Техническая информация
Вредоносные функции
Запускает на исполнение
- '%WINDIR%\syswow64\taskkill.exe' /f /im "ytd.exe"
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\rarsfx0\ytdsetup.exe
- %TEMP%\etilqs_tsecgdvtypymfzh
- %TEMP%\etilqs_do4mnhdfxlbd5df
- %TEMP%\etilqs_lq3seqdzm23vrzi
- %TEMP%\etilqs_xvupsrsjhlu1qen
- %TEMP%\etilqs_qewo88j9na7ii6j
- %TEMP%\etilqs_ghjvgzolcchmppb
- %ProgramFiles(x86)%\azureus software\ytd video downloader\ytd.exe
- %ProgramFiles(x86)%\azureus software\ytd video downloader\unins000.dat
- C:\users\public\desktop\ytd video downloader.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\ytd video downloader\uninstall ytd video downloader.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\ytd video downloader\ytd video downloader.lnk
- %ProgramFiles(x86)%\azureus software\ytd video downloader\is-eads0.tmp
- %ProgramFiles(x86)%\azureus software\ytd video downloader\is-57fed.tmp
- %ProgramFiles(x86)%\azureus software\ytd video downloader\is-r01kb.tmp
- %ProgramFiles(x86)%\azureus software\ytd video downloader\is-e5nsc.tmp
- %ProgramFiles(x86)%\azureus software\ytd video downloader\is-5t7de.tmp
- %ProgramFiles(x86)%\azureus software\ytd video downloader\is-1679m.tmp
- %ALLUSERSPROFILE%\ytd video downloader\is-13f8q.tmp
- %ProgramFiles(x86)%\azureus software\ytd video downloader\is-lr1g9.tmp
- %ProgramFiles(x86)%\azureus software\ytd video downloader\is-or857.tmp
- %ProgramFiles(x86)%\azureus software\ytd video downloader\is-26rm8.tmp
- %ProgramFiles(x86)%\azureus software\ytd video downloader\is-iusgn.tmp
- %ProgramFiles(x86)%\azureus software\ytd video downloader\is-v9ro2.tmp
- %ProgramFiles(x86)%\azureus software\ytd video downloader\is-535ai.tmp
- %ProgramFiles(x86)%\azureus software\ytd video downloader\is-qns2a.tmp
- %TEMP%\is-bhnla.tmp\_isetup\_setup64.tmp
- %TEMP%\is-j19tq.tmp\ytdsetup.tmp
- %TEMP%\rarsfx0\replace.exe
- %TEMP%\rarsfx0\cybermania.url
- %TEMP%\etilqs_otzwruopoblsttj
- %TEMP%\etilqs_phmyy0utfcp6tuu
Удаляет следующие файлы
- %TEMP%\is-bhnla.tmp\_isetup\_setup64.tmp
- %TEMP%\is-j19tq.tmp\ytdsetup.tmp
Перемещает следующие файлы
- %ProgramFiles(x86)%\azureus software\ytd video downloader\is-qns2a.tmp в %ProgramFiles(x86)%\azureus software\ytd video downloader\unins000.exe
- %ProgramFiles(x86)%\azureus software\ytd video downloader\is-535ai.tmp в %ProgramFiles(x86)%\azureus software\ytd video downloader\ytd.exe
- %ProgramFiles(x86)%\azureus software\ytd video downloader\is-v9ro2.tmp в %ProgramFiles(x86)%\azureus software\ytd video downloader\newtonsoft.json.dll
- %ProgramFiles(x86)%\azureus software\ytd video downloader\is-iusgn.tmp в %ProgramFiles(x86)%\azureus software\ytd video downloader\newtonsoft.json.xml
- %ProgramFiles(x86)%\azureus software\ytd video downloader\is-26rm8.tmp в %ProgramFiles(x86)%\azureus software\ytd video downloader\system.valuetuple.dll
- %ProgramFiles(x86)%\azureus software\ytd video downloader\is-or857.tmp в %ProgramFiles(x86)%\azureus software\ytd video downloader\system.valuetuple.xml
- %ProgramFiles(x86)%\azureus software\ytd video downloader\is-lr1g9.tmp в %ProgramFiles(x86)%\azureus software\ytd video downloader\ytd.exe.config
- %ALLUSERSPROFILE%\ytd video downloader\is-13f8q.tmp в %ALLUSERSPROFILE%\ytd video downloader\yt-dlp.exe
- %ProgramFiles(x86)%\azureus software\ytd video downloader\is-1679m.tmp в %ProgramFiles(x86)%\azureus software\ytd video downloader\ffmpeg.exe
- %ProgramFiles(x86)%\azureus software\ytd video downloader\is-5t7de.tmp в %ProgramFiles(x86)%\azureus software\ytd video downloader\manual.bat
- %ProgramFiles(x86)%\azureus software\ytd video downloader\is-e5nsc.tmp в %ProgramFiles(x86)%\azureus software\ytd video downloader\copying.apachev2
- %ProgramFiles(x86)%\azureus software\ytd video downloader\is-r01kb.tmp в %ProgramFiles(x86)%\azureus software\ytd video downloader\copying.lgplv2
- %ProgramFiles(x86)%\azureus software\ytd video downloader\is-57fed.tmp в %ProgramFiles(x86)%\azureus software\ytd video downloader\copying.lgplv3
- %ProgramFiles(x86)%\azureus software\ytd video downloader\is-eads0.tmp в %ProgramFiles(x86)%\azureus software\ytd video downloader\license
Сетевая активность
Подключается к
- 'yt####nloader.com':443
- 'x.##2.us':80
- 'au######te.geo.opera.com':80
- 'au######te.geo.opera.com':443
- 'google.com':80
- 'se####.yahoo.com':80
- 'du###uckgo.com':443
- 'bing.com':80
- 'am##on.com':80
- 'se####.yahoo.com':443
- 'en.###ipedia.org':80
- 'am##on.com':443
- 'en.###ipedia.org':443
TCP
Запросы HTTP GET
- http://x.##2.us/x.cer
- http://au######te.geo.opera.com/geolocation/
- http://www.google.com/favicon.ico
- http://se####.yahoo.com/favicon.ico
- http://www.bing.com/s/a/bing_p.ico
- http://www.am##on.com/favicon.ico
- http://en.###ipedia.org/favicon.ico
Другие
- 'yt####nloader.com':443
- 'au######te.geo.opera.com':443
- 'du###uckgo.com':443
- 'se####.yahoo.com':443
- 'am##on.com':443
- 'en.###ipedia.org':443
UDP
- DNS ASK yt####nloader.com
- DNS ASK x.##2.us
- DNS ASK google.com
- DNS ASK au######te.geo.opera.com
- DNS ASK se####.yahoo.com
- DNS ASK du###uckgo.com
- DNS ASK am##on.com
- DNS ASK bing.com
- DNS ASK bi##.#ikimedia.org
- DNS ASK en.###ipedia.org
Другое
Ищет следующие окна
- ClassName: 'EDIT' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'Opera_MessageWindow' WindowName: '%APPDATA%\Opera Software\Opera Stable'
Создает и запускает на исполнение
- '%TEMP%\rarsfx0\ytdsetup.exe' /silent
- '%TEMP%\is-j19tq.tmp\ytdsetup.tmp' /SL5="$A018A,24249263,950272,%TEMP%\RarSFX0\YTDSetup.exe" /silent
- '%ProgramFiles(x86)%\azureus software\ytd video downloader\ytd.exe'
- '%TEMP%\rarsfx0\replace.exe'
Запускает на исполнение
- '%ProgramFiles(x86)%\opera\launcher.exe' -noautoupdate -- "https://www.ytddownloader.com/thankyou.html?&isn=D331E31CA3214BBA9F9AC2C64E93DA0A&lang=1033&oldVer=&newVer=7.6.0.4&kt=PAD&pv=0"
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="3036.12.776665621\63531177" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="3036.11.1490616025\388271801" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="3036.10.594140282\1202630603" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="3036.9.1218775297\101936245" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="3036.8.322306955\382648716" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="3036.7.916591252\65058573" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' --type=utility --channel="3036.4.1380268207\890911170" --lang=en-US --no-sandbox --enable-proprietary-media-types-playback /prefetch:-645351001 /crash-reporter-parent-id=3572
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="3036.6.559236586\56132721" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="3036.5.445764042\2132298817" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="3036.4.1380268207\890911170" --lang=en-US --no-sandbox --enable-proprietary-media-types-playback /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=renderer --alt-high-dpi-setting=96 --disable-direct-npapi-requests --enable-deferred-image-decoding --lang=en-US --enable-proprietary-media-types-playback --extension-process --enable-we...
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=renderer --alt-high-dpi-setting=96 --disable-direct-npapi-requests --enable-deferred-image-decoding --lang=en-US --enable-proprietary-media-types-playback --disable-client-side-phishing-...
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=gpu-process --channel="2896.0.1566272699\1636296634" --enable-proprietary-media-types-playback --supports-dual-gpus=false --gpu-driver-bug-workarounds=1,19,42 --gpu-vendor-id=0x0000 --gp...
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=gpu-process --channel="3036.0.860742873\2129285595" --enable-proprietary-media-types-playback --supports-dual-gpus=false --gpu-driver-bug-workarounds=1,19,42 --gpu-vendor-id=0x0000 --gpu...
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' -noautoupdate --ran-launcher -- https://www.cybermania.ws/ /crash-reporter-parent-id=2896
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' -noautoupdate --ran-launcher -- https://www.cybermania.ws/
- '%ProgramFiles(x86)%\opera\launcher.exe' -noautoupdate -- "https://www.cybermania.ws/"
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' -noautoupdate --ran-launcher -- https://www.ytddownloader.com/thankyou.html?&isn=D331E31CA3214BBA9F9AC2C64E93DA0A&lang=1033&oldVer=&newVer=7.6.0.4&kt=PAD&pv=0 /crash-reporter-parent-id=3036
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' -noautoupdate --ran-launcher -- https://www.ytddownloader.com/thankyou.html?&isn=D331E31CA3214BBA9F9AC2C64E93DA0A&lang=1033&oldVer=&newVer=7.6.0.4&kt=PAD&pv=0
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="3036.16.301653694\1737575984" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="3036.17.1261655058\2021112392" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
