Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Classes\KUAIBA.DESKLINK\shell\open\command] '' = '%PROGRAM_FILES%\Kuai8\K8GM.exe -desktop'
Вредоносные функции:
Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\Kuai8\tool\K8RTLFix.exe' = '%PROGRAM_FILES%\Kuai8\tool\K8RTLFix.exe:*:Enabled:їм°ЙФЛРРївјмІвіМРт'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\Kuai8\K8DLPlatform.exe' = '%PROGRAM_FILES%\Kuai8\K8DLPlatform.exe:*:Enabled:їм°ЙУОП·ПВФШЖЅМЁ'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\Kuai8\tool\K8RTLFix.exe' = '%PROGRAM_FILES%\Kuai8\tool\K8RTLFix.exe:*:Enabled:їм°ЙФЛРРївјмІвіМРт'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\Kuai8\tool\K8PluginFix.exe' = '%PROGRAM_FILES%\Kuai8\tool\K8PluginFix.exe:*:Enabled:їм°ЙПВФШ№КХПјмІвіМРт'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\Kuai8\tool\K8PluginFix.exe' = '%PROGRAM_FILES%\Kuai8\tool\K8PluginFix.exe:*:Enabled:їм°ЙПВФШ№КХПјмІвіМРт'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\Kuai8\K8GM.exe' = '%PROGRAM_FILES%\Kuai8\K8GM.exe:*:Enabled:їм°ЙУОП·№ЬАнЖч'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\Kuai8\K8GM.exe' = '%PROGRAM_FILES%\Kuai8\K8GM.exe:*:Enabled:їм°ЙУОП·№ЬАнЖч'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\Kuai8\K8Flash.exe' = '%PROGRAM_FILES%\Kuai8\K8Flash.exe:*:Enabled:їм°ЙflashУОП·іМРт'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\Kuai8\K8DLPlatform.exe' = '%PROGRAM_FILES%\Kuai8\K8DLPlatform.exe:*:Enabled:їм°ЙУОП·ПВФШЖЅМЁ'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\Kuai8\K8Flash.exe' = '%PROGRAM_FILES%\Kuai8\K8Flash.exe:*:Enabled:їм°ЙflashУОП·іМРт'
Создает и запускает на исполнение:
- '%PROGRAM_FILES%\Kuai8\K8Update.exe' -install
- '%PROGRAM_FILES%\Kuai8\K8GM.exe' -atonce -show=3
- '%PROGRAM_FILES%\Kuai8\K8GM.exe' -update_data
- '%PROGRAM_FILES%\Kuai8\K8Update.exe' -reg
Запускает на исполнение:
- '<SYSTEM32>\regsvr32.exe' /s "%PROGRAM_FILES%\Kuai8\tool\K8DesktopIcon.dll"
- '<SYSTEM32>\regsvr32.exe' /u /s "%PROGRAM_FILES%\Kuai8\tool\K8DesktopIcon.dll"
Изменения в файловой системе:
Создает следующие файлы:
- %HOMEPATH%\Start Menu\Programs\їм°ЙУОП·\Р¶ФШїм°Й.lnk
- %PROGRAM_FILES%\Kuai8\Uninstall.exe
- %HOMEPATH%\Start Menu\Programs\їм°ЙУОП·\їм°ЙУОП·дЇААЖч.lnk
- %HOMEPATH%\Start Menu\Programs\їм°ЙУОП·\їм°ЙУОП·.lnk
- %HOMEPATH%\Start Menu\Programs\їм°ЙУОП·\їм°ЙflashІҐ·ЕЖч.lnk
- %PROGRAM_FILES%\Kuai8\data\local\user.xml
- %APPDATA%\Kuai8\IECaches\0\Cache\Content.IE5\desktop.ini
- %PROGRAM_FILES%\Kuai8\data\local\recent.xml
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\stat[1].php
- %APPDATA%\Kuai8\IECaches\0\Cache\desktop.ini
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\їм°ЙУОП·.lnk
- %PROGRAM_FILES%\Kuai8\data\plugin\flash.gmx
- %PROGRAM_FILES%\Kuai8\audio\complete.wav
- %PROGRAM_FILES%\Kuai8\data\plugin\pc.gmx
- %PROGRAM_FILES%\Kuai8\data\plugin\netwl.gmx
- %PROGRAM_FILES%\Kuai8\data\plugin\inwl.gmx
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\update_database[1].php
- %HOMEPATH%\Desktop\їм°ЙУОП·.lnk
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\stat_reg[1].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\update_hot[1].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\update_top[1].php
- %APPDATA%\Kuai8\IECaches\0\Cache\Content.IE5\T5V5YKZI\20140708165526628[1].png
- %APPDATA%\Kuai8\slider\slider_201407_20140708165526628.png
- %APPDATA%\Kuai8\slider\slider_201407_20140708165450397.png
- %APPDATA%\Kuai8\slider\slider_201407_20140709133104272.jpg
- %APPDATA%\Kuai8\IECaches\0\Cache\Content.IE5\T5V5YKZI\20140708165450397[1].png
- %APPDATA%\Kuai8\slider\slider_201407_20140708165649106.png
- %APPDATA%\Kuai8\IECaches\0\Cache\Content.IE5\T5V5YKZI\update_database[1].php
- %APPDATA%\Kuai8\IECaches\0\Cache\Content.IE5\T5V5YKZI\20140708165649106[1].png
- %APPDATA%\Kuai8\IECaches\0\Cache\Content.IE5\T5V5YKZI\20140704092541586[1].png
- %APPDATA%\Kuai8\slider\slider_201407_20140704092541586.png
- %APPDATA%\Kuai8\IECaches\0\Cache\Content.IE5\T5V5YKZI\20140709133104272[1].jpg
- %APPDATA%\Kuai8\IECaches\0\Cache\Content.IE5\I729IJ6P\desktop.ini
- %PROGRAM_FILES%\Kuai8\data\search.gms-journal
- %APPDATA%\Kuai8\IECaches\0\Cache\Content.IE5\IPKZGTKX\desktop.ini
- %APPDATA%\Kuai8\IECaches\0\Cache\Content.IE5\T5V5YKZI\desktop.ini
- %APPDATA%\Kuai8\IECaches\0\Cache\Content.IE5\8RUJU18T\desktop.ini
- %APPDATA%\Kuai8\IECaches\0\Cache\Content.IE5\T5V5YKZI\update_icon[1].php
- %APPDATA%\Kuai8\IECaches\0\Cache\Content.IE5\T5V5YKZI\update_plugin[1].php
- %APPDATA%\Kuai8\IECaches\0\Cache\Content.IE5\T5V5YKZI\CATOCF59
- %PROGRAM_FILES%\Kuai8\data\search.gms
- %APPDATA%\Kuai8\cache.xml
- %PROGRAM_FILES%\Kuai8\Microsoft.VC80.CRT.manifest
- %PROGRAM_FILES%\Kuai8\msvcp80.dll
- %PROGRAM_FILES%\Kuai8\K8UIRender.dll
- %PROGRAM_FILES%\Kuai8\K8DLUtils.dll
- %PROGRAM_FILES%\Kuai8\K8DLPlatform.exe
- %PROGRAM_FILES%\Kuai8\tool\K8Common.dll
- %PROGRAM_FILES%\Kuai8\tool\K8UIRender.dll
- %PROGRAM_FILES%\Kuai8\tool\K8Bubble.exe
- %PROGRAM_FILES%\Kuai8\msvcr80.dll
- %PROGRAM_FILES%\Kuai8\tool\K8RestoreWindow.dll
- %PROGRAM_FILES%\Kuai8\K8Common.dll
- %PROGRAM_FILES%\Kuai8\K8GM.exe
- %PROGRAM_FILES%\Kuai8\K8Flash.exe
- %TEMP%\nsp3.tmp\System.dll
- %TEMP%\nsu2.tmp
- %TEMP%\nsp3.tmp\K8NsisExtend.dll
- %PROGRAM_FILES%\Kuai8\K8BugReport.exe
- %PROGRAM_FILES%\Kuai8\K8UrlEncrypt.dll
- %PROGRAM_FILES%\Kuai8\K8Version.dll
- %PROGRAM_FILES%\Kuai8\K8Browser.exe
- %PROGRAM_FILES%\Kuai8\K8Update.exe
- %PROGRAM_FILES%\Kuai8\data\plugin\hot.gmx
- %PROGRAM_FILES%\Kuai8\data\plugin\top.gmx
- %PROGRAM_FILES%\Kuai8\data\database.gmx
- %PROGRAM_FILES%\Kuai8\tool\msvcp80.dll
- %PROGRAM_FILES%\Kuai8\tool\msvcr80.dll
- %PROGRAM_FILES%\Kuai8\data\plugin\runtime.gmx
- %PROGRAM_FILES%\Kuai8\data\plugin\rtfile.gmx
- %PROGRAM_FILES%\Kuai8\data\plugin\window.gmx
- %PROGRAM_FILES%\Kuai8\data\plugin\hardware.gmx
- %PROGRAM_FILES%\Kuai8\data\plugin\scan.gmx
- %PROGRAM_FILES%\Kuai8\tool\Microsoft.VC80.CRT.manifest
- %PROGRAM_FILES%\Kuai8\tool\K8DesktopExt.dll
- %PROGRAM_FILES%\Kuai8\tool\K8RTLFix.exe
- %PROGRAM_FILES%\Kuai8\tool\K8DesktopIcon.dll
- %PROGRAM_FILES%\Kuai8\tool\K8DLUtils.dll
- %PROGRAM_FILES%\Kuai8\tool\K8DesktopAssist.exe
- %PROGRAM_FILES%\Kuai8\tool\K8NetDetect.exe
- %PROGRAM_FILES%\Kuai8\tool\K8GamePacker.exe
- %PROGRAM_FILES%\Kuai8\tool\K8PluginFix.exe
- %PROGRAM_FILES%\Kuai8\tool\K8Sfx.exe
- %PROGRAM_FILES%\Kuai8\tool\K8ScreenCapture.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- %APPDATA%\Kuai8\IECaches\0\Cache\Content.IE5\8RUJU18T\desktop.ini
- %APPDATA%\Kuai8\IECaches\0\Cache\Content.IE5\IPKZGTKX\desktop.ini
- %APPDATA%\Kuai8\IECaches\0\Cache\Content.IE5\I729IJ6P\desktop.ini
- %APPDATA%\Kuai8\IECaches\0\Cache\desktop.ini
- %APPDATA%\Kuai8\IECaches\0\Cache\Content.IE5\desktop.ini
- %APPDATA%\Kuai8\IECaches\0\Cache\Content.IE5\T5V5YKZI\desktop.ini
Удаляет следующие файлы:
- %APPDATA%\Kuai8\IECaches\0\Cache\Content.IE5\T5V5YKZI\20140709133104272[1].jpg
- %APPDATA%\Kuai8\IECaches\0\Cache\Content.IE5\T5V5YKZI\20140708165450397[1].png
- %APPDATA%\Kuai8\IECaches\0\Cache\Content.IE5\T5V5YKZI\update_icon[1].php
- %APPDATA%\Kuai8\IECaches\0\Cache\Content.IE5\T5V5YKZI\update_plugin[1].php
- %APPDATA%\Kuai8\IECaches\0\Cache\Content.IE5\T5V5YKZI\20140708165649106[1].png
- %APPDATA%\Kuai8\IECaches\0\Cache\Content.IE5\T5V5YKZI\update_database[1].php
- %APPDATA%\Kuai8\IECaches\0\Cache\Content.IE5\T5V5YKZI\20140708165526628[1].png
- %APPDATA%\Kuai8\IECaches\0\Cache\Content.IE5\T5V5YKZI\20140704092541586[1].png
- %APPDATA%\Kuai8\IECaches\0\Cache\Content.IE5\T5V5YKZI\CATOCF59
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\stat_reg[1].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\update_database[1].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\update_hot[1].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\update_top[1].php
- %TEMP%\nsp3.tmp\System.dll
- %PROGRAM_FILES%\Kuai8\data\search.gms-journal
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\stat[1].php
- %TEMP%\nsp3.tmp\K8NsisExtend.dll
Сетевая активность:
Подключается к:
- 'se####e.kuai8.com':80
- 'ic##.kuai8.com':80
- 'up####.kuai8.com':80
- 'st##.kuai8.com':80
TCP:
Запросы HTTP GET:
- up####.kuai8.com/update_plugin.php?da##########################################################################################
- ic##.kuai8.com/slider/201407/20140709133104272.jpg
- up####.kuai8.com/update_plugin.php?da##########################################################################
- up####.kuai8.com/update_icon.php?da############################################################################
- ic##.kuai8.com/slider/201407/20140708165450397.png
- ic##.kuai8.com/slider/201407/20140704092541586.png
- ic##.kuai8.com/slider/201407/20140708165649106.png
- ic##.kuai8.com/slider/201407/20140708165526628.png
- up####.kuai8.com/update_plugin.php?da########################################################################
- up####.kuai8.com/update_plugin.php?da########################################################################################
- st##.kuai8.com/stat_reg.php?da######################################################################
- up####.kuai8.com/update_database.php?da######################################################################################
- up####.kuai8.com/update_hot.php?da######################################################################################
- up####.kuai8.com/update_top.php?da########################################################################################
- st##.kuai8.com/stat.php?da####################################################################
- up####.kuai8.com/update_plugin.php?da######################################################################################
- up####.kuai8.com/update_icon.php?da##########################################################################
- se####e.kuai8.com/time.php?da########
- up####.kuai8.com/update_icon.php?da########################################################################
Запросы HTTP POST:
- up####.kuai8.com/update_icon.php?da####################################################################
UDP:
- DNS ASK se####e.kuai8.com
- DNS ASK ic##.kuai8.com
- DNS ASK up####.kuai8.com
- DNS ASK st##.kuai8.com
Другое:
Ищет следующие окна:
- ClassName: 'SysListView32' WindowName: 'FolderView'
- ClassName: 'SHELLDLL_DefView' WindowName: '(null)'
- ClassName: '(null)' WindowName: '??Flash??'
- ClassName: '(null)' WindowName: '??????'
- ClassName: '(null)' WindowName: '???????'
- ClassName: '(null)' WindowName: '????Flash????'
- ClassName: 'GMKuaiBaWnd' WindowName: '????????'
- ClassName: '(null)' WindowName: '????????????'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: '(null)' WindowName: '??????????????'
