Техническая информация
Вредоносные функции:
Создает и запускает на исполнение:
- %PROGRAM_FILES%\Funmoods\1.5.23.22\funmoodssrv.exe /regServer
- %TEMP%\is111625\FunmoodsTB.exe -y -o"%APPDATA%\Mozilla\Firefox\Profiles\CWDGT0~1.DEF\EXTENS~1\ffxtlbr@funmoods.com"
- %TEMP%\nso2.tmp\tmp0002.exe /S /aflt=softpb /instlRef=softpb /mhp /mds /mnt /PKL=2 /AL=2
- %TEMP%\nso2.tmp\ns3.tmp "%TEMP%\nso2.tmp\lzma.exe" d %TEMP%\nso2.tmp\inetc.bin %TEMP%\nso2.tmp\inetc.dll
- %TEMP%\nso2.tmp\lzma.exe d %TEMP%\nso2.tmp\inetc.bin %TEMP%\nso2.tmp\inetc.dll
Запускает на исполнение:
- <SYSTEM32>\regsvr32.exe /s %PROGRAM_FILES%\Funmoods\1.5.23.22\escortEng.dll
- <SYSTEM32>\regsvr32.exe /s %PROGRAM_FILES%\Funmoods\1.5.23.22\escorTlbr.dll
- <SYSTEM32>\regsvr32.exe /s %PROGRAM_FILES%\Funmoods\1.5.23.22\escortShld.dll
- <SYSTEM32>\regsvr32.exe /s %PROGRAM_FILES%\Funmoods\1.5.23.22\\bh\escort.dll
- <SYSTEM32>\regsvr32.exe /s %PROGRAM_FILES%\Funmoods\1.5.23.22\escortApp.dll
Завершает или пытается завершить
следующие пользовательские процессы:
- firefox.exe
- iexplore.exe
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\imgs\flgs\ja.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\imgs\flgs\jp.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\imgs\flgs\it.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\imgs\flgs\he.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\imgs\flgs\il.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\imgs\flgs\pl.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\imgs\flgs\pt.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\imgs\flgs\no.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\imgs\logo.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\imgs\flgs\nl.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\imgs\flgs\cz.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\imgs\flgs\de.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\imgs\flgs\cn.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\imgs\flgs\bg.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\imgs\flgs\ch.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\imgs\flgs\fr.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\imgs\flgs\gr.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\imgs\flgs\es.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\imgs\flgs\eg.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\imgs\flgs\en.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\imgs\flgs\ro.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\META-INF\le_c6a58f26_4d2d_4341_b387_c4f2289b6170.rsa
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\META-INF\le_c6a58f26_4d2d_4341_b387_c4f2289b6170.sf
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\install.rdf
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\tmplt.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\META-INF\manifest.mf
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\user.js
- %TEMP%\0001EBD2.log
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\preferences.xul
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\funmoods.xul
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\loader.xul
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\imgs\flgs\sv.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\imgs\flgs\tr.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\imgs\flgs\se.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\imgs\flgs\ru.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\imgs\flgs\sa.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\funmoods.css
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\mtstart.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\chrome.manifest
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\imgs\flgs\ua.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\imgs\flgs\us.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\imgs\flgs\ae.png
- %TEMP%\is111625\chrome-extension.localstorage
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\iw[1].0&cv=1053&p=197
- %TEMP%\is111625\payloadflat.cis
- %TEMP%\0001B3F9.log
- %TEMP%\is111625\payload.cis
- %TEMP%\is111625\escortEng.dll
- %TEMP%\is111625\escorTlbr.dll
- %TEMP%\is111625\escortApp.dll
- %TEMP%\nso2.tmp\tmp0003.tmp
- %TEMP%\is111625\escort.dll
- %TEMP%\nso2.tmp\Math.dll
- %TEMP%\nso2.tmp\md5dll.dll
- %TEMP%\nso2.tmp\System.dll
- %TEMP%\nso2.tmp\lzma.exe
- %TEMP%\nso2.tmp\inetc.bin
- %TEMP%\nso2.tmp\tmp0002.exe
- %PROGRAM_FILES%\is111109.log
- %TEMP%\nso2.tmp\inetc.dll
- %TEMP%\nso2.tmp\nsExec.dll
- %TEMP%\nso2.tmp\ns3.tmp
- %TEMP%\is111625\escortShld.dll
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\searchplugins\Search.xml
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\imgs\arwDwn.gif
- <LS_APPDATA>\Google\Chrome\User Data\Default\Local Storage\chrome-extension_cjpglkicenollcignonpgiafdgfeehoj_0.localstorage-journal
- <LS_APPDATA>\funmoods-speeddial.crx
- <LS_APPDATA>\Google\Chrome\User Data\Default\Local Storage\chrome-extension_cjpglkicenollcignonpgiafdgfeehoj_0.localstorage
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\imgs\tellafriend.gif
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\images\pref.jpg
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\imgs\privecy_16_hot.gif
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\imgs\help_16.gif
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\imgs\home.gif
- %TEMP%\is111625\funmoodssrv.exe
- %TEMP%\is111625\FunmoodsTB.exe
- %TEMP%\is111625\funmoods.crx
- %TEMP%\is111625\favicon.ico
- %TEMP%\is111625\funmoods-speeddial.crx
- <LS_APPDATA>\Google\Chrome\User Data\Default\Local Storage\chrome-extension_fdloijijlkoblmigdofommgnheckmaki_0.localstorage
- <LS_APPDATA>\Google\Chrome\User Data\Default\Local Storage\chrome-extension_fdloijijlkoblmigdofommgnheckmaki_0.localstorage-journal
- <LS_APPDATA>\funmoods.crx
- %TEMP%\is111625\Sqlite3.dll
- %TEMP%\is111625\uninstall.exe
Удаляет следующие файлы:
- <LS_APPDATA>\Google\Chrome\User Data\Default\Local Storage\chrome-extension_fdloijijlkoblmigdofommgnheckmaki_0.localstorage-journal
- <LS_APPDATA>\Google\Chrome\User Data\Default\Local Storage\chrome-extension_cjpglkicenollcignonpgiafdgfeehoj_0.localstorage-journal
- %TEMP%\is111625\payloadflat.cis
- %TEMP%\nso2.tmp\tmp0003.tmp
- %TEMP%\is111625\payload.cis
- %TEMP%\is111625\chrome-extension.localstorage
- %TEMP%\is111625\Sqlite3.dll
- %TEMP%\0001EBD2.log
- %TEMP%\is111625\FunmoodsTB.exe
- %TEMP%\is111625\funmoods-speeddial.crx
- %TEMP%\is111625\funmoods.crx
- %TEMP%\nso2.tmp\inetc.bin
- %TEMP%\nso2.tmp\inetc.dll
- %TEMP%\0001B3F9.log
- %TEMP%\nso2.tmp\ns3.tmp
- %PROGRAM_FILES%\is111109.log
- %TEMP%\nso2.tmp\lzma.exe
- %TEMP%\nso2.tmp\System.dll
- %TEMP%\nso2.tmp\tmp0002.exe
- %TEMP%\nso2.tmp\nsExec.dll
- %TEMP%\nso2.tmp\Math.dll
- %TEMP%\nso2.tmp\md5dll.dll
Сетевая активность:
Подключается к:
- 'r.###moods.com':80
- 'rp.###moodscdn.com':80
- 'www.in####lwrapper.com':80
TCP:
Запросы HTTP GET:
- r.###moods.com/install_success/88e6680f000000000000000000000001/softpb/0?t=####
- www.in####lwrapper.com/api/iw/?i=###########################################################
Запросы HTTP POST:
- rp.###moodscdn.com/?pc#############
UDP:
- DNS ASK r.###moods.com
- DNS ASK rp.###moodscdn.com
- DNS ASK www.in####lwrapper.com
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
