Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Classes\BitRoll\shell\open\command] '' = '"""{app}\BitRoll.exe"" ""%1"""'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'wextract_cleanup1' = 'rundll32.exe <SYSTEM32>\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP001.TMP\"'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'wextract_cleanup0' = 'rundll32.exe <SYSTEM32>\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"'
Вредоносные функции:
Создает и запускает на исполнение:
- '%TEMP%\IXP000.TMP\WyzoSetup-SML.exe' /S
- '%TEMP%\eToroSetup.exe'
- '%TEMP%\IXP001.TMP\BitRoll-5.0.0.0-setup.exe'
- '%TEMP%\etoro.EXE' %TEMP%\
- '%PROGRAM_FILES%\Wyzo\components.exe' /S
- '%TEMP%\minime.exe' 7b7b0de131942013123
- '%PROGRAM_FILES%\Wyzo\AskSearchAsst.exe' /S
- '%TEMP%\IXP001.TMP\Etoro_BitRollWR.exe'
- '%TEMP%\IXP001.TMP\AdsPlusLink.exe'
- '%TEMP%\IXP000.TMP\Setup_00.exe'
- '%TEMP%\IXP001.TMP\vd.exe'
- '%TEMP%\IXP001.TMP\Forextrading.exe'
- '%TEMP%\IXP000.TMP\WyzoS.exe'
- '%TEMP%\IXP001.TMP\appsetup.exe'
- '%PROGRAM_FILES%\Wyzo\components.exe' (загружен из сети Интернет)
- '%TEMP%\etoro.EXE' (загружен из сети Интернет)
- '%TEMP%\minime.exe' (загружен из сети Интернет)
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsl9.tmp\StartMenu.dll
- %TEMP%\nsqC.tmp\InetLoad.dll
- %TEMP%\nsl9.tmp\Math.dll
- %TEMP%\nsl9.tmp\locate.dll
- %TEMP%\nsqC.tmp\KillProcDLL.dll
- %PROGRAM_FILES%\BitRoll\uninstall.exe
- %HOMEPATH%\Start Menu\Programs\BitRoll\HomePage.lnk
- %HOMEPATH%\Start Menu\Programs\BitRoll\Uninstall.lnk
- %PROGRAM_FILES%\BitRoll\BitRoll.url
- %HOMEPATH%\Start Menu\Programs\BitRoll\BitRoll.lnk
- %HOMEPATH%\Desktop\BitRoll.lnk
- %PROGRAM_FILES%\Wyzo\Timed out on connecting
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\get_file[1].php
- %TEMP%\nsxE.tmp\md5dll.dll
- %PROGRAM_FILES%\Ask Search Assistant\Install.asa.log
- %TEMP%\nsxE.tmp\KillProcDLL.dll
- %TEMP%\minime.exe
- %TEMP%\BitRoll.zip
- %TEMP%\nsl9.tmp\ZipDLL.dll
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\get_file[1].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\get_file[1].php
- %TEMP%\control.dll
- %TEMP%\nsl9.tmp\System.dll
- <LS_APPDATA>\Cooliris\19ae624a-0abb-fe40-a964-83e74c159e95\hf_config.pb
- <LS_APPDATA>\Cooliris\19ae624a-0abb-fe40-a964-83e74c159e95\prefs.sqlite
- %PROGRAM_FILES%\Wyzo\searchplugins\ask.xml
- %PROGRAM_FILES%\Wyzo\extensions\fireedition-sml@wyzo.com\components\fireedition.js
- %PROGRAM_FILES%\Wyzo\extensions\fireedition-sml@wyzo.com\searchplugins\.DS_Store
- %HOMEPATH%\Start Menu\Programs\Wyzo\Wyzo.lnk
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Wyzo.lnk
- %PROGRAM_FILES%\Wyzo\uninst.exe
- %HOMEPATH%\Desktop\Wyzo.lnk
- %HOMEPATH%\Start Menu\Programs\Wyzo\Wyzo (Safe Mode).lnk
- %HOMEPATH%\Start Menu\Programs\Wyzo\Wyzo Uninstall.lnk
- %PROGRAM_FILES%\Wyzo\LICENSE
- %PROGRAM_FILES%\Wyzo\wyzo.ico
- %TEMP%\nsqC.tmp\ExecPri.dll
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\components[1].exe
- %PROGRAM_FILES%\Wyzo\Wyzo Setup Components
- %PROGRAM_FILES%\Wyzo\unwyzo.ico
- %PROGRAM_FILES%\Wyzo\extensions\fireedition-sml@wyzo.com\chrome\.DS_Store
- %PROGRAM_FILES%\Wyzo\extensions\fireedition-sml@wyzo.com\chrome\fireedition.jar
- %PROGRAM_FILES%\Wyzo\extensions\fireedition-sml@wyzo.com\install.rdf
- %PROGRAM_FILES%\Wyzo\defaults\profile\bookmarks.html
- %PROGRAM_FILES%\Wyzo\extensions\fireedition-sml@wyzo.com\chrome.manifest
- %TEMP%\IXP001.TMP\BitRoll-5.0.0.0-setup.exe
- %TEMP%\aut7.tmp
- %TEMP%\aut5.tmp
- %TEMP%\IXP001.TMP\Forextrading.exe
- %TEMP%\eToroSetup.exe
- %TEMP%\IXP000.TMP\WyzoSetup-SML.exe
- %TEMP%\nsl9.tmp\modern-wizard.bmp
- %TEMP%\nsl9.tmp\modern-header.bmp
- %TEMP%\nsl9.tmp\ioSpecial.ini
- %TEMP%\nsl8.tmp
- %TEMP%\nsl9.tmp\nsProcess.dll
- %TEMP%\IXP001.TMP\Etoro_BitRollWR.exe
- %TEMP%\aut1.tmp
- %TEMP%\IXP001.TMP\AdsPlusLink.exe
- %TEMP%\IXP000.TMP\Setup_00.exe
- %TEMP%\IXP000.TMP\WyzoS.exe
- %TEMP%\ads.html
- %TEMP%\IXP001.TMP\appsetup.exe
- %TEMP%\aut4.tmp
- %TEMP%\aut3.tmp
- %TEMP%\aut2.tmp
- %TEMP%\IXP001.TMP\vd.exe
- %TEMP%\nsl9.tmp\InstallOptions.dll
- %TEMP%\nsxE.tmp\System.dll
- %TEMP%\nsxE.tmp\UserInfo.dll
- %PROGRAM_FILES%\Wyzo\AskSearchAsst.ini
- %PROGRAM_FILES%\Wyzo\AskSearchAsst.exe
- %PROGRAM_FILES%\Wyzo\ask.ico
- %TEMP%\nsxE.tmp\time.dll
- %PROGRAM_FILES%\Ask Search Assistant\AskSearchAsst.ini
- %PROGRAM_FILES%\Ask Search Assistant\ask.ico
- %PROGRAM_FILES%\Ask Search Assistant\uninst.exe
- %TEMP%\nsxE.tmp\LogEx.dll
- %HOMEPATH%\Start Menu\Programs\Ask Search Assistant\Uninstall.lnk
- %TEMP%\nsqC.tmp\Math.dll
- %TEMP%\nsqC.tmp\NSISdl.dll
- %TEMP%\nsqC.tmp\System.dll
- %TEMP%\nsqB.tmp
- %TEMP%\nsqC.tmp\GetVersion.dll
- %TEMP%\torrent2_br.bmp
- %TEMP%\etoro.EXE
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\installer[1]
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\etoro[1].EXE
- %TEMP%\nsl9.tmp\inetc2.dll
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\installer[1]
Удаляет следующие файлы:
- %TEMP%\nsl9.tmp\nsProcess.dll
- %TEMP%\nsl9.tmp\modern-wizard.bmp
- %TEMP%\nsl9.tmp\StartMenu.dll
- %TEMP%\nsl9.tmp\ZipDLL.dll
- %TEMP%\nsl9.tmp\System.dll
- %TEMP%\nsl9.tmp\ioSpecial.ini
- %TEMP%\nsl9.tmp\InstallOptions.dll
- %TEMP%\nsl9.tmp\locate.dll
- %TEMP%\nsl9.tmp\modern-header.bmp
- %TEMP%\nsl9.tmp\Math.dll
- %TEMP%\nsqC.tmp\KillProcDLL.dll
- %TEMP%\nsqC.tmp\InetLoad.dll
- %TEMP%\nsqC.tmp\Math.dll
- %TEMP%\nsqC.tmp\System.dll
- %TEMP%\nsqC.tmp\NSISdl.dll
- %PROGRAM_FILES%\Wyzo\AskSearchAsst.exe
- %PROGRAM_FILES%\Wyzo\components.exe
- %PROGRAM_FILES%\Wyzo\AskSearchAsst.ini
- %TEMP%\nsqC.tmp\GetVersion.dll
- %TEMP%\nsqC.tmp\ExecPri.dll
- %TEMP%\nsl9.tmp\inetc2.dll
- %TEMP%\IXP001.TMP\appsetup.exe
- %TEMP%\IXP001.TMP\AdsPlusLink.exe
- %TEMP%\IXP001.TMP\Forextrading.exe
- %TEMP%\aut5.tmp
- %TEMP%\IXP001.TMP\vd.exe
- %TEMP%\aut2.tmp
- %TEMP%\aut1.tmp
- %TEMP%\aut3.tmp
- %TEMP%\IXP001.TMP\Etoro_BitRollWR.exe
- %TEMP%\aut4.tmp
- %TEMP%\nsxE.tmp\md5dll.dll
- %TEMP%\nsxE.tmp\LogEx.dll
- %TEMP%\nsxE.tmp\System.dll
- %TEMP%\nsxE.tmp\UserInfo.dll
- %TEMP%\nsxE.tmp\time.dll
- %TEMP%\IXP000.TMP\WyzoS.exe
- %TEMP%\aut7.tmp
- %TEMP%\IXP000.TMP\Setup_00.exe
- %TEMP%\nsxE.tmp\KillProcDLL.dll
- %TEMP%\IXP000.TMP\WyzoSetup-SML.exe
Перемещает следующие файлы:
- %PROGRAM_FILES%\Wyzo\Wyzo Setup Components в %PROGRAM_FILES%\Wyzo\components.exe
Сетевая активность:
Подключается к:
- 'localhost':1042
- 'www.wy##.com':80
- 'in####l.bitroll.com':80
- 'localhost':1036
- 'ad.###erverplus.com':80
- 'www.et##o.com':80
TCP:
Запросы HTTP GET:
- in####l.bitroll.com/get_file.php?fi###############
- in####l.bitroll.com/get_file.php?fi##############################
- www.wy##.com/download/components.exe
- in####l.bitroll.com/get_file.php?fi#########
- www.et##o.com/installer/?st######
- www.et##o.com/SDL/typeC/etoro.EXE
- www.wy##.com/t/?ac#################################################################################################
UDP:
- DNS ASK www.wy##.com
- DNS ASK in####l.bitroll.com
- DNS ASK ad.###erverplus.com
- DNS ASK www.et##o.com
Другое:
Ищет следующие окна:
- ClassName: '#32770' WindowName: 'BitRoll'
- ClassName: 'MS_WebcheckMonitor' WindowName: '(null)'
- ClassName: 'SysListView32' WindowName: '(null)'
- ClassName: '#32770' WindowName: '(null)'
- ClassName: '' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'MS_AutodialMonitor' WindowName: '(null)'
- ClassName: 'IEFrame' WindowName: '(null)'
