Техническая информация
Для обеспечения автозапуска и распространения
Модифицирует следующие ключи реестра
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'cedbej' = 'rundll32.exe "<LS_APPDATA>\cedbej.dll",cedbej'
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Web Companion' = '%ProgramFiles%\Lavasoft\Web Companion\Application\WebCompanion.exe --minimize '
Создает или изменяет следующие файлы
- %WINDIR%\tasks\multishare.job
Создает следующие сервисы
- [<HKLM>\System\CurrentControlSet\Services\WCAssistantService] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\WCAssistantService] 'ImagePath' = '%ProgramFiles%\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe'
Вредоносные функции
Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '<SYSTEM32>\rundll32.exe' = '<SYSTEM32>\rundll32.exe:*:Enabled:rundll32...
Создает и запускает на исполнение
- '' (загружен из сети Интернет)
Завершает или пытается завершить
следующие пользовательские процессы:
- firefox.exe
Изменяет следующие настройки браузера Windows Internet Explorer
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2301' = '00000003'
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\1.tmp.exe
- %ProgramFiles%\lavasoft\web companion\application\zh-chs\webcompanioninstaller.resources.dll
- %ProgramFiles%\lavasoft\web companion\application\x86\sqlite.interop.dll
- %ProgramFiles%\lavasoft\web companion\application\x64\sqlite.interop.dll
- %ProgramFiles%\lavasoft\web companion\application\tr-tr\webcompanioninstaller.resources.dll
- %ProgramFiles%\lavasoft\web companion\application\tr-tr\webcompanion.resources.dll
- %ProgramFiles%\lavasoft\web companion\application\ru-ru\webcompanioninstaller.resources.dll
- %ProgramFiles%\lavasoft\web companion\application\ru-ru\webcompanion.resources.dll
- %ProgramFiles%\lavasoft\web companion\application\pt-br\webcompanioninstaller.resources.dll
- %ProgramFiles%\lavasoft\web companion\application\pt-br\webcompanion.resources.dll
- %ProgramFiles%\lavasoft\web companion\application\ja-jp\webcompanioninstaller.resources.dll
- %ProgramFiles%\lavasoft\web companion\application\ja-jp\webcompanion.resources.dll
- %ProgramFiles%\lavasoft\web companion\application\it-it\webcompanioninstaller.resources.dll
- %ProgramFiles%\lavasoft\web companion\application\it-it\webcompanion.resources.dll
- %ProgramFiles%\lavasoft\web companion\application\fr-ca\webcompanioninstaller.resources.dll
- %ProgramFiles%\lavasoft\web companion\application\fr-ca\webcompanion.resources.dll
- %ProgramFiles%\lavasoft\web companion\application\extension\@wcextensionff.xpi
- %ProgramFiles%\lavasoft\web companion\application\es-es\webcompanioninstaller.resources.dll
- %ProgramFiles%\lavasoft\web companion\application\es-es\webcompanion.resources.dll
- %ProgramFiles%\lavasoft\web companion\application\en-us\webcompanioninstaller.resources.dll
- %ProgramFiles%\lavasoft\web companion\application\en-us\webcompanion.resources.dll
- %ProgramFiles%\lavasoft\web companion\application\de-de\webcompanioninstaller.resources.dll
- %ProgramFiles%\lavasoft\web companion\application\de-de\webcompanion.resources.dll
- %ProgramFiles%\lavasoft\web companion\application\webcompanioninstaller.pdb
- %ProgramFiles%\lavasoft\web companion\application\webcompanioninstaller.exe.config
- %ProgramFiles%\lavasoft\web companion\application\webcompanioninstaller.exe
- %ProgramFiles%\lavasoft\web companion\application\webcompanionicon_pro.ico
- %ProgramFiles%\lavasoft\web companion\application\webcompanionicon.ico
- %ProgramFiles%\lavasoft\web companion\application\zh-hans\webcompanion.resources.dll
- %ALLUSERSPROFILE%\application data\lavasoft\web companion\options\partner.txt
- %ALLUSERSPROFILE%\application data\lavasoft\web companion\options\install.txt
- %ALLUSERSPROFILE%\application data\lavasoft\web companion\options\updateserver.txt
- %ALLUSERSPROFILE%\application data\lavasoft\web companion\options\appsettings.txt
- <LS_APPDATA>\lavasoft\webcompanion.exe_url_f5db2c2eotb405zbclgx4obr3tgwdj1t\4.7.1987.3881\gmfqu9ot.newcfg
- <LS_APPDATA>\lavasoft\webcompanion.exe_url_f5db2c2eotb405zbclgx4obr3tgwdj1t\4.7.1987.3881\k4psoj0d.newcfg
- <LS_APPDATA>\lavasoft\webcompanion.exe_url_f5db2c2eotb405zbclgx4obr3tgwdj1t\4.7.1987.3881\4tcsikr-.newcfg
- %TEMP%\xul9pzn5.dll
- %TEMP%\res7.tmp
- %TEMP%\csc6.tmp
- %TEMP%\xul9pzn5.out
- %TEMP%\xul9pzn5.cmdline
- %TEMP%\xul9pzn5.0.cs
- <LS_APPDATA>\lavasoft\webcompanion.exe_url_f5db2c2eotb405zbclgx4obr3tgwdj1t\4.7.1987.3881\csuab4z7.newcfg
- %ALLUSERSPROFILE%\application data\lavasoft\web companion\logs\windowsservice\wcassistantservicelog.log
- <SYSTEM32>\config\systemprofile\application data\microsoft\cryptneturlcache\content\ecf3006d44da211141391220ee5049f4
- <SYSTEM32>\config\systemprofile\application data\microsoft\cryptneturlcache\content\40c68d5626484a90937f0752c8b950ab
- <SYSTEM32>\config\systemprofile\application data\microsoft\cryptneturlcache\metadata\ecf3006d44da211141391220ee5049f4
- <SYSTEM32>\config\systemprofile\application data\microsoft\cryptneturlcache\metadata\40c68d5626484a90937f0752c8b950ab
- %ALLUSERSPROFILE%\application data\lavasoft\web companion\options\profileinfo.txt
- <LS_APPDATA>\lavasoft\webcompanion.exe_url_f5db2c2eotb405zbclgx4obr3tgwdj1t\4.7.1987.3881\sxh3lwyz.newcfg
- %ALLUSERSPROFILE%\application data\lavasoft\web companion\options\channelinfo.txt
- <LS_APPDATA>\lavasoft\webcompanion.exe_url_f5db2c2eotb405zbclgx4obr3tgwdj1t\4.7.1987.3881\ucuxa8yk.newcfg
- %ALLUSERSPROFILE%\start menu\programs\lavasoft\web companion\web companion.lnk
- %ALLUSERSPROFILE%\start menu\programs\lavasoft\web companion\frequently asked questions.url
- %ALLUSERSPROFILE%\application data\lavasoft\web companion\options\servicepartnerinfo.txt
- %ALLUSERSPROFILE%\application data\lavasoft\web companion\options\activefeatures.zip
- %ALLUSERSPROFILE%\application data\lavasoft\web companion\options\currentreleasenotes.txt
- <LS_APPDATA>\lavasoft\webcompanion.exe_url_f5db2c2eotb405zbclgx4obr3tgwdj1t\4.7.1987.3881\iy5lpgw4.newcfg
- %ALLUSERSPROFILE%\application data\lavasoft\web companion\logs\webcompanion\webcompanion.log
- %APPDATA%\lavasoft\web companion\options\language.txt
- %ALLUSERSPROFILE%\application data\lavasoft\web companion\options\eventsafeguard.txt
- %ProgramFiles%\lavasoft\web companion\application\webcompanionextensionie.dll
- %ProgramFiles%\lavasoft\web companion\application\webcompanion.loader.exe
- %ProgramFiles%\lavasoft\web companion\application\webcompanion.exe.config
- %ProgramFiles%\lavasoft\web companion\application\icsharpcode.sharpziplib.dll
- %ProgramFiles%\lavasoft\web companion\application\esent.interop.dll
- %ProgramFiles%\lavasoft\web companion\application\dotnetzip.dll
- %ProgramFiles%\lavasoft\web companion\application\bcusdk.dll
- %ProgramFiles%\lavasoft\web companion\application\bcuengines.dll
- %ProgramFiles%\lavasoft\web companion\application\ad-aware web companion.exe
- %TEMP%\webcompanion.zip
- %ALLUSERSPROFILE%\application data\lavasoft\web companion\options\statistics.txt
- %TEMP%\wcinstaller.log
- %TEMP%\7zs5.tmp\zh-chs\webcompanioninstaller.resources.dll
- %TEMP%\7zs5.tmp\tr-tr\webcompanioninstaller.resources.dll
- %TEMP%\7zs5.tmp\ru-ru\webcompanioninstaller.resources.dll
- %TEMP%\7zs5.tmp\pt-br\webcompanioninstaller.resources.dll
- %TEMP%\7zs5.tmp\ja-jp\webcompanioninstaller.resources.dll
- %TEMP%\7zs5.tmp\it-it\webcompanioninstaller.resources.dll
- %TEMP%\7zs5.tmp\fr-ca\webcompanioninstaller.resources.dll
- %TEMP%\7zs5.tmp\es-es\webcompanioninstaller.resources.dll
- %TEMP%\7zs5.tmp\en-us\webcompanioninstaller.resources.dll
- %TEMP%\7zs5.tmp\de-de\webcompanioninstaller.resources.dll
- %TEMP%\7zs5.tmp\icsharpcode.sharpziplib.dll
- %TEMP%\7zs5.tmp\webcompanioninstaller.exe
- %TEMP%\7zs5.tmp\webcompanioninstaller.exe.config
- %TEMP%\wcinstaller.exe
- %HOMEPATH%\cookies\user@webcompanion[1].txt
- <LS_APPDATA>\cedbej.dll
- %TEMP%\dcom.exe
- %APPDATA%\microsoft\multishare.exe
- %ProgramFiles%\lavasoft\web companion\application\interop.iwshruntimelibrary.dll
- %ProgramFiles%\lavasoft\web companion\application\interop.lavasofttcpservicelib.dll
- %ProgramFiles%\lavasoft\web companion\application\interop.shdocvw.dll
- %ProgramFiles%\lavasoft\web companion\application\interop.shell32.dll
- %ProgramFiles%\lavasoft\web companion\application\webcompaionreimageicon.ico
- %ProgramFiles%\lavasoft\web companion\application\vcruntime140d.dll
- %ProgramFiles%\lavasoft\web companion\application\ucrtbased.dll
- %ProgramFiles%\lavasoft\web companion\application\system.data.sqlite.dll
- %ProgramFiles%\lavasoft\web companion\application\newtonsoft.json.dll
- %ProgramFiles%\lavasoft\web companion\application\mozcompressor.dll
- %ProgramFiles%\lavasoft\web companion\application\microsoft.mshtml.dll
- %ProgramFiles%\lavasoft\web companion\application\lz4.dll
- %ProgramFiles%\lavasoft\web companion\application\log4net.dll
- %ProgramFiles%\lavasoft\web companion\application\liblz4.dll
- %ProgramFiles%\lavasoft\web companion\application\lavasoft.wcassistant.winservice.exe.config
- %ProgramFiles%\lavasoft\web companion\application\lavasoft.wcassistant.winservice.exe
- %ProgramFiles%\lavasoft\web companion\application\lavasoft.wcassistant.wcfservice.dll
- %ProgramFiles%\lavasoft\web companion\application\lavasoft.utils.sqllite.dll
- %ProgramFiles%\lavasoft\web companion\application\lavasoft.wcassistant.service.logger.dll
- %ProgramFiles%\lavasoft\web companion\application\lavasoft.utils.dll
- %ProgramFiles%\lavasoft\web companion\application\lavasoft.sysinfo.dll
- %ProgramFiles%\lavasoft\web companion\application\lavasoft.settings.dll
- %ProgramFiles%\lavasoft\web companion\application\lavasoft.searchprotect.repositories.dll
- %ProgramFiles%\lavasoft\web companion\application\lavasoft.searchprotect.business.dll
- %ProgramFiles%\lavasoft\web companion\application\lavasoft.omni.dll
- %ProgramFiles%\lavasoft\web companion\application\lavasoft.iecontroller.dll
- %ProgramFiles%\lavasoft\web companion\application\lavasoft.events.dll
- %ProgramFiles%\lavasoft\web companion\application\lavasoft.csharp.utilities.dll
- %ProgramFiles%\lavasoft\web companion\application\lavasoft.compression.dll
- %ProgramFiles%\lavasoft\web companion\application\lavasoft.automation.dll
- %ProgramFiles%\lavasoft\web companion\application\lavasoft.appcore.dll
- %ProgramFiles%\lavasoft\web companion\application\lavasoft.adblocker.dll
- %ProgramFiles%\lavasoft\web companion\application\webcompanion.exe
- %APPDATA%\mozilla\firefox\profiles\22ie2h77.default\searchplugins\bing-lavasoft-ff59.xml
Удаляет следующие файлы
- %TEMP%\res7.tmp
- %TEMP%\7zs5.tmp\webcompanioninstaller.exe
- %TEMP%\7zs5.tmp\tr-tr\webcompanioninstaller.resources.dll
- %TEMP%\7zs5.tmp\ru-ru\webcompanioninstaller.resources.dll
- %TEMP%\7zs5.tmp\pt-br\webcompanioninstaller.resources.dll
- %TEMP%\7zs5.tmp\ja-jp\webcompanioninstaller.resources.dll
- %TEMP%\7zs5.tmp\it-it\webcompanioninstaller.resources.dll
- %TEMP%\7zs5.tmp\icsharpcode.sharpziplib.dll
- %TEMP%\7zs5.tmp\fr-ca\webcompanioninstaller.resources.dll
- %TEMP%\7zs5.tmp\webcompanioninstaller.exe.config
- %TEMP%\7zs5.tmp\es-es\webcompanioninstaller.resources.dll
- %TEMP%\7zs5.tmp\de-de\webcompanioninstaller.resources.dll
- %ALLUSERSPROFILE%\application data\lavasoft\web companion\options\currentreleasenotes.txt
- %APPDATA%\mozilla\firefox\profiles\22ie2h77.default\searchplugins\bing-lavasoft-ff59.xml
- %TEMP%\xul9pzn5.out
- %TEMP%\xul9pzn5.dll
- %TEMP%\xul9pzn5.cmdline
- %TEMP%\xul9pzn5.0.cs
- %TEMP%\csc6.tmp
- %TEMP%\7zs5.tmp\en-us\webcompanioninstaller.resources.dll
- %TEMP%\7zs5.tmp\zh-chs\webcompanioninstaller.resources.dll
Перемещает следующие файлы
- <LS_APPDATA>\lavasoft\webcompanion.exe_url_f5db2c2eotb405zbclgx4obr3tgwdj1t\4.7.1987.3881\iy5lpgw4.newcfg в <LS_APPDATA>\lavasoft\webcompanion.exe_url_f5db2c2eotb405zbclgx4obr3tgwdj1t\4.7.1987.3881\user.config
- <LS_APPDATA>\lavasoft\webcompanion.exe_url_f5db2c2eotb405zbclgx4obr3tgwdj1t\4.7.1987.3881\ucuxa8yk.newcfg в <LS_APPDATA>\lavasoft\webcompanion.exe_url_f5db2c2eotb405zbclgx4obr3tgwdj1t\4.7.1987.3881\user.config
- <LS_APPDATA>\lavasoft\webcompanion.exe_url_f5db2c2eotb405zbclgx4obr3tgwdj1t\4.7.1987.3881\sxh3lwyz.newcfg в <LS_APPDATA>\lavasoft\webcompanion.exe_url_f5db2c2eotb405zbclgx4obr3tgwdj1t\4.7.1987.3881\user.config
- <LS_APPDATA>\lavasoft\webcompanion.exe_url_f5db2c2eotb405zbclgx4obr3tgwdj1t\4.7.1987.3881\csuab4z7.newcfg в <LS_APPDATA>\lavasoft\webcompanion.exe_url_f5db2c2eotb405zbclgx4obr3tgwdj1t\4.7.1987.3881\user.config
- <LS_APPDATA>\lavasoft\webcompanion.exe_url_f5db2c2eotb405zbclgx4obr3tgwdj1t\4.7.1987.3881\4tcsikr-.newcfg в <LS_APPDATA>\lavasoft\webcompanion.exe_url_f5db2c2eotb405zbclgx4obr3tgwdj1t\4.7.1987.3881\user.config
- <LS_APPDATA>\lavasoft\webcompanion.exe_url_f5db2c2eotb405zbclgx4obr3tgwdj1t\4.7.1987.3881\k4psoj0d.newcfg в <LS_APPDATA>\lavasoft\webcompanion.exe_url_f5db2c2eotb405zbclgx4obr3tgwdj1t\4.7.1987.3881\user.config
- <LS_APPDATA>\lavasoft\webcompanion.exe_url_f5db2c2eotb405zbclgx4obr3tgwdj1t\4.7.1987.3881\gmfqu9ot.newcfg в <LS_APPDATA>\lavasoft\webcompanion.exe_url_f5db2c2eotb405zbclgx4obr3tgwdj1t\4.7.1987.3881\user.config
Подменяет следующие файлы
- %APPDATA%\Mozilla\Firefox\Profiles\22ie2h77.default\prefs.js
- %APPDATA%\Mozilla\Firefox\Profiles\22ie2h77.default\search-metadata.json
- %APPDATA%\mozilla\firefox\profiles\22ie2h77.default\searchplugins\bing-lavasoft-ff59.xml
Сетевая активность
Подключается к
- 'localhost':1066
TCP
Запросы HTTP GET
- http://ip##pi.com/xml
- http://ho##pp2.cf/20190118/things.xml
- http://www.ho##pp2.cf/20190118/multishare.exe
- http://in#####.portmdfmoon.com/download/APSFADexpNR
- http://ho##pp2.cf/bb/tds.php
- http://ba###inging.com/m1/dcom.exe
- http://ho##pp2.cf/favicon.ico
- http://we####panion.com/nano_download.php?pa###########################
- http://wc#######dercdn.lavasoft.com/4.7.1987.3881/WebCompanion-4.7.1987.3881-prod.zip
- http://we####panion.com/version_logs?js#############################
- http://rt.###companion.com/notifications/download/rt/ActiveFeatures.zip
- http://wc######ers.lavasoft.com/Partner.svc/GetPartnerInfo?pa##############
- http://wc######ers.lavasoft.com/Partner.svc/GetPartnerInfo?pa#################
Запросы HTTP POST
- http://go#####analytics.com/collect
- http://wc#######-service.lavasoft.com/update.asmx
- http://wc######ing.lavasoft.com/Install.asmx
- http://wc######ing.lavasoft.com/tracking.asmx
- http://ws#####.lavasoft.com/ipservice.asmx
UDP
- DNS ASK ip##pi.com
- DNS ASK go#####analytics.com
- DNS ASK ho##pp2.cf
- DNS ASK in#####.portmdfmoon.com
- DNS ASK ba###inging.com
- DNS ASK we####panion.com
- DNS ASK wc######ing.lavasoft.com
- DNS ASK wc#######-service.lavasoft.com
- DNS ASK wc#######dercdn.lavasoft.com
- DNS ASK rt.###companion.com
- DNS ASK wc######ers.lavasoft.com
- DNS ASK sg#####ask.adaware.com
- DNS ASK ws#####.lavasoft.com
- DNS ASK fl##.#avasoft.com
Другое
Ищет следующие окна
- ClassName: 'OleMainThreadWndClass' WindowName: ''
Создает и запускает на исполнение
- '%TEMP%\1.tmp.exe' 1
- '%TEMP%\dcom.exe' /S /subid=133
- '%TEMP%\wcinstaller.exe' --silent --partner=AE190201 --homepage=1 --search=1 --campaign=292
- '%TEMP%\7zs5.tmp\webcompanioninstaller.exe' --partner=AE190201 --campaign=292 --version=4.7.1987.3881 --prod --silent --partner=AE190201 --homepage=1 --search=1 --campaign=292
- '%ProgramFiles%\lavasoft\web companion\application\webcompanion.exe' --silent --install --geo=
- '%ProgramFiles%\lavasoft\web companion\application\lavasoft.wcassistant.winservice.exe'
- '%ProgramFiles%\lavasoft\web companion\application\webcompanion.exe' --silent --afterinstall
- '<SYSTEM32>\rundll32.exe' "<LS_APPDATA>\cedbej.dll",cedbej %TEMP%\dcom.exe' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /C netsh http add urlacl url=http://+:#007/ user=Everyone' (со скрытым окном)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\xul9pzn5.cmdline"' (со скрытым окном)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES7.tmp" "%TEMP%\CSC6.tmp"' (со скрытым окном)
- '%ProgramFiles%\mozilla firefox\firefox.exe' %ProgramFiles%\Mozilla Firefox\firefox.exe -headless' (со скрытым окном)
Запускает на исполнение
- '%ProgramFiles%\mozilla firefox\firefox.exe' -osint -url "http://ho##pp2.cf/bb/tds.php"
- '<SYSTEM32>\rundll32.exe' "<LS_APPDATA>\cedbej.dll",cedbej %TEMP%\dcom.exe
- '<SYSTEM32>\svchost.exe' -k HTTPFilter
- '<SYSTEM32>\sc.exe' Create "WCAssistantService" binPath= "%ProgramFiles%\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe" DisplayName= "WC Assistant" start= auto
- '<SYSTEM32>\sc.exe' failure WCAssistantService reset= 30 actions= restart/60000
- '<SYSTEM32>\sc.exe' description "WCAssistantService" "Ad-Aware Web Companion Internet security service"
- '<SYSTEM32>\cmd.exe' /C netsh http add urlacl url=http://+:#007/ user=Everyone
- '<SYSTEM32>\netsh.exe' http add urlacl url=http://+:#007/ user=Everyone
- '<SYSTEM32>\verclsid.exe' /C {B5A7F190-DDA6-4420-B3BA-52453494E6CD} /I {00000000-0000-0000-C000-000000000046} /X 0x401
- '%WINDIR%\microsoft.net\framework\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\xul9pzn5.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES7.tmp" "%TEMP%\CSC6.tmp"
- '%ProgramFiles%\mozilla firefox\firefox.exe' %ProgramFiles%\Mozilla Firefox\firefox.exe -headless
