Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'ebailing' = '%PROGRAM_FILES%\ebailing\ebailing.exe /boot'
- [<HKLM>\SOFTWARE\Classes\ebl\shell\open\command] '' = '%PROGRAM_FILES%\ebailing\ebailing.exe "%1"'
Вредоносные функции:
Создает и запускает на исполнение:
- '%PROGRAM_FILES%\ebailing\eh.exe'
- '%PROGRAM_FILES%\ebailing\MyUpdater.exe' /S /Q
- '%PROGRAM_FILES%\ebailing\clean_old.exe'
- '%PROGRAM_FILES%\ebailing\ebailing.exe' /first
Завершает или пытается завершить
следующие пользовательские процессы:
- intpro.exe
- zapro.exe
Изменения в файловой системе:
Создает следующие файлы:
- %PROGRAM_FILES%\ebailing\skins\PhoneVE\Slider.bmp
- %PROGRAM_FILES%\ebailing\skins\PhoneVE\Slider_H.bmp
- %PROGRAM_FILES%\ebailing\skins\PhoneVE\Resource.h
- %PROGRAM_FILES%\ebailing\skins\PhoneVE\Sel.bmp
- %PROGRAM_FILES%\ebailing\skins\PhoneVE\XLeft_H.bmp
- %PROGRAM_FILES%\ebailing\skins\PhoneVE\XLeft_N.bmp
- %PROGRAM_FILES%\ebailing\skins\PhoneVE\Slider_S.bmp
- %PROGRAM_FILES%\ebailing\skins\PhoneVE\Thumbs.db
- %PROGRAM_FILES%\ebailing\skins\PhoneV\right_N.bmp
- %PROGRAM_FILES%\ebailing\skins\PhoneV\the.ui
- %PROGRAM_FILES%\ebailing\skins\PhoneV\left_N.bmp
- %PROGRAM_FILES%\ebailing\skins\PhoneV\right.bmp
- %PROGRAM_FILES%\ebailing\skins\PhoneVE\Main_E_N.bmp
- %PROGRAM_FILES%\ebailing\skins\PhoneVE\Main_E_S.bmp
- %PROGRAM_FILES%\ebailing\skins\PhoneVE\GradingBG.bmp
- %PROGRAM_FILES%\ebailing\skins\PhoneVE\Main_E_H.bmp
- %PROGRAM_FILES%\ebailing\skins\PhoneVE\the.ui
- %WINDIR%\my_updater.ini
- %PROGRAM_FILES%\ebailing\skins\PhoneVE\right_N.bmp
- %PROGRAM_FILES%\ebailing\skins\PhoneVE\rightbotton.bmp
- %PROGRAM_FILES%\ebailing\history.dat
- %TEMP%\helo_mu\version.ini
- %PROGRAM_FILES%\ebailing\uninstall.exe
- %HOMEPATH%\Desktop\°ЩБйЦъАн.lnk
- %PROGRAM_FILES%\ebailing\skins\PhoneVE\XRight_N.bmp
- %PROGRAM_FILES%\ebailing\skins\PhoneVE\XRight_S.bmp
- %PROGRAM_FILES%\ebailing\skins\PhoneVE\XLeft_S.bmp
- %PROGRAM_FILES%\ebailing\skins\PhoneVE\XRight_H.bmp
- %PROGRAM_FILES%\ebailing\skins\PhoneVE\leftbotton.bmp
- %PROGRAM_FILES%\ebailing\skins\PhoneVE\right.bmp
- %PROGRAM_FILES%\ebailing\skins\PhoneVE\left.bmp
- %PROGRAM_FILES%\ebailing\skins\PhoneVE\left_N.bmp
- %PROGRAM_FILES%\ebailing\skins\PhoneV\left.bmp
- %PROGRAM_FILES%\ebailing\View.exe
- %PROGRAM_FILES%\ebailing\skins\PhoneV\GradingBG.bmp
- %PROGRAM_FILES%\ebailing\NetViewX.ocx
- %PROGRAM_FILES%\ebailing\NetClient.dll
- %PROGRAM_FILES%\ebailing\skins\PhoneV\Main_E_S.bmp
- %PROGRAM_FILES%\ebailing\skins\PhoneV\Main_H.bmp
- %PROGRAM_FILES%\ebailing\skins\PhoneV\Main_E_H.bmp
- %PROGRAM_FILES%\ebailing\skins\PhoneV\Main_E_N.bmp
- %PROGRAM_FILES%\ebailing\DeviceManager.dll
- %PROGRAM_FILES%\ebailing\ebailing.exe
- %PROGRAM_FILES%\ebailing\clean_old.exe
- %PROGRAM_FILES%\ebailing\portSIPCore.dll
- %PROGRAM_FILES%\ebailing\zh_CN.dat
- %PROGRAM_FILES%\ebailing\en_US.dat
- %PROGRAM_FILES%\ebailing\MyUpdater.exe
- %PROGRAM_FILES%\ebailing\eh.exe
- %PROGRAM_FILES%\ebailing\skins\PhoneV\XLeft_S.bmp
- %PROGRAM_FILES%\ebailing\skins\PhoneV\XRight_H.bmp
- %PROGRAM_FILES%\ebailing\skins\PhoneV\XLeft_H.bmp
- %PROGRAM_FILES%\ebailing\skins\PhoneV\XLeft_N.bmp
- %PROGRAM_FILES%\ebailing\skins\PhoneV\blank.bmp
- %PROGRAM_FILES%\ebailing\skins\PhoneV\box.bmp
- %PROGRAM_FILES%\ebailing\skins\PhoneV\XRight_N.bmp
- %PROGRAM_FILES%\ebailing\skins\PhoneV\XRight_S.bmp
- %PROGRAM_FILES%\ebailing\skins\PhoneV\Resource.h
- %PROGRAM_FILES%\ebailing\skins\PhoneV\Sel.bmp
- %PROGRAM_FILES%\ebailing\skins\PhoneV\Main_N.bmp
- %PROGRAM_FILES%\ebailing\skins\PhoneV\Main_S.bmp
- %PROGRAM_FILES%\ebailing\skins\PhoneV\Slider_S.bmp
- %PROGRAM_FILES%\ebailing\skins\PhoneV\Thumbs.db
- %PROGRAM_FILES%\ebailing\skins\PhoneV\Slider.bmp
- %PROGRAM_FILES%\ebailing\skins\PhoneV\Slider_H.bmp
Сетевая активность:
Подключается к:
- 'www.eb###ing.com':80
TCP:
Запросы HTTP GET:
- www.eb###ing.com/download/version.ini?v=#############################################
UDP:
- DNS ASK www.eb###ing.com
Другое:
Ищет следующие окна:
- ClassName: '(null)' WindowName: '????????'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
