Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe] 'Debugger' = 'services.exe'
- [<HKLM>\SOFTWARE\Classes\XSEFile\Shell\Open\Command] '' = ''
Вредоносные функции:
Создает и запускает на исполнение:
- %TEMP%\7a.exe
- %TEMP%\hmen.exe
- %TEMP%\browser.exe
- %TEMP%\is-JTPA7.tmp\browser.tmp /SL5="$200DE,932318,67072,%TEMP%\browser.exe"
- %TEMP%\is-O0KR6.tmp\7a.tmp /SL5="$200E8,65238,54272,%TEMP%\7a.exe"
- C:\8009.exe
- C:\xiaohudui.exe
- C:\8009.exe sj.c
- %TEMP%\xiaohudui.exe
- %TEMP%\yingzi.exe
Запускает на исполнение:
- <SYSTEM32>\net1.exe stop sharedaccess
- <SYSTEM32>\taskkill.exe /f /im ekrn.exe
- <SYSTEM32>\taskkill.exe /f /im egui.exe
- <SYSTEM32>\rundll32.exe
- <SYSTEM32>\net.exe stop sharedaccess
- <SYSTEM32>\wscript.exe "%HOMEPATH%\Templates\Sec360.jse"
Завершает или пытается завершить
следующие пользовательские процессы:
- ekrn.exe
- 360tray.exe
Изменения в файловой системе:
Создает следующие файлы:
- %PROGRAM_FILES%\browser\Skin\Default\is-TDL28.tmp
- %PROGRAM_FILES%\browser\Skin\Default\is-OBJLO.tmp
- %PROGRAM_FILES%\browser\Skin\Default\is-HPA9C.tmp
- %PROGRAM_FILES%\browser\Skin\Default\is-SBKP0.tmp
- %PROGRAM_FILES%\browser\Skin\Default\is-IFTEO.tmp
- %PROGRAM_FILES%\browser\Skin\Default\is-O5RAK.tmp
- %PROGRAM_FILES%\browser\Skin\Default\is-O0241.tmp
- %PROGRAM_FILES%\browser\Skin\Default\is-QKQJ5.tmp
- %PROGRAM_FILES%\browser\Skin\Default\is-IDP31.tmp
- %PROGRAM_FILES%\browser\Skin\Default\is-2FN6R.tmp
- %PROGRAM_FILES%\browser\Skin\Default\is-OSB2E.tmp
- %PROGRAM_FILES%\browser\Skin\Default\is-MQMLL.tmp
- %PROGRAM_FILES%\browser\Plugin\ТіГжКу±кЅвЛш\is-9NTQH.tmp
- %PROGRAM_FILES%\browser\Skin\Default\is-7HRI5.tmp
- %PROGRAM_FILES%\browser\Skin\Default\is-4PU6G.tmp
- %PROGRAM_FILES%\browser\Plugin\Translate\is-AOOEH.tmp
- %PROGRAM_FILES%\browser\Plugin\ТіГжКу±кЅвЛш\is-87FPC.tmp
- %PROGRAM_FILES%\browser\Plugin\ТіГжКу±кЅвЛш\is-O8MQS.tmp
- %PROGRAM_FILES%\browser\Skin\Default\is-FL1EB.tmp
- %PROGRAM_FILES%\browser\Skin\Default\is-BFC1N.tmp
- %PROGRAM_FILES%\browser\Skin\Default\is-B5OIN.tmp
- %PROGRAM_FILES%\browser\Skin\Default\is-G8P3C.tmp
- %PROGRAM_FILES%\browser\Skin\Default\is-0IC82.tmp
- %PROGRAM_FILES%\browser\Skin\Default\is-9RJ4N.tmp
- %PROGRAM_FILES%\browser\Skin\Default\is-ACE7I.tmp
- %PROGRAM_FILES%\browser\User\is-R6585.tmp
- %PROGRAM_FILES%\browser\User\is-0OTB1.tmp
- %PROGRAM_FILES%\browser\User\is-A9EAH.tmp
- %PROGRAM_FILES%\browser\User\is-58MG8.tmp
- %PROGRAM_FILES%\browser\User\is-ML45K.tmp
- %PROGRAM_FILES%\browser\User\is-FUBAR.tmp
- %PROGRAM_FILES%\browser\unins000.dat
- %TEMP%\~4b3f1.tmp
- %TEMP%\~4b400.tmp
- %PROGRAM_FILES%\browser\User\is-RJ5UB.tmp
- %ALLUSERSPROFILE%\Start Menu\Programs\browser\browser.lnk
- %ALLUSERSPROFILE%\Desktop\°ІИ«дЇААЖч.lnk
- %PROGRAM_FILES%\browser\Skin\Default\is-NKAE5.tmp
- %PROGRAM_FILES%\browser\Skin\Default\is-7QQ4D.tmp
- %PROGRAM_FILES%\browser\Skin\Default\is-05SJ1.tmp
- %PROGRAM_FILES%\browser\Skin\Default\is-DCF8F.tmp
- %PROGRAM_FILES%\browser\Skin\Default\is-Q0H0A.tmp
- %PROGRAM_FILES%\browser\Skin\Default\is-H3GNO.tmp
- %PROGRAM_FILES%\browser\User\is-9OS43.tmp
- %PROGRAM_FILES%\browser\User\is-34N0J.tmp
- %PROGRAM_FILES%\browser\User\is-6LJ8E.tmp
- %PROGRAM_FILES%\browser\Skin\Default\is-5PKOB.tmp
- %PROGRAM_FILES%\browser\Skin\Default\is-9EH06.tmp
- %PROGRAM_FILES%\browser\Skin\Default\is-66N9K.tmp
- %PROGRAM_FILES%\browser\Plugin\Translate\is-SNK6D.tmp
- %TEMP%\is-4PPMR.tmp\tt.ico
- %PROGRAM_FILES%\NetMeeting\tt.ico
- %TEMP%\is-4PPMR.tmp\Sec360.jse
- %TEMP%\is-4PPMR.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-GP29T.tmp\_isetup\_RegDLL.tmp
- %TEMP%\is-GP29T.tmp\_isetup\_shfoldr.dll
- %PROGRAM_FILES%\browser\is-E1HDG.tmp
- %PROGRAM_FILES%\browser\is-IN3OS.tmp
- %PROGRAM_FILES%\browser\is-N66G4.tmp
- %HOMEPATH%\Templates\Sec360.jse
- %PROGRAM_FILES%\browser\is-13KA5.tmp
- %PROGRAM_FILES%\browser\is-M2DML.tmp
- %TEMP%\xiaohudui.exe
- %TEMP%\hmen.exe
- %TEMP%\browser.exe
- C:\xiaohudui.exe
- C:\8009.exe
- %TEMP%\yingzi.exe
- %TEMP%\is-O0KR6.tmp\7a.tmp
- %TEMP%\is-JTPA7.tmp\browser.tmp
- %TEMP%\is-4PPMR.tmp\_isetup\_RegDLL.tmp
- %TEMP%\~4159a.t
- %TEMP%\7a.exe
- %TEMP%\~42aab.t
- %PROGRAM_FILES%\browser\Language\is-O7URH.tmp
- %PROGRAM_FILES%\browser\Plugin\SnapShot\is-RG70R.tmp
- %PROGRAM_FILES%\browser\Plugin\TipPassword\is-BDKFB.tmp
- %PROGRAM_FILES%\browser\Plugin\TipPassword\is-K69D5.tmp
- %PROGRAM_FILES%\browser\Plugin\SnapShot\is-TAROT.tmp
- %PROGRAM_FILES%\browser\Plugin\SnapShot\is-RC0DT.tmp
- %PROGRAM_FILES%\browser\Plugin\SnapShot\is-KA256.tmp
- %PROGRAM_FILES%\browser\Plugin\Tools\is-1PRR4.tmp
- %PROGRAM_FILES%\browser\Plugin\Tools\is-8MODA.tmp
- %PROGRAM_FILES%\browser\Plugin\Translate\is-PQO7E.tmp
- %PROGRAM_FILES%\browser\Plugin\TipPassword\is-OQICF.tmp
- %PROGRAM_FILES%\browser\Plugin\Tools\is-QF8SB.tmp
- %PROGRAM_FILES%\browser\Plugin\Tools\is-7UHBU.tmp
- %PROGRAM_FILES%\browser\Plugin\MouseUnlock\is-71Q08.tmp
- %PROGRAM_FILES%\browser\Plugin\MouseUnlock\is-A5NJD.tmp
- %PROGRAM_FILES%\browser\Plugin\MouseUnlock\is-26E4G.tmp
- %PROGRAM_FILES%\browser\Plugin\LiquidLayout\is-8VM8S.tmp
- %PROGRAM_FILES%\browser\Plugin\LiquidLayout\is-BT7GR.tmp
- %PROGRAM_FILES%\browser\Plugin\LiquidLayout\is-S0IIS.tmp
- %PROGRAM_FILES%\browser\Plugin\ShowPassword\is-U85QJ.tmp
- %PROGRAM_FILES%\browser\Plugin\ShowPassword\is-JS89L.tmp
- %PROGRAM_FILES%\browser\Plugin\ShowPassword\is-FATG5.tmp
- %PROGRAM_FILES%\browser\Plugin\PageZoomMore\is-C4JG4.tmp
- %PROGRAM_FILES%\browser\Plugin\PageZoomMore\is-5UTPH.tmp
- %PROGRAM_FILES%\browser\Plugin\PageZoomMore\is-2B6KR.tmp
Удаляет следующие файлы:
- %TEMP%\~4159a.t
- %TEMP%\is-O0KR6.tmp\7a.tmp
- %PROGRAM_FILES%\browser\JJBrowser.exe
- %TEMP%\is-JTPA7.tmp\browser.tmp
- %TEMP%\is-GP29T.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-GP29T.tmp\_isetup\_RegDLL.tmp
- %TEMP%\is-4PPMR.tmp\tt.ico
- %TEMP%\is-4PPMR.tmp\Sec360.jse
- C:\xiaohudui.exe
- %TEMP%\~42aab.t
- %TEMP%\is-4PPMR.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-4PPMR.tmp\_isetup\_RegDLL.tmp
Перемещает следующие файлы:
- %PROGRAM_FILES%\browser\Skin\Default\is-2FN6R.tmp в %PROGRAM_FILES%\browser\Skin\Default\MainTool16.bmp
- %PROGRAM_FILES%\browser\Skin\Default\is-OSB2E.tmp в %PROGRAM_FILES%\browser\Skin\Default\MainTool24.bmp
- %PROGRAM_FILES%\browser\Skin\Default\is-OBJLO.tmp в %PROGRAM_FILES%\browser\Skin\Default\left.bmp
- %PROGRAM_FILES%\browser\Skin\Default\is-HPA9C.tmp в %PROGRAM_FILES%\browser\Skin\Default\MainMenu.bmp
- %PROGRAM_FILES%\browser\Skin\Default\is-MQMLL.tmp в %PROGRAM_FILES%\browser\Skin\Default\MainToolGray16.bmp
- %PROGRAM_FILES%\browser\Skin\Default\is-IDP31.tmp в %PROGRAM_FILES%\browser\Skin\Default\SearchBar.bmp
- %PROGRAM_FILES%\browser\Skin\Default\is-ACE7I.tmp в %PROGRAM_FILES%\browser\Skin\Default\Skin.ini
- %PROGRAM_FILES%\browser\Skin\Default\is-O0241.tmp в %PROGRAM_FILES%\browser\Skin\Default\MainToolGray24.bmp
- %PROGRAM_FILES%\browser\Skin\Default\is-QKQJ5.tmp в %PROGRAM_FILES%\browser\Skin\Default\right.bmp
- %PROGRAM_FILES%\browser\Skin\Default\is-FL1EB.tmp в %PROGRAM_FILES%\browser\Skin\Default\biaoti.bmp
- %PROGRAM_FILES%\browser\Skin\Default\is-BFC1N.tmp в %PROGRAM_FILES%\browser\Skin\Default\Border.bmp
- %PROGRAM_FILES%\browser\Skin\Default\is-0IC82.tmp в %PROGRAM_FILES%\browser\Skin\Default\BackGround.bmp
- %PROGRAM_FILES%\browser\Skin\Default\is-9RJ4N.tmp в %PROGRAM_FILES%\browser\Skin\Default\biaoqian.bmp
- %PROGRAM_FILES%\browser\Skin\Default\is-B5OIN.tmp в %PROGRAM_FILES%\browser\Skin\Default\ce.bmp
- %PROGRAM_FILES%\browser\Skin\Default\is-O5RAK.tmp в %PROGRAM_FILES%\browser\Skin\Default\Go.bmp
- %PROGRAM_FILES%\browser\Skin\Default\is-TDL28.tmp в %PROGRAM_FILES%\browser\Skin\Default\gongju.bmp
- %PROGRAM_FILES%\browser\Skin\Default\is-SBKP0.tmp в %PROGRAM_FILES%\browser\Skin\Default\dibian.bmp
- %PROGRAM_FILES%\browser\Skin\Default\is-IFTEO.tmp в %PROGRAM_FILES%\browser\Skin\Default\FavBar.bmp
- %PROGRAM_FILES%\browser\Skin\Default\is-DCF8F.tmp в %PROGRAM_FILES%\browser\Skin\Default\StatusTool.bmp
- %PROGRAM_FILES%\browser\User\is-58MG8.tmp в %PROGRAM_FILES%\browser\User\DownManager.ini
- %PROGRAM_FILES%\browser\User\is-ML45K.tmp в %PROGRAM_FILES%\browser\User\Filter.ini
- %PROGRAM_FILES%\browser\User\is-34N0J.tmp в %PROGRAM_FILES%\browser\User\baidu.ico
- %PROGRAM_FILES%\browser\User\is-6LJ8E.tmp в %PROGRAM_FILES%\browser\User\CollectorOutput.txt
- %PROGRAM_FILES%\browser\User\is-FUBAR.tmp в %PROGRAM_FILES%\browser\User\JJBrowser.ini
- %PROGRAM_FILES%\browser\User\is-A9EAH.tmp в %PROGRAM_FILES%\browser\User\SearchEngine.ini
- %PROGRAM_FILES%\browser\User\is-RJ5UB.tmp в %PROGRAM_FILES%\browser\User\taobao.ico
- %PROGRAM_FILES%\browser\User\is-R6585.tmp в %PROGRAM_FILES%\browser\User\LastClose.ini
- %PROGRAM_FILES%\browser\User\is-0OTB1.tmp в %PROGRAM_FILES%\browser\User\LastVisit.ini
- %PROGRAM_FILES%\browser\Skin\Default\is-NKAE5.tmp в %PROGRAM_FILES%\browser\Skin\Default\TabNew.bmp
- %PROGRAM_FILES%\browser\Skin\Default\is-7QQ4D.tmp в %PROGRAM_FILES%\browser\Skin\Default\TabNewActive.bmp
- %PROGRAM_FILES%\browser\Skin\Default\is-Q0H0A.tmp в %PROGRAM_FILES%\browser\Skin\Default\SysBtn.bmp
- %PROGRAM_FILES%\browser\Skin\Default\is-H3GNO.tmp в %PROGRAM_FILES%\browser\Skin\Default\TabActive.bmp
- %PROGRAM_FILES%\browser\Skin\Default\is-05SJ1.tmp в %PROGRAM_FILES%\browser\Skin\Default\TabNormal.bmp
- %PROGRAM_FILES%\browser\Skin\Default\is-66N9K.tmp в %PROGRAM_FILES%\browser\Skin\Default\zhuangtai.bmp
- %PROGRAM_FILES%\browser\User\is-9OS43.tmp в %PROGRAM_FILES%\browser\User\ad.html
- %PROGRAM_FILES%\browser\Skin\Default\is-5PKOB.tmp в %PROGRAM_FILES%\browser\Skin\Default\TaskBar.bmp
- %PROGRAM_FILES%\browser\Skin\Default\is-9EH06.tmp в %PROGRAM_FILES%\browser\Skin\Default\top.bmp
- %PROGRAM_FILES%\browser\Skin\Default\is-G8P3C.tmp в %PROGRAM_FILES%\browser\Skin\Default\AddressRight.bmp
- %PROGRAM_FILES%\browser\Plugin\MouseUnlock\is-26E4G.tmp в %PROGRAM_FILES%\browser\Plugin\MouseUnlock\plugin.ini
- %PROGRAM_FILES%\browser\Plugin\PageZoomMore\is-C4JG4.tmp в %PROGRAM_FILES%\browser\Plugin\PageZoomMore\icon.ico
- %PROGRAM_FILES%\browser\Plugin\MouseUnlock\is-71Q08.tmp в %PROGRAM_FILES%\browser\Plugin\MouseUnlock\MouseUnlock.htm
- %PROGRAM_FILES%\browser\Plugin\MouseUnlock\is-A5NJD.tmp в %PROGRAM_FILES%\browser\Plugin\MouseUnlock\MouseUnlock.ico
- %PROGRAM_FILES%\browser\Plugin\PageZoomMore\is-5UTPH.tmp в %PROGRAM_FILES%\browser\Plugin\PageZoomMore\plugin.ini
- %PROGRAM_FILES%\browser\Plugin\ShowPassword\is-JS89L.tmp в %PROGRAM_FILES%\browser\Plugin\ShowPassword\plugin.ini
- %PROGRAM_FILES%\browser\Plugin\ShowPassword\is-FATG5.tmp в %PROGRAM_FILES%\browser\Plugin\ShowPassword\script.htm
- %PROGRAM_FILES%\browser\Plugin\PageZoomMore\is-2B6KR.tmp в %PROGRAM_FILES%\browser\Plugin\PageZoomMore\script.htm
- %PROGRAM_FILES%\browser\Plugin\ShowPassword\is-U85QJ.tmp в %PROGRAM_FILES%\browser\Plugin\ShowPassword\password.ico
- %PROGRAM_FILES%\browser\is-E1HDG.tmp в %PROGRAM_FILES%\browser\JJBrowser.exe
- %PROGRAM_FILES%\browser\is-IN3OS.tmp в %PROGRAM_FILES%\browser\update.info
- %PROGRAM_FILES%\browser\is-13KA5.tmp в %PROGRAM_FILES%\browser\unins000.exe
- %PROGRAM_FILES%\browser\is-M2DML.tmp в %PROGRAM_FILES%\browser\JJBrowser.exe
- %PROGRAM_FILES%\browser\is-N66G4.tmp в %PROGRAM_FILES%\browser\Updater.ini
- %PROGRAM_FILES%\browser\Plugin\LiquidLayout\is-BT7GR.tmp в %PROGRAM_FILES%\browser\Plugin\LiquidLayout\plugin.ini
- %PROGRAM_FILES%\browser\Plugin\LiquidLayout\is-S0IIS.tmp в %PROGRAM_FILES%\browser\Plugin\LiquidLayout\script.htm
- %PROGRAM_FILES%\browser\Language\is-O7URH.tmp в %PROGRAM_FILES%\browser\Language\ChineseGB.ini
- %PROGRAM_FILES%\browser\Plugin\LiquidLayout\is-8VM8S.tmp в %PROGRAM_FILES%\browser\Plugin\LiquidLayout\icon.ico
- %PROGRAM_FILES%\browser\Plugin\SnapShot\is-TAROT.tmp в %PROGRAM_FILES%\browser\Plugin\SnapShot\CameraDll.dll
- %PROGRAM_FILES%\browser\Plugin\Translate\is-SNK6D.tmp в %PROGRAM_FILES%\browser\Plugin\Translate\translate.htm
- %PROGRAM_FILES%\browser\Plugin\Translate\is-AOOEH.tmp в %PROGRAM_FILES%\browser\Plugin\Translate\translate.ico
- %PROGRAM_FILES%\browser\Plugin\Tools\is-8MODA.tmp в %PROGRAM_FILES%\browser\Plugin\Tools\QuickTools.ini
- %PROGRAM_FILES%\browser\Plugin\Translate\is-PQO7E.tmp в %PROGRAM_FILES%\browser\Plugin\Translate\plugin.ini
- %PROGRAM_FILES%\browser\Plugin\ТіГжКу±кЅвЛш\is-87FPC.tmp в %PROGRAM_FILES%\browser\Plugin\ТіГжКу±кЅвЛш\MouseUnlock.htm
- %PROGRAM_FILES%\browser\Skin\Default\is-7HRI5.tmp в %PROGRAM_FILES%\browser\Skin\Default\AddressLeft.bmp
- %PROGRAM_FILES%\browser\Skin\Default\is-4PU6G.tmp в %PROGRAM_FILES%\browser\Skin\Default\AddressMid.bmp
- %PROGRAM_FILES%\browser\Plugin\ТіГжКу±кЅвЛш\is-O8MQS.tmp в %PROGRAM_FILES%\browser\Plugin\ТіГжКу±кЅвЛш\MouseUnlock.ico
- %PROGRAM_FILES%\browser\Plugin\ТіГжКу±кЅвЛш\is-9NTQH.tmp в %PROGRAM_FILES%\browser\Plugin\ТіГжКу±кЅвЛш\plugin.ini
- %PROGRAM_FILES%\browser\Plugin\SnapShot\is-RG70R.tmp в %PROGRAM_FILES%\browser\Plugin\SnapShot\SnapShot.exe
- %PROGRAM_FILES%\browser\Plugin\TipPassword\is-BDKFB.tmp в %PROGRAM_FILES%\browser\Plugin\TipPassword\plugin.ini
- %PROGRAM_FILES%\browser\Plugin\SnapShot\is-RC0DT.tmp в %PROGRAM_FILES%\browser\Plugin\SnapShot\plugin.ini
- %PROGRAM_FILES%\browser\Plugin\SnapShot\is-KA256.tmp в %PROGRAM_FILES%\browser\Plugin\SnapShot\setting.ini
- %PROGRAM_FILES%\browser\Plugin\TipPassword\is-K69D5.tmp в %PROGRAM_FILES%\browser\Plugin\TipPassword\script.htm
- %PROGRAM_FILES%\browser\Plugin\Tools\is-7UHBU.tmp в %PROGRAM_FILES%\browser\Plugin\Tools\QuickProcess.exe
- %PROGRAM_FILES%\browser\Plugin\Tools\is-1PRR4.tmp в %PROGRAM_FILES%\browser\Plugin\Tools\QuickTools.exe
- %PROGRAM_FILES%\browser\Plugin\TipPassword\is-OQICF.tmp в %PROGRAM_FILES%\browser\Plugin\TipPassword\TipPassword.ico
- %PROGRAM_FILES%\browser\Plugin\Tools\is-QF8SB.tmp в %PROGRAM_FILES%\browser\Plugin\Tools\QuickMute.exe
Сетевая активность:
Подключается к:
- 'li##.cuwqh.cn':6668
- 'vi#.#jiai.cn':80
TCP:
Запросы HTTP GET:
- vi#.#jiai.cn/admin/count.php?id################
- vi#.#jiai.cn/admin/count.php?id##################################################################################################################
UDP:
- DNS ASK li##.cuwqh.cn
- DNS ASK vi#.#jiai.cn
Другое:
Ищет следующие окна:
- ClassName: 'ToolbarWindow32' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'SysPager' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'TrayNotifyWnd' WindowName: ''
