Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Rs Hack Pack' = '%APPDATA%\InstallRsHackPack.exe'
Вредоносные функции:
Создает и запускает на исполнение:
- %TEMP%\GoogleEarthSetup.exe
Запускает на исполнение:
- <SYSTEM32>\rundll32.exe <SYSTEM32>\shimgvw.dll,ImageView_Fullscreen %TEMP%\u4Gv9.gif
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\GUM1.tmp\goopdateres_tr.dll
- %TEMP%\GUM1.tmp\goopdateres_uk.dll
- %TEMP%\GUM1.tmp\goopdateres_th.dll
- %TEMP%\GUM1.tmp\goopdateres_ta.dll
- %TEMP%\GUM1.tmp\goopdateres_te.dll
- %TEMP%\GUM1.tmp\goopdateres_ur.dll
- %TEMP%\u4Gv9.gif
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\google[1]
- %TEMP%\GUM1.tmp\goopdateres_zh-TW.dll
- %TEMP%\GUM1.tmp\goopdateres_vi.dll
- %TEMP%\GUM1.tmp\goopdateres_zh-CN.dll
- %TEMP%\GUM1.tmp\goopdateres_pt-PT.dll
- %TEMP%\GUM1.tmp\goopdateres_ro.dll
- %TEMP%\GUM1.tmp\goopdateres_pt-BR.dll
- %TEMP%\GUM1.tmp\goopdateres_no.dll
- %TEMP%\GUM1.tmp\goopdateres_pl.dll
- %TEMP%\GUM1.tmp\goopdateres_ru.dll
- %TEMP%\GUM1.tmp\goopdateres_sv.dll
- %TEMP%\GUM1.tmp\goopdateres_sw.dll
- %TEMP%\GUM1.tmp\goopdateres_sr.dll
- %TEMP%\GUM1.tmp\goopdateres_sk.dll
- %TEMP%\GUM1.tmp\goopdateres_sl.dll
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\303572DF538EDD8B1D606185F1D559B8
- %PROGRAM_FILES%\Google\Update\1.3.21.69\goopdateres_ca.dll
- %PROGRAM_FILES%\Google\Update\1.3.21.69\goopdateres_cs.dll
- %PROGRAM_FILES%\Google\Update\1.3.21.69\goopdateres_bn.dll
- %PROGRAM_FILES%\Google\Update\1.3.21.69\goopdateres_ar.dll
- %PROGRAM_FILES%\Google\Update\1.3.21.69\goopdateres_bg.dll
- %PROGRAM_FILES%\Google\Update\1.3.21.69\goopdateres_da.dll
- %PROGRAM_FILES%\Google\Update\1.3.21.69\goopdateres_en-GB.dll
- %PROGRAM_FILES%\Google\Update\1.3.21.69\goopdateres_es.dll
- %PROGRAM_FILES%\Google\Update\1.3.21.69\goopdateres_en.dll
- %PROGRAM_FILES%\Google\Update\1.3.21.69\goopdateres_de.dll
- %PROGRAM_FILES%\Google\Update\1.3.21.69\goopdateres_el.dll
- %PROGRAM_FILES%\Google\Update\1.3.21.69\GoogleUpdate.exe
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\74BFD122C0875EC75DBE5C6DB4C59019
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\79841F8EF00FBA86D33CC5A47696F165
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\303572DF538EDD8B1D606185F1D559B8
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\79841F8EF00FBA86D33CC5A47696F165
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\74BFD122C0875EC75DBE5C6DB4C59019
- %PROGRAM_FILES%\Google\Update\1.3.21.69\GoogleCrashHandler.exe
- %PROGRAM_FILES%\Google\Update\1.3.21.69\goopdateres_am.dll
- %PROGRAM_FILES%\Google\Update\1.3.21.69\goopdate.dll
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\486CC6AFD08942336C61FCD401C4A1D1
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\486CC6AFD08942336C61FCD401C4A1D1
- %TEMP%\GUM1.tmp\goopdateres_nl.dll
- %TEMP%\GUM1.tmp\goopdateres_bn.dll
- %TEMP%\GUM1.tmp\goopdateres_ca.dll
- %TEMP%\GUM1.tmp\goopdateres_bg.dll
- %TEMP%\GUM1.tmp\goopdateres_am.dll
- %TEMP%\GUM1.tmp\goopdateres_ar.dll
- %TEMP%\GUM1.tmp\goopdateres_cs.dll
- %TEMP%\GUM1.tmp\goopdateres_en.dll
- %TEMP%\GUM1.tmp\goopdateres_en-GB.dll
- %TEMP%\GUM1.tmp\goopdateres_el.dll
- %TEMP%\GUM1.tmp\goopdateres_da.dll
- %TEMP%\GUM1.tmp\goopdateres_de.dll
- %TEMP%\GUM1.tmp\GoogleCrashHandler.exe
- %TEMP%\GUM1.tmp\goopdate.dll
- %TEMP%\GUM1.tmp\GoogleUpdate.exe
- %TEMP%\GoogleEarthSetup.exe
- %TEMP%\GUT2.tmp
- %TEMP%\GUM1.tmp\npGoogleUpdate3.dll
- %TEMP%\GUM1.tmp\psmachine.dll
- %TEMP%\GUM1.tmp\psuser.dll
- %TEMP%\GUM1.tmp\GoogleUpdateOnDemand.exe
- %TEMP%\GUM1.tmp\GoogleUpdateHelper.msi
- %TEMP%\GUM1.tmp\GoogleUpdateBroker.exe
- %TEMP%\GUM1.tmp\goopdateres_es.dll
- %TEMP%\GUM1.tmp\goopdateres_ja.dll
- %TEMP%\GUM1.tmp\goopdateres_kn.dll
- %TEMP%\GUM1.tmp\goopdateres_iw.dll
- %TEMP%\GUM1.tmp\goopdateres_is.dll
- %TEMP%\GUM1.tmp\goopdateres_it.dll
- %TEMP%\GUM1.tmp\goopdateres_ko.dll
- %TEMP%\GUM1.tmp\goopdateres_mr.dll
- %TEMP%\GUM1.tmp\goopdateres_ms.dll
- %TEMP%\GUM1.tmp\goopdateres_ml.dll
- %TEMP%\GUM1.tmp\goopdateres_lt.dll
- %TEMP%\GUM1.tmp\goopdateres_lv.dll
- %TEMP%\GUM1.tmp\goopdateres_fi.dll
- %TEMP%\GUM1.tmp\goopdateres_fil.dll
- %TEMP%\GUM1.tmp\goopdateres_fa.dll
- %TEMP%\GUM1.tmp\goopdateres_es-419.dll
- %TEMP%\GUM1.tmp\goopdateres_et.dll
- %TEMP%\GUM1.tmp\goopdateres_fr.dll
- %TEMP%\GUM1.tmp\goopdateres_hu.dll
- %TEMP%\GUM1.tmp\goopdateres_id.dll
- %TEMP%\GUM1.tmp\goopdateres_hr.dll
- %TEMP%\GUM1.tmp\goopdateres_gu.dll
- %TEMP%\GUM1.tmp\goopdateres_hi.dll
Самоперемещается:
- из <Полный путь к вирусу> в %APPDATA%\InstallRsHackPack.exe
Сетевая активность:
Подключается к:
- 'cs######4-crl.verisign.com':80
- 'cr#.#hawte.com':80
- 'crl.verisign.com':80
- 'www.go##le.be':80
- 'localhost':1038
TCP:
Запросы HTTP GET:
- crl.verisign.com/tss-ca.crl
- crl.verisign.com/ThawteTimestampingCA.crl
- cr#.#hawte.com/ThawteCodeSigningCA.crl
- cr#.#hawte.com/ThawtePremiumServerCA.crl
- www.go##le.be/
- www.go##le.be/intl/nl_ALL/images/logos/images_logo_lg.gif
- cs######4-crl.verisign.com/CSC3-2004.crl
- crl.verisign.com/pca3.crl
UDP:
- DNS ASK cs######4-crl.verisign.com
- DNS ASK cr#.#hawte.com
- DNS ASK www.go##le.be
- DNS ASK crl.verisign.com
Другое:
Ищет следующие окна:
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'ShImgVw:CPreviewWnd' WindowName: ''
- ClassName: 'IEFrame' WindowName: ''
- ClassName: 'Indicator' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: '' WindowName: ''
