Техническая информация
Вредоносные функции
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\tmp_hp.vbs
- %TEMP%\etilqs_amycm0fomko03cr
- %TEMP%\etilqs_xzjgdc9cs4l2eja
- %TEMP%\etilqs_mjnvwtohrjlc6fw
- %TEMP%\etilqs_ifbqmepc4rlhpc7
- %TEMP%\etilqs_kyxlsbeql3ze9na
- %TEMP%\etilqs_7c0mree9lxk6lhv
- %TEMP%\etilqs_qzoldnu8cmfx067
- %TEMP%\etilqs_drpqive30lheex4
- %TEMP%\etilqs_0w0tc3jppy2ojoo
- %TEMP%\nsd9c8f.tmp\langdll.dll
- %TEMP%\nsd9c8f.tmp\ask_supertoolbar_spc2.bmp
- %TEMP%\nsd9c8f.tmp\asktoolbarinstaller-1.9.1.0.exe
- %TEMP%\nsd9c8f.tmp\askinstallchecker-1.5.0.0.exe
- %TEMP%\nsx9b84.tmp
- %TEMP%\downfile.exe
- %TEMP%\nsc54f3.tmp\uac.dll
- %TEMP%\etilqs_olg0gsyhoazvfjk
- %TEMP%\etilqs_nvndw2kdnbwzle8
Сетевая активность
Подключается к
- 'au######te.geo.opera.com':80
- 'fu##bol.com':80
- 'ya###.opera.com':80
- 'fa###ook.com':80
- 're###.opera.com':80
- 'si#####ck2.opera.com':80
- 'en.###ipedia.org':443
- 'en.###ipedia.org':80
- 'se####.yahoo.com':443
- 'am##on.com':443
- 'se####.yahoo.com':80
- 'bing.com':80
- 'du###uckgo.com':443
- 'am##on.com':80
- 'google.com':80
- 'au######te.geo.opera.com':443
- 'ro###.ebay.com':80
- 'ro###.ebay.com':443
TCP
Запросы HTTP GET
- http://au######te.geo.opera.com/geolocation/
- http://fu##bol.com/favicon.ico
- http://fu##bol.com/
- http://www.am##on.com/?ta#########################
- http://re###.opera.com/speeddials/partner/amazon_us
- http://www.fa###ook.com/favicon.ico
- http://ya###.opera.com/favicon.ico
- http://www.fa###ook.com/fz139/?ca#########################
- http://www.fa###ook.com/campaign/landing.php?ca#########################
- http://re###.opera.com/speeddials/partner/ebay_us
- http://re###.opera.com/speeddials/partner/facebook
- http://si#####ck2.opera.com/?ho#################################################
- http://re###.opera.com/www.opera.com/firstrun/
- http://si#####ck2.opera.com/?ho###################################################
- http://en.###ipedia.org/favicon.ico
- http://se####.yahoo.com/favicon.ico
- http://www.bing.com/s/a/bing_p.ico
- http://www.am##on.com/favicon.ico
- http://www.google.com/favicon.ico
- http://re###.opera.com/favicon.ico
- http://ro###.ebay.com/rover/1/711-53200-19255-0/1?ic###########################################################################################################################
Другие
- 'au######te.geo.opera.com':443
- 'du###uckgo.com':443
- 'am##on.com':443
- 'se####.yahoo.com':443
- 'en.###ipedia.org':443
- 'ya###.opera.com':443
- 'ro###.ebay.com':443
UDP
- DNS ASK google.com
- DNS ASK au######te.geo.opera.com
- DNS ASK se####.yahoo.com
- DNS ASK am##on.com
- DNS ASK du###uckgo.com
- DNS ASK bing.com
- DNS ASK bi##.#ikimedia.org
- DNS ASK en.###ipedia.org
- DNS ASK si#####ck2.opera.com
- DNS ASK re###.opera.com
- DNS ASK fa###ook.com
- DNS ASK ya###.opera.com
- DNS ASK op##a.com
- DNS ASK fu##bol.com
- DNS ASK ro###.ebay.com
Другое
Ищет следующие окна
- ClassName: 'Opera_MessageWindow' WindowName: '%APPDATA%\Opera Software\Opera Stable'
Создает и запускает на исполнение
- '%WINDIR%\syswow64\wscript.exe' %TEMP%\tmp_hp.vbs
- '%TEMP%\downfile.exe'
Запускает на исполнение
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="1648.5.2134837338\1042019793" --lang=en-US --enable-proprietary-media-types-playback --crash-reporter-pid=2760 --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="1648.12.66486285\1052680102" --lang=en-US --enable-proprietary-media-types-playback --crash-reporter-pid=2760 --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="1648.11.134984329\1553989640" --lang=en-US --enable-proprietary-media-types-playback --crash-reporter-pid=2760 --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="1648.10.1585504920\1886662527" --lang=en-US --enable-proprietary-media-types-playback --crash-reporter-pid=2760 --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="1648.9.710019866\1089596436" --lang=en-US --enable-proprietary-media-types-playback --crash-reporter-pid=2760 --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="1648.8.1237955980\644949740" --lang=en-US --enable-proprietary-media-types-playback --crash-reporter-pid=2760 --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="1648.7.1583296791\289641702" --lang=en-US --enable-proprietary-media-types-playback --crash-reporter-pid=2760 --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="1648.6.30344679\1382024870" --lang=en-US --enable-proprietary-media-types-playback --crash-reporter-pid=2760 --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="1648.16.1686770861\865762173" --lang=en-US --enable-proprietary-media-types-playback --crash-reporter-pid=2760 --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="1648.4.153358513\212177796" --lang=en-US --no-sandbox --enable-proprietary-media-types-playback --crash-reporter-pid=2760 /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=renderer --alt-high-dpi-setting=96 --disable-direct-npapi-requests --enable-deferred-image-decoding --lang=en-US --enable-proprietary-media-types-playback --extension-process --enable-we...
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=renderer --alt-high-dpi-setting=96 --disable-direct-npapi-requests --enable-deferred-image-decoding --lang=en-US --enable-proprietary-media-types-playback --disable-client-side-phishing-...
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=gpu-process --channel="1648.0.2070717091\1207381317" --enable-proprietary-media-types-playback --crash-reporter-pid=2760 --supports-dual-gpus=false --gpu-driver-bug-workarounds=1,19,42 -...
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' --ran-launcher http://fuutbol.com/ /crash-reporter-parent-id=1648
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --ran-launcher http://fuutbol.com/
- '%ProgramFiles(x86)%\opera\launcher.exe' http://fuutbol.com/
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="1648.15.304210623\497374216" --lang=en-US --enable-proprietary-media-types-playback --crash-reporter-pid=2760 --ignored=" --type=renderer " /prefetch:-645351001
- '%WINDIR%\syswow64\wscript.exe' %TEMP%\tmp_hp.vbs (со скрытым окном)
