Техническая информация
Вредоносные функции
Внедряет код в
следующие пользовательские процессы:
- chrome.exe
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\b55c.tmp\webservicemain.bat
- %TEMP%\scoped_dir_2592_827\crx_install\_locales\sv\messages.json
- %TEMP%\scoped_dir_2592_827\crx_install\_locales\sr\messages.json
- %TEMP%\scoped_dir_2592_827\crx_install\_locales\sl\messages.json
- %TEMP%\scoped_dir_2592_827\crx_install\_locales\sk\messages.json
- %TEMP%\scoped_dir_2592_827\crx_install\_locales\ru\messages.json
- %TEMP%\scoped_dir_2592_827\crx_install\_locales\ro\messages.json
- %TEMP%\scoped_dir_2592_827\crx_install\_locales\pt_pt\messages.json
- %TEMP%\scoped_dir_2592_827\crx_install\_locales\pt_br\messages.json
- %TEMP%\scoped_dir_2592_827\crx_install\_locales\hi\messages.json
- %TEMP%\scoped_dir_2592_827\crx_install\_locales\pl\messages.json
- %TEMP%\scoped_dir_2592_827\crx_install\_locales\nb\messages.json
- %TEMP%\scoped_dir_2592_827\crx_install\_locales\lv\messages.json
- %TEMP%\scoped_dir_2592_827\crx_install\_locales\lt\messages.json
- %TEMP%\scoped_dir_2592_827\crx_install\_locales\ko\messages.json
- %TEMP%\scoped_dir_2592_827\crx_install\_locales\ja\messages.json
- %TEMP%\scoped_dir_2592_827\crx_install\_locales\it\messages.json
- %TEMP%\scoped_dir_2592_827\crx_install\_locales\id\messages.json
- %TEMP%\scoped_dir_2592_827\crx_install\_locales\hu\messages.json
- %TEMP%\scoped_dir_2592_827\crx_install\_locales\nl\messages.json
- %TEMP%\scoped_dir_2592_827\crx_install\_locales\hr\messages.json
- %TEMP%\scoped_dir_2592_827\crx_install\_locales\th\messages.json
- %TEMP%\scoped_dir_2592_827\crx_install\images\icon_128.png
- %TEMP%\scoped_dir_2592_827\decoded_images
- %TEMP%\scoped_dir_2592_827\crx_install\_metadata\verified_contents.json
- %TEMP%\scoped_dir_2592_827\crx_install\manifest.json
- %TEMP%\scoped_dir_2592_827\crx_install\images\topbar_floating_button_pressed.png
- %TEMP%\scoped_dir_2592_827\crx_install\images\topbar_floating_button_maximize.png
- %TEMP%\scoped_dir_2592_827\crx_install\images\topbar_floating_button_hover.png
- %TEMP%\scoped_dir_2592_827\crx_install\images\topbar_floating_button_close.png
- %TEMP%\scoped_dir_2592_827\crx_install\images\topbar_floating_button.png
- %TEMP%\scoped_dir_2592_827\crx_install\_locales\uk\messages.json
- %TEMP%\scoped_dir_2592_827\crx_install\_locales\tr\messages.json
- %TEMP%\scoped_dir_2592_827\crx_install\images\flapper.gif
- %TEMP%\scoped_dir_2592_827\crx_install\html\craw_window.html
- %TEMP%\scoped_dir_2592_827\crx_install\css\craw_window.css
- %TEMP%\scoped_dir_2592_827\crx_install\craw_window.js
- %TEMP%\scoped_dir_2592_827\crx_install\craw_background.js
- %TEMP%\scoped_dir_2592_827\crx_install\_locales\zh_tw\messages.json
- %TEMP%\scoped_dir_2592_827\crx_install\_locales\zh_cn\messages.json
- %TEMP%\scoped_dir_2592_827\crx_install\_locales\vi\messages.json
- %TEMP%\scoped_dir_2592_827\crx_install\images\icon_16.png
- %TEMP%\scoped_dir_2592_827\crx_install\_locales\fr\messages.json
- %TEMP%\scoped_dir_2592_827\crx_install\_locales\fil\messages.json
- %TEMP%\scoped_dir_2592_827\crx_install\_locales\fi\messages.json
- %TEMP%\scoped_dir_2592_1955\crx_install\hotword_it.nmf
- %TEMP%\scoped_dir_2592_1955\crx_install\hotword_fr.nmf
- %TEMP%\scoped_dir_2592_1955\crx_install\hotword_es.nmf
- %TEMP%\scoped_dir_2592_1955\crx_install\hotword_en-gb.nmf
- %TEMP%\scoped_dir_2592_1955\crx_install\hotword_en-au.nmf
- %TEMP%\scoped_dir_2592_1955\crx_install\hotword_de.nmf
- %TEMP%\scoped_dir_2592_1955\crx_install\manifest.json
- %TEMP%\scoped_dir_2592_1955\crx_install\hotword_ko.nmf
- %TEMP%\294c.tmp
- %TEMP%\291c.tmp
- %TEMP%\etilqs_expc8c2k6hzw8sk
- %TEMP%\1fb5.tmp
- %TEMP%\etilqs_aom0cz617cucogp
- %TEMP%\etilqs_4f4o14qzhftuwlw
- nul
- %TEMP%\b55c.tmp\website_cycle.exe
- %TEMP%\b55c.tmp\website_setup.exe
- %TEMP%\scoped_dir_2592_1955\1fb5.tmp
- %TEMP%\scoped_dir_2592_1955\crx_install\hotword_.nmf
- %TEMP%\scoped_dir_2592_1955\crx_install\hotword_ja.nmf
- %TEMP%\scoped_dir_2592_1955\crx_install\hotword_pt-br.nmf
- %TEMP%\scoped_dir_2592_827\crx_install\_locales\et\messages.json
- %TEMP%\scoped_dir_2592_827\crx_install\_locales\ca\messages.json
- %TEMP%\scoped_dir_2592_827\crx_install\_locales\es_419\messages.json
- %TEMP%\scoped_dir_2592_827\crx_install\_locales\es\messages.json
- %TEMP%\scoped_dir_2592_827\crx_install\_locales\en_gb\messages.json
- %TEMP%\scoped_dir_2592_827\crx_install\_locales\en\messages.json
- %TEMP%\scoped_dir_2592_827\crx_install\_locales\el\messages.json
- %TEMP%\scoped_dir_2592_827\crx_install\_locales\de\messages.json
- %TEMP%\scoped_dir_2592_827\crx_install\_locales\da\messages.json
- %TEMP%\scoped_dir_2592_827\crx_install\_locales\cs\messages.json
- %TEMP%\scoped_dir_2592_827\crx_install\_locales\bg\messages.json
- %TEMP%\scoped_dir_2592_1955\crx_install\hotword_ru.nmf
- %TEMP%\scoped_dir_2592_827\294c.tmp
- %TEMP%\47a3.tmp
- %TEMP%\scoped_dir_2592_1955\decoded_message_catalogs
- %TEMP%\scoped_dir_2592_1955\decoded_images
- %TEMP%\scoped_dir_2592_1955\crx_install\_metadata\verified_contents.json
- %TEMP%\scoped_dir_2592_1955\crx_install\audio\chime.wav
- %TEMP%\scoped_dir_2592_1955\crx_install\_platform_specific\x86-64_ru\hotword-x86-64.nexe
- %TEMP%\scoped_dir_2592_1955\crx_install\_platform_specific\x86-64_ru\hotword.data
- %TEMP%\scoped_dir_2592_827\decoded_message_catalogs
- %TEMP%\etilqs_eb4askao7c7kb8b
Удаляет следующие файлы
- %TEMP%\291c.tmp
- %TEMP%\scoped_dir_2592_1955\1fb5.tmp
- %TEMP%\scoped_dir_2592_1955\decoded_images
- %TEMP%\scoped_dir_2592_1955\decoded_message_catalogs
- %TEMP%\1fb5.tmp
- %TEMP%\47a3.tmp
- %TEMP%\scoped_dir_2592_827\crx_install\images\icon_128.png
- %TEMP%\scoped_dir_2592_827\crx_install\images\icon_16.png
- %TEMP%\scoped_dir_2592_827\294c.tmp
- %TEMP%\scoped_dir_2592_827\decoded_images
- %TEMP%\scoped_dir_2592_827\decoded_message_catalogs
- %TEMP%\294c.tmp
Подменяет следующие файлы
- %TEMP%\scoped_dir_2592_827\crx_install\images\icon_128.png
- %TEMP%\scoped_dir_2592_827\crx_install\images\icon_16.png
Сетевая активность
TCP
Запросы HTTP GET
- http://www.gs##tic.com/chrome/profile_avatars/NothingToDownload
- http://ui##.#rizona.edu/sites/default/themes/uits_v2/css/jquery-ui-1.7.1.customf129.css?w
- http://ui##.#rizona.edu/sites/default/files/js/js_c3118e9ff584e763c9b98b77bd0d55a8.js
- http://ui##.#rizona.edu/sites/default/themes/uits_v2/images/ua_banner.gif
- http://ui##.#rizona.edu/sites/default/themes/uits_v2/images/uits_icon.gif
- http://ui##.#rizona.edu/sites/default/themes/uits_v2/images/banner_photo.jpg
- http://ui##.#rizona.edu/sites/default/files/uits-block-search.jpg
- http://ui##.#rizona.edu/sites/default/files/itwebsite-uits-new.jpg
- http://ui##.#rizona.edu/sites/default/files/247-icon-sm.gif
- http://ui##.#rizona.edu/sites/default/themes/uits_v2/images/mac_consulting.jpg
- http://ui##.#rizona.edu/sites/default/themes/uits_v2/stylef129.css?w
- http://ui##.#rizona.edu/sites/default/themes/uits_v2/nice_menus_defaultf129.css?w
- http://ui##.#rizona.edu/sites/default/files/uits-block-status.jpeg
- http://ui##.#rizona.edu/misc/menu-leaf.png
- http://ui##.#rizona.edu/sites/default/themes/uits_v2/images/menubar_background.gif
- http://ui##.#rizona.edu/sites/default/themes/uits_v2/images/menu_background.gif
- http://ui##.#rizona.edu/sites/default/themes/uits_v2/images/front-blocks.bg.png
- http://ui##.#rizona.edu/sites/default/themes/uits_v2/images/footer_bg.jpg
- http://ui##.#rizona.edu/sites/all/modules/extlink/extlink.png
- http://ui##.#rizona.edu/sites/default/themes/uits_v2/css/images/ui-icons_003366_256x240.png
- http://sc####.crazyegg.com/pages/scripts/0017/3186.js?43####
- http://www.go#####analytics.com/analytics.js
- http://ui##.#rizona.edu/sites/default/files/uits-block-alerts.jpeg
- http://ui##.#rizona.edu/sites/default/files/UITS_Jobs.png
- http://ui##.#rizona.edu/sites/default/modules/hierarchical_select/hierarchical_selectf129.css?w
- http://ui##.#rizona.edu/sites/all/modules/views/css/viewsf129.css?w
- http://ui##.#rizona.edu/sites/all/modules/cck/modules/fieldgroup/fieldgroupf129.css?w
- http://re####ctor.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvZDg2QUFVUUNkZlVTT0NHM2tJS2JpQnlWUQ/0.3.0.2_lccekmodgklaepjeofjdjpbminllajkg.crx
- http://r6######4g5edn7l.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvZDg2QUFVUUNkZlVTT0NHM2tJS2JpQnlWUQ/0.3.0.2_lccekmodgklaepjeofjdjpbminllajkg.crx?cm########################...
- http://re####ctor.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvZjAxQUFXVHlhaFhwNHJ6dDVCakV0NUEyQQ/1.0.0.5_nmmhkkegccagdldgiimedpiccmgmieda.crx
- http://r3######4g5edn7s.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvZjAxQUFXVHlhaFhwNHJ6dDVCakV0NUEyQQ/1.0.0.5_nmmhkkegccagdldgiimedpiccmgmieda.crx?cm########################...
- http://ui##.#rizona.edu/
- http://ui##.#rizona.edu/modules/aggregator/aggregatorf129.css?w
- http://ui##.#rizona.edu/modules/book/bookf129.css?w
- http://ui##.#rizona.edu/modules/node/nodef129.css?w
- http://ui##.#rizona.edu/modules/system/defaultsf129.css?w
- http://ui##.#rizona.edu/modules/system/systemf129.css?w
- http://ci#.#rizona.edu/statistics-metrics
- http://ui##.#rizona.edu/modules/system/system-menusf129.css?w
- http://ui##.#rizona.edu/sites/all/modules/cck/theme/content-modulef129.css?w
- http://ui##.#rizona.edu/sites/all/modules/date/datef129.css?w
- http://ui##.#rizona.edu/sites/all/modules/date/date_popup/themes/jquery.timeentryf129.css?w
- http://ui##.#rizona.edu/sites/all/modules/filefield/filefieldf129.css?w
- http://ui##.#rizona.edu/sites/all/modules/nice_menus/nice_menusf129.css?w
- http://ui##.#rizona.edu/sites/default/themes/uits_v2/uitsv2_nice_menusf129.css?w
- http://ui##.#rizona.edu/sites/default/modules/uits_location/uits_locationf129.css?w
- http://ui##.#rizona.edu/misc/farbtastic/farbtasticf129.css?w
- http://ui##.#rizona.edu/sites/all/modules/calendar/calendarf129.css?w
- http://ui##.#rizona.edu/sites/all/modules/extlink/extlinkf129.css?w
- http://ui##.#rizona.edu/modules/user/userf129.css?w
- http://www.go#####analytics.com/r/collect?v=#####################################################################################################################################################...
- http://ui##.#rizona.edu/sites/default/images/misc/favicon.ico.png
UDP
- DNS ASK clients4.google.com
- DNS ASK os##.#rizona.edu
- DNS ASK ua####s.arizona.edu
- DNS ASK th####.arizona.edu
- DNS ASK su####t.arizona.edu
- DNS ASK so######license.arizona.edu
- DNS ASK it.##izona.edu
- DNS ASK ar##ona.edu
- DNS ASK sc####.crazyegg.com
- DNS ASK go#####analytics.com
- DNS ASK fo###.gstatic.com
- DNS ASK ac#####s.youtube.com
- DNS ASK accounts.google.com
- DNS ASK ui##.#rizona.edu
- DNS ASK r6######4g5edn7l.gvt1.com
- DNS ASK re####ctor.gvt1.com
- DNS ASK ci#.#rizona.edu
- DNS ASK clients3.google.com
- DNS ASK tr######e.googleapis.com
- DNS ASK gs##tic.com
- DNS ASK go###eapis.com
- DNS ASK go##le.ru
- DNS ASK google.com
- DNS ASK clients2.google.com
- DNS ASK ss#.#static.com
- DNS ASK apis.google.com
- DNS ASK r3######4g5edn7s.gvt1.com
- 'accounts.google.com':443
- 'google.com':443
- 'go##le.ru':443
Другое
Ищет следующие окна
- ClassName: 'Chrome_MessageWindow' WindowName: '<LS_APPDATA>\Google\Chrome\User Data'
Создает и запускает на исполнение
- '%TEMP%\b55c.tmp\website_setup.exe'
- '%TEMP%\b55c.tmp\website_cycle.exe'
Запускает на исполнение
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\B55C.tmp\WebServiceMain.bat""
- '%WINDIR%\syswow64\timeout.exe' 5
- '%ProgramFiles(x86)%\google\chrome\application\chrome.exe'
- '%ProgramFiles(x86)%\google\chrome\application\chrome.exe' --type=gpu-process --channel="2592.0.2075013272\1744541553" --supports-dual-gpus=false --gpu-driver-bug-workarounds=1,19,42 --gpu-vendor-id=0x0000 --gpu-device-id=0x0000 --gpu-driver-vendor --g...
- '%ProgramFiles(x86)%\google\chrome\application\chrome.exe' --type=renderer --enable-deferred-image-decoding --lang=ru --force-fieldtrials="BackgroundRendererProcesses/Disallow/BrowserBlacklist/Enabled/*CTRequiredForEVTrial/RequirementEnforced/CaptivePo...
- '%ProgramFiles(x86)%\google\chrome\application\chrome.exe' --type=renderer --enable-deferred-image-decoding --lang=ru --force-fieldtrials="BackgroundRendererProcesses/Disallow/*BrowserBlacklist/Enabled/*CTRequiredForEVTrial/RequirementEnforced/CaptiveP...
- '%WINDIR%\syswow64\tasklist.exe' /FI "IMAGENAME eq Website_Setup.exe"
- '%WINDIR%\syswow64\find.exe' /I /N "Website_Setup.exe"
- '%ProgramFiles(x86)%\google\chrome\application\chrome.exe' --type=renderer --enable-deferred-image-decoding --lang=ru --force-fieldtrials="*BackgroundRendererProcesses/Disallow/*BrowserBlacklist/Enabled/*CTRequiredForEVTrial/RequirementEnforced/Captive...
- '%WINDIR%\syswow64\timeout.exe' 1
- '%WINDIR%\syswow64\tasklist.exe' /FI "IMAGENAME eq Website_Cycle.exe"
- '%WINDIR%\syswow64\find.exe' /I /N "Website_Cycle.exe"
