Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Clients\StartMenuInternet\BlueView.exe\shell\open\command] '' = '"%PROGRAM_FILES%\BlueView\BlueView.exe"'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'BlueSoft' = '%PROGRAM_FILES%\BlueSoft\BlueSoft.exe silent'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Brmas] 'Start' = '00000001'
Вредоносные функции:
Создает и запускает на исполнение:
- '%APPDATA%\BlueSoft\C86DA4AD-186C-4dc2-A540-02E7B075F714\blueview_silent[bszkne].exe' /norestart
- '%TEMP%\is-1CP2T.tmp\blueview_silent[bszkne].tmp' /SL5="$300F8,663518,83456,%APPDATA%\BlueSoft\C86DA4AD-186C-4dc2-A540-02E7B075F714\blueview_silent[bszkne].exe" /norestart
- '%PROGRAM_FILES%\BlueView\BlueView.exe' setdefault:1
- '%PROGRAM_FILES%\Brmas\bin\Brmas.exe'
- '%WINDIR%\Temp\bluesoft_gho_bszkne_inst.exe'
- '%PROGRAM_FILES%\BlueSoft\BlueSoft.exe' autoinstall
- '%APPDATA%\BlueSoft\C86DA4AD-186C-4dc2-A540-02E7B075F714\brmas_pc[bszkne].exe'
Перехватывает следующие функции в SSDT (System Service Descriptor Table):
- NtQuerySystemInformation, драйвер-обработчик: Brmas.sys
- NtQueryInformationProcess, драйвер-обработчик: Brmas.sys
- NtOpenProcess, драйвер-обработчик: Brmas.sys
- NtSetValueKey, драйвер-обработчик: Brmas.sys
- NtReadFile, драйвер-обработчик: Brmas.sys
- NtQueryValueKey, драйвер-обработчик: Brmas.sys
- NtDeleteValueKey, драйвер-обработчик: Brmas.sys
- NtDeleteKey, драйвер-обработчик: Brmas.sys
- NtCreateKey, драйвер-обработчик: Brmas.sys
- NtOpenKey, драйвер-обработчик: Brmas.sys
- NtEnumerateValueKey, драйвер-обработчик: Brmas.sys
- NtEnumerateKey, драйвер-обработчик: Brmas.sys
Изменения в файловой системе:
Создает следующие файлы:
- %APPDATA%\BlueView\icon\is-KHGU5.tmp
- %APPDATA%\BlueView\icon\is-B92BH.tmp
- %APPDATA%\BlueView\icon\is-UHC9J.tmp
- %APPDATA%\BlueView\icon\is-1VTQ8.tmp
- %APPDATA%\BlueView\icon\is-9U5S7.tmp
- %APPDATA%\BlueView\icon\is-C8LIB.tmp
- %APPDATA%\BlueView\icon\is-SVO51.tmp
- %APPDATA%\BlueView\icon\is-BE0KC.tmp
- %APPDATA%\BlueView\icon\is-LLMM8.tmp
- %APPDATA%\BlueView\icon\is-8R485.tmp
- %APPDATA%\BlueView\icon\is-0T3A7.tmp
- %APPDATA%\BlueView\icon\is-KEB2Q.tmp
- %APPDATA%\BlueView\icon\is-7RRA7.tmp
- %APPDATA%\BlueView\icon\is-V1MMO.tmp
- %APPDATA%\BlueView\icon\is-0KKCO.tmp
- %APPDATA%\BlueView\is-JFU51.tmp
- %APPDATA%\BlueView\icon\is-4VBD4.tmp
- %APPDATA%\BlueView\icon\is-JV4DO.tmp
- %APPDATA%\BlueView\icon\is-OU106.tmp
- %APPDATA%\BlueView\icon\is-9P936.tmp
- %APPDATA%\BlueView\icon\is-TOE3A.tmp
- %APPDATA%\BlueView\icon\is-CUOET.tmp
- %APPDATA%\BlueView\icon\is-872UT.tmp
- %APPDATA%\BlueView\icon\is-KAE98.tmp
- %APPDATA%\BlueView\icon\is-7R79S.tmp
- %APPDATA%\BlueView\setting.ini
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\hao123[1].png
- %PROGRAM_FILES%\Brmas\Pics\top_10.png
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\А¶№вдЇААЖч.lnk
- %PROGRAM_FILES%\BlueView\unins000.msg
- %PROGRAM_FILES%\BlueView\unins000.dat
- %PROGRAM_FILES%\Brmas\Pics\top_11.png
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\fav[1].7889&fav_update_time=&hid=11000000000000000001&rand=314593
- %PROGRAM_FILES%\Brmas\bin\brmas\db4.brmas
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\blank[1].png
- %PROGRAM_FILES%\Brmas\Pics\top_01.png
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\baidu[1].png
- %PROGRAM_FILES%\BlueView\uninstall\is-V0KEE.tmp
- %PROGRAM_FILES%\BlueView\uninstall\is-OPOT5.tmp
- %PROGRAM_FILES%\BlueView\uninstall\is-96U2U.tmp
- %PROGRAM_FILES%\BlueView\uninstall\is-E4DVA.tmp
- %PROGRAM_FILES%\BlueView\uninstall\is-1HPAM.tmp
- %PROGRAM_FILES%\BlueView\uninstall\is-KPC4U.tmp
- %ALLUSERSPROFILE%\Start Menu\А¶№вдЇААЖч.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\А¶№вдЇААЖч\Р¶ФШ А¶№вдЇААЖч.lnk
- %ALLUSERSPROFILE%\Desktop\А¶№вдЇААЖч.lnk
- %PROGRAM_FILES%\BlueView\uninstall\is-NQAD4.tmp
- %PROGRAM_FILES%\BlueView\uninstall\is-38C29.tmp
- %ALLUSERSPROFILE%\Start Menu\Programs\А¶№вдЇААЖч\А¶№вдЇААЖч.lnk
- %PROGRAM_FILES%\BlueView\is-7KGIF.tmp
- %APPDATA%\BlueSoft\setting.ini
- %ALLUSERSPROFILE%\Start Menu\Programs\А¶№вИнјюѕ«СЎ\А¶№вИнјюѕ«СЎ.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\А¶№вИнјюѕ«СЎ\Р¶ФШ А¶№вИнјюѕ«СЎ.lnk
- %APPDATA%\BlueSoft\ExeIcon\jingdong.ico
- %APPDATA%\BlueSoft\ExeIcon\taobao.ico
- %PROGRAM_FILES%\BlueSoft\Uninstall.exe
- %PROGRAM_FILES%\Brmas\bin\Brmas.exe
- %PROGRAM_FILES%\Brmas\bin\Brmas.sys
- %TEMP%\nsr4.tmp
- %TEMP%\CheckList.dll
- %TEMP%\nss5.tmp\System.dll
- %TEMP%\nsk2.tmp\modern-wizard.bmp
- %PROGRAM_FILES%\BlueSoft\BlueSoft.exe
- %APPDATA%\BlueSoft\softlist.xml
- %WINDIR%\Temp\bluesoft_gho_bszkne_inst.exe
- %TEMP%\nsk2.tmp\System.dll
- %TEMP%\nsk2.tmp\ioSpecial.ini
- %APPDATA%\BlueSoft\ExeIcon\blueview.ico
- %APPDATA%\BlueSoft\ExeIcon\brmas.ico
- %APPDATA%\BlueSoft\ExeIcon\hao123.ico
- %APPDATA%\BlueSoft\C86DA4AD-186C-4dc2-A540-02E7B075F714\blueview_silent.exe
- %APPDATA%\BlueSoft\C86DA4AD-186C-4dc2-A540-02E7B075F714\brmas_pc.exe
- %APPDATA%\BlueSoft\ExeIcon\baidu.ico
- %PROGRAM_FILES%\Brmas\bin\Brmas.dll
- %TEMP%\is-L800I.tmp\mainbk.bmp
- %TEMP%\is-L800I.tmp\setup_logo.bmp
- %TEMP%\is-L800I.tmp\setup_logo2.bmp
- %TEMP%\is-L800I.tmp\_isetup\_RegDLL.tmp
- %TEMP%\is-L800I.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-L800I.tmp\install.ico
- %TEMP%\is-L800I.tmp\changeDir_btn.bmp
- %TEMP%\is-L800I.tmp\setup_btn2.bmp
- %PROGRAM_FILES%\BlueView\is-OIMS0.tmp
- %TEMP%\is-L800I.tmp\setup_btn.bmp
- %TEMP%\is-L800I.tmp\top_bk.bmp
- %TEMP%\is-L800I.tmp\StretchLine.bmp
- %PROGRAM_FILES%\Brmas\bin\brmas\db1.brmas
- %PROGRAM_FILES%\Brmas\bin\brmas\db3.brmas
- %PROGRAM_FILES%\Brmas\bin\uninst.exe
- %PROGRAM_FILES%\Brmas\bin\BrowserMgr.dll
- %PROGRAM_FILES%\Brmas\bin\stat.dll
- %PROGRAM_FILES%\Brmas\bin\brmas\db0.brmas
- %PROGRAM_FILES%\Brmas\bin\iexplore.lnk
- %PROGRAM_FILES%\Brmas\bin\ProtConfig.dat
- %TEMP%\is-1CP2T.tmp\blueview_silent[bszkne].tmp
- %PROGRAM_FILES%\Brmas\setting.ini
- %HOMEPATH%\Start Menu\Programs\浏览器修复大师\浏览器修复大师.lnk
- %HOMEPATH%\Start Menu\Programs\浏览器修复大师\卸载 浏览器修复大师.lnk
Удаляет следующие файлы:
- %TEMP%\is-L800I.tmp\setup_logo2.bmp
- %TEMP%\is-L800I.tmp\StretchLine.bmp
- %TEMP%\is-L800I.tmp\setup_btn2.bmp
- %TEMP%\is-L800I.tmp\setup_logo.bmp
- %TEMP%\is-L800I.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-1CP2T.tmp\blueview_silent[bszkne].tmp
- %TEMP%\is-L800I.tmp\top_bk.bmp
- %TEMP%\is-L800I.tmp\_isetup\_RegDLL.tmp
- %TEMP%\is-L800I.tmp\setup_btn.bmp
- %TEMP%\nsk2.tmp\System.dll
- %TEMP%\CheckList.dll
- %TEMP%\nsk2.tmp\ioSpecial.ini
- %TEMP%\nsk2.tmp\modern-wizard.bmp
- %TEMP%\is-L800I.tmp\install.ico
- %TEMP%\is-L800I.tmp\mainbk.bmp
- %TEMP%\nss5.tmp\System.dll
- %TEMP%\is-L800I.tmp\changeDir_btn.bmp
Перемещает следующие файлы:
- %APPDATA%\BlueView\icon\is-SVO51.tmp в %APPDATA%\BlueView\icon\www.taobao.com.ico
- %APPDATA%\BlueView\icon\is-KEB2Q.tmp в %APPDATA%\BlueView\icon\www.sohu.com.ico
- %APPDATA%\BlueView\icon\is-LLMM8.tmp в %APPDATA%\BlueView\icon\www.vancl.com.ico
- %APPDATA%\BlueView\icon\is-BE0KC.tmp в %APPDATA%\BlueView\icon\www.tmall.com.ico
- %APPDATA%\BlueView\icon\is-0T3A7.tmp в %APPDATA%\BlueView\icon\www.sina.com.cn.ico
- %APPDATA%\BlueView\icon\is-B92BH.tmp в %APPDATA%\BlueView\icon\www.meituan.com.ico
- %APPDATA%\BlueView\icon\is-KHGU5.tmp в %APPDATA%\BlueView\icon\www.kaixin001.com.ico
- %APPDATA%\BlueView\icon\is-8R485.tmp в %APPDATA%\BlueView\icon\www.qq.com.ico
- %APPDATA%\BlueView\icon\is-UHC9J.tmp в %APPDATA%\BlueView\icon\www.microsoft.com.ico
- %PROGRAM_FILES%\BlueView\uninstall\is-96U2U.tmp в %PROGRAM_FILES%\BlueView\uninstall\close_btn.bmp
- %PROGRAM_FILES%\BlueView\uninstall\is-OPOT5.tmp в %PROGRAM_FILES%\BlueView\uninstall\cancel_btn.bmp
- %PROGRAM_FILES%\BlueView\uninstall\is-38C29.tmp в %PROGRAM_FILES%\BlueView\uninstall\unsetup_logo2.bmp
- %PROGRAM_FILES%\BlueView\uninstall\is-NQAD4.tmp в %PROGRAM_FILES%\BlueView\uninstall\unsetup_logo.bmp
- %PROGRAM_FILES%\BlueView\uninstall\is-V0KEE.tmp в %PROGRAM_FILES%\BlueView\uninstall\unsetup_btn.bmp
- %PROGRAM_FILES%\BlueView\uninstall\is-E4DVA.tmp в %PROGRAM_FILES%\BlueView\uninstall\mainbk.bmp
- %APPDATA%\BlueView\icon\is-7R79S.tmp в %APPDATA%\BlueView\icon\www.youku.com.ico
- %PROGRAM_FILES%\BlueView\uninstall\is-KPC4U.tmp в %PROGRAM_FILES%\BlueView\uninstall\StretchLine.bmp
- %PROGRAM_FILES%\BlueView\uninstall\is-1HPAM.tmp в %PROGRAM_FILES%\BlueView\uninstall\top_bk.bmp
- %APPDATA%\BlueView\icon\is-C8LIB.tmp в %APPDATA%\BlueView\icon\www.jd.com.ico
- %APPDATA%\BlueView\icon\is-JV4DO.tmp в %APPDATA%\BlueView\icon\baidu.iblueview.com.ico
- %APPDATA%\BlueView\icon\is-4VBD4.tmp в %APPDATA%\BlueView\icon\baidu.gsie.cn.ico
- %APPDATA%\BlueView\icon\is-V1MMO.tmp в %APPDATA%\BlueView\icon\game.gsie.cn.ico
- %APPDATA%\BlueView\icon\is-7RRA7.tmp в %APPDATA%\BlueView\icon\baidu.lvseie.com.ico
- %APPDATA%\BlueView\is-JFU51.tmp в %APPDATA%\BlueView\setting.ini
- %APPDATA%\BlueSoft\C86DA4AD-186C-4dc2-A540-02E7B075F714\brmas_pc.exe в %APPDATA%\BlueSoft\C86DA4AD-186C-4dc2-A540-02E7B075F714\brmas_pc[bszkne].exe
- %APPDATA%\BlueSoft\C86DA4AD-186C-4dc2-A540-02E7B075F714\blueview_silent.exe в %APPDATA%\BlueSoft\C86DA4AD-186C-4dc2-A540-02E7B075F714\blueview_silent[bszkne].exe
- %PROGRAM_FILES%\BlueView\is-7KGIF.tmp в %PROGRAM_FILES%\BlueView\BlueView.exe
- %PROGRAM_FILES%\BlueView\is-OIMS0.tmp в %PROGRAM_FILES%\BlueView\unins000.exe
- %APPDATA%\BlueView\icon\is-TOE3A.tmp в %APPDATA%\BlueView\icon\www.dianping.com.ico
- %APPDATA%\BlueView\icon\is-9P936.tmp в %APPDATA%\BlueView\icon\www.dangdang.com.ico
- %APPDATA%\BlueView\icon\is-9U5S7.tmp в %APPDATA%\BlueView\icon\www.hao123.com.ico
- %APPDATA%\BlueView\icon\is-1VTQ8.tmp в %APPDATA%\BlueView\icon\www.google.com.hk.ico
- %APPDATA%\BlueView\icon\is-OU106.tmp в %APPDATA%\BlueView\icon\www.baidu.com.ico
- %APPDATA%\BlueView\icon\is-CUOET.tmp в %APPDATA%\BlueView\icon\weibo.com.ico
- %APPDATA%\BlueView\icon\is-0KKCO.tmp в %APPDATA%\BlueView\icon\pindao.huoban.taobao.com.ico
- %APPDATA%\BlueView\icon\is-KAE98.tmp в %APPDATA%\BlueView\icon\www.2345.com.ico
- %APPDATA%\BlueView\icon\is-872UT.tmp в %APPDATA%\BlueView\icon\www.163.com.ico
Сетевая активность:
Подключается к:
- 'localhost':1045
- 'up####.safe.my.iedun.cn':80
- 'localhost':1042
- '12#.#25.114.144':80
- 'localhost':1040
TCP:
Запросы HTTP GET:
- up####.safe.my.iedun.cn/topimg/baidu.png
- up####.safe.my.iedun.cn/home1/fav/?us###############################################################################################################
- up####.safe.my.iedun.cn/topimg/hao123.png
- up####.safe.my.iedun.cn/topimg/blank.png
UDP:
- DNS ASK www.ib###view.com
- DNS ASK up####.iblueview.com
- DNS ASK sa##.#y.iedun.cn
- DNS ASK up####.safe.my.iedun.cn
- DNS ASK www.ba##u.com
- DNS ASK up####.u.gsie.cn
- DNS ASK www.download.windowsupdate.com
Другое:
Ищет следующие окна:
- ClassName: 'BVIE_MainWnd' WindowName: '(null)'
- ClassName: 'MS_AutodialMonitor' WindowName: '(null)'
- ClassName: 'MS_WebcheckMonitor' WindowName: '(null)'
- ClassName: 'BlueSoft_MainWnd' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: '85AD02CF-F95D-4f2c-8BCA-BDA546A35E63' WindowName: '(null)'
