Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Internet Explorer\Extensions\{54E67346-EE5A-45B6-82AA-4F0BB28C79C2}] 'ClsidExtension' = '{54E67346-EE5A-45B6-82AA-4F0BB28C79C2}'
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\regsvr32.exe' /s "%PROGRAM_FILES%\iRobinHood\iRobinHood Addon\iRobinHood.dll"
- '<SYSTEM32>\taskkill.exe' "/F /IM rssclient.exe"
- '<SYSTEM32>\taskkill.exe' /F /IM tbhelper2.exe
Изменения в файловой системе:
Создает следующие файлы:
- %PROGRAM_FILES%\iRobinHood\iRobinHood Addon\login-icon-16x16.png
- %PROGRAM_FILES%\iRobinHood\iRobinHood Addon\linkedin-icon-16x16.png
- %PROGRAM_FILES%\iRobinHood\iRobinHood Addon\inboxHasMessage.png
- %PROGRAM_FILES%\iRobinHood\iRobinHood Addon\openshareicon-20x20.png
- %PROGRAM_FILES%\iRobinHood\iRobinHood Addon\openshareicon-16x16.png
- %PROGRAM_FILES%\iRobinHood\iRobinHood Addon\logo.png
- %PROGRAM_FILES%\iRobinHood\iRobinHood Addon\hotmail-icon-16x16.png
- %PROGRAM_FILES%\iRobinHood\iRobinHood Addon\gmail-icon-16x16.png
- %PROGRAM_FILES%\iRobinHood\iRobinHood Addon\email-icon-16x16.png
- %PROGRAM_FILES%\iRobinHood\iRobinHood Addon\inbox.png
- %PROGRAM_FILES%\iRobinHood\iRobinHood Addon\imggoogle.png
- %PROGRAM_FILES%\iRobinHood\iRobinHood Addon\imgamazon.png
- %PROGRAM_FILES%\iRobinHood\iRobinHood Addon\openshareicon-24x24.png
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\install_stats[1].aspx
- %TEMP%\nsc2.tmp\inetc.dll
- %TEMP%\nsc2.tmp\IpConfig.dll
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\irobinhood@irobinhood.org.xpi
- %PROGRAM_FILES%\iRobinHood\iRobinHood Addon\uninstall.exe
- %TEMP%\1.tmp
- %PROGRAM_FILES%\iRobinHood\iRobinHood Addon\yahoo-icon-16x16.png
- %PROGRAM_FILES%\iRobinHood\iRobinHood Addon\shops.png
- %PROGRAM_FILES%\iRobinHood\iRobinHood Addon\share.png
- %PROGRAM_FILES%\iRobinHood\iRobinHood Addon\iRobinHoodPartnersVExtension1_42.crx
- %PROGRAM_FILES%\iRobinHood\iRobinHood Addon\irobinhood@irobinhood.org.xpi
- %PROGRAM_FILES%\iRobinHood\iRobinHood Addon\ToolConfig.xml
- %PROGRAM_FILES%\iRobinHood\iRobinHood Addon\ebay-icon-yellow-20x20.png
- %PROGRAM_FILES%\iRobinHood\iRobinHood Addon\ContributingCategory.png
- %PROGRAM_FILES%\iRobinHood\iRobinHood Addon\Contributing.png
- %PROGRAM_FILES%\iRobinHood\iRobinHood Addon\off.ico
- %PROGRAM_FILES%\iRobinHood\iRobinHood Addon\My Contributions.png
- %PROGRAM_FILES%\iRobinHood\iRobinHood Addon\FaceBook-icon-20x20.png
- %PROGRAM_FILES%\iRobinHood\iRobinHood Addon\FaceBook-icon-16x16.png
- %TEMP%\nsc2.tmp\UserInfo.dll
- %TEMP%\iRobinHoodAddonInstall.txt
- %TEMP%\nsc2.tmp\LogEx.dll
- %PROGRAM_FILES%\iRobinHood\iRobinHood Addon\On.ico
- %PROGRAM_FILES%\iRobinHood\iRobinHood Addon\iRobinHood.dll
- %TEMP%\nsc2.tmp\System.dll
- %PROGRAM_FILES%\iRobinHood\iRobinHood Addon\Non-Contributing.png
- %PROGRAM_FILES%\iRobinHood\iRobinHood Addon\YouTube-icon-20x20.png
- %PROGRAM_FILES%\iRobinHood\iRobinHood Addon\Twitter-icon-20x20.png
- %PROGRAM_FILES%\iRobinHood\iRobinHood Addon\Twitter-icon-16x16.png
- %PROGRAM_FILES%\iRobinHood\iRobinHood Addon\digg-icon-16x16.png
- %PROGRAM_FILES%\iRobinHood\iRobinHood Addon\delicious-icon-16x16.png
- %PROGRAM_FILES%\iRobinHood\iRobinHood Addon\blogger-icon-16x16.png
- %PROGRAM_FILES%\iRobinHood\iRobinHood Addon\On32x32.png
- %PROGRAM_FILES%\iRobinHood\iRobinHood Addon\On128x128.png
- %PROGRAM_FILES%\iRobinHood\iRobinHood Addon\On.png
- %PROGRAM_FILES%\iRobinHood\iRobinHood Addon\Prompt.png
- %PROGRAM_FILES%\iRobinHood\iRobinHood Addon\PayPal.png
- %PROGRAM_FILES%\iRobinHood\iRobinHood Addon\On48x48.png
Удаляет следующие файлы:
- %TEMP%\nsc2.tmp\System.dll
- %TEMP%\nsc2.tmp\UserInfo.dll
- %TEMP%\nsc2.tmp\LogEx.dll
- %TEMP%\nsc2.tmp\inetc.dll
- %TEMP%\nsc2.tmp\IpConfig.dll
Сетевая активность:
Подключается к:
- 'do####on-tools.org':80
TCP:
Запросы HTTP GET:
- do####on-tools.org/install_stats.aspx?in####################################
UDP:
- DNS ASK do####on-tools.org
Другое:
Ищет следующие окна:
- ClassName: '#32770' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: '(null)' WindowName: '(null)'
