Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Internet Explorer\Extensions\{5C3853CF-C7E0-4946-B3FA-1ABDB6F48108}] 'ClsidExtension' = '{5C3853CF-C7E0-4946-B3FA-1ABDB6F48108}'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'CdnCtr' = '%PROGRAM_FILES%\CNNIC\Cdn\cdnup.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'System' = '<SYSTEM32>\kernels32.exe'
Создает следующие сервисы:
- [<HKCU>\SYSTEM\CurrentControlSet\Services\F9CF678E] 'ImagePath' = '<SYSTEM32>\F9CF678E.EXE -service'
- [<HKLM>\SYSTEM\ControlSet001\Services\acpidisk] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\F9CF678E] 'ImagePath' = '<SYSTEM32>\F9CF678E.EXE -service'
- [<HKLM>\SYSTEM\ControlSet001\Services\cdnprot] 'start' = '00000000'
- [<HKLM>\SYSTEM\ControlSet001\Services\F9CF678E] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- <SYSTEM32>\F9CF678E.EXE -service
- %TEMP%\yaku0051.exe
- %TEMP%\9\setup.exe 00010802
- %ALLUSERSPROFILE%\Templates\temp.exe
- %TEMP%\181.exe 7004
- %TEMP%\dodolook004.exe
- %TEMP%\bind_50220.exe
- %TEMP%\setup0319.exe
- %TEMP%\win32.exe
- %ALLUSERSPROFILE%\Templates\temp.exe (загружен из сети Интернет)
Запускает на исполнение:
- <SYSTEM32>\ntvdm.exe -f -i3
- <SYSTEM32>\ntvdm.exe -f -i2
- <SYSTEM32>\ntvdm.exe -f -i4
- <SYSTEM32>\ntvdm.exe -f -i6
- <SYSTEM32>\ntvdm.exe -f -i5
- <SYSTEM32>\cmd.exe /c <SYSTEM32>\delme.bat
- <SYSTEM32>\netsh.exe firewall set allowedprogram '%TEMP%\win32.exe' enable
- <SYSTEM32>\regsvr32.exe /u /s "%PROGRAM_FILES%\SearchNet\SNHpr.dll"
- <SYSTEM32>\ntvdm.exe -f -i1
- <SYSTEM32>\regsvr32.exe /u /s "%PROGRAM_FILES%\Huaci\Huaci\SearchM.dll"
Внедряет код в
следующие системные процессы:
- %WINDIR%\Explorer.EXE
- <SYSTEM32>\winlogon.exe
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\1.dllb
- %PROGRAM_FILES%\CNNIC\Cdn\cdnforie.dll
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\null[1].jpg
- %PROGRAM_FILES%\CNNIC\Cdn\cdnuplib.dll
- %PROGRAM_FILES%\CNNIC\Cdn\cdnsign.dll
- %TEMP%\5.dllb
- <SYSTEM32>\dlh9jkd1q5.exe
- <SYSTEM32>\dlh9jkd1q2.exe
- <SYSTEM32>\dlh9jkd1q1.exe
- %TEMP%\2.dllb
- %PROGRAM_FILES%\CNNIC\Cdn\cdnup.exe
- %TEMP%\9\src.dat
- %TEMP%\src.tmp
- %TEMP%\9\setup.exe
- %TEMP%\9\cdnvers.dat
- %TEMP%\9\idnconvs.dll
- %PROGRAM_FILES%\CNNIC\Cdn\src.dat
- %PROGRAM_FILES%\CNNIC\Cdn\cdnaux.dll
- %PROGRAM_FILES%\CNNIC\Cdn\cdnunins.exe
- %PROGRAM_FILES%\CNNIC\Cdn\idnconvs.dll
- %PROGRAM_FILES%\CNNIC\Cdn\cdnvers.dat
- %WINDIR%\Temp\scsF.tmp
- %WINDIR%\Temp\scs10.tmp
- <SYSTEM32>\vx.tll
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\adv114[1].php
- %TEMP%\3.dllb
- %WINDIR%\Temp\scs14.tmp
- %WINDIR%\Temp\scs15.tmp
- %WINDIR%\Temp\scs13.tmp
- %WINDIR%\Temp\scs11.tmp
- %WINDIR%\Temp\scs12.tmp
- %WINDIR%\Temp\scsE.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\proxy[1].jpg
- %TEMP%\7.dllb
- <SYSTEM32>\dlh9jkd1q6.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\tool[1].jpg
- %TEMP%\6.dllb
- %WINDIR%\Temp\scsC.tmp
- %WINDIR%\Temp\scsD.tmp
- %WINDIR%\Temp\scsB.tmp
- <SYSTEM32>\dlh9jkd1q7.exe
- %WINDIR%\Temp\scsA.tmp
- <SYSTEM32>\dlh9jkd1q8.exe
- <SYSTEM32>\delme.bat
- %TEMP%\acpidisk.sys
- %TEMP%\DoSSSetup.dll
- <SYSTEM32>\kernels32.exe
- <SYSTEM32>\F9CF678E.DLL
- <SYSTEM32>\mprmsgse.axz
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\barsetup[1]
- <DRIVERS>\acpidisk.sys
- <SYSTEM32>\winlib .dll
- %TEMP%\nsl6.tmp\System.dll
- %TEMP%\win32.exe
- %TEMP%\setup0319.exe
- %TEMP%\dodolook004.exe
- %TEMP%\nsz2.tmp
- %TEMP%\bind_50220.exe
- %TEMP%\hkrxg
- <SYSTEM32>\F9CF678E.EXE
- %TEMP%\181.exe
- %TEMP%\yaku0051.exe
- %TEMP%\nsp4.tmp\System.dll
- %TEMP%\9\cdnprot.dat
- %TEMP%\9\cdnprot.sys
- %TEMP%\9\cdnprh.dll
- %TEMP%\4.dllb
- %TEMP%\9\cdnins.dll
- %TEMP%\9\cdnuplib.dll
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\ew4t54th3t456wt34567[1].php
- %TEMP%\9\cdnup.exe
- %TEMP%\9\cdnsign.dll
- %TEMP%\9\cdnunins.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\adload[1].php
- <SYSTEM32>\s1350980187g.dat
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\setup_yaku_0051[1].txt
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\update[1].txt
- %ALLUSERSPROFILE%\Templates\temp.exe
- %TEMP%\afx8.tmp
- %TEMP%\9\cdnaux.dll
- %TEMP%\9\cdnforie.dll
- %TEMP%\9\cdn.dll
- <SYSTEM32>\s1350980187h.dat
- %TEMP%\h5fvhcjs.dll
Удаляет следующие файлы:
- %WINDIR%\Temp\scsD.tmp
- %WINDIR%\Temp\scsB.tmp
- %WINDIR%\Temp\scsE.tmp
- %WINDIR%\Temp\scsC.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\tool[1].jpg
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\proxy[1].jpg
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\adv114[1].php
- %WINDIR%\Temp\scsA.tmp
- %WINDIR%\Temp\scs15.tmp
- %WINDIR%\Temp\scs10.tmp
- %WINDIR%\Temp\scs14.tmp
- %WINDIR%\Temp\scs12.tmp
- %WINDIR%\Temp\scsF.tmp
- %WINDIR%\Temp\scs11.tmp
- %WINDIR%\Temp\scs13.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\null[1].jpg
- %TEMP%\acpidisk.sys
- %TEMP%\DoSSSetup.dll
- %TEMP%\nsp4.tmp\System.dll
- %TEMP%\181.exe
- <SYSTEM32>\winlib .dll
- %TEMP%\nsl6.tmp\System.dll
- %TEMP%\yaku0051.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\barsetup[1]
- %TEMP%\h5fvhcjs.dll
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\adload[1].php
- %TEMP%\src.tmp
- %TEMP%\afx8.tmp
- %TEMP%\hkrxg
- <SYSTEM32>\s1350980187g.dat
- <SYSTEM32>\s1350980187h.dat
Сетевая активность:
Подключается к:
- 'gs.###system.com':80
- 'co###soft.net':80
- 'localhost':1044
- 'se###2.tqzn.com':80
- 'localhost':1037
- 'www.zh###ou8.com':80
TCP:
Запросы HTTP GET:
- co###soft.net/pic/null.jpg
- co###soft.net/ew4t54th3t456wt34567.php?ad###########################
- co###soft.net/pic/tool.jpg
- co###soft.net/34gfrfdsfghgretytrer5t65rerfgjh/adv114.php?ad####################################
- co###soft.net/pic/proxy.jpg
- www.zh###ou8.com/chajian//user/setup_yaku_0051.txt
- se###2.tqzn.com/barbindsoft/barsetup.exe?qu###########
- www.zh###ou8.com/chajian//update.txt
- co###soft.net/adv/114/adload.php?a1############################################################################################################################################################################
- gs.###system.com/gs.php?12##########################################################################################################################################
UDP:
- DNS ASK gs.###system.com
- DNS ASK co###soft.net
- DNS ASK se###2.tqzn.com
- DNS ASK www.zh###ou8.com
Другое:
Ищет следующие окна:
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-dc8.dd0.3c0006'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-db8.dbc.3b0002'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-df0.df4.3d0007'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-e08.e0c.3f0009'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-df8.e00.3e0008'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-dac.db4.3a0001'
- ClassName: '' WindowName: 'CdnHide'
- ClassName: 'Progman' WindowName: 'Program Manager'
- ClassName: '' WindowName: 'CdnUp'
- ClassName: '' WindowName: 'Chinese Navigation'
- ClassName: '' WindowName: 'Chinese Navigation Upgrade'
