Техническая информация
Вредоносные функции:
Создает и запускает на исполнение:
- %TEMP%\PPTV(pplive)_forqd325.exe
- %WINDIR%\ttvs\115brr.exe
- %WINDIR%\ttvs\Funshion.exe
- %TEMP%\Ins1132.exe /silent
- %WINDIR%\ttvs\sg.exe
- %WINDIR%\ttvs\forqd325.exe
- %WINDIR%\ttvs\FXInstall.exe
- %WINDIR%\ttvs\iemao.exe
- %WINDIR%\ttvs\Funshion.exe (загружен из сети Интернет)
- %TEMP%\PPTV(pplive)_forqd325.exe (загружен из сети Интернет)
- %TEMP%\Ins1132.exe (загружен из сети Интернет)
Запускает на исполнение:
- %PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE http://www.18##r.com/iclk/?zo#################
- %PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE http://www.9x##.com/iclk/?zo##################
- <SYSTEM32>\cmd.exe /c %WINDIR%\ttvs\_yude.bat
- %PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE http://cp##.netgy.com/redirect/reg_gbdns520.jsp
- <SYSTEM32>\net.exe stop sharedaccess
- <SYSTEM32>\net1.exe stop sharedaccess
- %PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE http://82####.9lwan.com/cj/direct/628138.html
Изменения в файловой системе:
Создает следующие файлы:
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\Funshion[1].exe
- %WINDIR%\ttvs\Funshion.exe
- %TEMP%\Ins1132.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\628138[1].html
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\reg_gbdns520[1].jsp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\iclk[1]
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\iclk[1]
- %TEMP%\pyversion.ini
- %WINDIR%\ttvs\_yude.bat
- %TEMP%\version.ini
- %WINDIR%\ttvs\forqd325.exe
- %WINDIR%\ttvs\淘网址.url
- %WINDIR%\ttvs\115brr.exe
- %WINDIR%\ttvs\iemao.exe
- %WINDIR%\ttvs\sg.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\PPTV(pplive)_forqd325[1].exe
- %TEMP%\PPTV(pplive)_forqd325.exe
- %WINDIR%\ttvs\FXInstall.exe
Удаляет следующие файлы:
- %WINDIR%\ttvs\FXInstall.exe
- %TEMP%\~DF6C73.tmp
- %WINDIR%\ttvs\Funshion.exe
Сетевая активность:
Подключается к:
- 'ms###ion.com':80
- 'cp##.netgy.com':80
- 'localhost':1053
- '82####.9lwan.com':80
- 'www.9x##.com':80
- 'pi##.#e.sogou.com':80
- 'im#.#ogou.com':80
- 'www.18##r.com':80
- 'do##.iemao.com':80
- 'localhost':1044
- 'localhost':1045
- 'localhost':1036
- 'co###.iemao.com':80
- 'co####.ie.sogou.com':80
- 'localhost':1051
- 'do####ad.pplive.com':80
- 'localhost':1049
TCP:
Запросы HTTP GET:
- im#.#ogou.com/fastversion.txt
- cp##.netgy.com/redirect/reg_gbdns520.jsp
- www.18##r.com/iclk/?zo#################
- pi##.#e.sogou.com/sepush.gif?h=########################################################
- www.9x##.com/iclk/?zo##################
- ms###ion.com/Funshion.exe
- do####ad.pplive.com/PPTV(pplive)_forqd325.exe
- co###.iemao.com/Count.ashx?ac#####################################################################################################################
- co####.ie.sogou.com/seversion.txt?h=################################
- 82####.9lwan.com/cj/direct/628138.html
- do##.iemao.com/files/Ins1132.exe
UDP:
- DNS ASK im#.#ogou.com
- DNS ASK cp##.netgy.com
- DNS ASK www.18##r.com
- DNS ASK pi##.#e.sogou.com
- DNS ASK www.9x##.com
- DNS ASK ms###ion.com
- DNS ASK do####ad.pplive.com
- DNS ASK co###.iemao.com
- DNS ASK co####.ie.sogou.com
- DNS ASK 82####.9lwan.com
- DNS ASK do##.iemao.com
Другое:
Ищет следующие окна:
- ClassName: '' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: '' WindowName: '??????????'
- ClassName: 'EDIT' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: '' WindowName: '??????????? ??'
