Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'GameBoxInformation' = '%ALLUSERSPROFILE%\Application Data\GameBox20144517\GameBox_20144517.exe /autorun'
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\Flash SWF Files Updaterver_201445.job
Вредоносные функции:
Создает и запускает на исполнение:
- '%PROGRAM_FILES%\Favorite\ico\_xhzm10_s.exe'
- '%ALLUSERSPROFILE%\Application Data\GameBox20144517\GameBox_20144517.exe' /report_install
- '%PROGRAM_FILES%\Favorite\ico\gbox_31_sltinstall.exe'
- '%PROGRAM_FILES%\Favorite\ico\pczh_107_306.exe'
Запускает на исполнение:
- '<SYSTEM32>\cmd.exe' /c ""%PROGRAM_FILES%\yunboplayer\yun.bat""
Ищет ветки реестра, отвечающие за хранение паролей сторонними программами:
- [<HKCU>\Software\FlashFXP]
Изменяет следующие настройки браузера Windows Internet Explorer:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings] 'WarnonZoneCrossing' = '00000000'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings] 'WarnonBadCertRecving' = '00000000'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings] 'WarnOnPostRedirect' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'WarnonZoneCrossing' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'WarnonBadCertRecving' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'WarnOnPostRedirect' = '00000000'
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %HOMEPATH%\Desktop\Internet Explorer.lnk
- %HOMEPATH%\Desktop\МФ±¦Нш.lnk
- %TEMP%\nsu5.tmp
- %PROGRAM_FILES%\Favorite\ico\tb1.ico
- %HOMEPATH%\Desktop\ФЖІҐУ°КУєР.lnk
- %HOMEPATH%\Desktop\360°ІИ«дЇААЖч.lnk
- %TEMP%\~kb7.tmp
- %TEMP%\~xc8.tmp.0\dui.dll.tmp
- %TEMP%\~xc8.tmp.0\GameBox.exe.tmp
- %TEMP%\nsp6.tmp\Base64.dll
- %TEMP%\nsp6.tmp\System.dll
- %TEMP%\nsp6.tmp\NSISdl.dll
- %PROGRAM_FILES%\Favorite\ico\123.ico
- %PROGRAM_FILES%\Favorite\ico\23451.ico
- %PROGRAM_FILES%\Favorite\ico\360.ico
- %PROGRAM_FILES%\Favorite\2345µјєЅ.url
- %PROGRAM_FILES%\Favorite\ЛС№·µјєЅ.url
- %PROGRAM_FILES%\Favorite\МФ±¦Нш.url
- %PROGRAM_FILES%\Favorite\ico\ie.ico
- %PROGRAM_FILES%\Favorite\ico\pczh_107_306.exe
- %PROGRAM_FILES%\Favorite\ico\sg1.ico
- %PROGRAM_FILES%\Favorite\ico\_xhzm10_s.exe
- %PROGRAM_FILES%\Favorite\ico\ay.ico
- %PROGRAM_FILES%\Favorite\ico\gbox_31_sltinstall.exe
- %TEMP%\~xc8.tmp.0\GBInit.exe.tmp
- %ALLUSERSPROFILE%\Application Data\GameBox20144517\webcore.dll
- %HOMEPATH%\Start Menu\Programs\4177游戏盒子\4177游戏盒子.lnk
- %HOMEPATH%\Start Menu\Programs\4177游戏盒子\配置工具\修复4177游戏盒子.lnk
- %ALLUSERSPROFILE%\Application Data\GameBox20144517\skin\news.ui
- %ALLUSERSPROFILE%\Application Data\GameBox20144517\snap.wav
- %ALLUSERSPROFILE%\Application Data\GameBox20144517\uninst.exe
- %PROGRAM_FILES%\ainqngz3.9\Ainqngz3.9.exe
- %PROGRAM_FILES%\ainqngz3.9\uninstall.exe
- %WINDIR%\wininit.ini
- %HOMEPATH%\Desktop\4177游戏盒子.lnk
- %HOMEPATH%\Desktop\Internet Explorer.lnk
- %APPDATA%\4177GameBox_Data\soft_report.ini
- %TEMP%\~xc8.tmp.0\webcore.dll.tmp
- %TEMP%\~xc8.tmp.0\skin\gamebox.ui.tmp
- %TEMP%\~xc8.tmp.0\skin\news.ui.tmp
- %TEMP%\~xc8.tmp.0\News.dll.tmp
- %TEMP%\~xc8.tmp.0\snap.wav.tmp
- %TEMP%\~xc8.tmp.0\uninst.exe.tmp
- %ALLUSERSPROFILE%\Application Data\GameBox20144517\GBInit.exe
- %ALLUSERSPROFILE%\Application Data\GameBox20144517\News.dll
- %ALLUSERSPROFILE%\Application Data\GameBox20144517\skin\gamebox.ui
- %HOMEPATH%\Templates\520144949878\YYM_955WD30.gif
- %ALLUSERSPROFILE%\Application Data\GameBox20144517\dui.dll
- %ALLUSERSPROFILE%\Application Data\GameBox20144517\GameBox_20144517.exe
- %PROGRAM_FILES%\yunboplayer\uboskin\skin\zb.jpg
- %PROGRAM_FILES%\yunboplayer\favorite\ico\23451.ico
- %PROGRAM_FILES%\yunboplayer\favorite\ico\360.ico
- %PROGRAM_FILES%\yunboplayer\favorite\ico\_xhzm10_s.exe
- %PROGRAM_FILES%\yunboplayer\favorite\ЛС№·µјєЅ.url
- %PROGRAM_FILES%\yunboplayer\favorite\МФ±¦Нш.url
- %PROGRAM_FILES%\yunboplayer\favorite\ico\123.ico
- %PROGRAM_FILES%\yunboplayer\favorite\ico\pczh_107_306.exe
- %PROGRAM_FILES%\yunboplayer\favorite\ico\sg1.ico
- %PROGRAM_FILES%\yunboplayer\favorite\ico\tb1.ico
- %PROGRAM_FILES%\yunboplayer\favorite\ico\ay.ico
- %PROGRAM_FILES%\yunboplayer\favorite\ico\gbox_31_sltinstall.exe
- %PROGRAM_FILES%\yunboplayer\favorite\ico\ie.ico
- %TEMP%\nsw3.tmp\yunbodown
- %PROGRAM_FILES%\yunboplayer\link.txt
- %PROGRAM_FILES%\yunboplayer\tj.txt
- %TEMP%\nsg2.tmp
- %TEMP%\nsw3.tmp\System.dll
- %TEMP%\nsw3.tmp\NSISdl.dll
- %PROGRAM_FILES%\yunboplayer\app\loading.swf
- %PROGRAM_FILES%\yunboplayer\app\yunboapp.exe
- %PROGRAM_FILES%\yunboplayer\favorite\2345µјєЅ.url
- %PROGRAM_FILES%\yunboplayer\ubohe.db
- %PROGRAM_FILES%\yunboplayer\yun.bat
- %PROGRAM_FILES%\yunboplayer\app\loading.html
- %PROGRAM_FILES%\yunboplayer\uboskin\config.ini
- %PROGRAM_FILES%\yunboplayer\uboskin\skin\logo.jpg
- %PROGRAM_FILES%\yunboplayer\uboskin\skin\logo.tif
- %PROGRAM_FILES%\yunboplayer\uboskin\skin\lt.jpg
- %PROGRAM_FILES%\yunboplayer\uboskin\skin\dibulan.jpg
- %PROGRAM_FILES%\yunboplayer\uboskin\skin\hp.jpg
- %PROGRAM_FILES%\yunboplayer\uboskin\skin\list.jpg
- %PROGRAM_FILES%\yunboplayer\uboskin\skin\min.jpg
- %PROGRAM_FILES%\yunboplayer\uboskin\skin\pk.jpg
- %PROGRAM_FILES%\yunboplayer\uboskin\skin\tv.jpg
- %PROGRAM_FILES%\yunboplayer\uboskin\skin\max-1.jpg
- %PROGRAM_FILES%\yunboplayer\uboskin\skin\max-2.jpg
- %PROGRAM_FILES%\yunboplayer\uboskin\skin\menu.jpg
- %PROGRAM_FILES%\yunboplayer\uboskin\app\loading.swf
- %PROGRAM_FILES%\yunboplayer\uboskin\html\gbook.html
- %PROGRAM_FILES%\yunboplayer\uboskin\html\loading.html
- %PROGRAM_FILES%\yunboplayer\uboskin\icon.ico
- %PROGRAM_FILES%\yunboplayer\uboskin\uboplaylist.xml
- %PROGRAM_FILES%\yunboplayer\uboskin\app\loading.html
- %PROGRAM_FILES%\yunboplayer\uboskin\skin\bf.jpg
- %PROGRAM_FILES%\yunboplayer\uboskin\skin\biaotilan.jpg
- %PROGRAM_FILES%\yunboplayer\uboskin\skin\bj.jpg
- %PROGRAM_FILES%\yunboplayer\uboskin\html\loading.swf
- %PROGRAM_FILES%\yunboplayer\uboskin\html\logo.gif
- %PROGRAM_FILES%\yunboplayer\uboskin\skin\Close.jpg
Удаляет следующие файлы:
- %HOMEPATH%\Templates\520144949878\YYM_955WD30.gif
- %TEMP%\nsp6.tmp\NSISdl.dll
- %TEMP%\nsp6.tmp\System.dll
- %TEMP%\nsw3.tmp\NSISdl.dll
- %TEMP%\nsw3.tmp\System.dll
- %TEMP%\nsw3.tmp\yunbodown
Сетевая активность:
Подключается к:
- 'cd##.##wn.17173ie.com':80
- 'so###.1htb.cn':80
TCP:
Запросы HTTP GET:
- so###.1htb.cn/
UDP:
- DNS ASK up####.aiqingzhihui.com
- DNS ASK tj.#177.com
- DNS ASK so###.1htb.cn
- DNS ASK cd##.##wn.17173ie.com
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
