Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\globalUpdateUpdateTaskMachineCore.job
- %WINDIR%\Tasks\globalUpdateUpdateTaskMachineUA.job
- %WINDIR%\Tasks\ffea8391-68df-45b2-85c3-84381f8681cb-4.job
- %WINDIR%\Tasks\ffea8391-68df-45b2-85c3-84381f8681cb-3.job
- %WINDIR%\Tasks\ffea8391-68df-45b2-85c3-84381f8681cb-11.job
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\globalUpdate] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- '%PROGRAM_FILES%\HDtubeV1.6\ffea8391-68df-45b2-85c3-84381f8681cb-11.exe' /sruSps=tHpRRspGIIgzv7aMQZiaA40xiu1qY35xpAssXMDUBGDWJdsY+reLpbIoyZyIEvf6V7NwelmAumnt+WOasV3FispiebRRi/aulTMr84jtiEnmnr9KshcGCxekXnnTsbFI/zC2vSx0H9ueCZ2nVddkzgsgALnDkuZ+bPnaxszRm4ikTkl5rJsz+ZXrd3fsuG59w8C/j0qRv87i8E6iUg/F0Fg0c6W0YH9gmjf63BRgSp+POAfh/QKr21e9SVr6RasRPKTJzlGXyANZ9ZPZD6en8dom/LRt+V8nP72tafaPBro6lWSAMmCdyvUMDlwbb8jahLApaIwjOhUdWxWhpWMflGpfjEJzY0KAar0lwN1mekYSIh6mZoOCHQelTLyUAWnlZT/4LEwKtJ2xgbZsJxejM1yPp2TMq7BvMmcDJgpmeEDBQxV+Xbx3pAwPrKGHdKtD07a4ViBWDqdVEisyCiaV4GluM28qqMvoracU6Mj6aJZTMZ4yb69zE6Pt0+T3EKchqB2tyu3GVhwEfQ7QVF2m+UqobEmBvjw6oGwN06eR0CAWUqo8j+9qz32APp1XgBftiKIrPeD+HlCNi3YzhuSbGCm1GCzJp0rxSOIiFTopn0BPv975Lo3hN1aXz93R0GrweVZDU+VgS00Xr5MOgHecYBp4niZrnsxUWpEjF9KOv4SpoqtsDlG5JwgFiBF2d4Z2AuBYvt9h4O1P+fFoznQSEaY7R/oEQirKcFQFpzQgx9DFE5h0BI1p7y5UhGfFkRw0/UePMXQwH15C9xkVgsbfO6vMDYQnI5vNDt3uH9cmSZPDdMRqtwW3cxns+7zIdw3sHaxtdgIpAAtGoDwyNtzJKToWWNyH52mtE5a3eCrfcUy5a4tdV7UjrIG8QDWZ/ifW3cF/rGjn2xMvJzcL4jDZYDO7eyHLy/A3B2C0gLETj67SOc1BtnnU5M0DARhrIOTHPBtA5YMKEHDwWWH+cmDvAiPzhN9r7h2WgG0i5bZT6v7YV5ARjIQVnGT7XVdFDYpZnisis+vZo1QTvcKcQI0/lbpJLstadwAkQ3lgKFfVkXtR7IKbCYpxFrtd40ysi9PfOYCOB8In41v5V2k2e02vChCnrzRD96Ugk4t2gaROyWfbf4MCV8POdik9T1SgO0F9UAj4H1foOppiHCHTheJUCq7bMZ+fa0tcEhVNN11Ad7cOp/aNU0rAWutZr9v95PZcNyxMve/U0TvidCIAJkFO1kCaHGE6S/lOjDc2XEYOVhEuzrqTFf3TqX93N+/TTi2krFgVxlFC32TOeamLJeg7V8ny1Os5MjO1oNzRXJ/dIr51kGBHWn7n5XU9/Evqv+UWdhM7qrkwZG8rDEXsaL6a6Hzqe0dyTpNQf9/xvwUuv/XbLu72lSB4xFTNLd+zyx+V2M9myh+5s4pymP8qut3MIFT3ivBA/Q083XAEjzSeglUjfqDsQV2r7e5M6u0GumHvOmK55Wl9lriU/oso5ut0U23xasx6cstFCjXktKAhT4bldSFHOgbFlFKBZgZ26+CZA/VbaCmJxNh5te+Nga3kmHo5zP1BCY6D9hfVgvwwIC6HbCqGMtuUP6r0VKCytHtuPS1T6Q328sAKkLqpdhXMnMz2OnsivrWpiB5h0h34sk5zMwj2jPSoN0Xy4ENH+iZBaQauznOJutN1OU7mdcl2YuayKEDWXhRIZ9vLw/edUA8=
- '%PROGRAM_FILES%\globalUpdate\Update\GoogleUpdate.exe' /regsvc
- '%PROGRAM_FILES%\HDtubeV1.6\ffea8391-68df-45b2-85c3-84381f8681cb-3.exe' /sruSps=MingoXdP/6mn/7yR1+mS52wXvLP+4xJTErfRMxvJL4YhE5ZPZoH6ltWhyY5BDOAFVpN1v+MtOYsT5R+H4ko7GbLf2dGqzBwrsb5ZFKSPFlSHNrLLRetlQmuTnp6zQjMHM/Ang7sa/N/Hf9esmHzeNugcKjH1OYr08M1AW3nXuaUTKMVCJCCudmWqBxhsqq6ayJ3bhUh6bILED8cSNebaREfcKwGnmaqdXQRIL5GvLvAUsRqDpGAt76MYyBVpjKzCiOs/o6N5saSUHuvOOP9acHJlCF99PyBENK62IPsHBt49FrDoI4Bc71XCAtX1ewyLBHdQxTyDHRnonRFt7KUtyjt3QAEEFy8I30hldQrLAZAL85ADNVn2n+7JWU8ipSYJeJfEQsGoputA6C75G1V42hOg3X8vzyikIo85qMJg6vcHzqhEKdhFZ1G7SjU/PmeAJlWQF7rlJsI9jpaq7pxmISIPTRkFEPunbJh80ZszjFbjWWBCA+Znx38W+g69f1GZdjZE8x6jfdAzu/cLFttPl/bGs3lEGV6jTtvxnT2/GqmqdxDzTfuVVUHUGHuerULyR9qfl5yXR6RB/DfOGPEWvexmL/G2J2fyEoXJ6G9Q3nKotaEO2L7eqYixcy1bc784gVJBxpRjObqXQ9QqA4t1gCSQ8hCRsvspWn8WQ9UvWMaSGfL+wAIdTRyRAKX2+laNWdpADKuCGxDdHMhiVp+xwm4Nn5qQ0/RemwHS/ODbXHTyiDZj7cdjH7b6Aj2Z21ThNmkpLYLhP/j7R3Fq7s8uKFsUyrFEV8qLQZp5s2h44oMTXIcXIQUNHOvBpVMdnciahkPJGXVp6ya6XnMDrWklEnpie3zb1Uy/cvX4ku/04w3FlAnHPYdQrFHsyXzSDT6kbfhjkLOTPBG91uQSbolzzKL5qlj4k1IL/TQfZcHstPxjkdgVoc/kop6TVxjicaIME4XBdHByLxk5AWx6UCSq5Noi7fRTdx0RoqqDnkWkyjaHxrEZdx5+1s9iECysrLClgPOvi9MJdSiSh0fhc2K3dRZr1rutQR8wXfeI72W2R7fzLOsSvuTYXiX5xEVba0Jc8GwKQeXC31Hu/qIg2BrdXlAngUSYXBuJSbK4PVHLZjhnOxHWiJu9YTY3J5BRs+FE3RBactahtExMY6mqBo/HPREBD3TtSCR9YoSCpwiRZku22Nz6mXEBa4JSK2VvHkKF7RtCg6+Yz5Twl5w+rRKln7wvO5qmfr02nV+cGYtluu/KUPDuL8K0kfmDlDQZw2EjQJsgbxKGXyVAUGwHc1bpk9vfJuLHwwvBcfnWfL/p5Md9OBQ8JCFtij9iLTSglVVpbWffhx7hoJuIAJh0nkEkDIAGp/FbgoS5Rs6tPN/YAj+zuyVCLdK36047veTGV8FrHSaIu1CYfwyzObdsA9XtrQMlx3XCdFEYWwdh7zGp7H3eWAMMgA1Z6vKcjLJLpwEjTJ/ZYyZiwmC87UsoIVC+e3oeFt5dJWF7kbpABfq9eybfiPQ+JNKUM1UrAXDtO8W/
- '%TEMP%\nsb2.tmp\Bugkbldmfwormw.exe'
- '%TEMP%\comh.484744\GoogleUpdate.exe' /silent /install "appguid={d3498eb0-cef2-4d31-825c-888294aaa97f}&appname=cfce24ef-fda2-4246-9584-13c516cbfc9d&needsadmin=True&lang=en"
Запускает на исполнение:
- '<SYSTEM32>\msiexec.exe' /V
Завершает или пытается завершить
следующие пользовательские процессы:
- chrome.exe
- opera.exe
- iexplore.exe
- firefox.exe
Изменения в файловой системе:
Создает следующие файлы:
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\C3E814D1CB223AFCD58214D14C3B7EAB
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\C3E814D1CB223AFCD58214D14C3B7EAB
- %TEMP%\nso5.tmp\ExecDos.dll
- %PROGRAM_FILES%\HDtubeV1.6\1293297481.mxaddon
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\8BD11C4A2318EC8E5A82462092971DEA
- %PROGRAM_FILES%\HDtubeV1.6\ffea8391-68df-45b2-85c3-84381f8681cb.crx
- %PROGRAM_FILES%\HDtubeV1.6\fe1f7290-36ed-4b2a-8c60-69e9d5767c28.crx
- %TEMP%\Cab6.tmp
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004
- %PROGRAM_FILES%\HDtubeV1.6\6ceb1f17-fc36-458b-ab09-7ca1b44d4177.crx
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\goopdate.dll
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- %PROGRAM_FILES%\HDtubeV1.6\ffea8391-68df-45b2-85c3-84381f8681cb-3.exe
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\npGoogleUpdate4.dll
- %PROGRAM_FILES%\globalUpdate\Update\GoogleUpdate.exe
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\psmachine.dll
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\GoogleUpdateBroker.exe
- %PROGRAM_FILES%\HDtubeV1.6\ffea8391-68df-45b2-85c3-84381f8681cb-4.exe
- %PROGRAM_FILES%\HDtubeV1.6\ffea8391-68df-45b2-85c3-84381f8681cb.xpi
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\GoogleUpdateOnDemand.exe
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\psuser.dll
- %TEMP%\Cab8.tmp
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\GoogleCrashHandler.exe
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\8BD11C4A2318EC8E5A82462092971DEA
- %PROGRAM_FILES%\HDtubeV1.6\ffea8391-68df-45b2-85c3-84381f8681cb-11.exe
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\GoogleUpdateHelper.msi
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\goopdateres_en.dll
- %TEMP%\CabA.tmp
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\GoogleUpdate.exe
- %TEMP%\nso5.tmp\nsisos.dll
- %TEMP%\nso5.tmp\InstallerUtils2.dll
- %TEMP%\nso5.tmp\InstallerUtils.dll
- %TEMP%\nso5.tmp\md5dll.dll
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\update[1].json
- %TEMP%\nso5.tmp\inetc.dll
- %TEMP%\nso5.tmp\UserInfo.dll
- %TEMP%\nso5.tmp\System.dll
- %TEMP%\nsb2.tmp\WrapperUtils.dll
- %TEMP%\nsb2.tmp\Ypdtwfsfdp.tmp
- %TEMP%\nsb2.tmp\System.dll
- %TEMP%\nsb2.tmp\Bugkbldmfwormw.exe
- %TEMP%\nso5.tmp\StdUtils.dll
- %TEMP%\nst4.tmp
- %TEMP%\nsb2.tmp\StdUtils.dll
- %TEMP%\comh.484744\goopdate.dll
- %TEMP%\comh.484744\GoogleUpdateOnDemand.exe
- %TEMP%\comh.484744\GoogleUpdateHelper.msi
- %TEMP%\comh.484744\goopdateres_en.dll
- %TEMP%\comh.484744\psuser.dll
- %TEMP%\comh.484744\psmachine.dll
- %TEMP%\comh.484744\npGoogleUpdate4.dll
- %TEMP%\comh.484744\GoogleUpdateBroker.exe
- %TEMP%\nso5.tmp\91675
- %PROGRAM_FILES%\HDtubeV1.6\utils.exe
- %TEMP%\nso5.tmp\update.json
- %TEMP%\nso5.tmp\300264
- %TEMP%\comh.484744\GoogleUpdate.exe
- %TEMP%\comh.484744\GoogleCrashHandler.exe
- %PROGRAM_FILES%\HDtubeV1.6\Uninstall.exe
Удаляет следующие файлы:
- %TEMP%\Cab8.tmp
- %TEMP%\CabA.tmp
- %TEMP%\nso5.tmp\300264
- %TEMP%\Cab6.tmp
Сетевая активность:
Подключается к:
- 'www.download.windowsupdate.com':80
- 'cr#.#hawte.com':80
- 'ts####.ws.symantec.com':80
- 'lo##.##fodatacloud.com':80
- 'up####.#nfodatacloud.com':80
- 'er####.#nfodatacloud.com':80
- 'st###.#nfodatacloud.com':80
TCP:
Запросы HTTP GET:
- cr#.#hawte.com/ThawteTimestampingCA.crl
- ts####.ws.symantec.com/tss-ca-g2.crl
- www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
- up####.#nfodatacloud.com/installer_updates/001700/update.json
- www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt
UDP:
- DNS ASK www.download.windowsupdate.com
- DNS ASK cr#.#hawte.com
- DNS ASK ts####.ws.symantec.com
- DNS ASK lo##.##fodatacloud.com
- DNS ASK up####.#nfodatacloud.com
- DNS ASK er####.#nfodatacloud.com
- DNS ASK st###.#nfodatacloud.com
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
