Техническая информация
Вредоносные функции
Запускает на исполнение
- '%WINDIR%\syswow64\taskkill.exe' /f /im "ytd.exe"
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\is-p2039.tmp\<Имя файла>.tmp
- %ProgramFiles(x86)%\greentree applications\ytd video downloader\lang\res1050.ini
- %ProgramFiles(x86)%\greentree applications\ytd video downloader\lang\res1049.ini
- %ProgramFiles(x86)%\greentree applications\ytd video downloader\lang\res1048.ini
- %ProgramFiles(x86)%\greentree applications\ytd video downloader\lang\res1045.ini
- %ProgramFiles(x86)%\greentree applications\ytd video downloader\lang\res1044.ini
- %ProgramFiles(x86)%\greentree applications\ytd video downloader\lang\res1043.ini
- %ProgramFiles(x86)%\greentree applications\ytd video downloader\lang\res1052.ini
- %ProgramFiles(x86)%\greentree applications\ytd video downloader\lang\res1051.ini
- %ProgramFiles(x86)%\greentree applications\ytd video downloader\lang\res1036.ini
- %ProgramFiles(x86)%\greentree applications\ytd video downloader\lang\res1035.ini
- %ProgramFiles(x86)%\greentree applications\ytd video downloader\lang\res1034.ini
- %ProgramFiles(x86)%\greentree applications\ytd video downloader\lang\res1033.ini
- %ProgramFiles(x86)%\greentree applications\ytd video downloader\lang\res1032.ini
- %ProgramFiles(x86)%\greentree applications\ytd video downloader\lang\res1031.ini
- %ProgramFiles(x86)%\greentree applications\ytd video downloader\lang\res1040.ini
- %ProgramFiles(x86)%\greentree applications\ytd video downloader\scripts.yds
- %ProgramFiles(x86)%\greentree applications\ytd video downloader\lang\res1053.ini
- %ProgramFiles(x86)%\greentree applications\ytd video downloader\plugins\plugins.dat.2360
- %PROGRAMDATA%\ytd video downloader\scripts0.yds
- %TEMP%\is-idd50.tmp\ytd.exe
- %PROGRAMDATA%\microsoft\windows\start menu\programs\ytd video downloader\uninstall.lnk
- %PROGRAMDATA%\microsoft\windows\start menu\programs\ytd video downloader\web site.url
- %PROGRAMDATA%\microsoft\windows\start menu\programs\ytd video downloader\ytd video downloader.lnk
- C:\users\public\desktop\ytd video downloader.lnk
- %ProgramFiles(x86)%\greentree applications\ytd video downloader\uninstall.exe
- %ProgramFiles(x86)%\greentree applications\ytd video downloader\lang\res9999.ini
- %ProgramFiles(x86)%\greentree applications\ytd video downloader\lang\res2074.ini
- %ProgramFiles(x86)%\greentree applications\ytd video downloader\lang\res2070.ini
- %ProgramFiles(x86)%\greentree applications\ytd video downloader\lang\res2052.ini
- %ProgramFiles(x86)%\greentree applications\ytd video downloader\lang\res1061.ini
- %ProgramFiles(x86)%\greentree applications\ytd video downloader\lang\res1060.ini
- %ProgramFiles(x86)%\greentree applications\ytd video downloader\lang\res1059.ini
- %ProgramFiles(x86)%\greentree applications\ytd video downloader\lang\res1030.ini
- %ProgramFiles(x86)%\greentree applications\ytd video downloader\lang\res1038.ini
- %ProgramFiles(x86)%\greentree applications\ytd video downloader\lang\res1029.ini
- %ProgramFiles(x86)%\greentree applications\ytd video downloader\lang\res1026.ini
- %ProgramFiles(x86)%\greentree applications\ytd video downloader\lang\res1025.ini
- %TEMP%\nsbf75f.tmp\nsisdl.dll
- %ProgramFiles(x86)%\greentree applications\ytd video downloader\copying.apachev2
- %ProgramFiles(x86)%\greentree applications\ytd video downloader\manual.bat
- %ProgramFiles(x86)%\greentree applications\ytd video downloader\ffmpeg.exe
- %ProgramFiles(x86)%\greentree applications\ytd video downloader\ytd.exe
- %TEMP%\nsbf75f.tmp\o.txt
- %TEMP%\nsbf75f.tmp\inst_start.txt
- %TEMP%\nsbf75f.tmp\userinfo.dll
- %ProgramFiles(x86)%\greentree applications\ytd video downloader\copying.lgplv3
- %TEMP%\nsbf75f.tmp\nsishelper.dll
- %TEMP%\nsbf75f.tmp\system.dll
- %TEMP%\nslf74e.tmp
- %TEMP%\is-idd50.tmp\ytdsetup.exe
- %TEMP%\is-idd50.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-idd50.tmp\_isetup\_setup64.tmp
- %WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\metadata\f0accf77cdcbff39f6191887f6d2d357
- %ProgramFiles(x86)%\greentree applications\ytd video downloader\lang\res1055.ini
- %ProgramFiles(x86)%\greentree applications\ytd video downloader\license
- %ProgramFiles(x86)%\greentree applications\ytd video downloader\libvlc.dll
- %ProgramFiles(x86)%\greentree applications\ytd video downloader\copying.lgplv2
- %ProgramFiles(x86)%\greentree applications\ytd video downloader\plugins\video_output\libwingdi_plugin.dll
- %ProgramFiles(x86)%\greentree applications\ytd video downloader\plugins\video_output\libvmem_plugin.dll
- %ProgramFiles(x86)%\greentree applications\ytd video downloader\plugins\video_output\libdrawable_plugin.dll
- %ProgramFiles(x86)%\greentree applications\ytd video downloader\plugins\video_output\libdirect3d_plugin.dll
- %ProgramFiles(x86)%\greentree applications\ytd video downloader\plugins\video_filter\libswscale_plugin.dll
- %ProgramFiles(x86)%\greentree applications\ytd video downloader\plugins\codec\libavcodec_plugin.dll
- %ProgramFiles(x86)%\greentree applications\ytd video downloader\plugins\audio_output\libdirectsound_plugin.dll
- %ProgramFiles(x86)%\greentree applications\ytd video downloader\plugins\audio_mixer\libinteger_mixer_plugin.dll
- %ProgramFiles(x86)%\greentree applications\ytd video downloader\plugins\audio_mixer\libfloat_mixer_plugin.dll
- %ProgramFiles(x86)%\greentree applications\ytd video downloader\plugins\audio_filter\libugly_resampler_plugin.dll
- %ProgramFiles(x86)%\greentree applications\ytd video downloader\plugins\audio_filter\libtrivial_channel_mixer_plugin.dll
- %ProgramFiles(x86)%\greentree applications\ytd video downloader\plugins\audio_filter\libaudio_format_plugin.dll
- %ProgramFiles(x86)%\greentree applications\ytd video downloader\plugins\access\libfilesystem_plugin.dll
- %ProgramFiles(x86)%\greentree applications\ytd video downloader\libvlccore.dll
- %ProgramFiles(x86)%\greentree applications\ytd video downloader\librtmp.dll
- %WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\content\f0accf77cdcbff39f6191887f6d2d357
Удаляет следующие файлы
- %TEMP%\nsbf75f.tmp\inst_start.txt
- %TEMP%\nsbf75f.tmp\nsisdl.dll
- %TEMP%\nsbf75f.tmp\nsishelper.dll
- %TEMP%\nsbf75f.tmp\o.txt
- %TEMP%\nsbf75f.tmp\system.dll
- %TEMP%\nsbf75f.tmp\userinfo.dll
- %TEMP%\is-idd50.tmp\ytd.exe
- %TEMP%\is-idd50.tmp\ytdsetup.exe
- %TEMP%\is-idd50.tmp\_isetup\_setup64.tmp
- %TEMP%\is-idd50.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-p2039.tmp\<Имя файла>.tmp
Перемещает следующие файлы
- %ProgramFiles(x86)%\greentree applications\ytd video downloader\plugins\plugins.dat.2360 в %ProgramFiles(x86)%\greentree applications\ytd video downloader\plugins\plugins.dat
Сетевая активность
TCP
Запросы HTTP GET
- http://www.yt####nloader.com/images/pixel.gif?ac#########################################################################################################################################
- http://do######.ytddownloader.com/offers/offers.php?id######
- http://www.yt####nloader.com/images/pixel.gif?ev####################################################
- http://x.##2.us/x.cer
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
- http://o.##2.us//MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D
UDP
- DNS ASK yt####nloader.com
- DNS ASK do######.ytddownloader.com
- DNS ASK x.##2.us
- DNS ASK o.##2.us
Другое
Ищет следующие окна
- ClassName: '' WindowName: ''
Создает и запускает на исполнение
- '%TEMP%\is-p2039.tmp\<Имя файла>.tmp' /SL5="$90214,11079588,182272,<Полный путь к файлу>"
- '%TEMP%\is-idd50.tmp\ytdsetup.exe' /S
- '%ProgramFiles(x86)%\greentree applications\ytd video downloader\ytd.exe'
- '%WINDIR%\syswow64\taskkill.exe' /f /im "ytd.exe"' (со скрытым окном)
