Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'oTimer' = '%APPDATA%\OT\oTimer.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'wjplay2_20140414173322' = '"%PROGRAM_FILES%\wjplay2\20140414173322\wjplay.exe" -mini'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'wjplay2_News_20140414173322' = '"%PROGRAM_FILES%\wjplay2\20140414173322\WJSpeed.exe" -mini'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Txssvr Service] 'Start' = '00000002'
Вредоносные функции:
Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\meinvying\meinvying.exe' = '%PROGRAM_FILES%\meinvying\meinvying.exe:*:Enabled:ГАЕ®УЄ'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\Your Product\woayavc_30309.exe' = '%PROGRAM_FILES%\Your Product\woayavc_30309.exe:*:Enabled:百度杀毒在线安装程序'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\Your Product\woayavc_30309.exe' = '%PROGRAM_FILES%\Your Product\woayavc_30309.exe:*:Enabled:百度杀毒在线安装程序'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%TEMP%\nsq3.tmp\meinvying.exe' = '%TEMP%\nsq3.tmp\meinvying.exe:*:Enabled:ГАЕ®УЄ'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\Your Product\qrgxdr_70739.exe' = '%PROGRAM_FILES%\Your Product\qrgxdr_70739.exe:*:Enabled:百度卫士在线安装程序'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\Your Product\qrgxdr_70739.exe' = '%PROGRAM_FILES%\Your Product\qrgxdr_70739.exe:*:Enabled:百度卫士在线安装程序'
Создает и запускает на исполнение:
- '%TEMP%\nsx6.tmp\nsD.tmp' sc create "Txssvr Service" binPath= "%PROGRAM_FILES%\aiqngz3.8\Txsvr.exe" start= auto
- '%TEMP%\nsx6.tmp\nsE.tmp' sc description "Txssvr Service" "Txssvr Service"
- '%PROGRAM_FILES%\wjplay2\20140414173322\WJSpeed.exe'
- '%PROGRAM_FILES%\wjplay2\20140414173322\wjplay.exe' -mini
- '%APPDATA%\OT\oTimer.exe'
- '%APPDATA%\OT\oUpdater.exe' -uploaddata
- '%APPDATA%\OT\oUpdater.exe' -update
- '%APPDATA%\OT\oInfo.exe'
- '%PROGRAM_FILES%\aiqngz3.8\Aiqngz3.8.exe'
- '%PROGRAM_FILES%\aiqngz3.8\fastlo.exe' /s
- '%PROGRAM_FILES%\Your Product\-8670_2508_mny.exe'
- '%PROGRAM_FILES%\Your Product\pczh_107_2508.exe'
- '%PROGRAM_FILES%\Your Product\setup_open_4705-2508.exe'
- '%TEMP%\_ir_sf_temp_0\irsetup.exe' __IRAOFF:629794 "__IRAFN:<Полный путь к вирусу>" "__IRCT:1" "__IRTSS:0" "__IRSID:S-1-5-21-2052111302-484763869-725345543-1003"
- '%PROGRAM_FILES%\Your Product\22222221.exe'
- '%TEMP%\nsq3.tmp\meinvying.exe' /fix
- '%PROGRAM_FILES%\meinvying\meinvying.exe' /A
- '%PROGRAM_FILES%\Your Product\sonlinetime_1308.exe'
- '%PROGRAM_FILES%\Your Product\qrgxdr_70739.exe'
- '%PROGRAM_FILES%\Your Product\woayavc_30309.exe'
Запускает на исполнение:
- '<SYSTEM32>\sc.exe' description "Txssvr Service" "Txssvr Service"
- '<SYSTEM32>\sc.exe' create "Txssvr Service" binPath= "%PROGRAM_FILES%\aiqngz3.8\Txsvr.exe" start= auto
- '<SYSTEM32>\taskkill.exe' /F /im mvhd.exe
Ищет ветки реестра, отвечающие за хранение паролей сторонними программами:
- [<HKCU>\Software\FlashFXP]
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nspC.tmp\tmpndcodz.dll
- %APPDATA%\OT\ManTraySetDlg\ManTraySetDlg.xcproj
- %APPDATA%\OT\ManTraySetDlg\resource.res
- %HOMEPATH%\Start Menu\Programs\wjplay2\wjplay2.lnk
- %ALLUSERSPROFILE%\Desktop\ГАЕ®УЄ.lnk
- %TEMP%\nspC.tmp\BDMNetGetInfo.dll
- %APPDATA%\OT\ManTraySetDlg\mainFrame.xml
- %ALLUSERSPROFILE%\Desktop\wjplay2.lnk
- %HOMEPATH%\Templates\142014417331915\YYM_955WD30.gif
- %APPDATA%\OT\ManTraySetDlg\tabOtherSettings.xml
- %APPDATA%\OT\ManTraySetDlg\tabTimeSettings.xml
- %APPDATA%\OT\ManTraySetDlg\tabSoundSettings.xml
- %HOMEPATH%\Start Menu\Programs\wjplay2\ЕдЦГ№¤ѕЯ\Р¶ФШwjplay2.lnk
- %HOMEPATH%\Start Menu\Programs\wjplay2\№Щ·ЅЦчТі.lnk
- %APPDATA%\OT\ManTraySetDlg\tabGeneralSettings.xml
- %APPDATA%\OT\ManTraySetDlg\style.css
- %ALLUSERSPROFILE%\Start Menu\Programs\ГАЕ®УЄ\Р¶ФШГАЕ®УЄ.lnk
- %PROGRAM_FILES%\wjplay2\20140414173322\Unins.exe
- %PROGRAM_FILES%\wjplay2\20140414173322\SysConfig.ini
- %PROGRAM_FILES%\wjplay2\20140414173322\wjplay.exe
- %TEMP%\nspC.tmp\hu.dll
- %PROGRAM_FILES%\wjplay2\20140414173322\playlist.xml
- %PROGRAM_FILES%\wjplay2\20140414173322\PlayerUpdate.exe
- %PROGRAM_FILES%\wjplay2\20140414173322\stat.ini
- %PROGRAM_FILES%\wjplay2\20140414173322\server.ini
- %PROGRAM_FILES%\meinvying\ГАЕ®УЄ.lnk
- %TEMP%\nso9.tmp\tmpi7flio.dll
- %ALLUSERSPROFILE%\Start Menu\Programs\ГАЕ®УЄ\ГАЕ®УЄ.lnk
- %APPDATA%\OT\ManTraySetDlg\images\set_right.png
- %PROGRAM_FILES%\wjplay2\20140414173322\WJSpeed.exe
- %APPDATA%\OT\ManTraySetDlg\images\set_line.png
- %TEMP%\nspC.tmp\BDLogicUtils.dll
- %TEMP%\nso9.tmp\BDMNetGetInfo.dll
- %HOMEPATH%\Favorites\Гв·СЙПНшµјєЅ.url
- %HOMEPATH%\Start Menu\Programs\°®Зй.ЦЗ»Ы.3.8\Р¶ФШ.lnk
- %PROGRAM_FILES%\aiqngz3.8\Txsvr.exe
- %TEMP%\nsx6.tmp\nsExec.dll
- %HOMEPATH%\Start Menu\Programs\°®Зй.ЦЗ»Ы.3.8\°®Зй.ЦЗ»Ы.3.8.lnk
- %PROGRAM_FILES%\aiqngz3.8\Aiqngz3.8.exe
- %HOMEPATH%\AppData\LocalLow\MeiNvYing\Fav9.dat
- %PROGRAM_FILES%\aiqngz3.8\fastlo.exe
- %PROGRAM_FILES%\aiqngz3.8\uninstall.exe
- %APPDATA%\zn1420144\set.ini
- %APPDATA%\zn1420144\min.ini
- %TEMP%\nsx6.tmp\Inetc.dll
- %TEMP%\nsx6.tmp\md5dll.dll
- %TEMP%\nsx6.tmp\nsE.tmp
- %TEMP%\nsx6.tmp\nsD.tmp
- %TEMP%\nsx6.tmp\Math.dll
- %HOMEPATH%\Desktop\°®Зй.ЦЗ»Ы.3.8.lnk
- %HOMEPATH%\Start Menu\Programs\oTimer\Р¶ФШoTimer.lnk
- %APPDATA%\OT\oInfo.exe
- %APPDATA%\OT\MainSet.exe
- %APPDATA%\OT\PopWinParam.xml
- %APPDATA%\OT\oUpdater.exe
- %HOMEPATH%\Favorites\МмТнѕьКВНш.url
- %APPDATA%\OT\ManTraySetDlg\tabWeatherSettings.xml
- %APPDATA%\OT\resources\ErrorPage.html
- %APPDATA%\OT\resources\CityList.xml
- %APPDATA%\OT\oTimerDll.dll
- %APPDATA%\OT\oTimer.exe
- %HOMEPATH%\Start Menu\Programs\oTimer\oTimer.lnk
- %HOMEPATH%\Desktop\oTimer.lnk
- %APPDATA%\OT\Uninstall.exe
- %APPDATA%\OT\setup.ini
- %TEMP%\tmpSKZXSteup.zip
- %APPDATA%\OT\XCGUId.dll
- %HOMEPATH%\Start Menu\Programs\Your Product\sonlinetime_1308.lnk
- %HOMEPATH%\Start Menu\Programs\Your Product\loveyou.lnk
- %PROGRAM_FILES%\Your Product\Uninstall\IRIMG2.JPG
- %PROGRAM_FILES%\Your Product\Uninstall\IRIMG1.JPG
- %HOMEPATH%\Start Menu\Programs\Your Product\qrgxdr_70739.lnk
- %HOMEPATH%\Start Menu\Programs\Your Product\-8670_2508_mny.lnk
- %HOMEPATH%\Start Menu\Programs\Your Product\pczh_107_2508.lnk
- %HOMEPATH%\Start Menu\Programs\Your Product\woayavc_30309.lnk
- %TEMP%\tmpSKZXComm.zip
- %TEMP%\nsy8.tmp
- %TEMP%\nszB.tmp
- %TEMP%\nsx6.tmp\Base64.dll
- %TEMP%\nsq3.tmp\System.dll
- %HOMEPATH%\Start Menu\Programs\Your Product\Uninstall Your Product.lnk
- %TEMP%\nsq3.tmp\meinvying.exe
- %TEMP%\nsc5.tmp
- %HOMEPATH%\Start Menu\Programs\Your Product\ОЮј«У°Тф°ІЧ°іМРт.lnk
- %PROGRAM_FILES%\Your Product\Uninstall\uni1.tmp
- %TEMP%\Your Product Setup Log.txt
- %PROGRAM_FILES%\Your Product\uninstall.exe
- %PROGRAM_FILES%\Your Product\Uninstall\uninstall.dat
- %TEMP%\_ir_sf_temp_0\irsetup.dat
- %TEMP%\_ir_sf_temp_0\irsetup.exe
- %TEMP%\_ir_sf_temp_0\IRIMG2.JPG
- %TEMP%\_ir_sf_temp_0\IRIMG1.JPG
- %PROGRAM_FILES%\Your Product\pczh_107_2508.exe
- %PROGRAM_FILES%\Your Product\woayavc_30309.exe
- %PROGRAM_FILES%\Your Product\sonlinetime_1308.exe
- %PROGRAM_FILES%\Your Product\22222221.exe
- %PROGRAM_FILES%\Your Product\setup_open_4705-2508.exe
- %PROGRAM_FILES%\Your Product\Uninstall\uninstall.xml
- %PROGRAM_FILES%\Your Product\qrgxdr_70739.exe
- %PROGRAM_FILES%\Your Product\-8670_2508_mny.exe
- %TEMP%\nso9.tmp\res\onlineWnd.zip
- %TEMP%\nso9.tmp\BDLogicUtils.dll
- %PROGRAM_FILES%\meinvying\meinvying.exe
- %PROGRAM_FILES%\wjplay2\20140414173322\Data\loading.gif
- %PROGRAM_FILES%\wjplay2\20140414173322\Data\err.jpg
- %PROGRAM_FILES%\wjplay2\20140414173322\Data\EKanR.dat
- %PROGRAM_FILES%\wjplay2\20140414173322\Data\def.jpg
- %PROGRAM_FILES%\wjplay2\20140414173322\Data\Err.html
- %APPDATA%\OT\ManTraySetDlg\images\set_common.png
- %PROGRAM_FILES%\wjplay2\20140414173322\Data\wj.ico
- %PROGRAM_FILES%\meinvying\uninst.exe
- %PROGRAM_FILES%\wjplay2\20140414173322\locallist.xml
- %PROGRAM_FILES%\wjplay2\20140414173322\DuiLib.dll
- %PROGRAM_FILES%\wjplay2\20140414173322\Data\tab_more.png
- %PROGRAM_FILES%\wjplay2\20140414173322\Data\poptime_bg.png
- %PROGRAM_FILES%\wjplay2\20140414173322\Data\User2.ini
- %PROGRAM_FILES%\meinvying\mvyy.exe
- %PROGRAM_FILES%\wjplay2\20140414173322\Data\Def.html
- %TEMP%\nso9.tmp\BDMDownload.dll
- %APPDATA%\OT\ManTraySetDlg\images\button.png
- %TEMP%\nsx6.tmp\NSISdl.dll
- %APPDATA%\OT\ManTraySetDlg\images\close.png
- %TEMP%\nspC.tmp\res\onlineWnd.zip
- %TEMP%\nsx6.tmp\System.dll
- %TEMP%\nspC.tmp\BDMSkin.dll
- %TEMP%\nso9.tmp\BDMSkin.dll
- %TEMP%\nso9.tmp\hu.dll
- %APPDATA%\OT\ManTraySetDlg\images\set_bk.png
- %PROGRAM_FILES%\wjplay2\20140414173322\client.ini
- %PROGRAM_FILES%\wjplay2\20140414173322\bottom.xml
- %TEMP%\nspC.tmp\BDMDownload.dll
- %TEMP%\nso9.tmp\dl.dll
- %TEMP%\nspC.tmp\dl.dll
- %APPDATA%\OT\ManTraySetDlg\images\question.png
Удаляет следующие файлы:
- %TEMP%\nsx6.tmp\Inetc.dll
- %TEMP%\nsx6.tmp\Math.dll
- %TEMP%\nsx6.tmp\nsE.tmp
- %TEMP%\nsx6.tmp\Base64.dll
- %TEMP%\nsx6.tmp\NSISdl.dll
- %TEMP%\nsx6.tmp\System.dll
- %TEMP%\nsx6.tmp\md5dll.dll
- %TEMP%\nsx6.tmp\nsExec.dll
- %TEMP%\nsq3.tmp\meinvying.exe
- %TEMP%\nsq3.tmp\System.dll
- %TEMP%\_ir_sf_temp_0\irsetup.dat
- %PROGRAM_FILES%\Your Product\Uninstall\uni1.tmp
- %HOMEPATH%\Templates\142014417331915\YYM_955WD30.gif
- %TEMP%\nsx6.tmp\nsD.tmp
- %TEMP%\tmpSKZXComm.zip
- %TEMP%\tmpSKZXSteup.zip
Сетевая активность:
Подключается к:
- 'localhost':1050
- 'localhost':1054
- 'localhost':1058
- '<IP-адрес в локальной сети>':445
- 'localhost':1039
- 'xu#.###ogin2.tenpay.com':443
UDP:
- DNS ASK tv.###ingzhihui.com
- DNS ASK cl####.095518.com
- DNS ASK tj.###ingzhihui.com
- DNS ASK sh###.baidu.com
- DNS ASK m1.##0308.com
- DNS ASK tj###.meinvying.net
- DNS ASK up####.180308.com
- DNS ASK up####.095518.com
- DNS ASK up####.035668.com
- DNS ASK cl####.180308.com
- DNS ASK tj.#uji.com
- DNS ASK tj#.##invying.net
- DNS ASK p.#.#aidu.com
- DNS ASK xu#.###ogin2.tenpay.com
- DNS ASK up####.aiqingzhihui.com
- DNS ASK m1.##5668.com
- DNS ASK up###e.wuji.com
- DNS ASK we####.baidu.com
- DNS ASK we#.##invying.net
- DNS ASK wj.#uji.com
Другое:
Ищет следующие окна:
- ClassName: 'TFormHuodongMini' WindowName: '(null)'
- ClassName: '(null)' WindowName: '(null)'
- ClassName: 'TFormTips' WindowName: '(null)'
- ClassName: 'TFormLoginTips' WindowName: '(null)'
- ClassName: 'SysListView32' WindowName: '(null)'
- ClassName: 'MS_WINHELP' WindowName: '(null)'
- ClassName: '#32770' WindowName: '(null)'
- ClassName: 'WujiPlayer' WindowName: '????????'
- ClassName: 'OnLineWnd' WindowName: '(null)'
- ClassName: 'MS_AutodialMonitor' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'BDMOnLineWnd' WindowName: '(null)'
- ClassName: 'THtmFormShow' WindowName: '(null)'
- ClassName: 'TFormMini' WindowName: '(null)'
- ClassName: 'MS_WebcheckMonitor' WindowName: '(null)'
- ClassName: 'TMeiNvYMainForm' WindowName: '(null)'
