Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\TBUpdater.job
- %WINDIR%\Tasks\Updater.job
Вредоносные функции:
Создает и запускает на исполнение:
- %TEMP%\sqlite3.exe "%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\search.sqlite" "UPDATE engine_data SET name = 'order' WHERE engineid LIKE '%google%'"
- %TEMP%\nsb7.tmp\ns8.tmp %TEMP%\sqlite3.exe "%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\search.sqlite" "UPDATE engine_data SET name = 'order' WHERE engineid LIKE '%google%'"
- %TEMP%\nsu2.tmp\nsA.tmp schtasks /create /sc minute /mo 60 /tn "TBUpdater" /tr "\"%ALLUSERSPROFILE%\Application Data\Update\tbupd.exe\"" /ru "System"
- %TEMP%\nsu2.tmp\ns9.tmp schtasks /create /sc minute /mo 60 /tn "Updater" /tr "\"%ALLUSERSPROFILE%\Application Data\Update\seupd.exe\"" /ru "System"
- %TEMP%\FFIT.exe
- %TEMP%\nsu2.tmp\ns3.tmp %TEMP%\FFIT.exe
- %ALLUSERSPROFILE%\Application Data\Update\seupd.exe
- %TEMP%\tb.exe
Запускает на исполнение:
- <SYSTEM32>\schtasks.exe /create /sc minute /mo 60 /tn "Updater" /tr "\"%ALLUSERSPROFILE%\Application Data\Update\seupd.exe\"" /ru "System"
- <SYSTEM32>\schtasks.exe /create /sc minute /mo 60 /tn "TBUpdater" /tr "\"%ALLUSERSPROFILE%\Application Data\Update\tbupd.exe\"" /ru "System"
- <SYSTEM32>\regsvr32.exe /s "%PROGRAM_FILES%\IEToolbar\Money-Booster\tbcore3.dll"
- <SYSTEM32>\taskkill.exe /F /IM rssclient.exe
- <SYSTEM32>\taskkill.exe /F /IM tbhelper.exe
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\games.gif
- %TEMP%\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\help.gif
- %TEMP%\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\home.gif
- %TEMP%\nsb7.tmp\ns8.tmp
- %TEMP%\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\facebook_25.png
- %TEMP%\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\feedback.gif
- %TEMP%\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\fun.gif
- %TEMP%\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\icons.bmp
- %TEMP%\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\info.txt
- %TEMP%\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\inspiration.gif
- %TEMP%\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\lock_ok.gif
- %TEMP%\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\ico_smartwallet.png
- %TEMP%\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\icons_old.bmp
- %TEMP%\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\ico_gadgets.png
- %TEMP%\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\ico_goodies.png
- %TEMP%\nsb7.tmp\nsExec.dll
- %TEMP%\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\affid.dat
- %TEMP%\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\arrow_refresh.png
- %TEMP%\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\basis.xml
- %TEMP%\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\about.gif
- %PROGRAM_FILES%\IEToolbar\Money-Booster\youtube18.png
- %PROGRAM_FILES%\IEToolbar\Money-Booster\youtube_25.png
- %TEMP%\sqlite3.exe
- %PROGRAM_FILES%\Mozilla Firefox\searchplugins\google_search.xml
- %TEMP%\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\dictionary.gif
- %TEMP%\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\downloads.gif
- %TEMP%\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\facebook18.png
- %TEMP%\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\computer_delete.png
- %TEMP%\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\business.gif
- %TEMP%\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\cog.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\user.js
- %TEMP%\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\uninstall.exe
- %TEMP%\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\update.exe
- %TEMP%\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\useful.gif
- %TEMP%\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\twitter_s.png
- %TEMP%\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\twitter.png
- %TEMP%\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\twitter18.png
- %TEMP%\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\twitters.png
- %TEMP%\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\version.txt
- %TEMP%\nsb7.tmp\System.dll
- %TEMP%\nsb7.tmp\registry.dll
- %TEMP%\aaaa.txt
- %TEMP%\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\youtube_25.png
- %TEMP%\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\video.gif
- %TEMP%\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\your_logo.png
- %TEMP%\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\youtube18.png
- %TEMP%\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\tweater_25.png
- %TEMP%\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\refresh.gif
- %TEMP%\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\script.html
- %TEMP%\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\shopping.gif
- %TEMP%\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\music.gif
- %TEMP%\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\money.gif
- %TEMP%\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\money_booster.png
- %TEMP%\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\movies.gif
- %TEMP%\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\smartwallet.png
- %TEMP%\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\translate.gif
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\search.sqlite-journal
- %TEMP%\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\tv.gif
- %TEMP%\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\tools.gif
- %TEMP%\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\software.gif
- %TEMP%\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\starpulse_25.png
- %TEMP%\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\TbHelper2.exe
- %PROGRAM_FILES%\IEToolbar\Money-Booster\downloads.gif
- %PROGRAM_FILES%\IEToolbar\Money-Booster\facebook18.png
- %PROGRAM_FILES%\IEToolbar\Money-Booster\facebook_25.png
- %PROGRAM_FILES%\IEToolbar\Money-Booster\dictionary.gif
- %PROGRAM_FILES%\IEToolbar\Money-Booster\business.gif
- %PROGRAM_FILES%\IEToolbar\Money-Booster\cog.png
- %PROGRAM_FILES%\IEToolbar\Money-Booster\computer_delete.png
- %PROGRAM_FILES%\IEToolbar\Money-Booster\feedback.gif
- %PROGRAM_FILES%\IEToolbar\Money-Booster\ico_gadgets.png
- %PROGRAM_FILES%\IEToolbar\Money-Booster\ico_goodies.png
- %PROGRAM_FILES%\IEToolbar\Money-Booster\ico_smartwallet.png
- %PROGRAM_FILES%\IEToolbar\Money-Booster\home.gif
- %PROGRAM_FILES%\IEToolbar\Money-Booster\fun.gif
- %PROGRAM_FILES%\IEToolbar\Money-Booster\games.gif
- %PROGRAM_FILES%\IEToolbar\Money-Booster\help.gif
- %PROGRAM_FILES%\IEToolbar\Money-Booster\basis.xml
- %TEMP%\FFIT.exe
- %PROGRAM_FILES%\Mozilla Firefox\extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\chrome.manifest
- %PROGRAM_FILES%\Mozilla Firefox\extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\install.rdf
- %TEMP%\tb.exe
- %ALLUSERSPROFILE%\Application Data\Update\seupd.exe
- %ALLUSERSPROFILE%\Application Data\Update\tbupd.exe
- %ALLUSERSPROFILE%\Application Data\Update\tbsk.exe
- %PROGRAM_FILES%\Mozilla Firefox\extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\chrome\lip.jar
- %PROGRAM_FILES%\IEToolbar\Money-Booster\about.gif
- %PROGRAM_FILES%\IEToolbar\Money-Booster\affid.dat
- %PROGRAM_FILES%\IEToolbar\Money-Booster\arrow_refresh.png
- %PROGRAM_FILES%\IEToolbar\Money-Booster\TbHelper2.exe
- %PROGRAM_FILES%\Mozilla Firefox\extensions\installed-extensions-processed.txt
- %PROGRAM_FILES%\IEToolbar\Money-Booster\Money-Booster-V1.0.7_1013.dll
- %PROGRAM_FILES%\IEToolbar\Money-Booster\TbCommonUtils.dll
- %PROGRAM_FILES%\IEToolbar\Money-Booster\tweater_25.png
- %PROGRAM_FILES%\IEToolbar\Money-Booster\twitter.png
- %PROGRAM_FILES%\IEToolbar\Money-Booster\twitter18.png
- %PROGRAM_FILES%\IEToolbar\Money-Booster\tv.gif
- %PROGRAM_FILES%\IEToolbar\Money-Booster\tbhelper.dll
- %PROGRAM_FILES%\IEToolbar\Money-Booster\tools.gif
- %PROGRAM_FILES%\IEToolbar\Money-Booster\translate.gif
- %PROGRAM_FILES%\IEToolbar\Money-Booster\twitter_s.png
- %PROGRAM_FILES%\IEToolbar\Money-Booster\version.txt
- %PROGRAM_FILES%\IEToolbar\Money-Booster\video.gif
- %PROGRAM_FILES%\IEToolbar\Money-Booster\your_logo.png
- %PROGRAM_FILES%\IEToolbar\Money-Booster\useful.gif
- %PROGRAM_FILES%\IEToolbar\Money-Booster\twitters.png
- %PROGRAM_FILES%\IEToolbar\Money-Booster\uninstall.exe
- %PROGRAM_FILES%\IEToolbar\Money-Booster\update.exe
- %PROGRAM_FILES%\IEToolbar\Money-Booster\tbcore3.dll
- %PROGRAM_FILES%\IEToolbar\Money-Booster\lock_ok.gif
- %PROGRAM_FILES%\IEToolbar\Money-Booster\money.gif
- %PROGRAM_FILES%\IEToolbar\Money-Booster\money_booster.png
- %PROGRAM_FILES%\IEToolbar\Money-Booster\inspiration.gif
- %PROGRAM_FILES%\IEToolbar\Money-Booster\icons.bmp
- %PROGRAM_FILES%\IEToolbar\Money-Booster\icons_old.bmp
- %PROGRAM_FILES%\IEToolbar\Money-Booster\info.txt
- %PROGRAM_FILES%\IEToolbar\Money-Booster\movies.gif
- %PROGRAM_FILES%\IEToolbar\Money-Booster\smartwallet.png
- %PROGRAM_FILES%\IEToolbar\Money-Booster\software.gif
- %PROGRAM_FILES%\IEToolbar\Money-Booster\starpulse_25.png
- %PROGRAM_FILES%\IEToolbar\Money-Booster\shopping.gif
- %PROGRAM_FILES%\IEToolbar\Money-Booster\music.gif
- %PROGRAM_FILES%\IEToolbar\Money-Booster\refresh.gif
- %PROGRAM_FILES%\IEToolbar\Money-Booster\script.html
Удаляет следующие файлы:
- %TEMP%\nsb7.tmp\registry.dll
- %TEMP%\nsb7.tmp\nsExec.dll
- %TEMP%\aaaa.txt
- %TEMP%\nsb7.tmp\System.dll
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\search.sqlite-journal
- %TEMP%\tb.exe
- %TEMP%\sqlite3.exe
- %TEMP%\nsb7.tmp\ns8.tmp
Сетевая активность:
Подключается к:
- 'www.li###nfopro.com':80
TCP:
Запросы HTTP GET:
- www.li###nfopro.com/reg/1013
UDP:
- DNS ASK www.li###nfopro.com
Другое:
Ищет следующие окна:
- ClassName: '' WindowName: ''
