Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Classes\Qvodbt\shell\open\command] '' = '"%WINDIR%\temp\Cookies\kb\QvodPlayer.exe" -qvodplayer.torrent "%1"'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Qvod Terminal] 'Start' = '00000002'
Вредоносные функции:
Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%WINDIR%\Temp\Cookies\kb\QvodTerminal.exe' = '%WINDIR%\Temp\Cookies\kb\QvodTerminal.exe:*:Enabled:QVOD'
Создает и запускает на исполнение:
- '%WINDIR%\Temp\Cookies\kb\QvodTerminal.exe'
- '%WINDIR%\Temp\Cookies\kb\QvodPlayer.exe'
Изменения в файловой системе:
Создает следующие файлы:
- %WINDIR%\Temp\Cookies\kb\Skin\Default\scroll_back.bmp
- %WINDIR%\Temp\Cookies\kb\Skin\Default\scroll_back_h.bmp
- %WINDIR%\Temp\Cookies\kb\Skin\Default\scroll_down.bmp
- %WINDIR%\Temp\Cookies\kb\Skin\Default\reold.bmp
- %WINDIR%\Temp\Cookies\kb\Skin\Default\right.bmp
- %WINDIR%\Temp\Cookies\kb\Skin\Default\right1.bmp
- %WINDIR%\Temp\Cookies\kb\Skin\Default\scroll_right.bmp
- %WINDIR%\Temp\Cookies\kb\Skin\Default\scroll_up.bmp
- %WINDIR%\Temp\Cookies\kb\Skin\Default\stop.bmp
- %WINDIR%\Temp\Cookies\kb\Skin\Default\scroll_left.bmp
- %WINDIR%\Temp\Cookies\kb\Skin\Default\scroll_limit.bmp
- %WINDIR%\Temp\Cookies\kb\Skin\Default\scroll_limit_h.bmp
- %WINDIR%\Temp\Cookies\kb\Skin\Default\open.bmp
- %WINDIR%\Temp\Cookies\kb\Skin\Default\pause.bmp
- %WINDIR%\Temp\Cookies\kb\Skin\Default\play.bmp
- %WINDIR%\Temp\Cookies\kb\Skin\Default\mute2.bmp
- %WINDIR%\Temp\Cookies\kb\Skin\Default\next.bmp
- %WINDIR%\Temp\Cookies\kb\Skin\Default\nowplay.bmp
- %WINDIR%\Temp\Cookies\kb\Skin\Default\progress.bmp
- %WINDIR%\Temp\Cookies\kb\Skin\Default\progress_point.bmp
- %WINDIR%\Temp\Cookies\kb\Skin\Default\progress_thumb.bmp
- %WINDIR%\Temp\Cookies\kb\Skin\Default\playlist_toolbar.bmp
- %WINDIR%\Temp\Cookies\kb\Skin\Default\pre.bmp
- %WINDIR%\Temp\Cookies\kb\Skin\Default\processp.bmp
- %WINDIR%\Temp\Cookies\kb\Skin\Default\tab.bmp
- %WINDIR%\Temp\Cookies\kb\QvodBand.dll
- %WINDIR%\Temp\Cookies\kb\QvodInsert.dll
- %WINDIR%\Temp\Cookies\kb\Playlist\Channel.xml
- %WINDIR%\Temp\Cookies\kb\Skin\Default.xml
- %WINDIR%\Temp\Cookies\kb\Skin\Logo.bmp
- %WINDIR%\Temp\Cookies\kb\NetAgent.dll
- %WINDIR%\Temp\Cookies\kb\Playlist\Playlist.xml
- %WINDIR%\Temp\Cookies\kb\Qvod.cfg
- %WINDIR%\Temp\Cookies\kb\qvodcfg.ini
- %WINDIR%\Temp\Cookies\kb\Playlist\Mediacenter.xml
- %WINDIR%\Temp\Cookies\kb\Playlist\Text.xml
- %WINDIR%\Temp\Cookies\kb\QvodPlayer.xml
- %WINDIR%\Temp\Cookies\kb\Skin\Default\tabs_right.bmp
- %WINDIR%\Temp\Cookies\kb\Skin\Default\top.bmp
- %WINDIR%\Temp\Cookies\kb\Skin\Default\topleft.bmp
- %WINDIR%\Temp\Cookies\kb\Skin\Default\tab1.bmp
- %WINDIR%\Temp\Cookies\kb\Skin\Default\tabs_left.bmp
- %WINDIR%\Temp\Cookies\kb\Skin\Default\tabs_mid.bmp
- %WINDIR%\Temp\Cookies\kb\Skin\Default\volume.bmp
- %WINDIR%\Temp\Cookies\kb\Skin\Default\volumeb.bmp
- %WINDIR%\Temp\Cookies\kb\Skin\Default\volumep.bmp
- %WINDIR%\Temp\Cookies\kb\Skin\Default\topleft1.bmp
- %WINDIR%\Temp\Cookies\kb\Skin\Default\topright.bmp
- %WINDIR%\Temp\Cookies\kb\Skin\Default\topright1.bmp
- %WINDIR%\Temp\Cookies\kb\Skin\Default\mute.bmp
- %WINDIR%\Temp\Cookies\kb\Skin\Default\backmid.bmp
- %WINDIR%\Temp\Cookies\kb\Skin\Default\backright.bmp
- %WINDIR%\Temp\Cookies\kb\Skin\Default\bgline.bmp
- %WINDIR%\Temp\Cookies\kb\Lang\zh_TW.dll
- %WINDIR%\Temp\Cookies\kb\Skin\Default\back.bmp
- %WINDIR%\Temp\Cookies\kb\Skin\Default\backleft.bmp
- %WINDIR%\Temp\Cookies\kb\Skin\Default\bottomright.bmp
- %WINDIR%\Temp\Cookies\kb\Skin\Default\bright1.bmp
- %WINDIR%\Temp\Cookies\kb\Skin\Default\caption.bmp
- %WINDIR%\Temp\Cookies\kb\Skin\Default\bleft1.bmp
- %WINDIR%\Temp\Cookies\kb\Skin\Default\bottom.bmp
- %WINDIR%\Temp\Cookies\kb\Skin\Default\bottomleft.bmp
- %WINDIR%\Temp\Cookies\kb\Codecs\asfsplliter.ax
- %WINDIR%\Temp\Cookies\kb\Codecs\atrc.dll
- %WINDIR%\Temp\Cookies\kb\Codecs\ColorFilter.ax
- %WINDIR%\Temp\Cookies\kb\QvodPlayer.exe
- %WINDIR%\Temp\Cookies\kb\QvodTerminal.exe
- %WINDIR%\Temp\Cookies\kb\AddIn\VisLrc.dll
- %WINDIR%\Temp\Cookies\kb\Codecs\raac.dll
- %WINDIR%\Temp\Cookies\kb\Codecs\RealMediaSplitter.ax
- %WINDIR%\Temp\Cookies\kb\Lang\en_US.dll
- %WINDIR%\Temp\Cookies\kb\Codecs\cook.dll
- %WINDIR%\Temp\Cookies\kb\Codecs\drvc.dll
- %WINDIR%\Temp\Cookies\kb\Codecs\f4v.swf
- %WINDIR%\Temp\Cookies\kb\Skin\Default\close.bmp
- %WINDIR%\Temp\Cookies\kb\Skin\Default\media_files.bmp
- %WINDIR%\Temp\Cookies\kb\Skin\Default\media_files_2.bmp
- %WINDIR%\Temp\Cookies\kb\Skin\Default\media_info.bmp
- %WINDIR%\Temp\Cookies\kb\Skin\Default\mediatolist.bmp
- %WINDIR%\Temp\Cookies\kb\Skin\Default\mediatree.bmp
- %WINDIR%\Temp\Cookies\kb\Skin\Default\media_del.bmp
- %WINDIR%\Temp\Cookies\kb\Skin\Default\menu.bmp
- %WINDIR%\Temp\Cookies\kb\Skin\Default\min.bmp
- %WINDIR%\Temp\Cookies\kb\Skin\Default\mtk.bmp
- %WINDIR%\Temp\Cookies\kb\Skin\Default\media_search.bmp
- %WINDIR%\Temp\Cookies\kb\Skin\Default\media_sham.bmp
- %WINDIR%\Temp\Cookies\kb\Skin\Default\media_sham_2.bmp
- %WINDIR%\Temp\Cookies\kb\Skin\Default\infofull.bmp
- %WINDIR%\Temp\Cookies\kb\Skin\Default\left.bmp
- %WINDIR%\Temp\Cookies\kb\Skin\Default\left1.bmp
- %WINDIR%\Temp\Cookies\kb\Skin\Default\full.bmp
- %WINDIR%\Temp\Cookies\kb\Skin\Default\icon.bmp
- %WINDIR%\Temp\Cookies\kb\Skin\Default\info.bmp
- %WINDIR%\Temp\Cookies\kb\Skin\Default\max.bmp
- %WINDIR%\Temp\Cookies\kb\Skin\Default\mediaeditdel.bmp
- %WINDIR%\Temp\Cookies\kb\Skin\Default\mediare.bmp
- %WINDIR%\Temp\Cookies\kb\Skin\Default\listbutton.bmp
- %WINDIR%\Temp\Cookies\kb\Skin\Default\listbutton2.bmp
- %WINDIR%\Temp\Cookies\kb\Skin\Default\listsplit.bmp
Сетевая активность:
Подключается к:
- '61.##9.219.203':80
- 'te####d.qvod.com':80
- 'localhost':8081
TCP:
Запросы HTTP GET:
- te####d.qvod.com/Text.xml
UDP:
- DNS ASK in####-ad.qvod.com
- DNS ASK st####.sipphone.com
- DNS ASK ag###.qvod.com
- DNS ASK up###e.qvod.com
- DNS ASK tr###.qvod.com
- DNS ASK st##.qvod.com
- DNS ASK te####d.qvod.com
- '1.#.0.127':65535
- '23#.#55.255.250':1900
- 'tr###.qvod.com':80
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'EDIT' WindowName: '(null)'
