Техническая информация
Вредоносные функции:
Создает и запускает на исполнение:
- '%PROGRAM_FILES%\WebplayerTool\TbHelper2.exe' -RegServer
Запускает на исполнение:
- '<SYSTEM32>\wbem\wmiadap.exe' /R /T
- '<SYSTEM32>\regsvr32.exe' /s "%PROGRAM_FILES%\WebplayerTool\TbCommonUtils.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%PROGRAM_FILES%\WebplayerTool\tbcore3.dll"
Изменения в файловой системе:
Создает следующие файлы:
- %APPDATA%\Toolbar4\{CDB982ED-F9D6-4E3B-B94B-96F705D35AD1}\fond2.bmp
- %APPDATA%\Toolbar4\{CDB982ED-F9D6-4E3B-B94B-96F705D35AD1}\fond.bmp
- %APPDATA%\Toolbar4\{CDB982ED-F9D6-4E3B-B94B-96F705D35AD1}\football.png
- %APPDATA%\Toolbar4\{CDB982ED-F9D6-4E3B-B94B-96F705D35AD1}\fondtoo2l.bmp
- %APPDATA%\Toolbar4\{CDB982ED-F9D6-4E3B-B94B-96F705D35AD1}\find.png
- %APPDATA%\Toolbar4\{CDB982ED-F9D6-4E3B-B94B-96F705D35AD1}\emmissionsblanc.png
- %APPDATA%\Toolbar4\{CDB982ED-F9D6-4E3B-B94B-96F705D35AD1}\emmisiosn.png
- %APPDATA%\Toolbar4\{CDB982ED-F9D6-4E3B-B94B-96F705D35AD1}\favicon.png
- %APPDATA%\Toolbar4\{CDB982ED-F9D6-4E3B-B94B-96F705D35AD1}\facebook.png
- %APPDATA%\Toolbar4\{CDB982ED-F9D6-4E3B-B94B-96F705D35AD1}\info.txt
- %APPDATA%\Toolbar4\{CDB982ED-F9D6-4E3B-B94B-96F705D35AD1}\include.xml
- %APPDATA%\Toolbar4\{CDB982ED-F9D6-4E3B-B94B-96F705D35AD1}\lo.png
- %APPDATA%\Toolbar4\{CDB982ED-F9D6-4E3B-B94B-96F705D35AD1}\inst.tmp
- %APPDATA%\Toolbar4\{CDB982ED-F9D6-4E3B-B94B-96F705D35AD1}\icons.bmp
- %APPDATA%\Toolbar4\{CDB982ED-F9D6-4E3B-B94B-96F705D35AD1}\home.png
- %APPDATA%\Toolbar4\{CDB982ED-F9D6-4E3B-B94B-96F705D35AD1}\heart.png
- %APPDATA%\Toolbar4\{CDB982ED-F9D6-4E3B-B94B-96F705D35AD1}\homeblanc.png
- %APPDATA%\Toolbar4\{CDB982ED-F9D6-4E3B-B94B-96F705D35AD1}\home1.png
- %APPDATA%\Toolbar4\{CDB982ED-F9D6-4E3B-B94B-96F705D35AD1}\arrow_refresh.png
- %APPDATA%\Toolbar4\{CDB982ED-F9D6-4E3B-B94B-96F705D35AD1}\acueil1.png
- %APPDATA%\Toolbar4\{CDB982ED-F9D6-4E3B-B94B-96F705D35AD1}\cap.png
- %APPDATA%\Toolbar4\{CDB982ED-F9D6-4E3B-B94B-96F705D35AD1}\basis.xml
- %APPDATA%\Toolbar4\{CDB982ED-F9D6-4E3B-B94B-96F705D35AD1}\123.png
- %PROGRAM_FILES%\WebplayerTool\uninstaller.exe
- %PROGRAM_FILES%\WebplayerTool\your_logo.png
- %PROGRAM_FILES%\WebplayerTool\inst.tmp
- %TEMP%\nsg2.tmp\inetc.dll
- %APPDATA%\Toolbar4\{CDB982ED-F9D6-4E3B-B94B-96F705D35AD1}\diers.png
- %APPDATA%\Toolbar4\{CDB982ED-F9D6-4E3B-B94B-96F705D35AD1}\computer_delete.png
- %APPDATA%\Toolbar4\{CDB982ED-F9D6-4E3B-B94B-96F705D35AD1}\emmision.png
- %APPDATA%\Toolbar4\{CDB982ED-F9D6-4E3B-B94B-96F705D35AD1}\divertissements.png
- %APPDATA%\Toolbar4\{CDB982ED-F9D6-4E3B-B94B-96F705D35AD1}\cog.png
- %APPDATA%\Toolbar4\{CDB982ED-F9D6-4E3B-B94B-96F705D35AD1}\chaineblnc.png
- %APPDATA%\Toolbar4\{CDB982ED-F9D6-4E3B-B94B-96F705D35AD1}\chaine.png
- %APPDATA%\Toolbar4\{CDB982ED-F9D6-4E3B-B94B-96F705D35AD1}\chianetv1.png
- %APPDATA%\Toolbar4\{CDB982ED-F9D6-4E3B-B94B-96F705D35AD1}\chainestv1.png
- %APPDATA%\Toolbar4\{CDB982ED-F9D6-4E3B-B94B-96F705D35AD1}\logo.png
- %APPDATA%\Toolbar4\{CDB982ED-F9D6-4E3B-B94B-96F705D35AD1}\seriestv1.png
- %APPDATA%\Toolbar4\{CDB982ED-F9D6-4E3B-B94B-96F705D35AD1}\seriestv.png
- %APPDATA%\Toolbar4\{CDB982ED-F9D6-4E3B-B94B-96F705D35AD1}\TbHelper2.exe
- %APPDATA%\Toolbar4\{CDB982ED-F9D6-4E3B-B94B-96F705D35AD1}\start.html
- %APPDATA%\Toolbar4\{CDB982ED-F9D6-4E3B-B94B-96F705D35AD1}\seriesblanc.png
- %APPDATA%\Toolbar4\{CDB982ED-F9D6-4E3B-B94B-96F705D35AD1}\push.exe
- %APPDATA%\Toolbar4\{CDB982ED-F9D6-4E3B-B94B-96F705D35AD1}\ogo.png
- %APPDATA%\Toolbar4\{CDB982ED-F9D6-4E3B-B94B-96F705D35AD1}\series.png
- %APPDATA%\Toolbar4\{CDB982ED-F9D6-4E3B-B94B-96F705D35AD1}\re.png
- %APPDATA%\Toolbar4\{CDB982ED-F9D6-4E3B-B94B-96F705D35AD1}\version.txt
- %APPDATA%\Toolbar4\{CDB982ED-F9D6-4E3B-B94B-96F705D35AD1}\update.exe
- %TEMP%\nsg2.tmp\System.dll
- %APPDATA%\Toolbar4\{CDB982ED-F9D6-4E3B-B94B-96F705D35AD1}\your_logo.png
- %APPDATA%\Toolbar4\{CDB982ED-F9D6-4E3B-B94B-96F705D35AD1}\uninstaller.exe
- %APPDATA%\Toolbar4\{CDB982ED-F9D6-4E3B-B94B-96F705D35AD1}\tvrea.png
- %APPDATA%\Toolbar4\{CDB982ED-F9D6-4E3B-B94B-96F705D35AD1}\tbs_include_script_013016.js
- %APPDATA%\Toolbar4\{CDB982ED-F9D6-4E3B-B94B-96F705D35AD1}\uninstall.exe
- %APPDATA%\Toolbar4\{CDB982ED-F9D6-4E3B-B94B-96F705D35AD1}\twitter.png
- %APPDATA%\Toolbar4\{CDB982ED-F9D6-4E3B-B94B-96F705D35AD1}\lolblanc.png
- %APPDATA%\Toolbar4\{CDB982ED-F9D6-4E3B-B94B-96F705D35AD1}\logoweb.png
- %APPDATA%\Toolbar4\{CDB982ED-F9D6-4E3B-B94B-96F705D35AD1}\ma.png
- %APPDATA%\Toolbar4\{CDB982ED-F9D6-4E3B-B94B-96F705D35AD1}\loupe.png
- %APPDATA%\Toolbar4\{CDB982ED-F9D6-4E3B-B94B-96F705D35AD1}\logotooool.png
- %APPDATA%\Toolbar4\{CDB982ED-F9D6-4E3B-B94B-96F705D35AD1}\logoplay.png
- %APPDATA%\Toolbar4\{CDB982ED-F9D6-4E3B-B94B-96F705D35AD1}\logobl.png
- %APPDATA%\Toolbar4\{CDB982ED-F9D6-4E3B-B94B-96F705D35AD1}\logoplay3.png
- %APPDATA%\Toolbar4\{CDB982ED-F9D6-4E3B-B94B-96F705D35AD1}\logoplay2.png
- %APPDATA%\Toolbar4\{CDB982ED-F9D6-4E3B-B94B-96F705D35AD1}\menui.bmp
- %APPDATA%\Toolbar4\{CDB982ED-F9D6-4E3B-B94B-96F705D35AD1}\menu.bmp
- %APPDATA%\Toolbar4\{CDB982ED-F9D6-4E3B-B94B-96F705D35AD1}\newlog.png
- %APPDATA%\Toolbar4\{CDB982ED-F9D6-4E3B-B94B-96F705D35AD1}\movies.png
- %APPDATA%\Toolbar4\{CDB982ED-F9D6-4E3B-B94B-96F705D35AD1}\magazine132.png
- %APPDATA%\Toolbar4\{CDB982ED-F9D6-4E3B-B94B-96F705D35AD1}\maga.png
- %APPDATA%\Toolbar4\{CDB982ED-F9D6-4E3B-B94B-96F705D35AD1}\mag2.png
- %APPDATA%\Toolbar4\{CDB982ED-F9D6-4E3B-B94B-96F705D35AD1}\magazine.png
- %APPDATA%\Toolbar4\{CDB982ED-F9D6-4E3B-B94B-96F705D35AD1}\maga2.png
- %PROGRAM_FILES%\WebplayerTool\webplayer.dll
- %PROGRAM_FILES%\WebplayerTool\fond.bmp
- %PROGRAM_FILES%\WebplayerTool\find.png
- %PROGRAM_FILES%\WebplayerTool\fondtoo2l.bmp
- %PROGRAM_FILES%\WebplayerTool\fond2.bmp
- %PROGRAM_FILES%\WebplayerTool\favicon.png
- %PROGRAM_FILES%\WebplayerTool\emmisiosn.png
- %PROGRAM_FILES%\WebplayerTool\emmision.png
- %PROGRAM_FILES%\WebplayerTool\facebook.png
- %PROGRAM_FILES%\WebplayerTool\emmissionsblanc.png
- %PROGRAM_FILES%\WebplayerTool\include.xml
- %PROGRAM_FILES%\WebplayerTool\icons.bmp
- %PROGRAM_FILES%\WebplayerTool\lo.png
- %PROGRAM_FILES%\WebplayerTool\info.txt
- %PROGRAM_FILES%\WebplayerTool\homeblanc.png
- %PROGRAM_FILES%\WebplayerTool\heart.png
- %PROGRAM_FILES%\WebplayerTool\football.png
- %PROGRAM_FILES%\WebplayerTool\home1.png
- %PROGRAM_FILES%\WebplayerTool\home.png
- %PROGRAM_FILES%\WebplayerTool\acueil1.png
- %PROGRAM_FILES%\WebplayerTool\123.png
- %PROGRAM_FILES%\WebplayerTool\basis.xml
- %PROGRAM_FILES%\WebplayerTool\arrow_refresh.png
- %TEMP%\nsg2.tmp\CabDLL.dll
- %TEMP%\nsg2.tmp\Processes.dll
- %TEMP%\nsg2.tmp\UAC.dll
- %TEMP%\webplayer.cab
- %TEMP%\nsg2.tmp\UserInfo.dll
- %PROGRAM_FILES%\WebplayerTool\computer_delete.png
- %PROGRAM_FILES%\WebplayerTool\cog.png
- %PROGRAM_FILES%\WebplayerTool\divertissements.png
- %PROGRAM_FILES%\WebplayerTool\diers.png
- %PROGRAM_FILES%\WebplayerTool\chianetv1.png
- %PROGRAM_FILES%\WebplayerTool\chaine.png
- %PROGRAM_FILES%\WebplayerTool\cap.png
- %PROGRAM_FILES%\WebplayerTool\chainestv1.png
- %PROGRAM_FILES%\WebplayerTool\chaineblnc.png
- %PROGRAM_FILES%\WebplayerTool\logo.png
- %PROGRAM_FILES%\WebplayerTool\seriestv1.png
- %PROGRAM_FILES%\WebplayerTool\seriestv.png
- %PROGRAM_FILES%\WebplayerTool\TbCommonUtils.dll
- %PROGRAM_FILES%\WebplayerTool\start.html
- %PROGRAM_FILES%\WebplayerTool\seriesblanc.png
- %PROGRAM_FILES%\WebplayerTool\push.exe
- %PROGRAM_FILES%\WebplayerTool\ogo.png
- %PROGRAM_FILES%\WebplayerTool\series.png
- %PROGRAM_FILES%\WebplayerTool\re.png
- %PROGRAM_FILES%\WebplayerTool\uninstall.exe
- %PROGRAM_FILES%\WebplayerTool\twitter.png
- %PROGRAM_FILES%\WebplayerTool\version.txt
- %PROGRAM_FILES%\WebplayerTool\update.exe
- %PROGRAM_FILES%\WebplayerTool\tvrea.png
- %PROGRAM_FILES%\WebplayerTool\tbhelper.dll
- %PROGRAM_FILES%\WebplayerTool\tbcore3.dll
- %PROGRAM_FILES%\WebplayerTool\tbs_include_script_013016.js
- %PROGRAM_FILES%\WebplayerTool\TbHelper2.exe
- %PROGRAM_FILES%\WebplayerTool\lolblanc.png
- %PROGRAM_FILES%\WebplayerTool\logoweb.png
- %PROGRAM_FILES%\WebplayerTool\ma.png
- %PROGRAM_FILES%\WebplayerTool\loupe.png
- %PROGRAM_FILES%\WebplayerTool\logotooool.png
- %PROGRAM_FILES%\WebplayerTool\logoplay.png
- %PROGRAM_FILES%\WebplayerTool\logobl.png
- %PROGRAM_FILES%\WebplayerTool\logoplay3.png
- %PROGRAM_FILES%\WebplayerTool\logoplay2.png
- %PROGRAM_FILES%\WebplayerTool\menui.bmp
- %PROGRAM_FILES%\WebplayerTool\menu.bmp
- %PROGRAM_FILES%\WebplayerTool\newlog.png
- %PROGRAM_FILES%\WebplayerTool\movies.png
- %PROGRAM_FILES%\WebplayerTool\magazine132.png
- %PROGRAM_FILES%\WebplayerTool\maga.png
- %PROGRAM_FILES%\WebplayerTool\mag2.png
- %PROGRAM_FILES%\WebplayerTool\magazine.png
- %PROGRAM_FILES%\WebplayerTool\maga2.png
Удаляет следующие файлы:
- %TEMP%\nsg2.tmp\UAC.dll
- %TEMP%\nsg2.tmp\UserInfo.dll
- <SYSTEM32>\wbem\Performance\WmiApRpl.ini
- %TEMP%\nsg2.tmp\System.dll
- %TEMP%\nsg2.tmp\CabDLL.dll
- %TEMP%\nsg2.tmp\inetc.dll
- %TEMP%\nsg2.tmp\Processes.dll
Сетевая активность:
Подключается к:
- 'to####rserver.com':80
TCP:
Запросы HTTP GET:
- to####rserver.com/statistics/?tb######################################################################################
UDP:
- DNS ASK to####rserver.com
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'SysListView32' WindowName: ''
- ClassName: '#32770' WindowName: ''
