Техническая информация
Вредоносные функции:
Создает и запускает на исполнение:
- '%PROGRAM_FILES%\netkuu\SYS.EXE'
- '%PROGRAM_FILES%\netkuu\WEBPLAYER9.EXE'
- '%PROGRAM_FILES%\netkuu\netkuu.exe'
- '%PROGRAM_FILES%\netkuu\vodplay.exe'
- '<SYSTEM32>\evodkey.exe'
Запускает на исполнение:
- '<SYSTEM32>\ping.exe' 127.0.0.1 -n 2
- '<SYSTEM32>\regsvr32.exe' /s "%PROGRAM_FILES%\WebPlayer9\WebPlayer9\WebPlayer9.ocx"
- '<SYSTEM32>\cmd.exe' /c ""%PROGRAM_FILES%\netkuu\R.bat" "
- '%WINDIR%\regedit.exe' /s %PROGRAM_FILES%\netkuu\zc.reg
Изменения в файловой системе:
Создает следующие файлы:
- %PROGRAM_FILES%\WebPlayer9\WebPlayer9\Data\UrlList.xml
- %PROGRAM_FILES%\WebPlayer9\WebPlayer9\FTKernelAPI.dll
- %PROGRAM_FILES%\WebPlayer9\WebPlayer9\FTKTCPxAPI.dll
- %PROGRAM_FILES%\WebPlayer9\WebPlayer9\Data\FilesList.xml
- %PROGRAM_FILES%\WebPlayer9\WebPlayer9\config\config.ini
- %PROGRAM_FILES%\WebPlayer9\WebPlayer9\Data\AD\热门游戏.swf
- %PROGRAM_FILES%\WebPlayer9\WebPlayer9\Data\AD\网上购物.swf
- %PROGRAM_FILES%\WebPlayer9\WebPlayer9\kad1\li.dat
- %PROGRAM_FILES%\WebPlayer9\WebPlayer9\kad1\nodes.dat
- %PROGRAM_FILES%\WebPlayer9\WebPlayer9\kad1\pk.dat
- %PROGRAM_FILES%\WebPlayer9\WebPlayer9\kad1\ki.dat
- %PROGRAM_FILES%\WebPlayer9\WebPlayer9\FTKUDPxAPI.dll
- %PROGRAM_FILES%\WebPlayer9\WebPlayer9\HttpMedia.dll
- %PROGRAM_FILES%\WebPlayer9\WebPlayer9\HttpSearchAPI2.dll
- %PROGRAM_FILES%\WebPlayer9\WebPlayer9\CodecsUpdate.exe
- %PROGRAM_FILES%\WebPlayer9\skins\default\stop_visited.bmp
- %PROGRAM_FILES%\WebPlayer9\skins\default\volumeNoUse_hover.bmp
- %PROGRAM_FILES%\WebPlayer9\skins\default\volumeNoUse_normal.bmp
- %PROGRAM_FILES%\WebPlayer9\skins\default\stop_NoUse.bmp
- %PROGRAM_FILES%\WebPlayer9\skins\default\stop_hover.bmp
- %PROGRAM_FILES%\WebPlayer9\skins\default\stop_hover2.bmp
- %PROGRAM_FILES%\WebPlayer9\skins\default\stop_normal.bmp
- %PROGRAM_FILES%\WebPlayer9\skins\default\volume_process2.bmp
- %PROGRAM_FILES%\WebPlayer9\skins\default\volume_visited.bmp
- %PROGRAM_FILES%\WebPlayer9\WebPlayer9\Codecs.dll
- %PROGRAM_FILES%\WebPlayer9\skins\default\volume_process.bmp
- %PROGRAM_FILES%\WebPlayer9\skins\default\volume_drag.bmp
- %PROGRAM_FILES%\WebPlayer9\skins\default\volume_hover.bmp
- %PROGRAM_FILES%\WebPlayer9\skins\default\volume_normal.bmp
- %PROGRAM_FILES%\WebPlayer9\WebPlayer9\kad1\si.dat
- %PROGRAM_FILES%\WebPlayer9\WebPlayer9\UDPEchoAPI.dll
- %PROGRAM_FILES%\WebPlayer9\WebPlayer9\WebPlayer9.lic
- %PROGRAM_FILES%\WebPlayer9\WebPlayer9\WebPlayer9.ocx
- %PROGRAM_FILES%\WebPlayer9\WebPlayer9\SkinZip.dll
- %PROGRAM_FILES%\WebPlayer9\WebPlayer9\MyCodecs\WMASF.DLL
- %PROGRAM_FILES%\WebPlayer9\WebPlayer9\MyCodecs\WMVCORE.DLL
- %PROGRAM_FILES%\WebPlayer9\WebPlayer9\MyCodecs\WMVSplitter.ax
- %PROGRAM_FILES%\WebPlayer9\wmv\qasf.dll
- %PROGRAM_FILES%\WebPlayer9\wmv\Wmadmod.dll
- %PROGRAM_FILES%\WebPlayer9\wmv\Wmvdmod.dll
- %PROGRAM_FILES%\WebPlayer9\wmv\msdmo.dll
- %PROGRAM_FILES%\WebPlayer9\WebPlayer9\WP9Init.exe
- %PROGRAM_FILES%\WebPlayer9\WebPlayer9\WP9Player.exe
- %PROGRAM_FILES%\WebPlayer9\WebPlayer9\WP9Service.exe
- %PROGRAM_FILES%\WebPlayer9\WebPlayer9\MyCodecs\RMSplitter.ax
- %PROGRAM_FILES%\WebPlayer9\WebPlayer9\kad2\si.dat
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\key[1].asp
- %PROGRAM_FILES%\WebPlayer9\WebPlayer9\kadnetdll.dll
- %PROGRAM_FILES%\WebPlayer9\WebPlayer9\kad2\pk.dat
- %PROGRAM_FILES%\WebPlayer9\WebPlayer9\kad2\ki.dat
- %PROGRAM_FILES%\WebPlayer9\WebPlayer9\kad2\li.dat
- %PROGRAM_FILES%\WebPlayer9\WebPlayer9\kad2\nodes.dat
- %PROGRAM_FILES%\WebPlayer9\WebPlayer9\lang\lang_zh_tw.xml
- %PROGRAM_FILES%\WebPlayer9\WebPlayer9\MyCodecs\flvsplitter2.ax
- %PROGRAM_FILES%\WebPlayer9\WebPlayer9\MyCodecs\l3codecx.ax
- %PROGRAM_FILES%\WebPlayer9\WebPlayer9\lang\lang_zh_cn.xml
- %PROGRAM_FILES%\WebPlayer9\WebPlayer9\lang\HowTo-Translate.txt
- %PROGRAM_FILES%\WebPlayer9\WebPlayer9\lang\lang_en_us.xml
- %PROGRAM_FILES%\WebPlayer9\WebPlayer9\lang\lang_ko_kr.xml
- <SYSTEM32>\evodkey.exe
- <SYSTEM32>\pncrt.dll
- %PROGRAM_FILES%\WebPlayer9\rmvb\atrc.dll
- %WINDIR%\Temp\NKbrowser.LOG
- %PROGRAM_FILES%\netkuu\WEBPLAYER9.EXE
- %PROGRAM_FILES%\netkuu\ZC.REG
- %PROGRAM_FILES%\netkuu\zxllq.exe
- %PROGRAM_FILES%\WebPlayer9\rmvb\hxltcolor.dll
- %PROGRAM_FILES%\WebPlayer9\rmvb\raac.dll
- %PROGRAM_FILES%\WebPlayer9\rmvb\rv10.dll
- %PROGRAM_FILES%\WebPlayer9\rmvb\drvc.dll
- %PROGRAM_FILES%\WebPlayer9\rmvb\cook.dll
- %PROGRAM_FILES%\WebPlayer9\rmvb\drv1.dll
- %PROGRAM_FILES%\WebPlayer9\rmvb\drv2.dll
- %PROGRAM_FILES%\netkuu\VODPlayer.dll
- %PROGRAM_FILES%\netkuu\LMSINET.dll
- %PROGRAM_FILES%\netkuu\netkuu.exe
- %PROGRAM_FILES%\netkuu\netkuu.ini
- %PROGRAM_FILES%\netkuu\livesource.ax
- %PROGRAM_FILES%\netkuu\Codecs\cook.dll
- %PROGRAM_FILES%\netkuu\Codecs\data.ini
- %PROGRAM_FILES%\netkuu\Codecs\drvc.dll
- %PROGRAM_FILES%\netkuu\version.ini
- %PROGRAM_FILES%\netkuu\VodHelper.dll
- %PROGRAM_FILES%\netkuu\vodplay.exe
- %PROGRAM_FILES%\netkuu\sysad.ini
- %PROGRAM_FILES%\netkuu\NullRender.dll
- %PROGRAM_FILES%\netkuu\R.bat
- %PROGRAM_FILES%\netkuu\SYS.EXE
- %PROGRAM_FILES%\WebPlayer9\rmvb\rv20.dll
- %PROGRAM_FILES%\WebPlayer9\skins\default\play_normal.bmp
- %PROGRAM_FILES%\WebPlayer9\skins\default\play_NoUse.bmp
- %PROGRAM_FILES%\WebPlayer9\skins\default\play_visited.bmp
- %PROGRAM_FILES%\WebPlayer9\skins\default\play_hover2.bmp
- %PROGRAM_FILES%\WebPlayer9\skins\default\pause_NoUse.bmp
- %PROGRAM_FILES%\WebPlayer9\skins\default\pause_visited.bmp
- %PROGRAM_FILES%\WebPlayer9\skins\default\play_hover.bmp
- %PROGRAM_FILES%\WebPlayer9\skins\default\ProgressBar_left.bmp
- %PROGRAM_FILES%\WebPlayer9\skins\default\ProgressBar_right.bmp
- %PROGRAM_FILES%\WebPlayer9\skins\default\skin.ini
- %PROGRAM_FILES%\WebPlayer9\skins\default\ProgressBar_center.bmp
- %PROGRAM_FILES%\WebPlayer9\skins\default\ProgressBarPlayed_center.bmp
- %PROGRAM_FILES%\WebPlayer9\skins\default\ProgressBarPlayed_left.bmp
- %PROGRAM_FILES%\WebPlayer9\skins\default\ProgressBarPlayed_right.bmp
- %PROGRAM_FILES%\WebPlayer9\skins\default\pause_normal.bmp
- %PROGRAM_FILES%\WebPlayer9\skins\default\fs_hover.bmp
- %PROGRAM_FILES%\WebPlayer9\skins\default\fs_hover2.bmp
- %PROGRAM_FILES%\WebPlayer9\skins\default\fs_normal.bmp
- %PROGRAM_FILES%\WebPlayer9\skins\default\drag.bmp
- %PROGRAM_FILES%\WebPlayer9\rmvb\rv30.dll
- %PROGRAM_FILES%\WebPlayer9\rmvb\rv40.dll
- %PROGRAM_FILES%\WebPlayer9\rmvb\sipr.dll
- %PROGRAM_FILES%\WebPlayer9\skins\default\OperationAreaBak_right.bmp
- %PROGRAM_FILES%\WebPlayer9\skins\default\pause_hover.bmp
- %PROGRAM_FILES%\WebPlayer9\skins\default\pause_hover2.bmp
- %PROGRAM_FILES%\WebPlayer9\skins\default\OperationAreaBak_left.bmp
- %PROGRAM_FILES%\WebPlayer9\skins\default\fs_NoUse.bmp
- %PROGRAM_FILES%\WebPlayer9\skins\default\fs_visited.bmp
- %PROGRAM_FILES%\WebPlayer9\skins\default\OperationAreaBak_center.bmp
Удаляет следующие файлы:
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\key[1].asp
Сетевая активность:
Подключается к:
- 'www.ca##stv.com':80
- 'localhost':1037
TCP:
Запросы HTTP GET:
- www.ca##stv.com/online/key.asp
UDP:
- DNS ASK www.ca##stv.com
Другое:
Ищет следующие окна:
- ClassName: 'MS_AutodialMonitor' WindowName: '(null)'
- ClassName: 'MS_WebcheckMonitor' WindowName: '(null)'
- ClassName: 'RegEdit_RegEdit' WindowName: '(null)'
- ClassName: 'EDIT' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
