Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'КЧИ¤_201408221643' = '"%PROGRAM_FILES%\ShouQu\201408221643\ShouQu.exe" /autostart'
Вредоносные функции:
Создает и запускает на исполнение:
- '%WINDIR%\empty.exe' 2844
- '%PROGRAM_FILES%\ShouQu\201408221643\ShouQu.exe' /install
- '<Текущая директория>\shouqu_106_9610.exe'
- '%TEMP%\is-1DEVB.tmp\shouqu_106_9610.tmp' /SL5="$1010E,1045444,66048,<Текущая директория>\shouqu_106_9610.exe"
Запускает на исполнение:
- '<SYSTEM32>\regsvr32.exe' /s "%PROGRAM_FILES%\ShouQu\201408221643\ShouQuBorder.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%PROGRAM_FILES%\ShouQu\201408221643\ShouQuUpdate.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%PROGRAM_FILES%\ShouQu\201408221643\ShouQuDll.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%PROGRAM_FILES%\ShouQu\201408221643\ShouQuExt.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%TEMP%\is-7I40V.tmp\ShouQuDll.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%PROGRAM_FILES%\ShouQu\201408221643\ShouQuGdi.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%PROGRAM_FILES%\ShouQu\201408221643\ShouQuConf.dll"
Изменения в файловой системе:
Создает следующие файлы:
- %PROGRAM_FILES%\ShouQu\201408221643\is-0MLS3.tmp
- %PROGRAM_FILES%\ShouQu\201408221643\is-PCMN4.tmp
- %PROGRAM_FILES%\ShouQu\201408221643\is-ASV1V.tmp
- %PROGRAM_FILES%\ShouQu\201408221643\is-1TMV7.tmp
- %PROGRAM_FILES%\ShouQu\201408221643\is-CE7DJ.tmp
- %TEMP%\is-7I40V.tmp\progressbg.png
- %TEMP%\is-7I40V.tmp\DirEditBackImg.png
- %PROGRAM_FILES%\ShouQu\201408221643\is-P1UCH.tmp
- %TEMP%\is-7I40V.tmp\progress.png
- %TEMP%\is-7I40V.tmp\bg_03.png
- %ALLUSERSPROFILE%\Start Menu\Programs\КЧИ¤\Р¶ФШ КЧИ¤.lnk
- %TEMP%\is-7I40V.tmp\finish.png
- %ALLUSERSPROFILE%\Start Menu\Programs\КЧИ¤\КЧИ¤.lnk
- %PROGRAM_FILES%\ShouQu\201408221643\is-S30NU.tmp
- %PROGRAM_FILES%\ShouQu\201408221643\is-G0SG3.tmp
- %ALLUSERSPROFILE%\Desktop\КЧИ¤.lnk
- %PROGRAM_FILES%\ShouQu\201408221643\unins000.dat
- %TEMP%\is-7I40V.tmp\innocallback.dll
- %TEMP%\is-7I40V.tmp\InnoUI.dll
- %TEMP%\is-7I40V.tmp\MessageBack.png
- %TEMP%\is-7I40V.tmp\fairy.dll
- %TEMP%\is-7I40V.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-1DEVB.tmp\shouqu_106_9610.tmp
- <Текущая директория>\shouqu_106_9610.exe
- %TEMP%\is-7I40V.tmp\_isetup\_RegDLL.tmp
- %WINDIR%\empty.exe
- %TEMP%\is-7I40V.tmp\NextButton.png
- %TEMP%\is-7I40V.tmp\bg_02.png
- %TEMP%\is-7I40V.tmp\close3.png
- %TEMP%\is-7I40V.tmp\changeA.png
- %TEMP%\is-7I40V.tmp\checkbox.png
- %TEMP%\is-7I40V.tmp\cancel.png
- %TEMP%\is-7I40V.tmp\go.png
- %TEMP%\is-7I40V.tmp\FrameImg.png
- %TEMP%\is-7I40V.tmp\ShouQuDll.dll
Удаляет следующие файлы:
- %TEMP%\is-7I40V.tmp\NextButton.png
- %TEMP%\is-7I40V.tmp\progress.png
- %TEMP%\is-7I40V.tmp\MessageBack.png
- %TEMP%\is-7I40V.tmp\innocallback.dll
- %TEMP%\is-7I40V.tmp\InnoUI.dll
- %TEMP%\is-7I40V.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-1DEVB.tmp\shouqu_106_9610.tmp
- %TEMP%\is-7I40V.tmp\_isetup\_RegDLL.tmp
- %TEMP%\is-7I40V.tmp\progressbg.png
- %TEMP%\is-7I40V.tmp\ShouQuDll.dll
- %TEMP%\is-7I40V.tmp\go.png
- %TEMP%\is-7I40V.tmp\changeA.png
- %TEMP%\is-7I40V.tmp\checkbox.png
- %TEMP%\is-7I40V.tmp\cancel.png
- %TEMP%\is-7I40V.tmp\bg_02.png
- %TEMP%\is-7I40V.tmp\bg_03.png
- %TEMP%\is-7I40V.tmp\finish.png
- %TEMP%\is-7I40V.tmp\FrameImg.png
- %TEMP%\is-7I40V.tmp\fairy.dll
- %TEMP%\is-7I40V.tmp\close3.png
- %TEMP%\is-7I40V.tmp\DirEditBackImg.png
Перемещает следующие файлы:
- %PROGRAM_FILES%\ShouQu\201408221643\is-ASV1V.tmp в %PROGRAM_FILES%\ShouQu\201408221643\ShouQuBorder.dll
- %PROGRAM_FILES%\ShouQu\201408221643\is-1TMV7.tmp в %PROGRAM_FILES%\ShouQu\201408221643\ShouQuExt.dll
- %PROGRAM_FILES%\ShouQu\201408221643\is-S30NU.tmp в %PROGRAM_FILES%\ShouQu\201408221643\ShouQuDll.dll
- %PROGRAM_FILES%\ShouQu\201408221643\is-G0SG3.tmp в %PROGRAM_FILES%\ShouQu\201408221643\ShouQuUpdate.dll
- %PROGRAM_FILES%\ShouQu\201408221643\is-CE7DJ.tmp в %PROGRAM_FILES%\ShouQu\201408221643\ShouQu.exe
- %PROGRAM_FILES%\ShouQu\201408221643\is-P1UCH.tmp в %PROGRAM_FILES%\ShouQu\201408221643\unins000.exe
- %PROGRAM_FILES%\ShouQu\201408221643\is-0MLS3.tmp в %PROGRAM_FILES%\ShouQu\201408221643\ShouQuConf.dll
- %PROGRAM_FILES%\ShouQu\201408221643\is-PCMN4.tmp в %PROGRAM_FILES%\ShouQu\201408221643\ShouQuGdi.dll
Сетевая активность:
Подключается к:
- 'to####.tai69.com':80
- 'localhost':1043
- 'jh.###tiao001.com':80
- 'localhost':1045
- 'xm##.tai69.com':80
- 'localhost':1039
- '12#.#25.114.144':80
- 'localhost':1041
- 'xm#.#ai69.com':80
TCP:
Запросы HTTP GET:
- to####.tai69.com/tongji/51la.html?sh#################
- jh.###tiao001.com/news.html
- xm##.tai69.com/config.php?v=#######
- 12#.#25.114.144/yaiaiuofhebjxzd/item/97bff1f6f1692221e2e3bd2b
- xm#.#ai69.com/config.php?v=#######
Запросы HTTP POST:
- to####.tai69.com/tongji/maintongji.asp
UDP:
- DNS ASK to####.tai69.com
- DNS ASK jh.###tiao001.com
- DNS ASK xm##.tai69.com
- DNS ASK hi.##idu.com
- DNS ASK xm#.#ai69.com
Другое:
Ищет следующие окна:
- ClassName: 'SysHeader32' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'SysDateTimePick32' WindowName: ''
- ClassName: 'msctls_updown32' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'MDIClient' WindowName: ''
- ClassName: 'Indicator' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'ComboBox' WindowName: ''
- ClassName: 'msctls_trackbar32' WindowName: ''
- ClassName: 'BUTTON' WindowName: ''
- ClassName: 'Edit' WindowName: ''
- ClassName: 'msctls_progress32' WindowName: ''
- ClassName: 'SysTreeView32' WindowName: ''
- ClassName: 'SysIPAddress32' WindowName: ''
- ClassName: 'ListBox' WindowName: ''
- ClassName: 'SysListView32' WindowName: ''
