Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'wjplay2_20140227145919' = '"%PROGRAM_FILES%\wjplay2\20140227145919\wjplay.exe" -mini'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'wjplay2_News_20140227145919' = '"%PROGRAM_FILES%\wjplay2\20140227145919\WJSpeed.exe" -mini'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Winssvr Service] 'Start' = '00000002'
Вредоносные функции:
Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\meinvying\meinvying.exe' = '%PROGRAM_FILES%\meinvying\meinvying.exe:*:Enabled:ГАЕ®УЄ'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%TEMP%\nsx3.tmp\meinvying.exe' = '%TEMP%\nsx3.tmp\meinvying.exe:*:Enabled:ГАЕ®УЄ'
Создает и запускает на исполнение:
- '%TEMP%\nso6.tmp\ns8.tmp' sc description "Winssvr Service" "Winssvr Service"
- '%TEMP%\nso6.tmp\ns7.tmp' sc create "Winssvr Service" binPath= "%PROGRAM_FILES%\aqingz3.7\Winsvr.exe" start= auto
- '%PROGRAM_FILES%\wjplay2\20140227145919\wjplay.exe' -mini
- '%PROGRAM_FILES%\wjplay2\20140227145919\WJSpeed.exe'
- '%PROGRAM_FILES%\aqingz3.7\lovmon.exe' /s
- '%PROGRAM_FILES%\aqingz3.7\Aqingz3.7.exe'
- '%PROGRAM_FILES%\meinvying\meinvying.exe' /A
- '%PROGRAM_FILES%\Your Product\pczh_107_1689.exe'
- '%PROGRAM_FILES%\Your Product\-8670_1689_mm.exe'
- '%TEMP%\_ir_sf_temp_0\irsetup.exe' __IRAOFF:731682 "__IRAFN:<Полный путь к вирусу>" "__IRCT:1" "__IRTSS:0" "__IRSID:S-1-5-21-2052111302-484763869-725345543-1003"
- '%TEMP%\nsx3.tmp\meinvying.exe' /fix
- '%PROGRAM_FILES%\Your Product\Мы°ЙІвКФ.exe'
- '%PROGRAM_FILES%\Your Product\setup_open_4705-1689.exe'
Запускает на исполнение:
- '<SYSTEM32>\sc.exe' description "Winssvr Service" "Winssvr Service"
- '<SYSTEM32>\sc.exe' create "Winssvr Service" binPath= "%PROGRAM_FILES%\aqingz3.7\Winsvr.exe" start= auto
- '<SYSTEM32>\taskkill.exe' /F /im mvhd.exe
Ищет ветки реестра, отвечающие за хранение паролей сторонними программами:
- [<HKCU>\Software\FlashFXP]
Изменения в файловой системе:
Создает следующие файлы:
- %PROGRAM_FILES%\wjplay2\20140227145919\SysConfig.ini
- %PROGRAM_FILES%\wjplay2\20140227145919\Unins.exe
- %PROGRAM_FILES%\wjplay2\20140227145919\server.ini
- %PROGRAM_FILES%\wjplay2\20140227145919\stat.ini
- %PROGRAM_FILES%\wjplay2\20140227145919\wjplay.exe
- %PROGRAM_FILES%\aqingz3.7\uninstall.exe
- %ALLUSERSPROFILE%\Desktop\wjplay2.lnk
- %PROGRAM_FILES%\wjplay2\20140227145919\WJSpeed.exe
- %PROGRAM_FILES%\aqingz3.7\Aqingz3.7.exe
- %PROGRAM_FILES%\wjplay2\20140227145919\playlist.xml
- %PROGRAM_FILES%\wjplay2\20140227145919\Data\poptime_bg.png
- %PROGRAM_FILES%\wjplay2\20140227145919\Data\tab_more.png
- %PROGRAM_FILES%\wjplay2\20140227145919\Data\err.jpg
- %PROGRAM_FILES%\wjplay2\20140227145919\Data\loading.gif
- %PROGRAM_FILES%\wjplay2\20140227145919\Data\User2.ini
- %PROGRAM_FILES%\wjplay2\20140227145919\locallist.xml
- %PROGRAM_FILES%\wjplay2\20140227145919\PlayerUpdate.exe
- %PROGRAM_FILES%\wjplay2\20140227145919\Data\wj.ico
- %PROGRAM_FILES%\wjplay2\20140227145919\DuiLib.dll
- %PROGRAM_FILES%\aqingz3.7\lovmon.exe
- %TEMP%\nso6.tmp\Math.dll
- %APPDATA%\zn2720142\min.ini
- %TEMP%\nso6.tmp\ns8.tmp
- %HOMEPATH%\Desktop\°®Зй.ЦЗ»Ы.3.7.lnk
- %APPDATA%\zn2720142\set.ini
- %WINDIR%\wininit.ini
- %HOMEPATH%\AppData\LocalLow\MeiNvYing\Fav9.dat
- %TEMP%\nso6.tmp\md5dll.dll
- %TEMP%\nso6.tmp\Inetc.dll
- %TEMP%\nso6.tmp\ns7.tmp
- %HOMEPATH%\Start Menu\Programs\wjplay2\№Щ·ЅЦчТі.lnk
- %HOMEPATH%\Start Menu\Programs\wjplay2\ЕдЦГ№¤ѕЯ\Р¶ФШwjplay2.lnk
- %PROGRAM_FILES%\aqingz3.7\Winsvr.exe
- %HOMEPATH%\Start Menu\Programs\wjplay2\wjplay2.lnk
- %HOMEPATH%\Start Menu\Programs\°®Зй.ЦЗ»Ы.3.7\Р¶ФШ.lnk
- %HOMEPATH%\Favorites\Гв·СЙПНшµјєЅ.url
- %HOMEPATH%\Favorites\МмТнѕьКВНш.url
- %HOMEPATH%\Start Menu\Programs\°®Зй.ЦЗ»Ы.3.7\°®Зй.ЦЗ»Ы.3.7.lnk
- %TEMP%\nso6.tmp\nsExec.dll
- %PROGRAM_FILES%\wjplay2\20140227145919\Data\Err.html
- %PROGRAM_FILES%\Your Product\Мы°ЙІвКФ.exe
- %HOMEPATH%\Start Menu\Programs\Your Product\-8670_1689_mm.lnk
- %PROGRAM_FILES%\Your Product\pczh_107_1689.exe
- %PROGRAM_FILES%\Your Product\setup_open_4705-1689.exe
- %HOMEPATH%\Start Menu\Programs\Your Product\pczh_107_1689.lnk
- %PROGRAM_FILES%\Your Product\Uninstall\IRIMG1.JPG
- %PROGRAM_FILES%\Your Product\Uninstall\IRIMG2.JPG
- %HOMEPATH%\Start Menu\Programs\Your Product\ОЮј«У°Тф°ІЧ°іМРт.lnk
- %HOMEPATH%\Start Menu\Programs\Your Product\QQЧЁ°ж.lnk
- %PROGRAM_FILES%\Your Product\-8670_1689_mm.exe
- %TEMP%\_ir_sf_temp_0\IRIMG1.JPG
- %TEMP%\_ir_sf_temp_0\IRIMG2.JPG
- %TEMP%\_ir_sf_temp_0\irsetup.exe
- %TEMP%\_ir_sf_temp_0\irsetup.dat
- %TEMP%\Your Product Setup Log.txt
- %PROGRAM_FILES%\Your Product\uninstall.exe
- %PROGRAM_FILES%\Your Product\Uninstall\uninstall.xml
- %PROGRAM_FILES%\Your Product\Uninstall\uni1.tmp
- %PROGRAM_FILES%\Your Product\Uninstall\uninstall.dat
- %HOMEPATH%\Start Menu\Programs\Your Product\Uninstall Your Product.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\ГАЕ®УЄ\Р¶ФШГАЕ®УЄ.lnk
- %ALLUSERSPROFILE%\Desktop\ГАЕ®УЄ.lnk
- %PROGRAM_FILES%\meinvying\ГАЕ®УЄ.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\ГАЕ®УЄ\ГАЕ®УЄ.lnk
- %PROGRAM_FILES%\wjplay2\20140227145919\bottom.xml
- %PROGRAM_FILES%\wjplay2\20140227145919\Data\def.jpg
- %PROGRAM_FILES%\wjplay2\20140227145919\Data\EKanR.dat
- %PROGRAM_FILES%\wjplay2\20140227145919\client.ini
- %PROGRAM_FILES%\wjplay2\20140227145919\Data\Def.html
- %HOMEPATH%\Templates\2720142145913859\YYM_955WD30.gif
- %TEMP%\nst5.tmp
- %TEMP%\nso6.tmp\Base64.dll
- %TEMP%\nsx3.tmp\System.dll
- %TEMP%\nsx3.tmp\meinvying.exe
- %TEMP%\nso6.tmp\System.dll
- %PROGRAM_FILES%\meinvying\mvyy.exe
- %PROGRAM_FILES%\meinvying\uninst.exe
- %TEMP%\nso6.tmp\NSISdl.dll
- %PROGRAM_FILES%\meinvying\meinvying.exe
Удаляет следующие файлы:
- %TEMP%\nso6.tmp\Math.dll
- %TEMP%\nso6.tmp\Inetc.dll
- %TEMP%\nso6.tmp\Base64.dll
- %TEMP%\nso6.tmp\md5dll.dll
- %TEMP%\nso6.tmp\System.dll
- %TEMP%\nso6.tmp\NSISdl.dll
- %TEMP%\nso6.tmp\nsExec.dll
- %TEMP%\nsx3.tmp\meinvying.exe
- %PROGRAM_FILES%\Your Product\Uninstall\uni1.tmp
- %TEMP%\_ir_sf_temp_0\irsetup.dat
- %TEMP%\nsx3.tmp\System.dll
- %HOMEPATH%\Templates\2720142145913859\YYM_955WD30.gif
- %TEMP%\nso6.tmp\ns8.tmp
- %TEMP%\nso6.tmp\ns7.tmp
Сетевая активность:
Подключается к:
- 'localhost':1050
- 'localhost':1048
- 'localhost':1055
- 'localhost':1053
- '<IP-адрес в локальной сети>':445
- 'localhost':1038
- 'xu#.###ogin2.tenpay.com':443
- 'up####.aiqingzhihui.com':80
TCP:
Запросы HTTP GET:
- up####.aiqingzhihui.com/0403/help1.html
UDP:
- DNS ASK up###e.wuji.com
- DNS ASK tj.###ingzhihui.com
- DNS ASK tv.###ingzhihui.com
- DNS ASK ai####.aiqingzhihui.com
- DNS ASK tj###.meinvying.net
- DNS ASK www.bi###sh8.com
- DNS ASK tj#.##invying.net
- DNS ASK xu#.###ogin2.tenpay.com
- DNS ASK up####.aiqingzhihui.com
- DNS ASK wj.#uji.com
- DNS ASK tj.#uji.com
- DNS ASK we#.##invying.net
Другое:
Ищет следующие окна:
- ClassName: '(null)' WindowName: '(null)'
- ClassName: 'MS_WebcheckMonitor' WindowName: '(null)'
- ClassName: 'MS_AutodialMonitor' WindowName: '(null)'
- ClassName: 'WujiPlayer' WindowName: '????????'
- ClassName: 'IEFrame' WindowName: '(null)'
- ClassName: '' WindowName: '(null)'
- ClassName: '(null)' WindowName: 'Microsoft Internet Explorer'
- ClassName: 'THtmFormShow' WindowName: '(null)'
- ClassName: 'TMeiNvYMainForm' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'TFormMini' WindowName: '(null)'
- ClassName: 'TFormHuodongMini' WindowName: '(null)'
- ClassName: 'TFormLoginTips' WindowName: '(null)'
- ClassName: 'TFormTips' WindowName: '(null)'
