tool\K8PluginFix.exe' = '%ProgramFiles%\Kuai8\too...
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsm2.tmp
- %ProgramFiles%\Kuai8\tool\Microsoft.VC80.CRT.manifest
- %ProgramFiles%\Kuai8\tool\msvcp80.dll
- %ProgramFiles%\Kuai8\tool\msvcr80.dll
- %ProgramFiles%\Kuai8\tool_x64\K8Shell.dll
- %ProgramFiles%\Kuai8\tool_x64\K8ShellIcon.dll
- %ProgramFiles%\Kuai8\tool\K8Shell.dll
- %ProgramFiles%\Kuai8\tool\K8ShellIcon.dll
- %APPDATA%\kuai8\data\database.gmx
- %APPDATA%\kuai8\data\plugin\hot.gmx
- %APPDATA%\kuai8\data\plugin\top.gmx
- %ProgramFiles%\Kuai8\K8DLPlatform.exe
- %APPDATA%\kuai8\data\plugin\scan.gmx
- %APPDATA%\kuai8\data\plugin\netwl.gmx
- %APPDATA%\kuai8\data\plugin\inwl.gmx
- %APPDATA%\kuai8\data\plugin\pc.gmx
- %APPDATA%\kuai8\data\plugin\search.gmx
- %ProgramFiles%\Kuai8\audio\complete.wav
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\їм°ЙУОП·.lnk
- %HOMEPATH%\Desktop\їм°ЙУОП·.lnk
- %HOMEPATH%\Desktop\їм°ЙТіУОґуМь.lnk
- %HOMEPATH%\Start Menu\Programs\їм°ЙУОП·\їм°ЙУОП·.lnk
- %HOMEPATH%\Start Menu\Programs\їм°ЙУОП·\їм°ЙflashІҐ·ЕЖч.lnk
- %ProgramFiles%\Kuai8\tool\K8PluginFix.exe
- %ProgramFiles%\Kuai8\tool\K8NetDetect.exe
- %ProgramFiles%\Kuai8\tool\K8RTLFix.exe
- %ProgramFiles%\Kuai8\tool\K8MiniPage.exe
- %ProgramFiles%\Kuai8\tool\K8Tray.exe
- %TEMP%\nsm3.tmp\K8NsisMiniExtend.dll
- %ProgramFiles%\Kuai8\K8GM.exe
- %ProgramFiles%\Kuai8\K8Flash.exe
- %ProgramFiles%\Kuai8\K8Browser.exe
- %ProgramFiles%\Kuai8\K8Web.exe
- %ProgramFiles%\Kuai8\K8Update.exe
- %ProgramFiles%\Kuai8\K8Version.dll
- %ProgramFiles%\Kuai8\K8BugReport.exe
- %ProgramFiles%\Kuai8\K8UrlEncrypt.dll
- %ProgramFiles%\Kuai8\K8Common.dll
- %HOMEPATH%\Start Menu\Programs\їм°ЙУОП·\їм°ЙТіУОґуМь.lnk
- %APPDATA%\kuai8\data\plugin\window.gmx
- %ProgramFiles%\Kuai8\K8DLUtils.dll
- %ProgramFiles%\Kuai8\Microsoft.VC80.CRT.manifest
- %ProgramFiles%\Kuai8\msvcp80.dll
- %ProgramFiles%\Kuai8\msvcr80.dll
- %ProgramFiles%\Kuai8\Uninstall.exe
- %ProgramFiles%\Kuai8\tool\K8RestoreWindow.dll
- %ProgramFiles%\Kuai8\tool\K8Bubble.exe
- %ProgramFiles%\Kuai8\tool\K8Common.dll
- %ProgramFiles%\Kuai8\tool\K8UIRender.dll
- %ProgramFiles%\Kuai8\tool\K8DLUtils.dll
- %ProgramFiles%\Kuai8\tool\K8External.exe
- %TEMP%\nsm3.tmp\System.dll
- %ProgramFiles%\Kuai8\K8UIRender.dll
- %HOMEPATH%\Start Menu\Programs\їм°ЙУОП·\Р¶ФШїм°Й.lnk
Сетевая активность:
Подключается к:
- 'up####.kuai8.com':80
- 'st##.kuai8.com':80
TCP:
Запросы HTTP GET:
- http://up####.kuai8.com/update_hot.php?da############################################################################################
- http://up####.kuai8.com/update_top.php?da############################################################################################
- http://up####.kuai8.com/update_database.php?da############################################################################################
- http://st##.kuai8.com/stat.php?da####################################################################
UDP:
- DNS ASK up####.kuai8.com
- DNS ASK st##.kuai8.com
Другое:
Ищет следующие окна:
- ClassName: 'GMBubbleWnd' WindowName: ''
- ClassName: 'GMKuaiBaWnd' WindowName: '????????'
- ClassName: 'GMKuaiBaWnd' WindowName: 'їм°ЙУОП·'
- ClassName: '' WindowName: '????Flash????'
- ClassName: '' WindowName: 'їм°ЙFlashУОП·'
- ClassName: '' WindowName: '????????????'
- ClassName: '' WindowName: 'їм°ЙНшТіУОП·'
- ClassName: '' WindowName: '??????????????'
- ClassName: '' WindowName: 'їм°ЙУОП·дЇААЖч'
Создает и запускает на исполнение:
- '%ProgramFiles%\Kuai8\K8GM.exe' -update_data
- '%ProgramFiles%\Kuai8\K8Update.exe' -install
Запускает на исполнение:
- '<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles%\Kuai8\tool\K8Shell.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles%\Kuai8\tool\K8ShellIcon.dll"
