Техническая информация
Для обеспечения автозапуска и распространения
Модифицирует следующие ключи реестра
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{20FB558F-6564-4bb3-96C5-D7886995A08A}] 'ClsidExtension' = '{0A312C2D-D8FD-4ED9-9866-85699DD5D00D}'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'Huihui' = '%ProgramFiles(x86)%\Youdao\ShoppingAssistant\ie\3.0.5\huihui.exe start'
Вредоносные функции
Запускает на исполнение
- '%ProgramFiles(x86)%\internet explorer\iexplore.exe' http://zhushou.huihui.cn/installed?version=3.0.5&browser=ie&vendor=dictkunbang
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\nsr6114.tmp
- %ProgramFiles(x86)%\youdao\shoppingassistant\other\ohjkicjidmohhfcjjlahfppkdblibkkb\js\loader.js
- %ProgramFiles(x86)%\youdao\shoppingassistant\other\ohjkicjidmohhfcjjlahfppkdblibkkb\js\deprice-notify.js
- %ProgramFiles(x86)%\youdao\shoppingassistant\other\ohjkicjidmohhfcjjlahfppkdblibkkb\js\bg.js
- %ProgramFiles(x86)%\youdao\shoppingassistant\other\ohjkicjidmohhfcjjlahfppkdblibkkb\images\notify.mp3
- %ProgramFiles(x86)%\youdao\shoppingassistant\other\ohjkicjidmohhfcjjlahfppkdblibkkb\images\logo.png
- %ProgramFiles(x86)%\youdao\shoppingassistant\other\ohjkicjidmohhfcjjlahfppkdblibkkb\images\icon.png
- %ProgramFiles(x86)%\youdao\shoppingassistant\other\ohjkicjidmohhfcjjlahfppkdblibkkb\images\icon-huihui.png
- %ProgramFiles(x86)%\youdao\shoppingassistant\other\ohjkicjidmohhfcjjlahfppkdblibkkb\images\icon-19.png
- %ProgramFiles(x86)%\youdao\shoppingassistant\other\ohjkicjidmohhfcjjlahfppkdblibkkb\images\icon-128.png
- %ProgramFiles(x86)%\youdao\shoppingassistant\other\ohjkicjidmohhfcjjlahfppkdblibkkb\images\huihuigwzs_sp.png
- %ProgramFiles(x86)%\youdao\shoppingassistant\other\ohjkicjidmohhfcjjlahfppkdblibkkb\images\help_hover.png
- %ProgramFiles(x86)%\youdao\shoppingassistant\other\ohjkicjidmohhfcjjlahfppkdblibkkb\images\help.png
- %ProgramFiles(x86)%\youdao\shoppingassistant\other\ohjkicjidmohhfcjjlahfppkdblibkkb\images\feedback_hover.png
- %ProgramFiles(x86)%\youdao\shoppingassistant\other\ohjkicjidmohhfcjjlahfppkdblibkkb\images\feedback.png
- %ProgramFiles(x86)%\youdao\shoppingassistant\other\ohjkicjidmohhfcjjlahfppkdblibkkb\images\discount_hover.png
- %ProgramFiles(x86)%\youdao\shoppingassistant\other\ohjkicjidmohhfcjjlahfppkdblibkkb\js\log.js
- %ProgramFiles(x86)%\youdao\shoppingassistant\other\ohjkicjidmohhfcjjlahfppkdblibkkb\js\notifybtncontroller.js
- %APPDATA%\microsoft\windows\privacie\index.dat
- %ProgramFiles(x86)%\youdao\shoppingassistant\other\ohjkicjidmohhfcjjlahfppkdblibkkb\js\options.js
- %LOCALAPPDATA%\yodao\shopping\profile.ini
- %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\extensions\gouwuassistant@gouwu.youdao.com.xpi
- %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\extensions\gouwuassistant@gouwu.youdao.com.xpi
- %ProgramFiles(x86)%\youdao\shoppingassistant\other\manifest.json
- %ProgramFiles(x86)%\youdao\shoppingassistant\other\360chrome.json
- %ProgramFiles(x86)%\youdao\shoppingassistant\other\ohjkicjidmohhfcjjlahfppkdblibkkb\lib\underscore.js
- %ProgramFiles(x86)%\youdao\shoppingassistant\other\ohjkicjidmohhfcjjlahfppkdblibkkb\lib\require.js
- %ProgramFiles(x86)%\youdao\shoppingassistant\other\ohjkicjidmohhfcjjlahfppkdblibkkb\lib\jquery.js
- %ProgramFiles(x86)%\youdao\shoppingassistant\other\ohjkicjidmohhfcjjlahfppkdblibkkb\lib\bootstrap.js
- %ProgramFiles(x86)%\youdao\shoppingassistant\other\ohjkicjidmohhfcjjlahfppkdblibkkb\lib\bootstrap.css
- %ProgramFiles(x86)%\youdao\shoppingassistant\other\ohjkicjidmohhfcjjlahfppkdblibkkb\js\tmpl.js
- %ProgramFiles(x86)%\youdao\shoppingassistant\other\ohjkicjidmohhfcjjlahfppkdblibkkb\js\popup.js
- %ProgramFiles(x86)%\youdao\shoppingassistant\other\ohjkicjidmohhfcjjlahfppkdblibkkb\js\ordernotifyutil.js
- %ProgramFiles(x86)%\youdao\shoppingassistant\other\ohjkicjidmohhfcjjlahfppkdblibkkb\js\order.js
- %ProgramFiles(x86)%\youdao\shoppingassistant\other\ohjkicjidmohhfcjjlahfppkdblibkkb\js\order-notification.js
- %ProgramFiles(x86)%\youdao\shoppingassistant\other\ohjkicjidmohhfcjjlahfppkdblibkkb\images\discount.png
- %ProgramFiles(x86)%\youdao\shoppingassistant\other\ohjkicjidmohhfcjjlahfppkdblibkkb\js\notification.js
- %ProgramFiles(x86)%\youdao\shoppingassistant\other\ohjkicjidmohhfcjjlahfppkdblibkkb\images\80-80.jpg
- %ProgramFiles(x86)%\youdao\shoppingassistant\other\ohjkicjidmohhfcjjlahfppkdblibkkb\bg.html
- %ProgramFiles(x86)%\youdao\shoppingassistant\other\youdaogouwu-3.0.6.crx
- %ProgramFiles(x86)%\youdao\shoppingassistant\other\youdaogouwu.xpi
- C:\users\public\desktop\惠惠网-桌面版.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\有道\惠惠购物助手\卸载惠惠购物助手.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\有道\惠惠购物助手\功能介绍.url
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\有道\惠惠购物助手\启动惠惠购物助手.lnk
- %ProgramFiles(x86)%\youdao\shoppingassistant\ie\3.0.5\uninst.exe
- %ProgramFiles(x86)%\youdao\shoppingassistant\ie\3.0.5\youdaoassistant.tlb
- %ProgramFiles(x86)%\youdao\shoppingassistant\ie\3.0.5\youdaoassistant.dll
- %ProgramFiles(x86)%\youdao\shoppingassistant\ie\3.0.5\monitor.exe
- %ProgramFiles(x86)%\youdao\shoppingassistant\ie\3.0.5\installassistant.exe
- %ProgramFiles(x86)%\youdao\shoppingassistant\ie\3.0.5\huihui.exe
- %ProgramFiles(x86)%\youdao\shoppingassistant\ie\3.0.5\formbk_shadow.png
- %ProgramFiles(x86)%\youdao\shoppingassistant\ie\3.0.5\crashrpt.dll
- %TEMP%\nsw6134.tmp\finishpage.ini
- %ProgramFiles(x86)%\youdao\shoppingassistant\other\youdaogouwu.mxaddon
- %ProgramFiles(x86)%\youdao\shoppingassistant\other\ohjkicjidmohhfcjjlahfppkdblibkkb\config.xml
- %ProgramFiles(x86)%\youdao\shoppingassistant\other\ohjkicjidmohhfcjjlahfppkdblibkkb\images\5.png
- %ProgramFiles(x86)%\youdao\shoppingassistant\other\ohjkicjidmohhfcjjlahfppkdblibkkb\deprice-notify.html
- %ProgramFiles(x86)%\youdao\shoppingassistant\other\ohjkicjidmohhfcjjlahfppkdblibkkb\images\4.png
- %ProgramFiles(x86)%\youdao\shoppingassistant\other\ohjkicjidmohhfcjjlahfppkdblibkkb\images\3.png
- %ProgramFiles(x86)%\youdao\shoppingassistant\other\ohjkicjidmohhfcjjlahfppkdblibkkb\images\2.png
- %ProgramFiles(x86)%\youdao\shoppingassistant\other\ohjkicjidmohhfcjjlahfppkdblibkkb\images\1.png
- %ProgramFiles(x86)%\youdao\shoppingassistant\other\ohjkicjidmohhfcjjlahfppkdblibkkb\css\popup.css
- %ProgramFiles(x86)%\youdao\shoppingassistant\other\ohjkicjidmohhfcjjlahfppkdblibkkb\css\options.css
- %ProgramFiles(x86)%\youdao\shoppingassistant\other\ohjkicjidmohhfcjjlahfppkdblibkkb\css\notification.css
- %ProgramFiles(x86)%\youdao\shoppingassistant\other\ohjkicjidmohhfcjjlahfppkdblibkkb\css\deprice-notify.css
- %ProgramFiles(x86)%\youdao\shoppingassistant\other\ohjkicjidmohhfcjjlahfppkdblibkkb\test-notify.html
- %ProgramFiles(x86)%\youdao\shoppingassistant\other\ohjkicjidmohhfcjjlahfppkdblibkkb\popup.html
- %ProgramFiles(x86)%\youdao\shoppingassistant\other\ohjkicjidmohhfcjjlahfppkdblibkkb\order.json
- %ProgramFiles(x86)%\youdao\shoppingassistant\other\ohjkicjidmohhfcjjlahfppkdblibkkb\order-notification.html
- %ProgramFiles(x86)%\youdao\shoppingassistant\other\ohjkicjidmohhfcjjlahfppkdblibkkb\options.html
- %ProgramFiles(x86)%\youdao\shoppingassistant\other\ohjkicjidmohhfcjjlahfppkdblibkkb\notification.html
- %ProgramFiles(x86)%\youdao\shoppingassistant\other\ohjkicjidmohhfcjjlahfppkdblibkkb\manifest.json
- %ProgramFiles(x86)%\youdao\shoppingassistant\other\ohjkicjidmohhfcjjlahfppkdblibkkb\images\6.png
- %LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012024011220240113\index.dat
Удаляет следующие файлы
- %TEMP%\nsw6134.tmp\finishpage.ini
Сетевая активность
Подключается к
- 'zh####u.huihui.cn':80
- 'yo##ao.com':80
- 'yo##ao.com':443
- 'oc##.#igicert.cn':80
- 'sh####.ydstatic.com':443
- 'yd#######mon-cdn.nosdn.127.net':443
TCP
Запросы HTTP GET
- http://zh####u.huihui.cn/log?ty##################################################################################################################################################################...
- http://www.yo##ao.com/
- http://oc##.#igicert.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAsTYrbuap0%2Blokw8W4gfTk%3D
- http://oc##.#igicert.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTRXf%2BqAIajMnZeiQcx27p1CzET2wQUJG%2BRP4mHhw4ywkAY38VM60%2FISTICEA1Z5X%2BowH3EMBlufes3dBo%3D
- http://zh####u.huihui.cn/installed?ve#########################################
- http://oc##.#igicert.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTRXf%2BqAIajMnZeiQcx27p1CzET2wQUJG%2BRP4mHhw4ywkAY38VM60%2FISTICEAlKWBpWcnw81UarVLPlLGg%3D
- http://oc##.#igicert.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTRXf%2BqAIajMnZeiQcx27p1CzET2wQUJG%2BRP4mHhw4ywkAY38VM60%2FISTICEAVozLsWyzC0vXc77piKGr4%3D
- http://zh####u.huihui.cn/update/ie/update.xml?ve##########################################################################################
- http://zh####u.huihui.cn/extensions/config.xml?ve##########################################################################################
- http://zh####u.huihui.cn/log?ty#############################################################################################################################################
- http://zh####u.huihui.cn/productSense?ve#########################################################################################################################################################...
Другие
- 'yo##ao.com':443
- 'sh####.ydstatic.com':443
- 'rl###.youdao.com':443
UDP
- DNS ASK zh####u.huihui.cn
- DNS ASK yo##ao.com
- DNS ASK oc##.#igicert.cn
- DNS ASK sh####.ydstatic.com
- DNS ASK rl###.youdao.com
- DNS ASK yd#######mon-cdn.nosdn.127.net
Другое
Ищет следующие окна
- ClassName: 'IEFrame' WindowName: ''
- ClassName: 'Static' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Создает и запускает на исполнение
- '%ProgramFiles(x86)%\youdao\shoppingassistant\ie\3.0.5\installassistant.exe' /vendor:dictkunbang /P "%ProgramFiles(x86)%\Youdao\ShoppingAssistant\ie\3.0.5" /S
Запускает на исполнение
- '%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\Youdao\ShoppingAssistant\ie\3.0.5\YoudaoAssistant.dll"
