Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Classes\engreader.erd\Shell\Open\Command] '' = '"%PROGRAM_FILES%\EngReader\engreader.exe" "%1"'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '·ЙСпУўУпФД¶БЖч' = '%PROGRAM_FILES%\EngReader\engreader.exe'
Вредоносные функции:
Создает и запускает на исполнение:
- '%PROGRAM_FILES%\EngReader\EngReader.exe'
- '%TEMP%\is-TSVD4.tmp\is-3RKLJ.tmp' /SL4 $40036 "<Полный путь к вирусу>" 1592762 52224
Изменения в файловой системе:
Создает следующие файлы:
- %ALLUSERSPROFILE%\Start Menu\Programs\·ЙСпУўУпФД¶БЖч 2012 Build 0701\·ЙСпУўУпФД¶БЖч 2012 Build 0701.lnk
- %PROGRAM_FILES%\EngReader\Readme.files\is-764NJ.tmp
- %ALLUSERSPROFILE%\Start Menu\Programs\·ЙСпУўУпФД¶БЖч 2012 Build 0701\·ЙСпУўУпФД¶БЖч 2012 Build 0701 НшХѕ.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\·ЙСпУўУпФД¶БЖч 2012 Build 0701\К№УГ°пЦъ.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\·ЙСпУўУпФД¶БЖч 2012 Build 0701\Р¶ФШ ·ЙСпУўУпФД¶БЖч 2012 Build 0701.lnk
- %PROGRAM_FILES%\EngReader\Readme.files\is-MHBRU.tmp
- %PROGRAM_FILES%\EngReader\Readme.files\is-SQP6J.tmp
- %PROGRAM_FILES%\EngReader\Readme.files\is-LMCSV.tmp
- %PROGRAM_FILES%\EngReader\Readme.files\is-D9LLU.tmp
- %PROGRAM_FILES%\EngReader\Readme.files\is-5PJOL.tmp
- %PROGRAM_FILES%\EngReader\Readme.files\is-HO6UR.tmp
- %HOMEPATH%\Desktop\·ЙСпУўУпФД¶БЖч 2012 Build 0701.lnk
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\index_468_60[1].htm
- %PROGRAM_FILES%\EngReader\article.dat
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\index_210_380[1].htm
- %PROGRAM_FILES%\EngReader\info.dat
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\index_120_60[1].htm
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\softcount[1]
- %PROGRAM_FILES%\EngReader\unins000.dat
- %PROGRAM_FILES%\EngReader\engreader.url
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\tuijian[1].htm
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\engpopup[1].htm
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\popup[1].htm
- %PROGRAM_FILES%\EngReader\Readme.files\is-HJMTB.tmp
- %PROGRAM_FILES%\EngReader\is-2K1RJ.tmp
- %PROGRAM_FILES%\EngReader\Readme.files\is-8JASD.tmp
- %PROGRAM_FILES%\EngReader\Readme.files\is-7LE88.tmp
- %PROGRAM_FILES%\EngReader\Readme.files\is-SMC70.tmp
- %PROGRAM_FILES%\EngReader\is-CLNBF.tmp
- %TEMP%\is-APL0H.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-TSVD4.tmp\is-3RKLJ.tmp
- %PROGRAM_FILES%\EngReader\is-GKKHQ.tmp
- %PROGRAM_FILES%\EngReader\is-KCEHT.tmp
- %PROGRAM_FILES%\EngReader\is-84CDE.tmp
- %PROGRAM_FILES%\EngReader\Readme.files\is-AK9BM.tmp
- %PROGRAM_FILES%\EngReader\Readme.files\is-VPF2P.tmp
- %PROGRAM_FILES%\EngReader\Readme.files\is-HTIT9.tmp
- %PROGRAM_FILES%\EngReader\Readme.files\is-7RI8H.tmp
- %PROGRAM_FILES%\EngReader\Readme.files\is-VUT93.tmp
- %PROGRAM_FILES%\EngReader\Readme.files\is-29POJ.tmp
- %PROGRAM_FILES%\EngReader\Readme.files\is-TJT6Q.tmp
- %PROGRAM_FILES%\EngReader\Readme.files\is-87ORS.tmp
- %PROGRAM_FILES%\EngReader\Readme.files\is-O5DF6.tmp
- %PROGRAM_FILES%\EngReader\Readme.files\is-SMC3I.tmp
- %PROGRAM_FILES%\EngReader\Readme.files\is-JBHFV.tmp
- %PROGRAM_FILES%\EngReader\Readme.files\is-TTNJ8.tmp
Удаляет следующие файлы:
- %TEMP%\is-TSVD4.tmp\is-3RKLJ.tmp
- %TEMP%\is-APL0H.tmp\_isetup\_shfoldr.dll
- %PROGRAM_FILES%\EngReader\engreader.exe
Перемещает следующие файлы:
- %PROGRAM_FILES%\EngReader\Readme.files\is-7RI8H.tmp в %PROGRAM_FILES%\EngReader\Readme.files\image013.jpg
- %PROGRAM_FILES%\EngReader\Readme.files\is-29POJ.tmp в %PROGRAM_FILES%\EngReader\Readme.files\image014.jpg
- %PROGRAM_FILES%\EngReader\Readme.files\is-VUT93.tmp в %PROGRAM_FILES%\EngReader\Readme.files\image015.jpg
- %PROGRAM_FILES%\EngReader\Readme.files\is-VPF2P.tmp в %PROGRAM_FILES%\EngReader\Readme.files\image012.jpg
- %PROGRAM_FILES%\EngReader\Readme.files\is-JBHFV.tmp в %PROGRAM_FILES%\EngReader\Readme.files\image009.jpg
- %PROGRAM_FILES%\EngReader\Readme.files\is-TJT6Q.tmp в %PROGRAM_FILES%\EngReader\Readme.files\image010.jpg
- %PROGRAM_FILES%\EngReader\Readme.files\is-HTIT9.tmp в %PROGRAM_FILES%\EngReader\Readme.files\image011.jpg
- %PROGRAM_FILES%\EngReader\Readme.files\is-5PJOL.tmp в %PROGRAM_FILES%\EngReader\Readme.files\image020.jpg
- %PROGRAM_FILES%\EngReader\Readme.files\is-MHBRU.tmp в %PROGRAM_FILES%\EngReader\Readme.files\image021.jpg
- %PROGRAM_FILES%\EngReader\Readme.files\is-764NJ.tmp в %PROGRAM_FILES%\EngReader\Readme.files\image022.jpg
- %PROGRAM_FILES%\EngReader\Readme.files\is-HO6UR.tmp в %PROGRAM_FILES%\EngReader\Readme.files\image019.jpg
- %PROGRAM_FILES%\EngReader\Readme.files\is-LMCSV.tmp в %PROGRAM_FILES%\EngReader\Readme.files\image016.jpg
- %PROGRAM_FILES%\EngReader\Readme.files\is-SQP6J.tmp в %PROGRAM_FILES%\EngReader\Readme.files\image017.jpg
- %PROGRAM_FILES%\EngReader\Readme.files\is-D9LLU.tmp в %PROGRAM_FILES%\EngReader\Readme.files\image018.jpg
- %PROGRAM_FILES%\EngReader\is-2K1RJ.tmp в %PROGRAM_FILES%\EngReader\Readme.htm
- %PROGRAM_FILES%\EngReader\Readme.files\is-HJMTB.tmp в %PROGRAM_FILES%\EngReader\Readme.files\filelist.xml
- %PROGRAM_FILES%\EngReader\Readme.files\is-8JASD.tmp в %PROGRAM_FILES%\EngReader\Readme.files\image001.jpg
- %PROGRAM_FILES%\EngReader\is-CLNBF.tmp в %PROGRAM_FILES%\EngReader\License.txt
- %PROGRAM_FILES%\EngReader\is-GKKHQ.tmp в %PROGRAM_FILES%\EngReader\unins000.exe
- %PROGRAM_FILES%\EngReader\is-84CDE.tmp в %PROGRAM_FILES%\EngReader\engreader.exe
- %PROGRAM_FILES%\EngReader\is-KCEHT.tmp в %PROGRAM_FILES%\EngReader\EngReader.exe
- %PROGRAM_FILES%\EngReader\Readme.files\is-87ORS.tmp в %PROGRAM_FILES%\EngReader\Readme.files\image006.jpg
- %PROGRAM_FILES%\EngReader\Readme.files\is-SMC3I.tmp в %PROGRAM_FILES%\EngReader\Readme.files\image007.jpg
- %PROGRAM_FILES%\EngReader\Readme.files\is-TTNJ8.tmp в %PROGRAM_FILES%\EngReader\Readme.files\image008.jpg
- %PROGRAM_FILES%\EngReader\Readme.files\is-O5DF6.tmp в %PROGRAM_FILES%\EngReader\Readme.files\image005.jpg
- %PROGRAM_FILES%\EngReader\Readme.files\is-SMC70.tmp в %PROGRAM_FILES%\EngReader\Readme.files\image002.jpg
- %PROGRAM_FILES%\EngReader\Readme.files\is-7LE88.tmp в %PROGRAM_FILES%\EngReader\Readme.files\image003.jpg
- %PROGRAM_FILES%\EngReader\Readme.files\is-AK9BM.tmp в %PROGRAM_FILES%\EngReader\Readme.files\image004.jpg
Сетевая активность:
Подключается к:
- 'en######r.feiyang163.com':80
- 'ad####.unadnet.com.cn':80
- 'localhost':1035
TCP:
Запросы HTTP GET:
- en######r.feiyang163.com/softinfo/index_210_380.htm
- en######r.feiyang163.com/softinfo/index_468_60.htm
- en######r.feiyang163.com/softinfo/info.htm
- en######r.feiyang163.com/softinfo/index_120_60.htm
- en######r.feiyang163.com/softinfo/article.htm
- ad####.unadnet.com.cn/ad/softad/popup.htm
- ad####.unadnet.com.cn/ad/softad/tuijian.htm
- ad####.unadnet.com.cn/count/softcount/?En#######
- ad####.unadnet.com.cn/ad/softad/engpopup.htm
UDP:
- DNS ASK en######r.feiyang163.com
- DNS ASK ad####.unadnet.com.cn
Другое:
Ищет следующие окна:
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'CicLoaderWndClass' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'IEFrame' WindowName: ''
