Техническая информация
Для обеспечения автозапуска и распространения:
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Orange update Core Service] 'Start' = '00000002'
Вредоносные функции:
Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\Orange\OrangeUpdate\Service\OUCore.exe' = '%PROGRAM_FILES%\Orange\OrangeUpdate\Service\OUCore.exe:*:Enabled:OrangeUpdate'
Создает и запускает на исполнение:
- '%PROGRAM_FILES%\Orange\OrangeUpdate\Service\OUIndicator.exe'
- '%PROGRAM_FILES%\Orange\OrangeUpdate\Service\OULookup.exe'
- '%PROGRAM_FILES%\Orange\OrangeUpdate\Service\OUSoftwareManager.exe'
- '%PROGRAM_FILES%\Orange\OrangeUpdate\Service\OUCore.exe' install
- '%PROGRAM_FILES%\Orange\OrangeUpdate\Service\OUCore.exe'
Запускает на исполнение:
- '<SYSTEM32>\taskkill.exe' /F /IM "OUSoftwareManager.exe"
- '<SYSTEM32>\taskkill.exe' /F /IM "OULaunchApp.exe"
- '<SYSTEM32>\taskkill.exe' /F /IM "OUDownload.exe"
- '<SYSTEM32>\net1.exe' start "Orange update Core Service" /1
- '<SYSTEM32>\taskkill.exe' /F /IM "OUCore.exe"
- '<SYSTEM32>\taskkill.exe' /F /IM "OUIndicator.exe"
- '<SYSTEM32>\taskkill.exe' /F /IM "OULookup.exe"
- '<SYSTEM32>\taskkill.exe' /F /IM "OUUpdateManager.exe"
- '<SYSTEM32>\taskkill.exe' /F /IM "OUNotification.exe"
- '<SYSTEM32>\cmd.exe' /c "%PROGRAM_FILES%\Orange\OrangeUpdate\Service\OUKILLProcess.bat"
- '<SYSTEM32>\taskkill.exe' /F /IM "OUTooltip.exe"
- '<SYSTEM32>\taskkill.exe' /F /IM "OUDelegator.exe"
- '<SYSTEM32>\taskkill.exe' /F /IM "OUManagerLight.exe"
Изменения в файловой системе:
Создает следующие файлы:
- %PROGRAM_FILES%\Orange\OrangeUpdate\Service\Logos\Logos.xml
- %PROGRAM_FILES%\Orange\OrangeUpdate\Service\Logos\AssistanceLivebox.png
- %PROGRAM_FILES%\Orange\OrangeUpdate\Service\Logos\AsistenteRouter.png
- %PROGRAM_FILES%\Orange\OrangeUpdate\Service\Logos\OrangeAdventurer.png
- %PROGRAM_FILES%\Orange\OrangeUpdate\Service\Logos\desktopsearch_logo.PNG
- %PROGRAM_FILES%\Orange\OrangeUpdate\Service\Logos\custoIE.png
- %PROGRAM_FILES%\Orange\OrangeUpdate\Service\Logos\UpdaterLogo.png
- %PROGRAM_FILES%\Orange\OrangeUpdate\Service\Microsoft.VC90.CRT\msvcr90.dll
- %PROGRAM_FILES%\Orange\OrangeUpdate\Service\detectors\ManagedSoftware\mac\ManagedSoftware_testrelocation.xml
- %PROGRAM_FILES%\Orange\OrangeUpdate\Service\detectors\ManagedSoftware\mac\ManagedSoftware_testoubundled.xml
- %PROGRAM_FILES%\Orange\OrangeUpdate\Service\detectors\ManagedSoftware\mac\ManagedSoftware_orangeupdatergui.xml
- %PROGRAM_FILES%\Orange\OrangeUpdate\Service\parameters.ini
- %PROGRAM_FILES%\Orange\OrangeUpdate\Service\Microsoft.VC90.CRT\msvcp90.dll
- %PROGRAM_FILES%\Orange\OrangeUpdate\Service\Microsoft.VC90.CRT\msvcm90.dll
- %PROGRAM_FILES%\Orange\OrangeUpdate\Service\Microsoft.VC90.CRT\Microsoft.VC90.CRT.manifest
- %TEMP%\nsr3.tmp\SimpleFC.dll
- %ALLUSERSPROFILE%\Application Data\Orange\Orange update\OUCore\preferences.ini
- %PROGRAM_FILES%\Orange\OrangeUpdate\Service\Fulluninstaller.exe
- %ALLUSERSPROFILE%\Application Data\Orange\Orange update\OULookup\lookup.1.spOutReq.xml
- %ALLUSERSPROFILE%\Application Data\Orange\Orange update\OUCore\users\%USERNAME%\LocalCatalog.xml
- %ALLUSERSPROFILE%\Application Data\Orange\Orange update\OUCore\LocalCatalog.xml
- %PROGRAM_FILES%\Orange\OrangeUpdate\Service\Logos\tracer.cfg
- %PROGRAM_FILES%\Orange\OrangeUpdate\Service\Logos\navigateur_logo.PNG
- %PROGRAM_FILES%\Orange\OrangeUpdate\Service\Logos\liveboxusbwidget.png
- %PROGRAM_FILES%\Orange\OrangeUpdate\Service\Logos\internetexplorer.png
- %PROGRAM_FILES%\Orange\OrangeUpdate\Service\Logos\notificationmail_logo.png
- %PROGRAM_FILES%\Orange\OrangeUpdate\Service\Logos\logger.cfg
- %PROGRAM_FILES%\Orange\OrangeUpdate\Service\Logos\toolbar_logo.png
- %PROGRAM_FILES%\Orange\OrangeUpdate\Service\Logos\smackit.png
- %PROGRAM_FILES%\Orange\OrangeUpdate\Service\OUIndicator.exe
- %PROGRAM_FILES%\Orange\OrangeUpdate\Service\OUSelfUpdExec.exe
- %PROGRAM_FILES%\Orange\OrangeUpdate\Service\OUDownload.exe
- %PROGRAM_FILES%\Orange\OrangeUpdate\Service\OUDelegator.exe
- %PROGRAM_FILES%\Orange\OrangeUpdate\Service\JSONClient.dll
- %PROGRAM_FILES%\Orange\OrangeUpdate\Service\Tracer.dll
- %PROGRAM_FILES%\Orange\OrangeUpdate\Service\Util.dll
- %PROGRAM_FILES%\Orange\OrangeUpdate\Service\OULaunchApp.exe
- %PROGRAM_FILES%\Orange\OrangeUpdate\Service\OUKILLProcess.bat
- %TEMP%\nsr3.tmp\System.dll
- %TEMP%\nsm2.tmp
- %TEMP%\nsr3.tmp\ExecDos.dll
- %PROGRAM_FILES%\Orange\OrangeUpdate\Service\OUSoftwareManager.exe
- %PROGRAM_FILES%\Orange\OrangeUpdate\Service\OULookup.exe
- %PROGRAM_FILES%\Orange\OrangeUpdate\Service\OUCore.exe
- %PROGRAM_FILES%\Orange\OrangeUpdate\Service\detectors\ManagedSoftware\ManagedSoftware_orangeupdatergui.xml
- %PROGRAM_FILES%\Orange\OrangeUpdate\Service\detectors\ManagedSoftware\ManagedSoftware_orange-update.xml
- %PROGRAM_FILES%\Orange\OrangeUpdate\Service\detectors\ManagedSoftware\ManagedSoftware_notificationmail.xml
- %PROGRAM_FILES%\Orange\OrangeUpdate\Service\detectors\ManagedSoftware\ManagedSoftware_toolbar.xml
- %PROGRAM_FILES%\Orange\OrangeUpdate\Service\detectors\ManagedSoftware\mac\ManagedSoftware_orangeclef3g.xml
- %PROGRAM_FILES%\Orange\OrangeUpdate\Service\detectors\ManagedSoftware\mac\ManagedSoftware_orange-update.xml
- %PROGRAM_FILES%\Orange\OrangeUpdate\Service\detectors\ManagedSoftware\mac\ManagedSoftware_notificationmail.xml
- %PROGRAM_FILES%\Orange\OrangeUpdate\Service\detectors\ManagedSoftware\ManagedSoftware_internetexplorer.xml
- %PROGRAM_FILES%\Orange\OrangeUpdate\Service\QtCore4.dll
- %PROGRAM_FILES%\Orange\OrangeUpdate\Service\ProxyDetection.dll
- %PROGRAM_FILES%\Orange\OrangeUpdate\Service\DCProtocol.dll
- %PROGRAM_FILES%\Orange\OrangeUpdate\Service\detectors\ManagedSoftware\ManagedSoftware_adventurer.xml
- %PROGRAM_FILES%\Orange\OrangeUpdate\Service\detectors\ManagedSoftware\ManagedSoftware_custoIE.xml
- %PROGRAM_FILES%\Orange\OrangeUpdate\Service\detectors\ManagedSoftware\ManagedSoftware_assistance-livebox.xml
- %PROGRAM_FILES%\Orange\OrangeUpdate\Service\detectors\ManagedSoftware\ManagedSoftware_asistente-router.xml
Удаляет следующие файлы:
- %ALLUSERSPROFILE%\Application Data\Orange\Orange update\OUCore\users\%USERNAME%\LocalCatalog.xml
- %ALLUSERSPROFILE%\Application Data\Orange\Orange update\OULookup\lookup.1.spOutReq.xml
- %TEMP%\nsr3.tmp\System.dll
- %TEMP%\nsr3.tmp\ExecDos.dll
- %TEMP%\nsr3.tmp\SimpleFC.dll
Сетевая активность:
Подключается к:
- 'sd######-apct.orange.com':80
- 'up####.###icielsgratuits.orange.fr':80
- 'localhost':6037
- 'wp#d':80
TCP:
Запросы HTTP GET:
- sd######-apct.orange.com/v1/dcshe0xwm4zegprvgjrair095_1c5q/events.svc?dc########################################################################################################################################################################
- wp#d/wpad.dat
Запросы HTTP POST:
- up####.###icielsgratuits.orange.fr/updater/getUpdateInfos.php
UDP:
- DNS ASK up####.###icielsgratuits.orange.fr
- DNS ASK sd######-apct.orange.com
- DNS ASK wp#d
Другое:
Ищет следующие окна:
- ClassName: '(null)' WindowName: '(null)'
