Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '360sd' = '"%PROGRAM_FILES%\360\360sd\360sdrun.exe"'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\EfiMon] 'ImagePath' = 'System32\Drivers\Efimon.sys'
- [<HKLM>\SYSTEM\ControlSet001\Services\360SelfProtection] 'Start' = '00000001'
- [<HKLM>\SYSTEM\ControlSet001\Services\BAPIDRV] 'Start' = '00000001'
- [<HKLM>\SYSTEM\ControlSet001\Services\360rp] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\HookPort] 'Start' = '00000000'
- [<HKLM>\SYSTEM\ControlSet001\Services\EfiMon] 'Start' = '00000001'
Вредоносные функции:
Создает и запускает на исполнение:
- '%PROGRAM_FILES%\360\360sd\dep360.exe' /install /url=
- '%PROGRAM_FILES%\360\360sd\360rp.exe'
- '%PROGRAM_FILES%\360\360sd\dep360.exe'
- '<SYSTEM32>\360sd_bjx.exe' /S
- '%PROGRAM_FILES%\360\360sd\dep360.exe' /chkvir /silent
- '%PROGRAM_FILES%\360\360sd\360rp.exe' /install
Запускает на исполнение:
- '<SYSTEM32>\ping.exe' 127.0.0.1 -n 1
Ищет ветки реестра, отвечающие за хранение паролей сторонними программами:
- [<HKCU>\Software\Microsoft\MSNMessenger]
Изменения в файловой системе:
Создает следующие файлы:
- %PROGRAM_FILES%\360\360sd\7z.dll
- %PROGRAM_FILES%\360\360sd\Qshield.dat
- %PROGRAM_FILES%\360\360sd\libspyerp.dat
- %PROGRAM_FILES%\360\360sd\antiRK.dll
- %PROGRAM_FILES%\360\360sd\360nzp.exe
- %PROGRAM_FILES%\360\360sd\360nzp.dll
- %PROGRAM_FILES%\360\360sd\FrontScan.dll
- %PROGRAM_FILES%\360\360sd\360MalwareSection.dll
- %PROGRAM_FILES%\360\360sd\cloudcom2.dll
- %PROGRAM_FILES%\360\360sd\libwhite.dat
- %PROGRAM_FILES%\360\360sd\dscon.dat
- %PROGRAM_FILES%\360\360sd\dsr.dat
- %PROGRAM_FILES%\360\360sd\arfp.db
- %PROGRAM_FILES%\360\360sd\bdfsfltr.reg
- %PROGRAM_FILES%\360\360sd\trufos.dll
- %PROGRAM_FILES%\360\360sd\trufos.sys
- %PROGRAM_FILES%\360\360sd\bdfsfltr.sys
- %PROGRAM_FILES%\360\360sd\bdfsfltr.cat
- %PROGRAM_FILES%\360\360sd\bdfsfltr.inf
- %PROGRAM_FILES%\360\360sd\listpredef.dat
- %PROGRAM_FILES%\360\360sd\wlist.dll
- %PROGRAM_FILES%\360\360sd\wlistdb.db
- %PROGRAM_FILES%\360\360sd\smartscn.dll
- %PROGRAM_FILES%\360\360sd\smartscn.dat
- %PROGRAM_FILES%\360\360sd\smartscn.inc
- <DRIVERS>\360SelfProtection.sys
- %PROGRAM_FILES%\360\360sd\setting.ini
- %ALLUSERSPROFILE%\Desktop\360Й±¶ѕ.lnk
- %PROGRAM_FILES%\360\360sd\uninst.exe
- %PROGRAM_FILES%\360\360sd\360sdu1.dat
- <DRIVERS>\hookport.sys
- %PROGRAM_FILES%\360\360sd\wcachedb.db-journal
- %PROGRAM_FILES%\360\360sd\wcachedb.db
- <DRIVERS>\BAPIDRV.SYS
- %ALLUSERSPROFILE%\Start Menu\Programs\360Й±¶ѕ\360Й±¶ѕ.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\360Й±¶ѕ\ІЎ¶ѕёфАлЗш.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\360Й±¶ѕ\Р¶ФШ360Й±¶ѕ.lnk
- %PROGRAM_FILES%\360\360sd\updatecfg.ini
- %PROGRAM_FILES%\360\360sd\heavygate.dll
- %PROGRAM_FILES%\360\360sd\sysfilerepS.dll
- %PROGRAM_FILES%\360\360sd\CQhCltHttpW.dll
- %PROGRAM_FILES%\360\360sd\cloudsec2.dll
- %PROGRAM_FILES%\360\360sd\deepscan.dll
- %PROGRAM_FILES%\360\360sd\360upk.dll
- %PROGRAM_FILES%\360\360sd\sdinst360.exe
- %PROGRAM_FILES%\360\360sd\SDSkin\Default.uic
- %PROGRAM_FILES%\360\360sd\custom\Default\LanguageList.xml
- %PROGRAM_FILES%\360\360sd\qutmipc.sys
- %PROGRAM_FILES%\360\360sd\BAPI.dll
- %PROGRAM_FILES%\360\360sd\BAPIDRV.sys
- %PROGRAM_FILES%\360\360sd\360rp.exe
- %PROGRAM_FILES%\360\360sd\360sdrun.exe
- %PROGRAM_FILES%\360\360sd\SDVersion.dll
- %PROGRAM_FILES%\360\360sd\dep360.ini
- %PROGRAM_FILES%\360\360sd\360sd.exe
- %PROGRAM_FILES%\360\360sd\360sdupd.exe
- %PROGRAM_FILES%\360\360sd\safemon\360procmon.dll
- %PROGRAM_FILES%\360\360sd\safemon\EfiProc.dll
- %PROGRAM_FILES%\360\360sd\safemon\SelfProtectAPI2.dll
- %PROGRAM_FILES%\360\360sd\360Quart.exe
- %PROGRAM_FILES%\360\360sd\QTQuart.dll
- %PROGRAM_FILES%\360\360sd\ROUTER.dll
- %PROGRAM_FILES%\360\360sd\sdrunchk.ini
- %TEMP%\nsy4.tmp\System.dll
- %TEMP%\nsy4.tmp\UserInfo.dll
- %PROGRAM_FILES%\360\360sd\360verify.dll
- %TEMP%\aut1.tmp
- <SYSTEM32>\360sd_bjx.exe
- %TEMP%\nst3.tmp
- %PROGRAM_FILES%\360\360sd\Wrapper.dll
- %PROGRAM_FILES%\360\360sd\CrashReport.dll
- %PROGRAM_FILES%\360\360sd\DumpUper.exe
- %PROGRAM_FILES%\360\360sd\avcheck.dll
- %PROGRAM_FILES%\360\360sd\AVLib.dat
- %PROGRAM_FILES%\360\360sd\dep360.exe
- %PROGRAM_FILES%\360\360sd\msvcp80.dll
- %PROGRAM_FILES%\360\360sd\msvcr80.dll
- %PROGRAM_FILES%\360\360sd\avxdisk.dll
- %PROGRAM_FILES%\360\360sd\DataDriv.dat
- %PROGRAM_FILES%\360\360sd\mfc42u.dll
- %PROGRAM_FILES%\360\360sd\olepro32.dll
- %PROGRAM_FILES%\360\360sd\vdbup.dll
- %PROGRAM_FILES%\360\360sd\qutmdrv.sys
- %PROGRAM_FILES%\360\360sd\bdfltlib.dll
- %PROGRAM_FILES%\360\360sd\bdardrv.dll
- %PROGRAM_FILES%\360\360sd\bdcore.dll
- %PROGRAM_FILES%\360\360sd\scan.dll
- %PROGRAM_FILES%\360\360sd\Microsoft.VC80.CRT.manifest
- %PROGRAM_FILES%\360\360sd\360sd.dat
- %PROGRAM_FILES%\360\360sd\360sdown.dat
- %PROGRAM_FILES%\360\360sd\MenuEx.dll
- %PROGRAM_FILES%\360\360sd\safemon\360tray.exe
- %PROGRAM_FILES%\360\360sd\safemon\360SelfProtection.sys
- %PROGRAM_FILES%\360\360sd\safemon\Hookport.sys
- %PROGRAM_FILES%\360\360sd\Safelive.dll
- %PROGRAM_FILES%\360\360sd\LiveUpdate360.exe
- %PROGRAM_FILES%\360\360sd\LiveUpdate360skin\Default.uiz
- %PROGRAM_FILES%\360\360sd\360net.dll
- %PROGRAM_FILES%\360\360sd\LiveUpd360.dll
- %PROGRAM_FILES%\360\360sd\PDown.dll
Удаляет следующие файлы:
- <SYSTEM32>\360sd_bjx.exe
- %PROGRAM_FILES%\360\360sd\wcachedb.db-journal
- %PROGRAM_FILES%\360\360sd\360sdu.dat
- %TEMP%\aut1.tmp
- %TEMP%\nsy4.tmp\System.dll
- %TEMP%\nsy4.tmp\UserInfo.dll
Перемещает следующие файлы:
- %PROGRAM_FILES%\360\360sd\360sdu1.dat в %PROGRAM_FILES%\360\360sd\360sdu.dat
Самоудаляется.
Сетевая активность:
Подключается к:
- 'co##.f.360.cn':80
- 'localhost':1038
- 'st##.sd.360.cn':80
TCP:
Запросы HTTP GET:
- st##.sd.360.cn/install.htm?mi##################################################################
UDP:
- DNS ASK co##.f.360.cn
- DNS ASK st##.sd.360.cn
Другое:
Ищет следующие окна:
- ClassName: 'Indicator' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
