Техническая информация
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\DllHost.exe' /pid=0xaa4 /log
- '%WINDIR%\explorer.exe' /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
- '%WINDIR%\explorer.exe' http://www.te###.com.br
Изменения в файловой системе:
Создает следующие файлы:
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\MANIFEST-000001
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\000001.dbtmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\MANIFEST-000002
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\6043.tmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\60F1.tmp
- %APPDATA%\Roaming\Microsoft\Windows\Recent\CustomDestinations\ZWLLGD3QWIO1340OUGOP.temp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\000002.dbtmp
- %TEMP%\etilqs_F6Ep5i2Z9llw0cO
- <Служебный элемент>
- %APPDATA%\Roaming\Opera Software\Opera Stable\86DA.tmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\LOG
- %APPDATA%\Roaming\Opera Software\Opera Stable\6C28.tmp
- %TEMP%\etilqs_nh8dnEzjA1NOitd
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\MANIFEST-000002
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\000002.dbtmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\LOG
- %TEMP%\~DFF19760499EB9C9F3.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\MANIFEST-000001
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\000001.dbtmp
- %TEMP%\etilqs_pUw8oxTp4SfevS8
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\5A83.tmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\5E6B.tmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\5FA5.tmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\History Provider Cache
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\587C.tmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\59F4.tmp
Удаляет следующие файлы:
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\6033.tmp~RF66048.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\5F95.tmp~RF65fea.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\60D1.tmp~RF66122.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\MANIFEST-000001
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\CURRENT~RF663f0.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\5E4B.tmp~RF65f7d.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\MANIFEST-000001
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\CURRENT~RF64604.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\582D.tmp~RF65984.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\5A63.tmp~RF65b1a.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\59E4.tmp~RF65a5f.TMP
Перемещает следующие файлы:
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\60F1.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\60D1.tmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\60D1.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\60D1.tmp~RF66122.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\6033.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\6033.tmp~RF66048.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\5F95.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\5F95.tmp~RF65fea.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\6043.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\6033.tmp
- %APPDATA%\Roaming\Microsoft\Windows\Recent\CustomDestinations\ZWLLGD3QWIO1340OUGOP.temp в %APPDATA%\Roaming\Microsoft\Windows\Recent\CustomDestinations\8548f632abe97aa3.customDestinations-ms
- %APPDATA%\Roaming\Opera Software\Opera Stable\6C28.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Preferences
- %APPDATA%\Roaming\Opera Software\Opera Stable\86DA.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Local State
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\CURRENT в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\CURRENT~RF663f0.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\000001.dbtmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\CURRENT
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\000002.dbtmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\CURRENT
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\5FA5.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\5F95.tmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\587C.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\582D.tmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\582D.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\582D.tmp~RF65984.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\CURRENT в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\CURRENT~RF64604.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\000001.dbtmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\CURRENT
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\000002.dbtmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\CURRENT
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\59F4.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\59E4.tmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\5E6B.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\5E4B.tmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\5E4B.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\5E4B.tmp~RF65f7d.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\5A63.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\5A63.tmp~RF65b1a.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\59E4.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\59E4.tmp~RF65a5f.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\5A83.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\5A63.tmp
Сетевая активность:
UDP:
- DNS ASK bi##.#ikimedia.org
- DNS ASK ap#.###sys.opera.com
- DNS ASK dn#.##ftncsi.com
- DNS ASK sl####i.yandex.ru
- DNS ASK au######te.geo.opera.com
- DNS ASK en.###ipedia.org
- DNS ASK re###.opera.com
- DNS ASK si#####ck2.opera.com
- DNS ASK www.google.com
- DNS ASK www.mu####a.hpg.com.br
- DNS ASK www.ic#.com
- DNS ASK www.go##le.ru
- DNS ASK i.##0.ru
- DNS ASK www.te###.com.br
Другое:
Ищет следующие окна:
- ClassName: 'OleMainThreadWndClass' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'Opera_MessageWindow' WindowName: '%APPDATA%\Roaming\Opera Software\Opera Stable'
