Техническая информация
Вредоносные функции:
Создает и запускает на исполнение:
- '%TEMP%\install\tryyyesesss.exe'
- '%TEMP%\install\SpeedMP3Downloader.sfx.exe'
- '%TEMP%\install\SpeedMP3Downloader-2.5.1.2.Setup.exe' /S /NCRC
Запускает на исполнение:
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\install\sil_2.bat" "
- '<SYSTEM32>\wbem\wmiadap.exe' /R /T
Изменения в файловой системе:
Создает следующие файлы:
- %PROGRAM_FILES%\SpeedMP3Downloader\res\images\Religious.jpg
- %PROGRAM_FILES%\SpeedMP3Downloader\res\images\Rock.jpg
- %PROGRAM_FILES%\SpeedMP3Downloader\res\images\R&B & Soul.jpg
- %PROGRAM_FILES%\SpeedMP3Downloader\res\images\Rap & Hip-Hop.jpg
- %PROGRAM_FILES%\SpeedMP3Downloader\res\images\World Music.jpg
- %PROGRAM_FILES%\SpeedMP3Downloader\res\images\_play.gif
- %PROGRAM_FILES%\SpeedMP3Downloader\res\images\_playing.gif
- %PROGRAM_FILES%\SpeedMP3Downloader\res\images\_download.gif
- %PROGRAM_FILES%\SpeedMP3Downloader\res\images\_downloading.gif
- %PROGRAM_FILES%\SpeedMP3Downloader\res\images\Classical.jpg
- %PROGRAM_FILES%\SpeedMP3Downloader\res\images\Country & Folk.jpg
- %PROGRAM_FILES%\SpeedMP3Downloader\res\images\All.jpg
- %PROGRAM_FILES%\SpeedMP3Downloader\res\images\Blues.jpg
- %PROGRAM_FILES%\SpeedMP3Downloader\res\images\Electronic.jpg
- %PROGRAM_FILES%\SpeedMP3Downloader\res\images\More & Other.jpg
- %PROGRAM_FILES%\SpeedMP3Downloader\res\images\Pop.jpg
- %PROGRAM_FILES%\SpeedMP3Downloader\res\images\Indie & Alertnative.jpg
- %PROGRAM_FILES%\SpeedMP3Downloader\res\images\Jazz.jpg
- %ALLUSERSPROFILE%\Start Menu\Programs\Speed MP3 Downloader\Speed MP3 Downloader.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Speed MP3 Downloader\Help.lnk
- %PROGRAM_FILES%\SpeedMP3Downloader\skins\default.skn
- %PROGRAM_FILES%\SpeedMP3Downloader\CheckInstall.exe
- %ALLUSERSPROFILE%\Start Menu\Programs\Speed MP3 Downloader\Speed MP3 Downloader Site.url
- %ALLUSERSPROFILE%\Desktop\Speed MP3 Downloader.lnk
- %PROGRAM_FILES%\SpeedMP3Downloader\uninst.exe
- %ALLUSERSPROFILE%\Start Menu\Programs\Speed MP3 Downloader\Buy Speed MP3 Downloader.url
- %ALLUSERSPROFILE%\Start Menu\Programs\Speed MP3 Downloader\Uninstall Speed MP3 Downloader.lnk
- %PROGRAM_FILES%\SpeedMP3Downloader\res\images\_tabheadbg.gif
- %PROGRAM_FILES%\SpeedMP3Downloader\res\images\about.png
- %PROGRAM_FILES%\SpeedMP3Downloader\res\images\_popunit.gif
- %PROGRAM_FILES%\SpeedMP3Downloader\res\images\_star.gif
- %PROGRAM_FILES%\SpeedMP3Downloader\res\images\bg.jpg
- %PROGRAM_FILES%\SpeedMP3Downloader\res\images\entersn.gif
- %PROGRAM_FILES%\SpeedMP3Downloader\res\images\trialbg.png
- %PROGRAM_FILES%\SpeedMP3Downloader\res\images\buynow.gif
- %PROGRAM_FILES%\SpeedMP3Downloader\res\images\c_cospel.jpg
- %PROGRAM_FILES%\SpeedMP3Downloader\avdevice-52.dll
- %PROGRAM_FILES%\SpeedMP3Downloader\avfilter-1.dll
- %PROGRAM_FILES%\SpeedMP3Downloader\avcodec-52.dll
- %PROGRAM_FILES%\SpeedMP3Downloader\avcore-0.dll
- %PROGRAM_FILES%\SpeedMP3Downloader\avformat-52.dll
- %PROGRAM_FILES%\SpeedMP3Downloader\swscale-0.dll
- %PROGRAM_FILES%\SpeedMP3Downloader\lang\English.lan
- %PROGRAM_FILES%\SpeedMP3Downloader\avutil-50.dll
- %PROGRAM_FILES%\SpeedMP3Downloader\const.dat
- %TEMP%\install\SpeedMP3Downloader-2.5.1.2.Setup.exe
- %TEMP%\install\SpeedMP3Downloader.sfx.exe
- %TEMP%\$inst\2.tmp
- %TEMP%\$inst\temp_0.tmp
- %TEMP%\install\tryyyesesss.exe
- %PROGRAM_FILES%\SpeedMP3Downloader\SDL.dll
- %PROGRAM_FILES%\SpeedMP3Downloader\SpeedMP3Downloader.exe
- %TEMP%\install\sil_2.bat
- %TEMP%\nsr2.tmp
- %PROGRAM_FILES%\SpeedMP3Downloader\res\icon48\01.png
- %PROGRAM_FILES%\SpeedMP3Downloader\res\icon48\011.png
- %PROGRAM_FILES%\SpeedMP3Downloader\res\welcome.html
- %PROGRAM_FILES%\SpeedMP3Downloader\res\welcome.swf
- %PROGRAM_FILES%\SpeedMP3Downloader\res\icon48\02.png
- %PROGRAM_FILES%\SpeedMP3Downloader\res\icon48\05.png
- %PROGRAM_FILES%\SpeedMP3Downloader\res\icon48\06.png
- %PROGRAM_FILES%\SpeedMP3Downloader\res\icon48\03.png
- %PROGRAM_FILES%\SpeedMP3Downloader\res\icon48\04.png
- %PROGRAM_FILES%\SpeedMP3Downloader\res\categories_en.html
- %PROGRAM_FILES%\SpeedMP3Downloader\res\keywordlist_en.html
- %PROGRAM_FILES%\SpeedMP3Downloader\res\banner.html
- %PROGRAM_FILES%\SpeedMP3Downloader\res\buynow.gif
- %PROGRAM_FILES%\SpeedMP3Downloader\res\loading.swf
- %PROGRAM_FILES%\SpeedMP3Downloader\res\result_en.html
- %PROGRAM_FILES%\SpeedMP3Downloader\res\trialnotify.mht
- %PROGRAM_FILES%\SpeedMP3Downloader\res\player.dat
- %PROGRAM_FILES%\SpeedMP3Downloader\res\regpage.html
Удаляет следующие файлы:
- %TEMP%\install\tryyyesesss.exe
- <SYSTEM32>\wbem\Performance\WmiApRpl.ini
- <SYSTEM32>\PerfStringBackup.TMP
- %TEMP%\$inst\temp_0.tmp
- %TEMP%\install\SpeedMP3Downloader-2.5.1.2.Setup.exe
- %TEMP%\install\SpeedMP3Downloader.sfx.exe
Сетевая активность:
Подключается к:
- 'cl#####.#peedmp3downloader.com':80
- 'localhost':1039
TCP:
Запросы HTTP GET:
- cl#####.#peedmp3downloader.com/client/?PI##########################################
UDP:
- DNS ASK cl#####.#peedmp3downloader.com
Другое:
Ищет следующие окна:
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'IEFrame' WindowName: ''
