Техническая информация
Вредоносные функции:
Создает и запускает на исполнение:
- %TEMP%\is103796\SearchyaTB.exe -y -o"%APPDATA%\Mozilla\Firefox\Profiles\CWDGT0~1.DEF\EXTENS~1\ffxtlbr@searchya.com"
- %PROGRAM_FILES%\SearchYa!\1.5.20.0\searchyasrv.exe /regServer
Запускает на исполнение:
- <SYSTEM32>\regsvr32.exe /s %PROGRAM_FILES%\SearchYa!\1.5.20.0\searchyaEng.dll
- <SYSTEM32>\regsvr32.exe /s %PROGRAM_FILES%\SearchYa!\1.5.20.0\searchyaTlbr.dll
- <SYSTEM32>\regsvr32.exe /s %PROGRAM_FILES%\SearchYa!\1.5.20.0\escortShld.dll
- <SYSTEM32>\regsvr32.exe /s %PROGRAM_FILES%\SearchYa!\1.5.20.0\\bh\searchya.dll
- <SYSTEM32>\regsvr32.exe /s %PROGRAM_FILES%\SearchYa!\1.5.20.0\searchyaApp.dll
Завершает или пытается завершить
следующие пользовательские процессы:
- firefox.exe
- iexplore.exe
Изменения в файловой системе:
Создает следующие файлы:
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@searchya.com\ffxtlbr@searchya.com\content\imgs\flgs\pl.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@searchya.com\ffxtlbr@searchya.com\content\imgs\flgs\pt.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@searchya.com\ffxtlbr@searchya.com\content\imgs\flgs\nl.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@searchya.com\ffxtlbr@searchya.com\content\imgs\flgs\no.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@searchya.com\ffxtlbr@searchya.com\content\imgs\flgs\sa.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@searchya.com\ffxtlbr@searchya.com\content\imgs\flgs\se.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@searchya.com\ffxtlbr@searchya.com\content\imgs\flgs\ro.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@searchya.com\ffxtlbr@searchya.com\content\imgs\flgs\ru.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@searchya.com\ffxtlbr@searchya.com\content\imgs\icon_seperator.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@searchya.com\ffxtlbr@searchya.com\content\imgs\flgs\il.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@searchya.com\ffxtlbr@searchya.com\content\imgs\flgs\gr.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@searchya.com\ffxtlbr@searchya.com\content\imgs\flgs\he.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@searchya.com\ffxtlbr@searchya.com\content\imgs\flgs\jp.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@searchya.com\ffxtlbr@searchya.com\content\imgs\logo.PNG
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@searchya.com\ffxtlbr@searchya.com\content\imgs\flgs\it.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@searchya.com\ffxtlbr@searchya.com\content\imgs\flgs\ja.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@searchya.com\ffxtlbr@searchya.com\META-INF\manifest.mf
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@searchya.com\ffxtlbr@searchya.com\META-INF\zigbert.rsa
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@searchya.com\ffxtlbr@searchya.com\user.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@searchya.com\ffxtlbr@searchya.com\stage.dat
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@searchya.com\ffxtlbr@searchya.com\install.rdf
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\user.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@searchya.com\ffxtlbr@searchya.com\META-INF\zigbert.sf
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@searchya.com\ffxtlbr@searchya.com\content\searchya.xul
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@searchya.com\ffxtlbr@searchya.com\content\imgs\flgs\ua.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@searchya.com\ffxtlbr@searchya.com\content\imgs\flgs\us.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@searchya.com\ffxtlbr@searchya.com\content\imgs\flgs\sv.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@searchya.com\ffxtlbr@searchya.com\content\imgs\flgs\tr.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@searchya.com\ffxtlbr@searchya.com\content\mtstart.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@searchya.com\ffxtlbr@searchya.com\content\tmplt.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@searchya.com\ffxtlbr@searchya.com\chrome.manifest
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@searchya.com\ffxtlbr@searchya.com\content\searchya.css
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@searchya.com\ffxtlbr@searchya.com\content\imgs\flgs\fr.png
- %TEMP%\is103796\searchyasrv.exe
- %TEMP%\is103796\SearchyaTB.exe
- %TEMP%\is103796\searchyaApp.dll
- %TEMP%\is103796\searchyaEng.dll
- %TEMP%\is103796\Sqlite3.dll
- %TEMP%\is103796\uninstall.exe
- %TEMP%\is103796\searchyaTlbr.dll
- %TEMP%\is103796\speeddial.crx
- %TEMP%\is103796\payload.cis
- %TEMP%\is103796\payloadflat.cis
- %PROGRAM_FILES%\is103718.log
- %TEMP%\00019565.log
- %TEMP%\is103796\favicon.ico
- %TEMP%\is103796\searchya.dll
- %TEMP%\is103796\chrome-extension.localstorage
- %TEMP%\is103796\escortShld.dll
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@searchya.com\ffxtlbr@searchya.com\content\imgs\flgs\cn.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@searchya.com\ffxtlbr@searchya.com\content\imgs\flgs\cz.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@searchya.com\ffxtlbr@searchya.com\content\imgs\flgs\bg.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@searchya.com\ffxtlbr@searchya.com\content\imgs\flgs\ch.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@searchya.com\ffxtlbr@searchya.com\content\imgs\flgs\en.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@searchya.com\ffxtlbr@searchya.com\content\imgs\flgs\es.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@searchya.com\ffxtlbr@searchya.com\content\imgs\flgs\de.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@searchya.com\ffxtlbr@searchya.com\content\imgs\flgs\eg.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@searchya.com\ffxtlbr@searchya.com\content\imgs\home.gif
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@searchya.com\ffxtlbr@searchya.com\content\imgs\privecy_16_hot.gif
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@searchya.com\ffxtlbr@searchya.com\content\imgs\arwDwn.gif
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@searchya.com\ffxtlbr@searchya.com\content\imgs\help_16.gif
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@searchya.com\ffxtlbr@searchya.com\content\imgs\1331420689_package_network.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@searchya.com\ffxtlbr@searchya.com\content\imgs\flgs\ae.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@searchya.com\ffxtlbr@searchya.com\content\imgs\specialoffer.gif
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@searchya.com\ffxtlbr@searchya.com\content\imgs\tellafriend.gif
Удаляет следующие файлы:
- %TEMP%\is103796\SearchyaTB.exe
- %TEMP%\is103796\chrome-extension.localstorage
- %TEMP%\is103796\Sqlite3.dll
- %TEMP%\is103796\speeddial.crx
- %TEMP%\00019565.log
- %PROGRAM_FILES%\is103718.log
- %TEMP%\is103796\payloadflat.cis
- %TEMP%\is103796\payload.cis
Самоудаляется.
Сетевая активность:
Подключается к:
- 'rp.###rchyacdn.com':80
TCP:
Запросы HTTP POST:
- rp.###rchyacdn.com/?pc###########
- rp.###rchyacdn.com/?pc#############
UDP:
- DNS ASK rp.###rchyacdn.com
