Техническая информация
Вредоносные функции
Ищет ветки реестра, отвечающие за хранение паролей сторонними программами
- [HKCU\Software\Microsoft\MSNMessenger]
Читает файлы, отвечающие за хранение паролей сторонними программами
- %APPDATA%\mozilla\firefox\profiles.ini
- %LOCALAPPDATA%\google\chrome\user data\default\web data
Изменения в файловой системе
Создает следующие файлы
- %APPDATA%\abs10\app\boostspeed\axcomponentsrtl.bpl
- %APPDATA%\abs10\app\boostspeed\axcomponentsvcl.bpl
- %APPDATA%\abs10\app\boostspeed\data\applications.dat
- %APPDATA%\abs10\app\boostspeed\data\main.ini
- %APPDATA%\abs10\app\boostspeed\data\products.json
- %APPDATA%\abs10\app\boostspeed\lang\deu.lng
- %APPDATA%\abs10\app\boostspeed\lang\enu.lng
- %APPDATA%\abs10\app\boostspeed\lang\esp.lng
- %APPDATA%\abs10\app\boostspeed\lang\fra.lng
- %APPDATA%\abs10\app\boostspeed\lang\ita.lng
- %APPDATA%\abs10\app\boostspeed\lang\jpn.lng
- %APPDATA%\abs10\app\boostspeed\lang\rus.lng
- %APPDATA%\abs10\app\boostspeed\rtl250.bpl
- %APPDATA%\abs10\app\boostspeed\vcl250.bpl
- %APPDATA%\abs10\app\boostspeed\vclimg250.bpl
- %APPDATA%\abs10\auslogicsboostspeedportable.ini
- %APPDATA%\abs10\data\auslogicsboostspeedportable.reg
- %APPDATA%\abs10\data\settings\auslogicsboostspeedportablesettings.ini
- %APPDATA%\abs10\app\boostspeed\actioncenterforms.dll
- %APPDATA%\abs10\app\boostspeed\actioncenterhelper.dll
- %APPDATA%\abs10\app\boostspeed\advisorhelper.dll
- %APPDATA%\abs10\app\boostspeed\atpopupshelper.dll
- %APPDATA%\abs10\app\boostspeed\attoolsexthelper.dll
- %APPDATA%\abs10\app\boostspeed\attoolsstdhelper.dll
- %APPDATA%\abs10\app\boostspeed\atupdatershelper.dll
- %APPDATA%\abs10\app\boostspeed\boostspeed.exe
- %APPDATA%\abs10\app\boostspeed\browsercarehelper.agent.x32.dll
- %APPDATA%\abs10\app\boostspeed\browsercarehelper.agent.x64.dll
- %APPDATA%\abs10\app\boostspeed\browsercarehelper.dll
- %APPDATA%\abs10\app\boostspeed\browserhelper.dll
- %APPDATA%\abs10\app\boostspeed\cdefrag.exe
- %APPDATA%\abs10\app\boostspeed\cfahelper.dll
- %APPDATA%\abs10\app\boostspeed\commonforms.dll
- %APPDATA%\abs10\app\boostspeed\commonforms.routine.dll
- %APPDATA%\abs10\app\boostspeed\commonforms.site.dll
- %APPDATA%\abs10\app\boostspeed\debughelper.dll
- %APPDATA%\abs10\app\boostspeed\diskcleanerhelper.dll
- %APPDATA%\abs10\app\boostspeed\diskdefrag.exe
- %APPDATA%\abs10\app\boostspeed\diskdefraghelper.dll
- %APPDATA%\abs10\app\boostspeed\diskdoctor.exe
- %APPDATA%\abs10\app\boostspeed\diskdoctorchecker.x32.dll
- %APPDATA%\abs10\app\boostspeed\diskdoctorchecker.x64.dll
- %APPDATA%\abs10\app\boostspeed\diskdoctorhelper.dll
- %APPDATA%\abs10\app\boostspeed\diskexplorer.exe
- %APPDATA%\abs10\app\boostspeed\diskexplorerhelper.dll
- %APPDATA%\abs10\app\boostspeed\diskwipehelper.dll
- %APPDATA%\abs10\app\boostspeed\dssrcasync.dll
- %APPDATA%\abs10\app\boostspeed\dssrcwm.dll
- %APPDATA%\abs10\app\boostspeed\duplicatefilefinder.exe
- %APPDATA%\abs10\app\boostspeed\duplicatefilefinderhelper.dll
- %APPDATA%\abs10\app\boostspeed\filerecovery.exe
- %APPDATA%\abs10\app\boostspeed\filerecoveryhelper.dll
- %APPDATA%\abs10\app\boostspeed\fileshredder.exe
- %APPDATA%\abs10\app\boostspeed\freespacewiper.exe
- %APPDATA%\abs10\app\boostspeed\internetoptimizer.exe
- %APPDATA%\abs10\app\boostspeed\internetoptimizerhelper.dll
- %APPDATA%\abs10\app\boostspeed\localizer.dll
- %APPDATA%\abs10\app\boostspeed\ndefrg32.exe
- %APPDATA%\abs10\app\boostspeed\ndefrg64.exe
- %APPDATA%\abs10\app\boostspeed\rdboot32.exe
- %APPDATA%\abs10\app\boostspeed\rdboot64.exe
- %APPDATA%\abs10\app\boostspeed\registrycleaner.exe
- %APPDATA%\abs10\app\boostspeed\registrycleanerhelper.dll
- %APPDATA%\abs10\app\boostspeed\registrydefrag.exe
- %APPDATA%\abs10\app\boostspeed\registrydefraghelper.dll
- %APPDATA%\abs10\app\boostspeed\reporthelper.dll
- %APPDATA%\abs10\app\boostspeed\rescuecenter.exe
- %APPDATA%\abs10\app\boostspeed\rescuecenterform.dll
- %APPDATA%\abs10\app\boostspeed\rescuecenterhelper.dll
- %APPDATA%\abs10\app\boostspeed\senddebuglog.exe
- %APPDATA%\abs10\app\boostspeed\servicemanagerhelper.dll
- %APPDATA%\abs10\app\boostspeed\shellextension.contextmenu.x32.dll
- %APPDATA%\abs10\app\boostspeed\shellextension.contextmenu.x64.dll
- %APPDATA%\abs10\app\boostspeed\shellextension.dll
- %APPDATA%\abs10\app\boostspeed\shfolder.dll
- %APPDATA%\abs10\app\boostspeed\spywarecheckerhelper.dll
- %APPDATA%\abs10\app\boostspeed\sqlite3.dll
- %APPDATA%\abs10\app\boostspeed\startupmanager.exe
- %APPDATA%\abs10\app\boostspeed\startupmanagerhelper.dll
- %APPDATA%\abs10\app\boostspeed\systeminformation.exe
- %APPDATA%\abs10\app\boostspeed\systeminformationhelper.dll
- %APPDATA%\abs10\app\boostspeed\taskmanager.exe
- %APPDATA%\abs10\app\boostspeed\taskmanagerhelper.agent.x32.dll
- %APPDATA%\abs10\app\boostspeed\taskmanagerhelper.agent.x64.dll
- %APPDATA%\abs10\app\boostspeed\taskmanagerhelper.dll
- %APPDATA%\abs10\app\boostspeed\taskschedulerhelper.dll
- %APPDATA%\abs10\app\boostspeed\trackeraserhelper.dll
- %APPDATA%\abs10\app\boostspeed\tweakmanager.exe
- %APPDATA%\abs10\app\boostspeed\tweakmanagerhelper.dll
- %APPDATA%\abs10\app\boostspeed\uninstallmanager.exe
- %APPDATA%\abs10\app\boostspeed\uninstallmanagerhelper.dll
- %APPDATA%\abs10\app\boostspeed\volumeshelper.dll
- %APPDATA%\abs10\app\boostspeed\windowsslimmer.exe
- %APPDATA%\abs10\app\boostspeed\windowsslimmerhelper.dll
- %APPDATA%\abs10\boostspeed10.exe
- %TEMP%\nsu1ca3.tmp
- %TEMP%\nsj1cc3.tmp\registry.dll
- %TEMP%\nsj1cc3.tmp\system.dll
- %ALLUSERSPROFILE%\auslogics\boostspeed\10.x\logs\tweakmanagerstatistics.log
- %ALLUSERSPROFILE%\auslogics\boostspeed\10.x\rescuehidden\boostspeed\251024134248634.rsc
- %ALLUSERSPROFILE%\auslogics\boostspeed\10.x\$$$web data135785431
- %ALLUSERSPROFILE%\auslogics\boostspeed\10.x\$$$web data135785474
- %ALLUSERSPROFILE%\auslogics\boostspeed\10.x\$$$web data135785485
- %ALLUSERSPROFILE%\auslogics\boostspeed\10.x\$$$web data135790171
- %ALLUSERSPROFILE%\auslogics\boostspeed\10.x\$$$web data135791092
- D:\ddfc36af-d567-4d21-b5e7-8a66d3d5c4ff.tmp
- C:\ddfc36af-d567-4d21-b5e7-8a66d3d5c4ff.tmp
Удаляет файлы, которые сам же создал
- %ALLUSERSPROFILE%\auslogics\boostspeed\10.x\$$$web data135785431
- %ALLUSERSPROFILE%\auslogics\boostspeed\10.x\$$$web data135785474
- %ALLUSERSPROFILE%\auslogics\boostspeed\10.x\$$$web data135785485
- %ALLUSERSPROFILE%\auslogics\boostspeed\10.x\$$$web data135790171
- %ALLUSERSPROFILE%\auslogics\boostspeed\10.x\$$$web data135791092
Сетевая активность
Подключается к
- 'au###gics.com':80
- 'au###gics.com':443
- 'oc##.#ectigo.com':80
TCP
Запросы HTTP GET
- http://www.au###gics.com/tools/autoupdate/?s=###
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?22##############
- http://oc##.#ectigo.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRDC9IOTxN6GmyRjyTl2n4yTUczyAQUjYxexFStiuF36Zv5mwXhuAGNYeECEDtQwuL0rPqYbCY5zwX5tbA%3D
Другие
- 'au###gics.com':443
UDP
- DNS ASK au###gics.com
- DNS ASK oc##.#ectigo.com
Другое
Ищет следующие окна
- ClassName: 'RegEdit_RegEdit' WindowName: ''
Создает и запускает на исполнение
- '%APPDATA%\abs10\boostspeed10.exe'
- '%APPDATA%\abs10\app\boostspeed\boostspeed.exe'
Запускает на исполнение
- '%WINDIR%\syswow64\regedit.exe' /s "%APPDATA%\ABS10\Data\\AusLogicsBoostSpeedPortable.reg"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%APPDATA%\ABS10\App\BoostSpeed\BrowserCareHelper.Agent.x32.dll" (со скрытым окном)
- '%WINDIR%\syswow64\regsvr32.exe' /s "%APPDATA%\ABS10\App\BoostSpeed\BrowserCareHelper.Agent.x64.dll" (со скрытым окном)
- '<SYSTEM32>\regsvr32.exe' /s "%APPDATA%\ABS10\App\BoostSpeed\BrowserCareHelper.Agent.x64.dll"
- '%APPDATA%\abs10\boostspeed10.exe' (со скрытым окном)
