Техническая информация
Вредоносные функции:
Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\KBS\ISiCastAgent\ISiCastAgent.exe' = '%PROGRAM_FILES%\KBS\ISiCastAgent\ISiCastAgent.exe:*:Enabled:ISiCastAgent'
Создает и запускает на исполнение:
- '%APPDATA%\OnFreeTV_APP\onfree.exe'
- '%TEMP%\RarSFX0\OnFreeTV.exe'
Запускает на исполнение:
- '<SYSTEM32>\xcopy.exe' "%TEMP%\RarSFX0\App\KBS" "%PROGRAM_FILES%\KBS\" /cherky
- '<SYSTEM32>\xcopy.exe' "%TEMP%\RarSFX0\App\OnFreeTV_APP" "%APPDATA%\OnFreeTV_APP\" /cherky
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\ztmp\t7405.bat" "%TEMP%\RarSFX0\OnFreeTV.exe" "
- '%WINDIR%\regedit.exe' /s %TEMP%\RarSFX0\App\Data\xp86_ins.reg
Изменения в файловой системе:
Создает следующие файлы:
- %PROGRAM_FILES%\KBS\ISiCastAgent\InitInfo.xml
- %PROGRAM_FILES%\KBS\ISiCastAgent\IOCP.dll
- %PROGRAM_FILES%\KBS\ISiCastAgent\Exception.dll
- %PROGRAM_FILES%\KBS\ISiCastAgent\FastMemFunc.dll
- %PROGRAM_FILES%\KBS\ISiCastAgent\ISiCastAgentHelper_KBS.inf
- %PROGRAM_FILES%\KBS\ISiCastAgent\ISiCastFirewall.exe
- %PROGRAM_FILES%\KBS\ISiCastAgent\ISiCastAgent.exe
- %PROGRAM_FILES%\KBS\ISiCastAgent\ISiCastAgentHelper_KBS.dll
- %PROGRAM_FILES%\KBS\ISiCastAgent\Content.dll
- %TEMP%\RarSFX0\App\Data\xppe86_ins.reg
- %TEMP%\RarSFX0\App\KBS\ISiCastAgent\UpdaterUI_Agent.swf
- %TEMP%\RarSFX0\App\Data\xp86_del.reg
- %TEMP%\RarSFX0\App\Data\xp86_ins.reg
- %PROGRAM_FILES%\KBS\ISiCastAgent\CheckRelation.dll
- %PROGRAM_FILES%\KBS\ISiCastAgent\Cleaner.exe
- %TEMP%\ztmp\t7405.bat
- %TEMP%\ztmp\t7457.exe
- %PROGRAM_FILES%\KBS\ISiCastAgent\ISiCUpdaterService.exe
- %PROGRAM_FILES%\KBS\ISiCastAgent\unins000.dat
- %PROGRAM_FILES%\KBS\ISiCastAgent\unins000.exe
- %PROGRAM_FILES%\KBS\ISiCastAgent\Session.dll
- %PROGRAM_FILES%\KBS\ISiCastAgent\ssleay32.dll
- %APPDATA%\OnFreeTV_APP\ofCfig.ini
- %APPDATA%\OnFreeTV_APP\onfree.exe
- %PROGRAM_FILES%\KBS\ISiCastAgent\UpdaterUI_Agent.swf
- %APPDATA%\OnFreeTV_APP\ch.dat
- %PROGRAM_FILES%\KBS\ISiCastAgent\msvcr90.dll
- %PROGRAM_FILES%\KBS\ISiCastAgent\Log.dll
- %PROGRAM_FILES%\KBS\ISiCastAgent\MFC71.dll
- %PROGRAM_FILES%\KBS\ISiCastAgent\libeay32.dll
- %PROGRAM_FILES%\KBS\ISiCastAgent\list
- %PROGRAM_FILES%\KBS\ISiCastAgent\msvcp71.dll
- %PROGRAM_FILES%\KBS\ISiCastAgent\msvcr71.dll
- %PROGRAM_FILES%\KBS\ISiCastAgent\Microsoft.VC90.CRT.manifest
- %PROGRAM_FILES%\KBS\ISiCastAgent\Microsoft.VC90.MFC.manifest
- %TEMP%\RarSFX0\App\KBS\ISiCastAgent\Content.dll
- %TEMP%\RarSFX0\App\KBS\ISiCastAgent\Exception.dll
- %TEMP%\RarSFX0\App\KBS\ISiCastAgent\unins000.exe
- %TEMP%\RarSFX0\App\KBS\ISiCastAgent\CheckRelation.dll
- %TEMP%\RarSFX0\App\KBS\ISiCastAgent\ISiCastAgentHelper_KBS.dll
- %TEMP%\RarSFX0\App\KBS\ISiCastAgent\libeay32.dll
- %TEMP%\RarSFX0\App\KBS\ISiCastAgent\FastMemFunc.dll
- %TEMP%\RarSFX0\App\KBS\ISiCastAgent\IOCP.dll
- %TEMP%\RarSFX0\OnFreeTV.exe
- %TEMP%\RarSFX0\App\KBS\ISiCastAgent\ISiCastAgentHelper_KBS.inf
- %TEMP%\RarSFX0\App\KBS\ISiCastAgent\Cleaner.exe
- %TEMP%\RarSFX0\App\KBS\ISiCastAgent\InitInfo.xml
- %TEMP%\RarSFX0\App\OnFreeTV_APP\ofCfig.ini
- %TEMP%\RarSFX0\App\KBS\ISiCastAgent\ISiCUpdaterService.exe
- %TEMP%\RarSFX0\App\OnFreeTV_APP\onfree.exe
- %TEMP%\RarSFX0\App\KBS\ISiCastAgent\ISiCastAgent.exe
- %TEMP%\RarSFX0\App\KBS\ISiCastAgent\ISiCastFirewall.exe
- %TEMP%\RarSFX0\App\KBS\ISiCastAgent\Log.dll
- %TEMP%\RarSFX0\App\Data\win64_del.reg
- %TEMP%\RarSFX0\App\Data\win64_ins.reg
- %TEMP%\RarSFX0\App\KBS\ISiCastAgent\Microsoft.VC90.CRT.manifest
- %TEMP%\RarSFX0\App\KBS\ISiCastAgent\Microsoft.VC90.MFC.manifest
- %TEMP%\RarSFX0\App\Data\winpe64_ins.reg
- %TEMP%\RarSFX0\App\Data\winpe86_ins.reg
- %TEMP%\RarSFX0\App\Data\win86_del.reg
- %TEMP%\RarSFX0\App\Data\win86_ins.reg
- %TEMP%\RarSFX0\App\KBS\ISiCastAgent\unins000.dat
- %TEMP%\RarSFX0\App\KBS\ISiCastAgent\msvcr71.dll
- %TEMP%\RarSFX0\App\KBS\ISiCastAgent\msvcr90.dll
- %TEMP%\RarSFX0\App\KBS\ISiCastAgent\MFC71.dll
- %TEMP%\RarSFX0\App\KBS\ISiCastAgent\msvcp71.dll
- %TEMP%\RarSFX0\App\KBS\ISiCastAgent\list
- %TEMP%\RarSFX0\App\OnFreeTV_APP\ch.dat
- %TEMP%\RarSFX0\App\KBS\ISiCastAgent\Session.dll
- %TEMP%\RarSFX0\App\KBS\ISiCastAgent\ssleay32.dll
Сетевая активность:
Подключается к:
- 'ap#.#nfree.tv':80
TCP:
Запросы HTTP GET:
- ap#.#nfree.tv/18/ck/
UDP:
- DNS ASK ap#.#nfree.tv
Другое:
Ищет следующие окна:
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'RegEdit_RegEdit' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
