Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '479505b1f8281a649a8801f1eb990bb7' = '"%APPDATA%\Roaming\no-name.exe" ..'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '479505b1f8281a649a8801f1eb990bb7' = '"%APPDATA%\Roaming\no-name.exe" ..'
Вредоносные функции:
Создает и запускает на исполнение:
- '%APPDATA%\Roaming\no-name.exe'
- '%TEMP%\936.exe'
- '%APPDATA%\Roaming\msconfig.exe'
Запускает на исполнение:
- '<SYSTEM32>\netsh.exe' firewall add allowedprogram "%APPDATA%\Roaming\no-name.exe" "no-name.exe" ENABLE
Изменения в файловой системе:
Создает следующие файлы:
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\4325.tmp
- %APPDATA%\Roaming\Microsoft\Windows\Recent\CustomDestinations\EDEQDTQ957QXH05SYNZL.temp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\MANIFEST-000001
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\4259.tmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\3E4D.tmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\412C.tmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\41DA.tmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\000001.dbtmp
- <Служебный элемент>
- %TEMP%\etilqs_YM7UiIeSWfy81r7
- %APPDATA%\Roaming\Opera Software\Opera Stable\384E.tmp
- %TEMP%\etilqs_j1jA35k2S2WPMO8
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\MANIFEST-000002
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\000002.dbtmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\LOG
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.new
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\MANIFEST-000001
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\000001.dbtmp
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.new
- %APPDATA%\Roaming\msconfig.exe
- %TEMP%\936.exe
- %APPDATA%\Roaming\no-name.exe
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\MANIFEST-000002
- %APPDATA%\Roaming\Opera Software\Opera Stable\17C4.tmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\3CB3.tmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\3D61.tmp
- %TEMP%\etilqs_4ujpyZ0BEOOyIVc
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\000002.dbtmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\LOG
- %APPDATA%\Roaming\Opera Software\Opera Stable\History Provider Cache
Удаляет следующие файлы:
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\4248.tmp~RF542ba.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\41C9.tmp~RF5422d.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\4315.tmp~RF543f2.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\MANIFEST-000001
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\CURRENT~RF54ae4.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\408F.tmp~RF541b1.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\MANIFEST-000001
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\CURRENT~RF4f4ba.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\3CA3.tmp~RF53d0f.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\3E3C.tmp~RF53f31.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\3D50.tmp~RF53e18.TMP
Перемещает следующие файлы:
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\4259.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\4248.tmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\4248.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\4248.tmp~RF542ba.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\4325.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\4315.tmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\408F.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\408F.tmp~RF541b1.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\41DA.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\41C9.tmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\41C9.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\41C9.tmp~RF5422d.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\000002.dbtmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\CURRENT
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\CURRENT в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\CURRENT~RF54ae4.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\384E.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Local State
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\4315.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\4315.tmp~RF543f2.TMP
- %APPDATA%\Roaming\Microsoft\Windows\Recent\CustomDestinations\EDEQDTQ957QXH05SYNZL.temp в %APPDATA%\Roaming\Microsoft\Windows\Recent\CustomDestinations\8548f632abe97aa3.customDestinations-ms
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\000001.dbtmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\CURRENT
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\412C.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\408F.tmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\000002.dbtmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\CURRENT
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\CURRENT в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\CURRENT~RF4f4ba.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\17C4.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Preferences
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.new в %WINDIR%\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.new в %WINDIR%\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\000001.dbtmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\CURRENT
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\3D50.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\3D50.tmp~RF53e18.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\3E4D.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\3E3C.tmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\3E3C.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\3E3C.tmp~RF53f31.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\3CB3.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\3CA3.tmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\3CA3.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\3CA3.tmp~RF53d0f.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\3D61.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\3D50.tmp
Сетевая активность:
UDP:
- DNS ASK en.###ipedia.org
- DNS ASK sl####i.yandex.ru
- DNS ASK no####e.no-ip.biz
- DNS ASK au######te.geo.opera.com
- DNS ASK re###.opera.com
- DNS ASK ap#.###sys.opera.com
- DNS ASK dn#.##ftncsi.com
- DNS ASK si#####ck2.opera.com
- DNS ASK www.ic#.com
- DNS ASK www.google.com
- DNS ASK bi##.#ikimedia.org
- DNS ASK i.##0.ru
- DNS ASK www.go##le.ru
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'Indicator' WindowName: ''
- ClassName: 'Opera_MessageWindow' WindowName: '%APPDATA%\Roaming\Opera Software\Opera Stable'
