Техническая информация
Для обеспечения автозапуска и распространения
Устанавливает следующие настройки сервисов
- [<HKLM>\System\CurrentControlSet\Services\LdBoxDrv] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\LdBoxDrv] 'ImagePath' = '%ProgramFiles%\dnplayerext2\LdBoxDrv.sys'
Создает следующие сервисы
- 'LdBoxDrv' %ProgramFiles%\dnplayerext2\LdBoxDrv.sys
Вредоносные функции
Запускает на исполнение
- '%WINDIR%\syswow64\taskkill.exe' /F /IM LdBoxHeadless.exe /T
- '%WINDIR%\syswow64\taskkill.exe' /F /IM LdBoxSVC.exe /T
- '%WINDIR%\syswow64\taskkill.exe' /F /IM VirtualBox.exe /T
- '%WINDIR%\syswow64\taskkill.exe' /F /IM VBoxManage.exe /T
Изменения в файловой системе
Создает следующие файлы
- <Текущая директория>\vms\config\leidian0.config
- %ProgramFiles%\dnplayerext2\vboxmanage.exe
- %ProgramFiles%\dnplayerext2\vboxinstallhelper.dll
- %ProgramFiles%\dnplayerext2\vboxhostchannel.dll
- %ProgramFiles%\dnplayerext2\vboxguestpropsvc.dll
- %ProgramFiles%\dnplayerext2\vboxguestcontrolsvc.dll
- %ProgramFiles%\dnplayerext2\vboxextpackhelperapp.exe
- %ProgramFiles%\dnplayerext2\vboxdtrace.exe
- %ProgramFiles%\dnplayerext2\vboxdraganddropsvc.dll
- %ProgramFiles%\dnplayerext2\vboxddu.dll
- %ProgramFiles%\dnplayerext2\vboxdd2.dll
- %ProgramFiles%\dnplayerext2\vboxdd.dll
- %ProgramFiles%\dnplayerext2\vboxdbg.dll
- %ProgramFiles%\dnplayerext2\vboxcpureport.exe
- %ProgramFiles%\dnplayerext2\vboxcapi.dll
- %ProgramFiles%\dnplayerext2\vboxc.dll
- %ProgramFiles%\dnplayerext2\vboxbugreport.exe
- %ProgramFiles%\dnplayerext2\vboxballoonctrl.exe
- %ProgramFiles%\dnplayerext2\vboxautostartsvc.exe
- %ProgramFiles%\dnplayerext2\vboxauthsimple.dll
- %ProgramFiles%\dnplayerext2\vboxauth.dll
- %ProgramFiles%\dnplayerext2\vbox-img.exe
- %ProgramFiles%\dnplayerext2\usbuninstall.exe
- %ProgramFiles%\dnplayerext2\usbtest.exe
- %ProgramFiles%\dnplayerext2\usbinstall.exe
- %ProgramFiles%\dnplayerext2\supuninstall.exe
- %ProgramFiles%\dnplayerext2\vboxnetdhcp.exe
- %ProgramFiles%\dnplayerext2\vboxnetfltnobj.dll
- %ProgramFiles%\dnplayerext2\vboxnetnat.exe
- %ProgramFiles%\dnplayerext2\vboxoglhostcrutil.dll
- %ProgramFiles%\dnplayerext2\x86\vboxproxystub-x86.dll
- %ProgramFiles%\dnplayerext2\x86\vboxclient-x86.dll
- %ProgramFiles%\dnplayerext2\x86\ssleay32.dll
- %ProgramFiles%\dnplayerext2\x86\msvcr120.dll
- %ProgramFiles%\dnplayerext2\x86\msvcr100.dll
- %ProgramFiles%\dnplayerext2\x86\msvcp120.dll
- %ProgramFiles%\dnplayerext2\x86\msvcp100.dll
- %ProgramFiles%\dnplayerext2\x86\libeay32.dll
- %ProgramFiles%\dnplayerext2\x86\libcurl.dll
- %ProgramFiles%\dnplayerext2\virtualbox.exe
- %ProgramFiles%\dnplayerext2\vboxvmmpreload.exe
- %ProgramFiles%\dnplayerext2\vboxvmm.dll
- %ProgramFiles%\dnplayerext2\vboxsvga3d.dll
- %ProgramFiles%\dnplayerext2\vboxtestogl.exe
- %ProgramFiles%\dnplayerext2\vboxsuplib.dll
- %ProgramFiles%\dnplayerext2\vboxsharedfolders.dll
- %ProgramFiles%\dnplayerext2\vboxsharedcropengl.dll
- %ProgramFiles%\dnplayerext2\vboxsharedclipboard.dll
- %ProgramFiles%\dnplayerext2\vboxsdl.exe
- %ProgramFiles%\dnplayerext2\vboxrt.dll
- %ProgramFiles%\dnplayerext2\vboxres.dll
- %ProgramFiles%\dnplayerext2\vboxrem.dll
- %ProgramFiles%\dnplayerext2\vboxproxystublegacy.dll
- %ProgramFiles%\dnplayerext2\vboxproxystub.dll
- %ProgramFiles%\dnplayerext2\vboxoglrenderspu.dll
- %ProgramFiles%\dnplayerext2\vboxoglhosterrorspu.dll
- %ProgramFiles%\dnplayerext2\x86\vboxrt-x86.dll
- %ProgramFiles%\dnplayerext2\suploggerctl.exe
- %ProgramFiles%\dnplayerext2\supinstall.exe
- %ProgramFiles%\dnplayerext2\ssleay32.dll
- %ProgramFiles%\dnplayerext2\ldboxdrv.sys
- %ProgramFiles%\dnplayerext2\dpinst_86.exe
- %ProgramFiles%\dnplayerext2\dpinst_64.exe
- %ProgramFiles%\dnplayerext2\dbgplugindiggers.dll
- %ProgramFiles%\dnplayerext2\vboxefi64.fd
- %ProgramFiles%\dnplayerext2\vboxefi32.fd
- %ProgramFiles%\dnplayerext2\uninstall.bat
- %ProgramFiles%\dnplayerext2\tstmicrorc.gc
- %ProgramFiles%\dnplayerext2\loadall.sh
- %ProgramFiles%\dnplayerext2\loadall.cmd
- %ProgramFiles%\dnplayerext2\load.sh
- %ProgramFiles%\dnplayerext2\load.cmd
- %ProgramFiles%\dnplayerext2\ldvmmrc.rc
- %ProgramFiles%\dnplayerext2\ldvmmr0.r0
- %ProgramFiles%\dnplayerext2\ldboxnetlwf.inf
- %ProgramFiles%\dnplayerext2\ldboxnetlwf.cat
- %ProgramFiles%\dnplayerext2\ldboxdrv.inf
- %ProgramFiles%\dnplayerext2\ldboxdrv.cat
- %ProgramFiles%\dnplayerext2\ldboxddrc.rc
- %ProgramFiles%\dnplayerext2\ldboxddr0.r0
- %ProgramFiles%\dnplayerext2\ldboxdd2rc.rc
- %ProgramFiles%\dnplayerext2\ldboxdd2r0.r0
- %ProgramFiles%\dnplayerext2\install.bat
- %ProgramFiles%\dnplayerext2\comregister.cmd
- %APPDATA%\changzhi2\log\dnrepairer.log
- %ProgramFiles%\dnplayerext2\ldboxheadless.exe
- %ProgramFiles%\dnplayerext2\ldboxnetlwf.sys
- %ProgramFiles%\dnplayerext2\ldboxsvc.exe
- %ProgramFiles%\dnplayerext2\ldvirtualbox.exe
- %ProgramFiles%\dnplayerext2\regsvr32_x86.exe
- %ProgramFiles%\dnplayerext2\regsvr32_x64.exe
- %ProgramFiles%\dnplayerext2\regsvc.dll
- %ProgramFiles%\dnplayerext2\qt5winextras.dll
- %ProgramFiles%\dnplayerext2\qt5widgets.dll
- %ProgramFiles%\dnplayerext2\qt5printsupport.dll
- %ProgramFiles%\dnplayerext2\qt5opengl.dll
- %ProgramFiles%\dnplayerext2\qt5gui.dll
- %ProgramFiles%\dnplayerext2\qt5core.dll
- %ProgramFiles%\dnplayerext2\platforms\qwindows.dll
- %ProgramFiles%\dnplayerext2\platforms\qoffscreen.dll
- %ProgramFiles%\dnplayerext2\platforms\qminimal.dll
- %ProgramFiles%\dnplayerext2\netlwfinstall.exe
- %ProgramFiles%\dnplayerext2\netlwfuninstall.exe
- %ProgramFiles%\dnplayerext2\netfltuninstall.exe
- %ProgramFiles%\dnplayerext2\netfltinstall.exe
- %ProgramFiles%\dnplayerext2\netadpuninstall.exe
- %ProgramFiles%\dnplayerext2\netadpinstall.exe
- %ProgramFiles%\dnplayerext2\netadp6uninstall.exe
- %ProgramFiles%\dnplayerext2\netadp6install.exe
- %ProgramFiles%\dnplayerext2\msvcr120.dll
- %ProgramFiles%\dnplayerext2\msvcr100.dll
- %ProgramFiles%\dnplayerext2\msvcp120.dll
- %ProgramFiles%\dnplayerext2\msvcp100.dll
- %ProgramFiles%\dnplayerext2\libeay32.dll
- %ProgramFiles%\dnplayerext2\libcurl.dll
- %ProgramFiles%\dnplayerext2\sdl.dll
- %WINDIR%\temp\uddde2e.tmp
Удаляет следующие файлы
- %WINDIR%\temp\uddde2e.tmp
Другое
Ищет следующие окна
- ClassName: '' WindowName: ''
Создает и запускает на исполнение
- '%ProgramFiles%\dnplayerext2\ldboxsvc.exe' /RegServer
- '%WINDIR%\syswow64\net.exe' start cryptsvc' (со скрытым окном)
- '%WINDIR%\syswow64\regsvr32.exe' "%ProgramFiles%\dnplayerext2\x86\VBoxProxyStub-x86.dll" /s' (со скрытым окном)
- '<SYSTEM32>\regsvr32.exe' "%ProgramFiles%\dnplayerext2\VBoxProxyStub.dll" /s' (со скрытым окном)
- '%WINDIR%\syswow64\regsvr32.exe' "%ProgramFiles%\dnplayerext2\x86\VBoxClient-x86.dll" /s' (со скрытым окном)
- '<SYSTEM32>\regsvr32.exe' "%ProgramFiles%\dnplayerext2\VBoxC.dll" /s' (со скрытым окном)
- '%ProgramFiles%\dnplayerext2\ldboxsvc.exe' /RegServer' (со скрытым окном)
- '%WINDIR%\syswow64\taskkill.exe' /F /IM VBoxManage.exe /T' (со скрытым окном)
- '%WINDIR%\syswow64\taskkill.exe' /F /IM VirtualBox.exe /T' (со скрытым окном)
- '%WINDIR%\syswow64\taskkill.exe' /F /IM LdBoxSVC.exe /T' (со скрытым окном)
- '%WINDIR%\syswow64\taskkill.exe' /F /IM LdBoxHeadless.exe /T' (со скрытым окном)
- '%WINDIR%\syswow64\icacls.exe' "<Текущая директория>\vms" /grant *S-1-1-0:F *S-1-5-7:F /t' (со скрытым окном)
- '%WINDIR%\syswow64\icacls.exe' "<Текущая директория>\vms" /grant everyone:F /t' (со скрытым окном)
- '%WINDIR%\syswow64\takeown.exe' /f "<Текущая директория>\vms" /r /d y' (со скрытым окном)
- '%WINDIR%\syswow64\regsvr32.exe' cryptdlg.dll /s' (со скрытым окном)
- '%WINDIR%\syswow64\regsvr32.exe' rsaenh.dll /s' (со скрытым окном)
- '%WINDIR%\syswow64\regsvr32.exe' dssenh.dll /s' (со скрытым окном)
- '%WINDIR%\syswow64\regsvr32.exe' Initpki.dll /s' (со скрытым окном)
- '%WINDIR%\syswow64\regsvr32.exe' Wintrust.dll /s' (со скрытым окном)
- '%WINDIR%\syswow64\regsvr32.exe' Softpub.dll /s' (со скрытым окном)
- '%WINDIR%\syswow64\sc.exe' create LdBoxDrv binPath= "%ProgramFiles%\dnplayerext2\LdBoxDrv.sys" type= kernel start= auto' (со скрытым окном)
- '%WINDIR%\syswow64\sc.exe' start LdBoxDrv' (со скрытым окном)
Запускает на исполнение
- '%WINDIR%\syswow64\net.exe' start cryptsvc
- '%WINDIR%\syswow64\regsvr32.exe' "%ProgramFiles%\dnplayerext2\x86\VBoxProxyStub-x86.dll" /s
- '<SYSTEM32>\regsvr32.exe' "%ProgramFiles%\dnplayerext2\VBoxProxyStub.dll" /s
- '%WINDIR%\syswow64\regsvr32.exe' "%ProgramFiles%\dnplayerext2\x86\VBoxClient-x86.dll" /s
- '<SYSTEM32>\regsvr32.exe' "%ProgramFiles%\dnplayerext2\VBoxC.dll" /s
- '%WINDIR%\syswow64\icacls.exe' "<Текущая директория>\vms" /grant *S-1-1-0:F *S-1-5-7:F /t
- '%WINDIR%\syswow64\icacls.exe' "<Текущая директория>\vms" /grant everyone:F /t
- '%WINDIR%\syswow64\sc.exe' create LdBoxDrv binPath= "%ProgramFiles%\dnplayerext2\LdBoxDrv.sys" type= kernel start= auto
- '%WINDIR%\syswow64\takeown.exe' /f "<Текущая директория>\vms" /r /d y
- '%WINDIR%\syswow64\regsvr32.exe' rsaenh.dll /s
- '%WINDIR%\syswow64\regsvr32.exe' dssenh.dll /s
- '%WINDIR%\syswow64\regsvr32.exe' Initpki.dll /s
- '%WINDIR%\syswow64\regsvr32.exe' Wintrust.dll /s
- '%WINDIR%\syswow64\regsvr32.exe' Softpub.dll /s
- '%WINDIR%\syswow64\net1.exe' start cryptsvc
- '%WINDIR%\syswow64\regsvr32.exe' cryptdlg.dll /s
- '%WINDIR%\syswow64\sc.exe' start LdBoxDrv
