Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Classes\xmlfile\shell\Open\command] '' = '"%PROGRAM_FILES%\SogouExplorer\SogouExplorer.exe" "%1"'
- [<HKLM>\SOFTWARE\Classes\mhtmlfile\shell\open\command] '' = '"%PROGRAM_FILES%\SogouExplorer\SogouExplorer.exe" "%1"'
- [<HKLM>\SOFTWARE\Clients\StartMenuInternet\SogouExplorer.exe\Shell\open\command] '' = '%PROGRAM_FILES%\SogouExplorer\SogouExplorer.exe'
- <Служебный элемент>
- [<HKLM>\SOFTWARE\Classes\htmlfile\shell\open\command] '' = '"%PROGRAM_FILES%\SogouExplorer\SogouExplorer.exe" "%1"'
- [<HKLM>\SOFTWARE\Classes\HTTP\shell\open\command] '' = '"%PROGRAM_FILES%\SogouExplorer\SogouExplorer.exe" "%1"'
- [<HKLM>\SOFTWARE\Classes\SogouExplorer.AssocFile.HTM\Shell\open\command] '' = '"%PROGRAM_FILES%\SogouExplorer\SogouExplorer.exe" "%1"'
- [<HKLM>\SOFTWARE\Classes\https\shell\open\command] '' = '"%PROGRAM_FILES%\SogouExplorer\SogouExplorer.exe" "%1"'
- [<HKLM>\SOFTWARE\Classes\InternetShortcut\shell\open\command] '' = '"%PROGRAM_FILES%\SogouExplorer\SogouExplorer.exe" "%1"'
Вредоносные функции:
Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\SogouExplorer\setask.exe' = '%PROGRAM_FILES%\SogouExplorer\setask.exe:*:Enabled:SogouExplorer'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\SogouExplorer\SogouExplorer.exe' = '%PROGRAM_FILES%\SogouExplorer\SogouExplorer.exe:*:Enabled:SogouExplorer'
Создает и запускает на исполнение:
- '%PROGRAM_FILES%\SogouExplorer\SogouExplorer.exe'
- '%PROGRAM_FILES%\SogouExplorer\SogouExplorer.exe' -ForceAutoUpgrade
- '%PROGRAM_FILES%\SogouExplorer\SogouExplorer.exe' -DignityWorks0
- '%PROGRAM_FILES%\SogouExplorer\seup.exe' /name:sogoubrowser /S /auto
- '%PROGRAM_FILES%\SogouExplorer\setask.exe' 0 65760 65772 65762 65768 0 31529 "UbOQP+6wZK8Q4Gr9PmsimXqVgfNWWH/WsDJmKjDXiWE=" ";;;0;;;0;0;VXNlSUVQcm94eQ==; ;;"
- '%PROGRAM_FILES%\SogouExplorer\setask.exe' 65866 65760 65772 65762 65768 0 31529 "siXR2shN0XiOsZ2C1s0GgKxG1QObsHlP1Fpcx0AhlX8=" ";;;0;;;0;0;VXNlSUVQcm94eQ==; ;;"
- '%PROGRAM_FILES%\SogouExplorer\SogouExplorer.exe' -PinToTaskbar
- '%PROGRAM_FILES%\SogouExplorer\SogouExplorer.exe' -UnpinFromTaskbar
- '%TEMP%\SogouExplorer_1.4.0.414_2410_silent.exe'
- '%PROGRAM_FILES%\SogouExplorer\SogouExplorer.exe' -SogouDefault
- '%PROGRAM_FILES%\SogouExplorer\SogouExplorer.exe' -logseinst
- '%PROGRAM_FILES%\SogouExplorer\SogouExplorer.exe' -addtofw
Запускает на исполнение:
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\7ZSfx000.cmd" "
Изменения в файловой системе:
Создает следующие файлы:
- %PROGRAM_FILES%\SogouExplorer\UserInstruct\passport.swf
- %PROGRAM_FILES%\SogouExplorer\StartPage\Selector\start_zidingyi_text.gif
- %PROGRAM_FILES%\SogouExplorer\UserInstruct\videoExtract.swf
- %PROGRAM_FILES%\SogouExplorer\UserInstruct\passport_20.swf
- %PROGRAM_FILES%\SogouExplorer\StartPage\Selector\start_text_1.png
- %PROGRAM_FILES%\SogouExplorer\StartPage\Selector\start_stage_main.png
- %PROGRAM_FILES%\SogouExplorer\StartPage\Selector\start_zidingyi_icon.gif
- %PROGRAM_FILES%\SogouExplorer\StartPage\Selector\start_zidingyi_dizhikuang.gif
- %PROGRAM_FILES%\SogouExplorer\UserInstruct\videoOnTop.swf
- %APPDATA%\SogouExplorer\HistoryUrl.db
- %PROGRAM_FILES%\SogouExplorer\Uninstall.exe
- %PROGRAM_FILES%\SogouExplorer\cap.se
- %PROGRAM_FILES%\SogouExplorer\changelog.txt
- %PROGRAM_FILES%\SogouExplorer\seup.exe
- %PROGRAM_FILES%\SogouExplorer\SogouExplorer.exe
- %PROGRAM_FILES%\SogouExplorer\setask.exe
- %PROGRAM_FILES%\SogouExplorer\crashrpt.exe
- %PROGRAM_FILES%\SogouExplorer\StartPage\Selector\start_stage_arrow_zuiai.png
- %PROGRAM_FILES%\SogouExplorer\StartPage\Selector\start_btn_zidingyi_hit.png
- %PROGRAM_FILES%\SogouExplorer\StartPage\Selector\start_btn_zidingyi.png
- %PROGRAM_FILES%\SogouExplorer\StartPage\Selector\start_btn_zuiai_hit.png
- %PROGRAM_FILES%\SogouExplorer\StartPage\Selector\start_btn_zuiai.png
- %PROGRAM_FILES%\SogouExplorer\StartPage\Selector\start_btn_queding_hover.png
- %PROGRAM_FILES%\SogouExplorer\StartPage\Selector\start_btn_queding_hit.png
- %PROGRAM_FILES%\SogouExplorer\StartPage\Selector\start_btn_sousuo_hit.png
- %PROGRAM_FILES%\SogouExplorer\StartPage\Selector\start_btn_sousuo.png
- %PROGRAM_FILES%\SogouExplorer\StartPage\Selector\start_checkbox_checked.png
- %PROGRAM_FILES%\SogouExplorer\StartPage\Selector\start_stage_arrow_kongbai.png
- %PROGRAM_FILES%\SogouExplorer\StartPage\Selector\start_stage_arrow_daohang.png
- %PROGRAM_FILES%\SogouExplorer\StartPage\Selector\start_stage_arrow_zidingyi.png
- %PROGRAM_FILES%\SogouExplorer\StartPage\Selector\start_stage_arrow_sousuo.png
- %PROGRAM_FILES%\SogouExplorer\StartPage\Selector\start_checkbox_normal.png
- %PROGRAM_FILES%\SogouExplorer\StartPage\Selector\start_checkbox_hover.png
- %PROGRAM_FILES%\SogouExplorer\StartPage\Selector\start_ico_home.gif
- %PROGRAM_FILES%\SogouExplorer\StartPage\Selector\start_daohang_logo_bg.png
- %ALLUSERSPROFILE%\Start Menu\Programs\ЛС№·дЇААЖч\ЛС№·дЇААЖч.lnk
- %ALLUSERSPROFILE%\Start Menu\ЛС№·дЇААЖч.lnk
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\ЛС№·дЇААЖч.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\ЛС№·дЇААЖч\·ГОКЛС№·дЇААЖчНшХѕ.lnk
- %PROGRAM_FILES%\SogouExplorer\p2pclient.dll
- %PROGRAM_FILES%\SogouExplorer\seapi.dll
- %ALLUSERSPROFILE%\Desktop\ЛС№·дЇААЖч.lnk
- %PROGRAM_FILES%\SogouExplorer\site.url
- %APPDATA%\SogouExplorer\HistoryUrl.db-journal
- %APPDATA%\SogouExplorer\Favorite2.dat
- %TEMP%\etilqs_dm8lQOUqBY0YKnViHvoA
- %APPDATA%\SogouExplorer\FavIcon\default_page.ico
- %TEMP%\7ZSfx000.cmd
- %APPDATA%\SogouExplorer\configlocal.xml
- %APPDATA%\SogouExplorer\Config.xml
- %APPDATA%\SogouExplorer\Favorite2.dat-journal
- %APPDATA%\SogouExplorer\CommCfg.xml
- %PROGRAM_FILES%\SogouExplorer\seacc.dll
- %PROGRAM_FILES%\SogouExplorer\MainUIFrame.dll
- %PROGRAM_FILES%\SogouExplorer\Dialog.dll
- %PROGRAM_FILES%\SogouExplorer\UserCenter.dll
- %PROGRAM_FILES%\SogouExplorer\Trash.dll
- %PROGRAM_FILES%\SogouExplorer\browser.conf
- %PROGRAM_FILES%\SogouExplorer\config.se
- %PROGRAM_FILES%\SogouExplorer\SECommon.dll
- %PROGRAM_FILES%\SogouExplorer\HWSignature.dll
- %PROGRAM_FILES%\SogouExplorer\sqlite3.dll
- %PROGRAM_FILES%\SogouExplorer\ShareClient.dll
- %PROGRAM_FILES%\SogouExplorer\pxpnet.dll
- %PROGRAM_FILES%\SogouExplorer\CheckRange.dll
- %PROGRAM_FILES%\SogouExplorer\video_acc.dll
- %PROGRAM_FILES%\SogouExplorer\msvcr80.dll
- %PROGRAM_FILES%\SogouExplorer\msvcp80.dll
- %PROGRAM_FILES%\SogouExplorer\sogounet.dll
- %PROGRAM_FILES%\SogouExplorer\Microsoft.VC80.CRT.manifest
- %PROGRAM_FILES%\SogouExplorer\StartPage\Selector\start_btn_queding.png
- %PROGRAM_FILES%\SogouExplorer\StartPage\Local\index.html
- %PROGRAM_FILES%\SogouExplorer\StartPage\Local\iframe.html
- %PROGRAM_FILES%\SogouExplorer\StartPage\Local\index2.html
- %PROGRAM_FILES%\SogouExplorer\StartPage\Local\index1.html
- %PROGRAM_FILES%\SogouExplorer\StartPage\Local\guding1.png
- %PROGRAM_FILES%\SogouExplorer\StartPage\Local\googlec.gif
- %PROGRAM_FILES%\SogouExplorer\StartPage\Local\help.gif
- %PROGRAM_FILES%\SogouExplorer\StartPage\Local\guding2.png
- %PROGRAM_FILES%\SogouExplorer\StartPage\Local\logo.gif
- %PROGRAM_FILES%\SogouExplorer\StartPage\Local\rbg2.jpg
- %PROGRAM_FILES%\SogouExplorer\StartPage\Local\rbg0.jpg
- %PROGRAM_FILES%\SogouExplorer\StartPage\Local\reset.gif
- %PROGRAM_FILES%\SogouExplorer\StartPage\Local\rbg3.jpg
- %PROGRAM_FILES%\SogouExplorer\StartPage\Local\q1.png
- %PROGRAM_FILES%\SogouExplorer\StartPage\Local\none.jpg
- %PROGRAM_FILES%\SogouExplorer\StartPage\Local\rbg.jpg
- %PROGRAM_FILES%\SogouExplorer\StartPage\Local\q2.png
- %PROGRAM_FILES%\SogouExplorer\StartPage\Local\google.gif
- %PROGRAM_FILES%\SogouExplorer\Skin\DefaultSkin.ses
- %TEMP%\nst3.tmp\KillProc.dll
- %PROGRAM_FILES%\SogouExplorer\StartPage\Local\baiduc.gif
- %PROGRAM_FILES%\SogouExplorer\StartPage\Local\baidu.gif
- %TEMP%\nsn2.tmp
- %TEMP%\SogouExplorer_1.4.0.414_2410_silent.exe
- %TEMP%\nst3.tmp\io.ini
- %TEMP%\nst3.tmp\System.dll
- %PROGRAM_FILES%\SogouExplorer\StartPage\Local\checkbox.gif
- %PROGRAM_FILES%\SogouExplorer\StartPage\Local\default.jpg
- %PROGRAM_FILES%\SogouExplorer\StartPage\Local\default.gif
- %PROGRAM_FILES%\SogouExplorer\StartPage\Local\fenge.png
- %PROGRAM_FILES%\SogouExplorer\StartPage\Local\default_page.ico
- %PROGRAM_FILES%\SogouExplorer\StartPage\Local\checkbox2.gif
- %PROGRAM_FILES%\SogouExplorer\StartPage\Local\checkbox1.gif
- %PROGRAM_FILES%\SogouExplorer\StartPage\Local\close.png
- %PROGRAM_FILES%\SogouExplorer\StartPage\Local\close.gif
- %PROGRAM_FILES%\SogouExplorer\StartPage\Selector\pic_zuiai_2.jpg
- %PROGRAM_FILES%\SogouExplorer\StartPage\Selector\pic_zuiai_1.jpg
- %PROGRAM_FILES%\SogouExplorer\StartPage\Selector\s_google_logo.png
- %PROGRAM_FILES%\SogouExplorer\StartPage\Selector\s_baidu_logo.png
- %PROGRAM_FILES%\SogouExplorer\StartPage\Selector\pic_kongbai.jpg
- %PROGRAM_FILES%\SogouExplorer\StartPage\Selector\pic_daohang.jpg
- %PROGRAM_FILES%\SogouExplorer\StartPage\Selector\pic_zuiai.jpg
- %PROGRAM_FILES%\SogouExplorer\StartPage\Selector\pic_sousuo.jpg
- %PROGRAM_FILES%\SogouExplorer\StartPage\Selector\s_sogou_logo.png
- %PROGRAM_FILES%\SogouExplorer\StartPage\Selector\start_btn_kongbai_hit.png
- %PROGRAM_FILES%\SogouExplorer\StartPage\Selector\start_btn_kongbai.png
- %PROGRAM_FILES%\SogouExplorer\StartPage\Selector\start_btn_qita.png
- %PROGRAM_FILES%\SogouExplorer\StartPage\Selector\start_btn_light.png
- %PROGRAM_FILES%\SogouExplorer\StartPage\Selector\start_body_bg.jpg
- %PROGRAM_FILES%\SogouExplorer\StartPage\Selector\sogou_logo.png
- %PROGRAM_FILES%\SogouExplorer\StartPage\Selector\start_btn_daohang_hit.png
- %PROGRAM_FILES%\SogouExplorer\StartPage\Selector\start_btn_daohang.png
- %PROGRAM_FILES%\SogouExplorer\StartPage\Selector\index2.html
- %PROGRAM_FILES%\SogouExplorer\StartPage\Local\shadow1.jpg
- %PROGRAM_FILES%\SogouExplorer\StartPage\Local\setok.gif
- %PROGRAM_FILES%\SogouExplorer\StartPage\Local\sogou.gif
- %PROGRAM_FILES%\SogouExplorer\StartPage\Local\shadow2.gif
- %PROGRAM_FILES%\SogouExplorer\StartPage\Local\selmenu.png
- %PROGRAM_FILES%\SogouExplorer\StartPage\Local\sb.jpg
- %PROGRAM_FILES%\SogouExplorer\StartPage\Local\setcancel.gif
- %PROGRAM_FILES%\SogouExplorer\StartPage\Local\set.gif
- %PROGRAM_FILES%\SogouExplorer\StartPage\Local\sogouc.gif
- %PROGRAM_FILES%\SogouExplorer\StartPage\Selector\google_logo.png
- %PROGRAM_FILES%\SogouExplorer\StartPage\Selector\baidu_logo.png
- %PROGRAM_FILES%\SogouExplorer\StartPage\Selector\index1.html
- %PROGRAM_FILES%\SogouExplorer\StartPage\Selector\index.html
- %PROGRAM_FILES%\SogouExplorer\StartPage\Local\tran1.png
- %PROGRAM_FILES%\SogouExplorer\StartPage\Local\space.gif
- %PROGRAM_FILES%\SogouExplorer\StartPage\Local\tran3.png
- %PROGRAM_FILES%\SogouExplorer\StartPage\Local\tran2.png
Удаляет следующие файлы:
- %TEMP%\nst3.tmp\KillProc.dll
- %TEMP%\nst3.tmp\System.dll
- %TEMP%\7ZSfx000.cmd
- %APPDATA%\SogouExplorer\HistoryUrl.db-journal
- %APPDATA%\SogouExplorer\Favorite2.dat-journal
- %TEMP%\nst3.tmp\io.ini
Самоудаляется.
Сетевая активность:
Подключается к:
- 'localhost':1048
- 'pi##.#e.sogou.com':80
TCP:
Запросы HTTP GET:
- pi##.#e.sogou.com/ie.png?1D######################################################################################
- pi##.#e.sogou.com/ie.png?kF###################################################################################################
UDP:
- DNS ASK ie.##gou.com
- DNS ASK ch####.acc.sogou.com
- DNS ASK co####.ie.sogou.com
- DNS ASK www.so##u.com
- DNS ASK co####.acc.sogou.com
- DNS ASK pi##.#e.sogou.com
- DNS ASK ip.###.sogou.com
- DNS ASK www.23##.com
Другое:
Ищет следующие окна:
- ClassName: 'MS_WebcheckMonitor' WindowName: '(null)'
- ClassName: 'MS_AutodialMonitor' WindowName: '(null)'
- ClassName: 'Internet Explorer_Server' WindowName: '(null)'
- ClassName: 'PyUpBasicInfoWnd' WindowName: '???????'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'SE_AxControl' WindowName: '(null)'
- ClassName: 'SE_SogouExplorerFrame' WindowName: '(null)'
- ClassName: 'SE_MainUI' WindowName: '(null)'
- ClassName: 'SGSEUpUIWnd' WindowName: '(null)'
