Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'wextract_cleanup0' = 'rundll32.exe <SYSTEM32>\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"'
Вредоносные функции:
Создает и запускает на исполнение:
- '%TEMP%\IXP000.TMP\TVUpdate522.exe'
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\InstallShield\Professional\RunTime\ObjF.tmp
- %CommonProgramFiles%\InstallShield\Professional\RunTime\iKernel.rgs
- %CommonProgramFiles%\InstallShield\Professional\RunTime\IsProBE.tlb
- %TEMP%\{0A19137B-00F3-4716-9AA0-A93AFC79C4B0}\{354DD2C0-12BC-4D11-94A3-874EB4D8C997}\Bbrde9d4.rra
- %TEMP%\{0A19137B-00F3-4716-9AA0-A93AFC79C4B0}\{354DD2C0-12BC-4D11-94A3-874EB4D8C997}\Licee967.rra
- %TEMP%\{0A19137B-00F3-4716-9AA0-A93AFC79C4B0}\{354DD2C0-12BC-4D11-94A3-874EB4D8C997}\setue8bb.rra
- %CommonProgramFiles%\InstallShield\Professional\RunTime\09\01\Intel32\ctoB.tmp
- %CommonProgramFiles%\InstallShield\Professional\RunTime\09\01\Intel32\DotA.tmp
- %CommonProgramFiles%\InstallShield\Professional\RunTime\09\01\Intel32\iKe9.tmp
- %CommonProgramFiles%\InstallShield\Professional\RunTime\IsPE.tmp
- %CommonProgramFiles%\InstallShield\Professional\RunTime\09\01\Intel32\iusD.tmp
- %CommonProgramFiles%\InstallShield\Professional\RunTime\09\01\Intel32\iscC.tmp
- %TEMP%\{0A19137B-00F3-4716-9AA0-A93AFC79C4B0}\{354DD2C0-12BC-4D11-94A3-874EB4D8C997}\Requeace.rra
- %TEMP%\{0A19137B-00F3-4716-9AA0-A93AFC79C4B0}\{354DD2C0-12BC-4D11-94A3-874EB4D8C997}\Strif1b4.rra
- %TEMP%\{0A19137B-00F3-4716-9AA0-A93AFC79C4B0}\coref156.rra
- %TEMP%\{0A19137B-00F3-4716-9AA0-A93AFC79C4B0}\{354DD2C0-12BC-4D11-94A3-874EB4D8C997}\_ISUf108.rra
- %TEMP%\{0A19137B-00F3-4716-9AA0-A93AFC79C4B0}\{354DD2C0-12BC-4D11-94A3-874EB4D8C997}\_IsRf369.rra
- %TEMP%\{0A19137B-00F3-4716-9AA0-A93AFC79C4B0}\{354DD2C0-12BC-4D11-94A3-874EB4D8C997}\defaf30c.rra
- %TEMP%\{0A19137B-00F3-4716-9AA0-A93AFC79C4B0}\{354DD2C0-12BC-4D11-94A3-874EB4D8C997}\isrtf221.rra
- %TEMP%\{0A19137B-00F3-4716-9AA0-A93AFC79C4B0}\{354DD2C0-12BC-4D11-94A3-874EB4D8C997}\Bbrded6e.rra
- %TEMP%\{0A19137B-00F3-4716-9AA0-A93AFC79C4B0}\{354DD2C0-12BC-4D11-94A3-874EB4D8C997}\Bbrdec36.rra
- %TEMP%\{0A19137B-00F3-4716-9AA0-A93AFC79C4B0}\{354DD2C0-12BC-4D11-94A3-874EB4D8C997}\map_eb1c.rra
- %TEMP%\{0A19137B-00F3-4716-9AA0-A93AFC79C4B0}\{354DD2C0-12BC-4D11-94A3-874EB4D8C997}\Bbrdefef.rra
- %TEMP%\{0A19137B-00F3-4716-9AA0-A93AFC79C4B0}\{354DD2C0-12BC-4D11-94A3-874EB4D8C997}\Bbrdef04.rra
- %TEMP%\{0A19137B-00F3-4716-9AA0-A93AFC79C4B0}\{354DD2C0-12BC-4D11-94A3-874EB4D8C997}\Bbrdee39.rra
- %TEMP%\bye1.tmp\Disk1\setup.exe
- %TEMP%\bye1.tmp\Disk1\setup.bmp
- %TEMP%\bye1.tmp\Disk1\layout.bin
- %TEMP%\bye1.tmp\Disk1\setup.inx
- %TEMP%\bye1.tmp\Disk1\setup.ini
- %TEMP%\bye1.tmp\Disk1\setup.ibt
- %TEMP%\ISPackFiles.ini
- %TEMP%\IXP000.TMP\document.exe
- %TEMP%\IXP000.TMP\TVUpdate522.exe
- %TEMP%\bye1.tmp\Disk1\engine32.cab
- %TEMP%\bye1.tmp\Disk1\data1.hdr
- %TEMP%\bye1.tmp\Disk1\data1.cab
- %TEMP%\bye1.tmp\Disk1\setup.skin
- %TEMP%\_se8.tmp
- %CommonProgramFiles%\InstallShield\Professional\RunTime\09\01\Intel32\isp6.tmp\temp.000
- %TEMP%\igd7.tmp
- %TEMP%\skin3a99.rra
- %TEMP%\iss2.tmp\setup.skin
- %TEMP%\isp5.tmp\temp.000
- %CommonProgramFiles%\InstallShield\Professional\RunTime\09\01\Intel32\isp3.tmp\temp.000
- %CommonProgramFiles%\InstallShield\Professional\RunTime\09\01\Intel32\set4.tmp
- %TEMP%\iss2.tmp\setup.ini
- %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\366ccbe66db0bf95cfddb9eac8f3ddec_23ef5514-3059-436f-a4a7-4cefaab20eb1
- %APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\Preferred
- %APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\82c411ae-0120-4dfc-b9ae-775534f8c3ed
Удаляет следующие файлы:
- %TEMP%\skin3a99.rra
- %CommonProgramFiles%\InstallShield\Professional\RunTime\IsPE.tmp
- %TEMP%\_se8.tmp
- %CommonProgramFiles%\InstallShield\Professional\RunTime\09\01\Intel32\set4.tmp
- %TEMP%\igd7.tmp
Перемещает следующие файлы:
- %TEMP%\{0A19137B-00F3-4716-9AA0-A93AFC79C4B0}\{354DD2C0-12BC-4D11-94A3-874EB4D8C997}\Bbrded6e.rra в %TEMP%\{0A19137B-00F3-4716-9AA0-A93AFC79C4B0}\{354DD2C0-12BC-4D11-94A3-874EB4D8C997}\Bbrd3.BMP
- %TEMP%\{0A19137B-00F3-4716-9AA0-A93AFC79C4B0}\{354DD2C0-12BC-4D11-94A3-874EB4D8C997}\Bbrdee39.rra в %TEMP%\{0A19137B-00F3-4716-9AA0-A93AFC79C4B0}\{354DD2C0-12BC-4D11-94A3-874EB4D8C997}\Bbrd4.BMP
- %TEMP%\{0A19137B-00F3-4716-9AA0-A93AFC79C4B0}\{354DD2C0-12BC-4D11-94A3-874EB4D8C997}\Bbrdef04.rra в %TEMP%\{0A19137B-00F3-4716-9AA0-A93AFC79C4B0}\{354DD2C0-12BC-4D11-94A3-874EB4D8C997}\Bbrd5.BMP
- %TEMP%\{0A19137B-00F3-4716-9AA0-A93AFC79C4B0}\{354DD2C0-12BC-4D11-94A3-874EB4D8C997}\Requeace.rra в %TEMP%\{0A19137B-00F3-4716-9AA0-A93AFC79C4B0}\{354DD2C0-12BC-4D11-94A3-874EB4D8C997}\Requirements.txt
- %TEMP%\{0A19137B-00F3-4716-9AA0-A93AFC79C4B0}\{354DD2C0-12BC-4D11-94A3-874EB4D8C997}\map_eb1c.rra в %TEMP%\{0A19137B-00F3-4716-9AA0-A93AFC79C4B0}\{354DD2C0-12BC-4D11-94A3-874EB4D8C997}\map_bkgrnd.bmp
- %TEMP%\{0A19137B-00F3-4716-9AA0-A93AFC79C4B0}\{354DD2C0-12BC-4D11-94A3-874EB4D8C997}\Bbrdec36.rra в %TEMP%\{0A19137B-00F3-4716-9AA0-A93AFC79C4B0}\{354DD2C0-12BC-4D11-94A3-874EB4D8C997}\Bbrd2.BMP
- %TEMP%\{0A19137B-00F3-4716-9AA0-A93AFC79C4B0}\{354DD2C0-12BC-4D11-94A3-874EB4D8C997}\Bbrdefef.rra в %TEMP%\{0A19137B-00F3-4716-9AA0-A93AFC79C4B0}\{354DD2C0-12BC-4D11-94A3-874EB4D8C997}\Bbrd6.BMP
- %TEMP%\{0A19137B-00F3-4716-9AA0-A93AFC79C4B0}\{354DD2C0-12BC-4D11-94A3-874EB4D8C997}\isrtf221.rra в %TEMP%\{0A19137B-00F3-4716-9AA0-A93AFC79C4B0}\{354DD2C0-12BC-4D11-94A3-874EB4D8C997}\isrt.dll
- %TEMP%\{0A19137B-00F3-4716-9AA0-A93AFC79C4B0}\{354DD2C0-12BC-4D11-94A3-874EB4D8C997}\defaf30c.rra в %TEMP%\{0A19137B-00F3-4716-9AA0-A93AFC79C4B0}\{354DD2C0-12BC-4D11-94A3-874EB4D8C997}\default.pal
- %TEMP%\{0A19137B-00F3-4716-9AA0-A93AFC79C4B0}\{354DD2C0-12BC-4D11-94A3-874EB4D8C997}\_IsRf369.rra в %TEMP%\{0A19137B-00F3-4716-9AA0-A93AFC79C4B0}\{354DD2C0-12BC-4D11-94A3-874EB4D8C997}\_IsRes.dll
- %TEMP%\{0A19137B-00F3-4716-9AA0-A93AFC79C4B0}\{354DD2C0-12BC-4D11-94A3-874EB4D8C997}\_ISUf108.rra в %TEMP%\{0A19137B-00F3-4716-9AA0-A93AFC79C4B0}\{354DD2C0-12BC-4D11-94A3-874EB4D8C997}\_ISUser.dll
- %TEMP%\{0A19137B-00F3-4716-9AA0-A93AFC79C4B0}\coref156.rra в %TEMP%\{0A19137B-00F3-4716-9AA0-A93AFC79C4B0}\corecomp.ini
- %TEMP%\{0A19137B-00F3-4716-9AA0-A93AFC79C4B0}\{354DD2C0-12BC-4D11-94A3-874EB4D8C997}\Strif1b4.rra в %TEMP%\{0A19137B-00F3-4716-9AA0-A93AFC79C4B0}\{354DD2C0-12BC-4D11-94A3-874EB4D8C997}\StringTable-0009-English.ips
- %TEMP%\{0A19137B-00F3-4716-9AA0-A93AFC79C4B0}\{354DD2C0-12BC-4D11-94A3-874EB4D8C997}\Bbrde9d4.rra в %TEMP%\{0A19137B-00F3-4716-9AA0-A93AFC79C4B0}\{354DD2C0-12BC-4D11-94A3-874EB4D8C997}\Bbrd1.bmp
- %CommonProgramFiles%\InstallShield\Professional\RunTime\09\01\Intel32\isp6.tmp\IGdi.dll в %CommonProgramFiles%\InstallShield\Professional\RunTime\09\01\Intel32\iGdi.dll
- %TEMP%\isp5.tmp\temp.000 в %TEMP%\isp5.tmp\_Setup.dll
- %CommonProgramFiles%\InstallShield\Professional\RunTime\09\01\Intel32\iKe9.tmp в %CommonProgramFiles%\InstallShield\Professional\RunTime\09\01\Intel32\iKernel.dll
- %CommonProgramFiles%\InstallShield\Professional\RunTime\09\01\Intel32\isp3.tmp\temp.000 в %CommonProgramFiles%\InstallShield\Professional\RunTime\09\01\Intel32\isp3.tmp\setup.dll
- %CommonProgramFiles%\InstallShield\Professional\RunTime\09\01\Intel32\isp3.tmp\setup.dll в %CommonProgramFiles%\InstallShield\Professional\RunTime\09\01\Intel32\setup.dll
- %CommonProgramFiles%\InstallShield\Professional\RunTime\09\01\Intel32\isp6.tmp\temp.000 в %CommonProgramFiles%\InstallShield\Professional\RunTime\09\01\Intel32\isp6.tmp\IGdi.dll
- %CommonProgramFiles%\InstallShield\Professional\RunTime\09\01\Intel32\DotA.tmp в %CommonProgramFiles%\InstallShield\Professional\RunTime\09\01\Intel32\DotNetInstaller.exe
- %CommonProgramFiles%\InstallShield\Professional\RunTime\ObjF.tmp в %CommonProgramFiles%\InstallShield\Professional\RunTime\Objectps.dll
- %TEMP%\{0A19137B-00F3-4716-9AA0-A93AFC79C4B0}\{354DD2C0-12BC-4D11-94A3-874EB4D8C997}\setue8bb.rra в %TEMP%\{0A19137B-00F3-4716-9AA0-A93AFC79C4B0}\{354DD2C0-12BC-4D11-94A3-874EB4D8C997}\setup.inx
- %TEMP%\{0A19137B-00F3-4716-9AA0-A93AFC79C4B0}\{354DD2C0-12BC-4D11-94A3-874EB4D8C997}\Licee967.rra в %TEMP%\{0A19137B-00F3-4716-9AA0-A93AFC79C4B0}\{354DD2C0-12BC-4D11-94A3-874EB4D8C997}\License.txt
- %CommonProgramFiles%\InstallShield\Professional\RunTime\09\01\Intel32\ctoB.tmp в %CommonProgramFiles%\InstallShield\Professional\RunTime\09\01\Intel32\ctor.dll
- %CommonProgramFiles%\InstallShield\Professional\RunTime\09\01\Intel32\iscC.tmp в %CommonProgramFiles%\InstallShield\Professional\RunTime\09\01\Intel32\iscript.dll
- %CommonProgramFiles%\InstallShield\Professional\RunTime\09\01\Intel32\iusD.tmp в %CommonProgramFiles%\InstallShield\Professional\RunTime\09\01\Intel32\iuser.dll
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
