Техническая информация
Вредоносные функции:
Создает и запускает на исполнение:
- '<LS_APPDATA>\{A578853D-14DE-4BF2-BFEC-CC8D3CA16D3F}\7za.exe' e "<LS_APPDATA>\{A578853D-14DE-4BF2-BFEC-CC8D3CA16D3F}\poda.r" -o"%APPDATA%\Roaming\VolIE" bundles\onload.js -pVFCJZZF -y
- '<LS_APPDATA>\{A578853D-14DE-4BF2-BFEC-CC8D3CA16D3F}\7za.exe' e "<LS_APPDATA>\{A578853D-14DE-4BF2-BFEC-CC8D3CA16D3F}\poda.r" -o"%APPDATA%\Roaming\scope_dir" bundles\scope.exe -pVFCJZZF -y
- '<LS_APPDATA>\{A578853D-14DE-4BF2-BFEC-CC8D3CA16D3F}\7za.exe' e "<LS_APPDATA>\{A578853D-14DE-4BF2-BFEC-CC8D3CA16D3F}\poda.r" -o"%APPDATA%\Roaming\ARHome" bundles\Updater.exe -pVFCJZZF -y
- '<LS_APPDATA>\{A578853D-14DE-4BF2-BFEC-CC8D3CA16D3F}\7za.exe' e "<LS_APPDATA>\{A578853D-14DE-4BF2-BFEC-CC8D3CA16D3F}\poda.r" -o"%APPDATA%\Roaming\VolIE" bundles\FoxPro_32.dll -pVFCJZZF -y
Запускает на исполнение:
- '<SYSTEM32>\schtasks.exe' /Delete /tn "Newsfeed" /f
- '<SYSTEM32>\schtasks.exe' /Create /TR "\"%APPDATA%\Roaming\scope_dir\scope.exe\"" /SC DAILY /TN "Newsfeed" /ST 03:11:00 /du 0024:00 /RI 10 /RL HIGHEST /f
- '<SYSTEM32>\conhost.exe' /Delete /tn "mium0d" /f
- '<SYSTEM32>\schtasks.exe' /Create /TR "\"%APPDATA%\Roaming\scope_dir\scope.exe\"" /SC ONLOGON /TN "mium0d" /RL HIGHEST /f
- '<SYSTEM32>\conhost.exe' /offerraupdate
- '<SYSTEM32>\RAServer.exe' /offerraupdate
- '<SYSTEM32>\svchost.exe' "<LS_APPDATA>\6hEEbYN.vbs"
- '<SYSTEM32>\schtasks.exe' 0x6cc launcher.exe
- '<SYSTEM32>\schtasks.exe' /Delete /tn "9A5A8340-6B15" /f
- '<SYSTEM32>\schtasks.exe' /Create /TR "\"%APPDATA%\Roaming\ARHome\Updater.exe\"" /SC ONIDLE /TN "9A5A8340-6B15" /I 1 /RL HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /Delete /tn "Mistl" /f
- '<SYSTEM32>\schtasks.exe' /Create /TR "\"%PROGRAM_FILES%\Mistl\Mistl.exe\"" /SC DAILY /TN "Mistl" /ST 06:09:00 /du 0024:00 /RI 360 /RL HIGHEST /f
- '<SYSTEM32>\taskhost.exe' SYSTEM
- '<SYSTEM32>\cscript.exe' "<LS_APPDATA>\6hEEbYN.vbs"
- '<SYSTEM32>\schtasks.exe' /Create /TN "AdUp Update" /TR "\"%PROGRAM_FILES%\AdsFree\AdsFree.exe\"" /SC ONSTART /DELAY 0005:00 /RL HIGHEST /f
- '<SYSTEM32>\svchost.exe' -k secsvcs
Изменяет следующие настройки браузера Windows Internet Explorer:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1A10' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '{AEBA21FA-782A-4A90-978D-B72164C80120}' = '{1a,37,61,59,23,52,35,0c,7a,5f,20,17,2f,1e,1a,19,0e,2b,01,73,13,37,13,12,14,1a,15,2a}'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '{A8A88C49-5EB2-4990-A1A2-0876022C854F}' = '{1a,37,61,59,23,52,35,0c,7a,5f,20,17,2f,1e,1a,19,0e,2b,01,73,13,37,13,12,14,1a,15,2a}'
Изменения в файловой системе:
Создает следующие файлы:
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\E7D3.tmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\E2B2.tmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\E96A.tmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\EC8A.tmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\EAC3.tmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\D7A8.tmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\000002.dbtmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\MANIFEST-000002
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\LOG
- %APPDATA%\Roaming\Opera Software\Opera Stable\History Provider Cache
- %TEMP%\etilqs_heFSgMdQLmu5jeE
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\LOG
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\000002.dbtmp
- %TEMP%\etilqs_KPmcheAro3f2Y9W
- %APPDATA%\Roaming\Opera Software\Opera Stable\F584.tmp
- %TEMP%\etilqs_sfRectfpEdywoa7
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\MANIFEST-000002
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\F15E.tmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\EE50.tmp
- %APPDATA%\Roaming\Microsoft\Windows\Recent\CustomDestinations\40XEQMPR9R4XWI1YA7DH.temp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\000001.dbtmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\MANIFEST-000001
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\000001.dbtmp
- %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\user.js
- %PROGRAM_FILES%\AdsFree\AdsFree.exe
- %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\prefs.jstmp
- <SYSTEM32>\Tasks\AdUp Update
- <SYSTEM32>\Tasks\9A5A8340-6B15
- <SYSTEM32>\Tasks\Mistl
- <LS_APPDATA>\{A578853D-14DE-4BF2-BFEC-CC8D3CA16D3F}\7za.exe
- <LS_APPDATA>\6hEEbYN.vbs
- <LS_APPDATA>\{A578853D-14DE-4BF2-BFEC-CC8D3CA16D3F}\poda.r
- %APPDATA%\Roaming\ARHome\Updater.exe
- %APPDATA%\Roaming\ARHome\qhnsjt.dat
- <SYSTEM32>\Tasks\mium0d
- %APPDATA%\Roaming\scope_dir\scope.exe
- <SYSTEM32>\Tasks\Newsfeed
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\MANIFEST-000001
- <Служебный элемент>
- %APPDATA%\Roaming\VolIE\onload.js
- <SYSTEM32>\GroupPolicy\Machine\Registry.pol
- <SYSTEM32>\GroupPolicy\gpt.ini
- C:\ProgramData\ntuser.pol
- %APPDATA%\Roaming\VolIE\FoxPro_32.dll
- %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\searchPlugins\VenteeRo.xml
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\ProgramData\tempntuser.pol
Удаляет следующие файлы:
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\EBED.tmp~RFceda8.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\EA84.tmp~RFceb96.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\E93A.tmp~RFcea10.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\EE30.tmp~RFcefda.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\MANIFEST-000001
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\CURRENT~RFcf92d.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\F100.tmp~RFcf298.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\E755.tmp~RFce84b.TMP
- <LS_APPDATA>\{A578853D-14DE-4BF2-BFEC-CC8D3CA16D3F}\7za.exe
- %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\prefs.js
- C:\ProgramData\tempntuser.pol
- <LS_APPDATA>\{A578853D-14DE-4BF2-BFEC-CC8D3CA16D3F}\poda.r
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\E292.tmp~RFce629.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\MANIFEST-000001
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\CURRENT~RFcb422.TMP
Перемещает следующие файлы:
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\EE50.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\EE30.tmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\EE30.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\EE30.tmp~RFcefda.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\F15E.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\F100.tmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\EA84.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\EA84.tmp~RFceb96.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\EC8A.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\EBED.tmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\EBED.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\EBED.tmp~RFceda8.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\000002.dbtmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\CURRENT
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\CURRENT в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\CURRENT~RFcf92d.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\F584.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Local State
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\F100.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\F100.tmp~RFcf298.TMP
- %APPDATA%\Roaming\Microsoft\Windows\Recent\CustomDestinations\40XEQMPR9R4XWI1YA7DH.temp в %APPDATA%\Roaming\Microsoft\Windows\Recent\CustomDestinations\8548f632abe97aa3.customDestinations-ms
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\000001.dbtmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\CURRENT
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\EAC3.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\EA84.tmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\000002.dbtmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\CURRENT
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\CURRENT в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\CURRENT~RFcb422.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\D7A8.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Preferences
- %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\prefs.jstmp в %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\prefs.js
- C:\ProgramData\ntuser.pol в C:\ProgramData\tempntuser.pol
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\000001.dbtmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\CURRENT
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\E755.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\E755.tmp~RFce84b.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\E96A.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\E93A.tmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\E93A.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\E93A.tmp~RFcea10.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\E2B2.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\E292.tmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\E292.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\E292.tmp~RFce629.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\E7D3.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\E755.tmp
Самоудаляется.
Сетевая активность:
UDP:
- DNS ASK sl####i.yandex.ru
- DNS ASK bi##.#ikimedia.org
- DNS ASK ap#.###sys.opera.com
- DNS ASK au######te.geo.opera.com
- DNS ASK en.###ipedia.org
- DNS ASK re###.opera.com
- DNS ASK dn#.##ftncsi.com
- DNS ASK www.ic#.com
- DNS ASK si#####ck2.opera.com
- DNS ASK www.google.com
- DNS ASK i.##0.ru
- DNS ASK www.go##le.ru
- DNS ASK www.ac##ads.com
Другое:
Ищет следующие окна:
- ClassName: 'OleMainThreadWndClass' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'Opera_MessageWindow' WindowName: '%APPDATA%\Roaming\Opera Software\Opera Stable'
