Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\globalUpdateUpdateTaskMachineCore.job
- %WINDIR%\Tasks\globalUpdateUpdateTaskMachineUA.job
- %WINDIR%\Tasks\8d5b34af-b068-4d01-81b9-d5ad47309383-4.job
- %WINDIR%\Tasks\8d5b34af-b068-4d01-81b9-d5ad47309383-3.job
- %WINDIR%\Tasks\8d5b34af-b068-4d01-81b9-d5ad47309383-11.job
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\globalUpdate] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- '%PROGRAM_FILES%\SmartSaver+ 3\8d5b34af-b068-4d01-81b9-d5ad47309383-11.exe' /SCHQtFqM=rMNN8DFbgdS/+JqMLo8b72a3rT/LE5CtL+aj/rcjJEgHhQ4m6rDCqDUT+9zaajjawDall3FsCbIGV7t2M9H8kwRU62ZjFpbu2XQCOM5J2jJc5jRlm4bUmi82+YiPP67Q61qMnDsfmwr1TPPGw+FEQ9ajtSbIUlet4Ygeb3QjCS3HA1dRIKue4/5aXBkUJ0c91S+uHBElwHO9yq4oNjXF03rgMIyf5UWoIfP8VGxXThH9ir+LJKd71Olh1mEuaRz69Vd8QVXanB8yM+fC/0omi3QlT8vUfEURTQ1F60BYJRSrF4jyjNqR1Q9KFQpbGTiP44K+KTVik2rNCCW8k73U5wRrS6CqwwQlvIBkPyKW9q7Qmdc0UqNvUtga4AheERzIArlhgYgkmTNhKKgHnGM2tnrRO4iW2jWvb4NCq5uuq3/JrrUruckvV2cjngCc4ejDx2XYrVDVJuk/xiZcSQMjlslIdgmohOyRpxo0kgIEGd4g7fWeQsYzZ2pmpQx4IjfMS/kkXF9gKA/8jPAhj8Gti+HsyJpnBI+U6H4syh7N+lj4TV3cKDSDy7+6uIJYNLRYqcnJ9GqeQWlPX0qxSvha0EkYE+v65Sh0jldlp9MuIL+quzjpVWO8fZg/LnsBILIwhDhsnUG6DJPA6qBpfGtv9kdxj61kTD9A4JFbLWGNBcayc38ln1Wpv/MT8NSKki9ux1YEdWxTMOmRJ/Q3No1Ma/XUr9x0ONzojTS1UEH2L2ZiaNgdsHBPLGVxmqCIwfs4qtpwhERKp5G7V+PJrHdPvAUqlPpOrP+AB27gUPv6RrMVRkM2IT26Hy5DoyySTM7yX5kSqEUsYNTrrWa95zFVtnvhpEhHj+MtHQyrXRJ0VmF2r/99ybScD0EKOG/QCtVv+KyGu830fvDY5/JE0xu6HG66m7du46rR0+vO5wmHoTDkv3RIQt78oPnGwlfZ6vHxAxh8J3ZTB3R+pSUz56OQ870cOJrFD1vr3njhtPnxBlHgZY9eeuo4MdMHNLVJqpsNN8euJB9sEGyaRjCeDvvzoHBTgpdacLCjVO2YnwKeMlGenL1SMcWnFkj4bwC1ApgFTzowHEqm2Mu46y/QEbOPlnD+EdfrO85i1RoR2yLZH8pXjJqGdNYzmJwwrXB6DJnXxH3NWMvjhFLD/JaoGUEnyMtHZXur2HpOOssgzRCgj1y/duSLZf+P9IdfxnoqUF2mq0N2Me9T62uNpsfwFnRLUHRXijEEsShFwU9Tkyy26PIStijv7CFxeF7nDsh2GgYvhbAsrXcXc0acq/8aTFbuGZKPi2FN0I50qdf8EFBPRYJMR5RolEaYOOA70ZvehovKVwaCghyuNYtTTJT8DdmTWFOq97V+LvUo8Qt++ziWYaCRK8dvksQ7mBJVhuGnaQ9sykuKR2OivWJbtJqVnnXUVXQxohItwfu+xoE6PrrSg6h/c+XW/wjwyHwn3cYlD9S8arDO067zk1IUhoo+XGWxPskUU2ZwtLhAYIc12Yj+YVsCj0NPTOwSv4pBF1PlPgi1mN2BrCZtUu3adb9Bs8WXmLdj6LGqUgnVoxIFdIDi1J6Unfj7uQ26LF57dxkOzJZV5NiajNbe7tB9QTuEyDn8ZiCdt16zDACJjwLVSy4LTauIIDLmLqplOSUgeTTohgk6qt3hjxt7ubnbXLOb5MGdML1v24gwlghxx8rgsQVzKOA=
- '%PROGRAM_FILES%\globalUpdate\Update\GoogleUpdate.exe' /regsvc
- '%PROGRAM_FILES%\SmartSaver+ 3\8d5b34af-b068-4d01-81b9-d5ad47309383-3.exe' /SCHQtFqM=gdSInku9jDwDHsL2azXvKKglrY3EjsawzYaowhM3A874jebnDj7DOx6PjttCT4tpkvEQ9yaIZ93OCxlk52nhFDvd1QUy73Era3XWr/QLZ6XTkp9+ITxgiFFUgZCwwAtCpgOK8B45kDcljbH/+SLkPC0Ambm2vIfoHbtPrxsQqlGB/Q8LQQRrAhuaJMFgJrJ6pDtlrjWcCLnX7Dvv/DyxS3NCnz8LTMjJXowmnRnlbTD33jhLgXToTwdchMUroLDrjoIrV5vb9appvYb6IjLEFbSghd08vKgcEVa/B9sUqtseYvUVqk95ZbO4CK8DL1zBQBfuCNEnSelt6ZZ5VqTxCQPJjoKmaQLd6IAv/IHNbphUOEmj1okDAljfDWf62oo3y2efK2FolyeumwG2Jhswa0C46v+zNP8k0tty8krUqlvxfGiTnEMgYPH115GXNUHkbxQVED2nEVxN6a0C6Chwt7skWC2AC80J+yrQQ2TMypFU9BowjSOdIaJo2LEKb+Icov0L6kB5YkKTSRBQLpth/CaLBibvyvkP9hpO/91vKPhfv9tOKsCVMkKBHUOoFiRxXe0WUnjKdXT1D7q2aVi7ElJT7jhN+n8Y2QMGjf7i72iW4z9z2vava17wIBCmn365y+79tF05w1c6rpkc6tOThHp4nfGd//eESSAk26HJAL8sBR5rGUJu4ByKOKJBjxzKi7GMmRz5Gs8PvUrnVwRF4p6lwRDIusboccGgMsosKVpEEcsYrN1+YTdaUAL96x1gimUm3ZnkjnOqcDMFoGFhug/vtakhoFrezSHrj9KYM4/dwiFQ4k9pWWgFbQyvY8TVE4xnwbsKi5OYHCLjZj8T8Vn2ywOkWWjyKvWaqPk0MNOaJGQVecTrCfmJHTk+VEWTAj+U8HAeoZQP3dwIgt4azovBArZTnOB8pyZG48AR8sFtlfWU9codoh7oTKgnVJC9BJJsWmDLbM6WMUoAI9MIyklUW70RqAQmA4jHNE8xkUxTaN9OvjYgW1Ykfjzena5FCc6mwhVnWN2ZMLcmzbo1BLvJDbvEiJ8rHDJI8hsACHb7yPZGjf3QHZHSK/oteoQhSdJRsESnCc50n1sUMKlhvDi1k5PNONoTJomRb3WGchR/Y0VExtvpXHjQ4oPJjgOOT1H30CI7RZKixZlGeB+3h3R/5MzwxyRbtLHwGfm0YyQQZc2kzp8OBHnLw7rnXMB/RA5djGDmN/jXrCHfl0t76qA8lfAoPao7Ti0hPn0V1NMu8FIL5V4mspjO8m6sm72e9bftFhE6WTiuX0yoxO2wKbB49A4XmTfA9vQo3YgGCqxZm7ajcQ/3qh734VKU4mSbudd6B3uObD+Nrqh75v84sw==
- '%TEMP%\nsu3.tmp\Coeklkn.exe'
- '%TEMP%\comh.284278\GoogleUpdate.exe' /silent /install "appguid={c9d76707-c026-4d95-a555-fd84632c7493}&appname=773a2b4a-2525-4ff3-ba72-524f4d256f3a&needsadmin=True&lang=en"
Завершает или пытается завершить
следующие пользовательские процессы:
- chrome.exe
- opera.exe
- iexplore.exe
- firefox.exe
Изменения в файловой системе:
Создает следующие файлы:
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\C3E814D1CB223AFCD58214D14C3B7EAB
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\C3E814D1CB223AFCD58214D14C3B7EAB
- %TEMP%\nsl6.tmp\ExecDos.dll
- %PROGRAM_FILES%\SmartSaver+ 3\1293297481.mxaddon
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\8BD11C4A2318EC8E5A82462092971DEA
- %PROGRAM_FILES%\SmartSaver+ 3\8d5b34af-b068-4d01-81b9-d5ad47309383.crx
- %PROGRAM_FILES%\SmartSaver+ 3\360-48922.crx
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004
- %PROGRAM_FILES%\SmartSaver+ 3\48922.crx
- %PROGRAM_FILES%\SmartSaver+ 3\8d5b34af-b068-4d01-81b9-d5ad47309383-3.exe
- %TEMP%\Cab7.tmp
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- %PROGRAM_FILES%\globalUpdate\Update\GoogleUpdate.exe
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\psmachine.dll
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\psuser.dll
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\npGoogleUpdate4.dll
- %PROGRAM_FILES%\SmartSaver+ 3\48922.xpi
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\GoogleUpdateOnDemand.exe
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\GoogleUpdateBroker.exe
- %TEMP%\Cab9.tmp
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\GoogleCrashHandler.exe
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\8BD11C4A2318EC8E5A82462092971DEA
- %PROGRAM_FILES%\SmartSaver+ 3\8d5b34af-b068-4d01-81b9-d5ad47309383-11.exe
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\GoogleUpdateHelper.msi
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\goopdateres_en.dll
- %TEMP%\CabB.tmp
- %TEMP%\nsl6.tmp\inetc.dll
- %TEMP%\nsl6.tmp\UserInfo.dll
- %TEMP%\nsl6.tmp\md5dll.dll
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\update[1].json
- %TEMP%\nsl6.tmp\173976
- %PROGRAM_FILES%\SmartSaver+ 3\utils.exe
- %TEMP%\nsl6.tmp\update.json
- %TEMP%\nsl6.tmp\StdUtils.dll
- %TEMP%\nsa5.tmp
- %TEMP%\nsp2.tmp
- %TEMP%\nsl6.tmp\System.dll
- %TEMP%\nsl6.tmp\nsisos.dll
- %TEMP%\nsl6.tmp\InstallerUtils2.dll
- %TEMP%\nsl6.tmp\InstallerUtils.dll
- %TEMP%\comh.284278\npGoogleUpdate4.dll
- %TEMP%\comh.284278\goopdateres_en.dll
- %TEMP%\comh.284278\goopdate.dll
- %TEMP%\comh.284278\psmachine.dll
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\goopdate.dll
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\GoogleUpdate.exe
- %TEMP%\comh.284278\psuser.dll
- %TEMP%\comh.284278\GoogleCrashHandler.exe
- %PROGRAM_FILES%\SmartSaver+ 3\Uninstall.exe
- %TEMP%\nsl6.tmp\444658
- %TEMP%\comh.284278\GoogleUpdate.exe
- %TEMP%\comh.284278\GoogleUpdateOnDemand.exe
- %TEMP%\comh.284278\GoogleUpdateHelper.msi
- %TEMP%\comh.284278\GoogleUpdateBroker.exe
Удаляет следующие файлы:
- %TEMP%\Cab9.tmp
- %TEMP%\CabB.tmp
- %TEMP%\nsl6.tmp\444658
- %TEMP%\Cab7.tmp
Сетевая активность:
Подключается к:
- 'www.download.windowsupdate.com':80
- 'cr#.#hawte.com':80
- 'ts####.ws.symantec.com':80
- 'lo##.##ninfocloud.com':80
- 'up####.geninfocloud.com':80
- 'er####.geninfocloud.com':80
- 'st###.#eninfocloud.com':80
TCP:
Запросы HTTP GET:
- cr#.#hawte.com/ThawteTimestampingCA.crl
- ts####.ws.symantec.com/tss-ca-g2.crl
- www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
- up####.geninfocloud.com/installer_updates/000840/update.json
- www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt
UDP:
- DNS ASK www.download.windowsupdate.com
- DNS ASK cr#.#hawte.com
- DNS ASK ts####.ws.symantec.com
- DNS ASK lo##.##ninfocloud.com
- DNS ASK up####.geninfocloud.com
- DNS ASK er####.geninfocloud.com
- DNS ASK st###.#eninfocloud.com
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
