Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Classes\xmlbar\Shell\Open\Command] '' = '"%PROGRAM_FILES%\InstantGet\InstantGet.exe" "%1"'
- [<HKLM>\SOFTWARE\Microsoft\Internet Explorer\Extensions\{6DDFE91C-A45C-4812-8F57-098932C9D88D}] 'Exec' = '%PROGRAM_FILES%\InstantGet\InstantGet.exe'
Вредоносные функции:
Создает и запускает на исполнение:
- '%TEMP%\7ZipSfx.000\instantget.exe' /S
- '%PROGRAM_FILES%\InstantGet\InstantGet.exe'
- '%TEMP%\_ir_sf_temp_0\irsetup.exe' __IRAOFF:721954 "__IRAFN:<Полный путь к вирусу>" "__IRCT:1" "__IRTSS:0" "__IRSID:S-1-5-21-2052111302-484763869-725345543-1003"
- '%TEMP%\_ir_sf_temp_0\InstantGet.2.12.exe'
Запускает на исполнение:
- '<SYSTEM32>\taskkill.exe' /F /IM opera.exe
- '<SYSTEM32>\wbem\wmiadap.exe' /R /T
- '<SYSTEM32>\taskkill.exe' /F /IM safari.exe
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\7ZipSfx.000\stop.cmd" "
- '<SYSTEM32>\taskkill.exe' /F /IM iexplore.exe
- '<SYSTEM32>\taskkill.exe' /F /IM firefox.exe
Завершает или пытается завершить
следующие пользовательские процессы:
- opera.exe
- safari.exe
- iexplore.exe
- firefox.exe
Изменения в файловой системе:
Создает следующие файлы:
- %PROGRAM_FILES%\InstantGet\language\Swedish.lng
- %PROGRAM_FILES%\InstantGet\language\Turkish.lng
- %PROGRAM_FILES%\InstantGet\language\ar.bmp
- %PROGRAM_FILES%\InstantGet\language\Romanian.lng
- %PROGRAM_FILES%\InstantGet\language\Russian.lng
- %PROGRAM_FILES%\InstantGet\language\Spanish.lng
- %PROGRAM_FILES%\InstantGet\language\cn.bmp
- %PROGRAM_FILES%\InstantGet\language\cz.bmp
- %PROGRAM_FILES%\InstantGet\language\de.bmp
- %PROGRAM_FILES%\InstantGet\language\bg.bmp
- %PROGRAM_FILES%\InstantGet\language\br.bmp
- %PROGRAM_FILES%\InstantGet\language\ca.bmp
- %PROGRAM_FILES%\InstantGet\language\Portuguese Brazilian.lng
- %PROGRAM_FILES%\InstantGet\language\Dutch.lng
- %PROGRAM_FILES%\InstantGet\language\English.lng
- %PROGRAM_FILES%\InstantGet\language\Farsi.lng
- %PROGRAM_FILES%\InstantGet\language\Chinese Traditional.lng
- %PROGRAM_FILES%\InstantGet\language\Croatian.lng
- %PROGRAM_FILES%\InstantGet\language\Czech.lng
- %PROGRAM_FILES%\InstantGet\language\Italian.lng
- %PROGRAM_FILES%\InstantGet\language\Korean.lng
- %PROGRAM_FILES%\InstantGet\language\Polish.lng
- %PROGRAM_FILES%\InstantGet\language\French.lng
- %PROGRAM_FILES%\InstantGet\language\German.lng
- %PROGRAM_FILES%\InstantGet\language\Hungarian.lng
- %PROGRAM_FILES%\InstantGet\language\en.bmp
- %ALLUSERSPROFILE%\Start Menu\Programs\InstantGet\readme.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\InstantGet\Website.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\InstantGet\Uninstall.lnk
- %PROGRAM_FILES%\InstantGet\Uninstall.exe
- %ALLUSERSPROFILE%\Start Menu\Programs\InstantGet\InstantGet.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\InstantGet\InstantGet Help.lnk
- %APPDATA%\InstantGet\appdata\igversion.ini
- %APPDATA%\InstantGet\appdata\FlvRules.ini
- %APPDATA%\InstantGet\appdata\proxyrules.ini
- %ALLUSERSPROFILE%\Desktop\InstantGet.lnk
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\InstantGet.lnk
- %TEMP%\TFR4.tmp
- %PROGRAM_FILES%\InstantGet\language\tr.bmp
- %PROGRAM_FILES%\InstantGet\language\hu.bmp
- %PROGRAM_FILES%\InstantGet\language\ir.bmp
- %PROGRAM_FILES%\InstantGet\language\it.bmp
- %PROGRAM_FILES%\InstantGet\language\es.bmp
- %PROGRAM_FILES%\InstantGet\language\fr.bmp
- %PROGRAM_FILES%\InstantGet\language\hr.bmp
- %PROGRAM_FILES%\InstantGet\language\rm.bmp
- %PROGRAM_FILES%\InstantGet\language\ru.bmp
- %PROGRAM_FILES%\InstantGet\language\sw.bmp
- %PROGRAM_FILES%\InstantGet\language\kr.bmp
- %PROGRAM_FILES%\InstantGet\language\nl.bmp
- %PROGRAM_FILES%\InstantGet\language\pl.bmp
- %APPDATA%\InstantGet\appdata\swfobject.js
- %APPDATA%\InstantGet\appdata\mediaplayer.swf
- %PROGRAM_FILES%\InstantGet\IEBar\IGIEBar.dll
- %PROGRAM_FILES%\InstantGet\config\FlvPause.gif
- %PROGRAM_FILES%\InstantGet\config\FlvFinish.gif
- %PROGRAM_FILES%\InstantGet\config\defaults\FlvRules.ini
- %PROGRAM_FILES%\InstantGet\IEBar\config\defaults\xmlbar.bmp
- %PROGRAM_FILES%\InstantGet\updater.exe
- %PROGRAM_FILES%\InstantGet\Readme.txt
- %PROGRAM_FILES%\InstantGet\IEBar\IGCatcher.dll
- %PROGRAM_FILES%\InstantGet\IEBar\config\Chinese Simplified\XBIEBar.xml
- %PROGRAM_FILES%\InstantGet\IEBar\config\defaults\XBIEBar.xml
- %PROGRAM_FILES%\InstantGet\config\FlvStart.gif
- %TEMP%\_ir_sf_temp_0\IRIMG2.JPG
- %TEMP%\_ir_sf_temp_0\InstantGet.2.12.exe
- %TEMP%\7ZipSfx.000\stop.cmd
- %TEMP%\_ir_sf_temp_0\irsetup.exe
- %TEMP%\_ir_sf_temp_0\irsetup.dat
- %TEMP%\_ir_sf_temp_0\IRIMG1.JPG
- %PROGRAM_FILES%\InstantGet\InstantGet.exe
- %PROGRAM_FILES%\InstantGet\InstantGet.chm
- %PROGRAM_FILES%\InstantGet\config\affiliate.ini
- %TEMP%\7ZipSfx.000\instantget.exe
- %TEMP%\nsx2.tmp
- %TEMP%\nsc3.tmp\CloseInstantGet.dll
- %PROGRAM_FILES%\InstantGet\InstantGet.url
- %PROGRAM_FILES%\InstantGet\skins\Corona\Toolbar.bmp
- %PROGRAM_FILES%\InstantGet\skins\Corona\skin.xml
- %PROGRAM_FILES%\InstantGet\skins\MacX\BarMark.bmp
- %PROGRAM_FILES%\InstantGet\config\defaults\control.bmp
- %PROGRAM_FILES%\InstantGet\config\defaults\install.bmp
- %PROGRAM_FILES%\InstantGet\skins\Corona\MainWindow.bmp
- %PROGRAM_FILES%\InstantGet\language\Bulgarian.lng
- %PROGRAM_FILES%\InstantGet\language\Catalan.lng
- %PROGRAM_FILES%\InstantGet\language\Chinese Simplified.lng
- %PROGRAM_FILES%\InstantGet\skins\MacX\clips.bmp
- %PROGRAM_FILES%\InstantGet\skins\MacX\skin.xml
- %PROGRAM_FILES%\InstantGet\language\Arabic.lng
- %PROGRAM_FILES%\InstantGet\config\defaults\ExtTools.ini
- %PROGRAM_FILES%\InstantGet\config\Farsi\ExtTools.ini
- %PROGRAM_FILES%\InstantGet\config\French\ExtTools.ini
- %PROGRAM_FILES%\InstantGet\config\German\ExtTools.ini
- %PROGRAM_FILES%\InstantGet\sounds\jobdone.wav
- %PROGRAM_FILES%\InstantGet\config\Chinese Simplified\ExtTools.ini
- %PROGRAM_FILES%\InstantGet\config\Croatian\ExtTools.ini
- %PROGRAM_FILES%\InstantGet\config\Korean\ExtTools.ini
- %PROGRAM_FILES%\InstantGet\config\Portuguese Brazilian\ExtTools.ini
- %PROGRAM_FILES%\InstantGet\config\Russian\ExtTools.ini
- %PROGRAM_FILES%\InstantGet\config\Hungarian\ExtTools.ini
- %PROGRAM_FILES%\InstantGet\config\Italian\ExtTools.ini
- %PROGRAM_FILES%\InstantGet\config\Japanese\ExtTools.ini
Удаляет следующие файлы:
- <SYSTEM32>\wbem\Performance\WmiApRpl.ini
- <SYSTEM32>\PerfStringBackup.TMP
- %APPDATA%\InstantGet\appdata\igversion.ini
- %TEMP%\_ir_sf_temp_0\irsetup.dat
- %TEMP%\nsc3.tmp\CloseInstantGet.dll
Сетевая активность:
Подключается к:
- 'localhost':1039
- 'www.in###ntget.com':80
- 'localhost':1036
- 'www.xm##ar.com':80
TCP:
Запросы HTTP GET:
- www.xm##ar.com/api_rule.php?la############
- www.xm##ar.com/api_rule.php?ve####################
- www.xm##ar.com/iebar/welcome.php?id###############################################################################################
- www.in###ntget.com/igversion.php
UDP:
- DNS ASK www.in###ntget.com
- DNS ASK www.xm##ar.com
Другое:
Ищет следующие окна:
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'Edit' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: '' WindowName: ''
