Техническая информация
Для обеспечения автозапуска и распространения:
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\system update kb77500] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- '%PROGRAM_FILES%\MSR\Privoxy\privoxy.exe'
- '%WINDIR%\Microsoft\system update kb77500\WindowsUpdater.exe'
Запускает на исполнение:
- '<SYSTEM32>\msiexec.exe' -Embedding E9D463F50E4952BB29054647C18CADA4
- '<SYSTEM32>\msiexec.exe' -Embedding 038EDBC5A965F3DC438581D9B1995C56 M Global\MSI0000
- '<SYSTEM32>\msiexec.exe' /i "%TEMP%\MsiToExe.SetupExtension.msi" /q
- '<SYSTEM32>\msiexec.exe' /V
Завершает или пытается завершить
следующие пользовательские процессы:
- chrome.exe
Изменяет следующие настройки браузера Windows Internet Explorer:
- [\REGISTRY\USER\S-1-5-20_CLASSES\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'ProxyEnable' = '00000001'
- [\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'ProxyServer' = 'http=127.0.0.1:8118;https=127.0.0.1:8118'
- [\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'ProxyEnable' = '00000001'
- [<HKCU>_CLASSES\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'ProxyServer' = 'http=127.0.0.1:8118;https=127.0.0.1:8118'
- [<HKCU>_CLASSES\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'ProxyEnable' = '00000001'
- [\REGISTRY\USER\S-1-5-20_CLASSES\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'ProxyServer' = 'http=127.0.0.1:8118;https=127.0.0.1:8118'
- [\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'ProxyEnable' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'ProxyServer' = 'http=127.0.0.1:8118;https=127.0.0.1:8118'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'ProxyEnable' = '00000001'
- [\REGISTRY\USER\S-1-5-19_CLASSES\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'ProxyServer' = 'http=127.0.0.1:8118;https=127.0.0.1:8118'
- [\REGISTRY\USER\S-1-5-19_CLASSES\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'ProxyEnable' = '00000001'
- [\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'ProxyServer' = 'http=127.0.0.1:8118;https=127.0.0.1:8118'
Изменения в файловой системе:
Создает следующие файлы:
- %PROGRAM_FILES%\MSR\Privoxy\doc\user-manual\installation.html
- %PROGRAM_FILES%\MSR\Privoxy\doc\user-manual\introduction.html
- %PROGRAM_FILES%\MSR\Privoxy\doc\user-manual\index.html
- %PROGRAM_FILES%\MSR\Privoxy\doc\user-manual\files-in-use.jpg
- %PROGRAM_FILES%\MSR\Privoxy\doc\user-manual\filter-file.html
- %PROGRAM_FILES%\MSR\Privoxy\doc\user-manual\quickstart.html
- %PROGRAM_FILES%\MSR\Privoxy\doc\user-manual\seealso.html
- %PROGRAM_FILES%\MSR\Privoxy\doc\user-manual\p_doc.css
- %PROGRAM_FILES%\MSR\Privoxy\doc\user-manual\proxy2.jpg
- %PROGRAM_FILES%\MSR\Privoxy\doc\user-manual\proxy_setup.jpg
- %PROGRAM_FILES%\MSR\Privoxy\doc\p_doc.css
- %PROGRAM_FILES%\MSR\Privoxy\doc\user-manual\actions-file.html
- %PROGRAM_FILES%\MSR\Privoxy\doc\images\proxy_setup.jpg
- %PROGRAM_FILES%\MSR\Privoxy\doc\faq\trouble.html
- %PROGRAM_FILES%\MSR\Privoxy\doc\images\files-in-use.jpg
- %PROGRAM_FILES%\MSR\Privoxy\doc\user-manual\contact.html
- %PROGRAM_FILES%\MSR\Privoxy\doc\user-manual\copyright.html
- %PROGRAM_FILES%\MSR\Privoxy\doc\user-manual\configuration.html
- %PROGRAM_FILES%\MSR\Privoxy\doc\user-manual\appendix.html
- %PROGRAM_FILES%\MSR\Privoxy\doc\user-manual\config.html
- %PROGRAM_FILES%\MSR\Privoxy\doc\user-manual\startup.html
- %PROGRAM_FILES%\MSR\Privoxy\templates\mod-unstable-warning
- %PROGRAM_FILES%\MSR\Privoxy\templates\no-such-domain
- %PROGRAM_FILES%\MSR\Privoxy\templates\mod-title
- %PROGRAM_FILES%\MSR\Privoxy\templates\mod-local-help
- %PROGRAM_FILES%\MSR\Privoxy\templates\mod-support-and-service
- %PROGRAM_FILES%\MSR\Privoxy\user.filter
- %PROGRAM_FILES%\MSR\Privoxy\user.filter_old
- %PROGRAM_FILES%\MSR\Privoxy\user.action
- %PROGRAM_FILES%\MSR\Privoxy\templates\url-info-osd.xml
- %PROGRAM_FILES%\MSR\Privoxy\trust.txt
- %PROGRAM_FILES%\MSR\Privoxy\mgwz.dll
- %PROGRAM_FILES%\MSR\Privoxy\privoxy.exe
- %PROGRAM_FILES%\MSR\Privoxy\LICENSE.txt
- %PROGRAM_FILES%\MSR\Privoxy\doc\user-manual\templates.html
- %PROGRAM_FILES%\MSR\Privoxy\doc\user-manual\whatsnew.html
- %PROGRAM_FILES%\MSR\Privoxy\templates\cgi-style.css
- %PROGRAM_FILES%\MSR\Privoxy\templates\connect-failed
- %PROGRAM_FILES%\MSR\Privoxy\README.txt
- %PROGRAM_FILES%\MSR\Privoxy\privoxy.log
- %PROGRAM_FILES%\MSR\Privoxy\privoxy_uninstall.exe
- %PROGRAM_FILES%\MSR\system update kb77500\win32.reg
- %PROGRAM_FILES%\MSR\system update kb77500\Newtonsoft.Json.dll
- %PROGRAM_FILES%\MSR\system update kb77500\SQLite.Interop.dll
- %PROGRAM_FILES%\MSR\system update kb77500\Installer.dll
- %PROGRAM_FILES%\MSR\system update kb77500\InstallFirefoxExtension.dll
- \Device\LanmanRedirector\CRNJEUFU*\MAILSLOT\NET\NETLOGON
- %PROGRAM_FILES%\MSR\system update kb77500\tmp.txt
- %WINDIR%\Installer\MSI7.tmp
- %WINDIR%\Installer\MSI6.tmp
- %PROGRAM_FILES%\MSR\system update kb77500\InstallFirefoxExtension.InstallState
- %TEMP%\CFG2.tmp
- %WINDIR%\Installer\MSI3.tmp
- %WINDIR%\Installer\MSI1.tmp
- %TEMP%\MsiToExe.SetupExtension.msi
- %WINDIR%\Installer\26fc7.msi
- %PROGRAM_FILES%\MSR\system update kb77500\WindowsUpdater.exe
- %PROGRAM_FILES%\MSR\system update kb77500\System.Data.SQLite.dll
- %PROGRAM_FILES%\MSR\system update kb77500\InstallerLibrary.dll
- %WINDIR%\Installer\MSI4.tmp
- C:\Config.Msi\26fca.rbs
- %WINDIR%\Microsoft\system update kb77500\win32.reg
- %PROGRAM_FILES%\MSR\Privoxy\doc\faq\configuration.html
- %PROGRAM_FILES%\MSR\Privoxy\doc\faq\contact.html
- %PROGRAM_FILES%\MSR\Privoxy\doc\developer-manual\webserver-update.html
- %PROGRAM_FILES%\MSR\Privoxy\doc\developer-manual\newrelease.html
- %PROGRAM_FILES%\MSR\Privoxy\doc\developer-manual\testing.html
- %PROGRAM_FILES%\MSR\Privoxy\doc\faq\installation.html
- %PROGRAM_FILES%\MSR\Privoxy\doc\faq\misc.html
- %PROGRAM_FILES%\MSR\Privoxy\doc\faq\index.html
- %PROGRAM_FILES%\MSR\Privoxy\doc\faq\copyright.html
- %PROGRAM_FILES%\MSR\Privoxy\doc\faq\general.html
- %PROGRAM_FILES%\MSR\Privoxy\AUTHORS.txt
- %PROGRAM_FILES%\MSR\Privoxy\config.txt
- %WINDIR%\Microsoft\system update kb77500\WindowsUpdater.exe
- %WINDIR%\Microsoft\system update kb77500\Installer.dll
- %WINDIR%\Microsoft\system update kb77500\InstallerLibrary.dll
- %PROGRAM_FILES%\MSR\Privoxy\doc\developer-manual\index.html
- %PROGRAM_FILES%\MSR\Privoxy\doc\developer-manual\introduction.html
- %PROGRAM_FILES%\MSR\Privoxy\doc\developer-manual\documentation.html
- %PROGRAM_FILES%\MSR\Privoxy\doc\developer-manual\coding.html
- %PROGRAM_FILES%\MSR\Privoxy\doc\developer-manual\cvs.html
Удаляет следующие файлы:
- %WINDIR%\Installer\MSI7.tmp
- C:\Config.Msi\26fca.rbs
- %WINDIR%\Installer\26fc7.msi
- %WINDIR%\Installer\MSI4.tmp
- %WINDIR%\Installer\MSI1.tmp
- %WINDIR%\Installer\MSI3.tmp
- %WINDIR%\Installer\MSI6.tmp
Сетевая активность:
Подключается к:
- 'zo##ar.info':80
- 'wp#d':80
TCP:
Запросы HTTP GET:
- wp#d/wpad.dat
Запросы HTTP POST:
- zo##ar.info/getData.php
UDP:
- DNS ASK zo##ar.info
- DNS ASK wp#d
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
