Техническая информация
Для обеспечения автозапуска и распространения
Модифицирует следующие ключи реестра
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Jbygxq' = '%APPDATA%\OPERAS~1\OPERAS~1\JUMPLI~2\F33BJN~1\RDVGHE~1.EXE'
Создает или изменяет следующие файлы
- <SYSTEM32>\tasks\gpqjpgekltu
- %APPDATA%\Microsoft\windows\Start Menu\programs\startup\wufwurl.lnk
Вредоносные функции
Внедряет код в
следующие системные процессы:
- %WINDIR%\explorer.exe
следующие пользовательские процессы:
- firefox.exe
Перехватывает функции
в браузерах
- Процесс firefox.exe, модуль nss3.dll
Завершает или пытается завершить
следующие системные процессы:
- <SYSTEM32>\raserver.exe
- <SYSTEM32>\shrpubw.exe
- <SYSTEM32>\rdvghelper.exe
- <SYSTEM32>\ie4ushowie.exe
следующие пользовательские процессы:
- iexplore.exe
Изменения в файловой системе
Создает следующие файлы
- %LOCALAPPDATA%\albb\wtsapi32.dll
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\lv-lv\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\lt-lt\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\lb-lu\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\ko-kr\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\ja-jp\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\it-it\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\is-is\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\hu-hu\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\hr-hr\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\he-il\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\gl-es\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\fr-xf\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\fr-fr\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\fr-ch\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\fr-ca\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\fr-be\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\fi-fi\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\et-ee\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\eu-es\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\ms-my\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\nb-no\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\zh-hk\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\zh-cn\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\vi-vn\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\uk-ua\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\tr-tr\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\th-th\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\sv-se\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\sr-latn-rs\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\sk-sk\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\en-in\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\ru-ru\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\ro-ro\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\pt-pt\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\pt-br\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\pl-pl\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\nn-no\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\nl-nl\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\nl-be\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\es-xl\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\es-us\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\es-mx\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\ca-es\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\bg-bg\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\ar-sa\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\metadata.json
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content.cab
- %APPDATA%\microsoft\network\connections\4cdw9\ie4ushowie.exe
- %APPDATA%\microsoft\network\connections\4cdw9\version.dll
- %LOCALAPPDATA%\ntrzn\ie4ushowie.exe
- %LOCALAPPDATA%\ntrzn\version.dll
- %APPDATA%\opera software\opera stable\jump list icons\f33bjnsjw\rdvghelper.exe
- %APPDATA%\opera software\opera stable\jump list icons\f33bjnsjw\wtsapi32.dll
- %LOCALAPPDATA%\1imbv7eiv\rdvghelper.exe
- %LOCALAPPDATA%\1imbv7eiv\wtsapi32.dll
- %APPDATA%\microsoft\templates\livecontent\16\user\13brpj\raserver.exe
- %APPDATA%\microsoft\templates\livecontent\16\user\13brpj\wtsapi32.dll
- %LOCALAPPDATA%\albb\raserver.exe
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\cs-cz\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\da-dk\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\ca-es-valencia\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\de-at\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\es-es\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\de-ch\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\es-co\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\es-cl\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\es-ar\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\en-za\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\en-us\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\en-ph\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\en-nz\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\sl-si\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\zh-tw\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\en-ie\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\en-id\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\en-hk\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\en-gb\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\en-ca\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\en-au\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\el-gr\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\de-de\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- %ProgramFiles%\unp\updatenotificationmgr\unpcampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\content2\en-my\8a27f2ca-9fcd-4181-9520-7fa56b86b178.xml
- C:\$recycle.bin\s-1-5-18\desktop.ini
Присваивает атрибут 'скрытый' для следующих файлов
- C:\$recycle.bin\s-1-5-18\desktop.ini
Перемещает следующие файлы
- %ProgramFiles%\unp\logs\updatenotificationpipeline.001.etl в %ProgramFiles%\unp\logs\updatenotificationpipeline.002.etl
Изменяет следующие файлы
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1004681136-874170566-1875838749-1001\f58155b4b1d5a524ca0261c3ee99fb50_3a013a80-9fd9-4823-9743-876b68250df0
Подменяет следующие файлы
- %ProgramFiles%\UNP\Logs\UpdateNotificationPipeline.001.etl
Сетевая активность
TCP
Запросы HTTP GET
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?2c##############
Другое
Создает и запускает на исполнение
- '%LOCALAPPDATA%\albb\raserver.exe'
- '%LOCALAPPDATA%\1imbv7eiv\rdvghelper.exe'
- '%LOCALAPPDATA%\ntrzn\ie4ushowie.exe'
Запускает на исполнение
- '<SYSTEM32>\devicecensus.exe'
- '<SYSTEM32>\usoclient.exe' StartScan
- '<SYSTEM32>\apphostregistrationverifier.exe'
- '<SYSTEM32>\regsvr32.exe' /s <Полный путь к файлу>
