Техническая информация
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\find.exe' /i "thunder.exe"
- '%ProgramFiles%\Internet Explorer\IEXPLORE.EXE' http://www.du##.com/?un#########
- '<SYSTEM32>\cmd.exe' /c ""%ProgramFiles%\СёАЧVIPЧрПн°ж\ВМ»Ї.bat" "
- '<SYSTEM32>\tasklist.exe'
Изменения в файловой системе:
Создает следующие файлы:
- %ProgramFiles%\СёАЧVIPЧрПн°ж\Program\thunder.ico
- %ProgramFiles%\СёАЧVIPЧрПн°ж\Program\thundervip.ico
- %ProgramFiles%\СёАЧVIPЧрПн°ж\Program\tp_config.ini
- %ProgramFiles%\СёАЧVIPЧрПн°ж\Program\p2sp.dll
- %ProgramFiles%\СёАЧVIPЧрПн°ж\Program\ptl.dll
- %ProgramFiles%\СёАЧVIPЧрПн°ж\Program\sqlite3.dll
- %ProgramFiles%\СёАЧVIPЧрПн°ж\Program\tp_proxy.dll
- %ProgramFiles%\СёАЧVIPЧрПн°ж\Program\xl_client.dll
- %ProgramFiles%\СёАЧVIPЧрПн°ж\Program\xl_data.dll
- %ProgramFiles%\СёАЧVIPЧрПн°ж\Program\xlstat.dll
- %ProgramFiles%\СёАЧVIPЧрПн°ж\Program\ts.dll
- %ProgramFiles%\СёАЧVIPЧрПн°ж\Program\upnp.exe
- %ProgramFiles%\СёАЧVIPЧрПн°ж\Program\utl.dll
- %ProgramFiles%\СёАЧVIPЧрПн°ж\Program\p2p_upload.dll
- %ProgramFiles%\СёАЧVIPЧрПн°ж\Program\emule_kernel.dll
- %ProgramFiles%\СёАЧVIPЧрПн°ж\Program\fs.dll
- %ProgramFiles%\СёАЧVIPЧрПн°ж\Program\libexpat.dll
- %ProgramFiles%\СёАЧVIPЧрПн°ж\Program\download-complete.wav
- %ProgramFiles%\СёАЧVIPЧрПн°ж\Program\download_engine.dll
- %ProgramFiles%\СёАЧVIPЧрПн°ж\Program\dtnet.dll
- %ProgramFiles%\СёАЧVIPЧрПн°ж\Program\libpng13.dll
- %ProgramFiles%\СёАЧVIPЧрПн°ж\Program\p2p.dll
- %ProgramFiles%\СёАЧVIPЧрПн°ж\Program\p2p_cloud.dll
- %ProgramFiles%\СёАЧVIPЧрПн°ж\Program\p2p_local_res.dll
- %ProgramFiles%\СёАЧVIPЧрПн°ж\Program\mini_unzip_dll.dll
- %ProgramFiles%\СёАЧVIPЧрПн°ж\Program\minizip.dll
- %ProgramFiles%\СёАЧVIPЧрПн°ж\Program\mp.dll
- %ProgramFiles%\СёАЧVIPЧрПн°ж\Program\zlib1.dll
- %ProgramFiles%\СёАЧVIPЧрПн°ж\Thunder\Xar\ThunderApp\VipTaskDetailInfoPanel.xar
- %ProgramFiles%\СёАЧVIPЧрПн°ж\Thunder\Xar\ThunderApp\mini\Community.xar
- %ProgramFiles%\СёАЧVIPЧрПн°ж\Thunder\Xar\ThunderApp\mini\ConfigPanel.xar
- %ProgramFiles%\СёАЧVIPЧрПн°ж\Thunder\Xar\ThunderApp\VipConfigPanel.xar
- %ProgramFiles%\СёАЧVIPЧрПн°ж\Thunder\Xar\ThunderApp\VipOffline.xar
- %ProgramFiles%\СёАЧVIPЧрПн°ж\Thunder\Xar\ThunderApp\VipStatusBar.xar
- %ProgramFiles%\СёАЧVIPЧрПн°ж\Thunder\Xar\ThunderApp\mini\Offline.xar
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.lnk
- %HOMEPATH%\Start Menu\Internet Explorer.lnk
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\duba[1]
- %ProgramFiles%\СёАЧVIPЧрПн°ж\Thunder\Xar\ThunderApp\mini\SchemeTask.xar
- %ProgramFiles%\СёАЧVIPЧрПн°ж\Thunder\Xar\ThunderApp\mini\StatusBar.xar
- %ProgramFiles%\СёАЧVIPЧрПн°ж\Thunder\Xar\ThunderApp\mini\TaskDetailInfo.xar
- %ProgramFiles%\СёАЧVIPЧрПн°ж\Thunder\Xar\ThunderApp\VipCommunity.xar
- %ProgramFiles%\СёАЧVIPЧрПн°ж\Thunder\Xar\ThunderCoreMini.xar
- %ProgramFiles%\СёАЧVIPЧрПн°ж\Thunder\Xar\ThunderLiveUpdate.xar
- %ProgramFiles%\СёАЧVIPЧрПн°ж\Thunder\Xar\ThunderApp\Community.xar
- %ProgramFiles%\СёАЧVIPЧрПн°ж\Thunder\Xar\BasicControls.xar
- %ProgramFiles%\СёАЧVIPЧрПн°ж\Thunder\Xar\ThunderCore.xar
- %ProgramFiles%\СёАЧVIPЧрПн°ж\Thunder\Xar\ThunderCoreExt.xar
- %ProgramFiles%\СёАЧVIPЧрПн°ж\Thunder\Xar\ThunderApp\ConfigPanel.xar
- %ProgramFiles%\СёАЧVIPЧрПн°ж\Thunder\Xar\ThunderApp\StatusBar.xar
- %ProgramFiles%\СёАЧVIPЧрПн°ж\Thunder\Xar\ThunderApp\TaskDetailInfoPanel.xar
- %ProgramFiles%\СёАЧVIPЧрПн°ж\Thunder\Xar\ThunderApp\VipAppCollection.xar
- %ProgramFiles%\СёАЧVIPЧрПн°ж\Thunder\Xar\ThunderApp\MainWndSearchCtrl.xar
- %ProgramFiles%\СёАЧVIPЧрПн°ж\Thunder\Xar\ThunderApp\Offline.xar
- %ProgramFiles%\СёАЧVIPЧрПн°ж\Thunder\Xar\ThunderApp\SchemeTask.xar
- %ProgramFiles%\СёАЧVIPЧрПн°ж\Program\down_dispatcher.dll
- %ProgramFiles%\СёАЧVIPЧрПн°ж\Program\BaseCommunity.dll
- %ProgramFiles%\СёАЧVIPЧрПн°ж\Program\BaseIM.dll
- %ProgramFiles%\СёАЧVIPЧрПн°ж\Program\Community.dll
- %ProgramFiles%\СёАЧVIPЧрПн°ж\Data\skin\default\defaultvip.png
- %ProgramFiles%\СёАЧVIPЧрПн°ж\Data\skin\default\defaultvipbkg.png
- %ProgramFiles%\СёАЧVIPЧрПн°ж\Data\skin\default\vipskin.xml
- %ProgramFiles%\СёАЧVIPЧрПн°ж\Program\DownloadClient.dll
- %ProgramFiles%\СёАЧVIPЧрПн°ж\Program\PerformanceServer.exe
- %ProgramFiles%\СёАЧVIPЧрПн°ж\Program\TA.dll
- %ProgramFiles%\СёАЧVIPЧрПн°ж\Program\Thunder.exe
- %ProgramFiles%\СёАЧVIPЧрПн°ж\Program\DownloadKernel.dll
- %ProgramFiles%\СёАЧVIPЧрПн°ж\Program\DownloadServer.dll
- %ProgramFiles%\СёАЧVIPЧрПн°ж\Program\ModeConverter.exe
- %ProgramFiles%\СёАЧVIPЧрПн°ж\Data\ThunderPush\ThunderPush.7.99.12.xml
- %ProgramFiles%\СёАЧVIPЧрПн°ж\BHO\ThunderAgent.dll
- %ProgramFiles%\СёАЧVIPЧрПн°ж\BHO\XLNonIESvr.exe
- %ProgramFiles%\СёАЧVIPЧрПн°ж\BHO\geturl.htm
- %TEMP%\nsq2.tmp
- %ProgramFiles%\СёАЧVIPЧрПн°ж\ВМ»Ї.bat
- %ProgramFiles%\СёАЧVIPЧрПн°ж\BHO\OfflineDownload.htm
- %ProgramFiles%\СёАЧVIPЧрПн°ж\BHO\Platform\XLFSIO.dll
- %ProgramFiles%\СёАЧVIPЧрПн°ж\Data\MainWndTabItem\lixian.png
- %ProgramFiles%\СёАЧVIPЧрПн°ж\Data\MainWndTabItem\tab_lixian.png
- %ProgramFiles%\СёАЧVIPЧрПн°ж\Data\MainWndTabItem\vipdefault.xml
- %ProgramFiles%\СёАЧVIPЧрПн°ж\BHO\Platform\XLLuaRuntime.dll
- %ProgramFiles%\СёАЧVIPЧрПн°ж\BHO\Platform\np_tdieplat.dll
- %ProgramFiles%\СёАЧVIPЧрПн°ж\BHO\Platform\tdshareddata.dll
- %ProgramFiles%\СёАЧVIPЧрПн°ж\Program\ThunderMini.exe
- %ProgramFiles%\СёАЧVIPЧрПн°ж\Program\XLUserS.dll
- %ProgramFiles%\СёАЧVIPЧрПн°ж\Program\XLWebBrowser.dll
- %ProgramFiles%\СёАЧVIPЧрПн°ж\Program\al.dll
- %ProgramFiles%\СёАЧVIPЧрПн°ж\Program\XLTempFile.ico
- %ProgramFiles%\СёАЧVIPЧрПн°ж\Program\XLUE.dll
- %ProgramFiles%\СёАЧVIPЧрПн°ж\Program\XLUEIPC.dll
- %ProgramFiles%\СёАЧVIPЧрПн°ж\Program\asyn_download_interface.dll
- %ProgramFiles%\СёАЧVIPЧрПн°ж\Program\bt_kernel.dll
- %ProgramFiles%\СёАЧVIPЧрПн°ж\Program\dl_peer_id.dll
- %ProgramFiles%\СёАЧVIPЧрПн°ж\Program\dl_uac_tool.dll
- %ProgramFiles%\СёАЧVIPЧрПн°ж\Program\asyn_frame.dll
- %ProgramFiles%\СёАЧVIPЧрПн°ж\Program\atl71.dll
- %ProgramFiles%\СёАЧVIPЧрПн°ж\Program\backend_agent.dll
- %ProgramFiles%\СёАЧVIPЧрПн°ж\Program\XLLuaRuntime.dll
- %ProgramFiles%\СёАЧVIPЧрПн°ж\Program\VipServiceOffline.dll
- %ProgramFiles%\СёАЧVIPЧрПн°ж\Program\Win7AppId.exe
- %ProgramFiles%\СёАЧVIPЧрПн°ж\Program\XBrowser.exe
- %ProgramFiles%\СёАЧVIPЧрПн°ж\Program\ThunderPlatform.exe
- %ProgramFiles%\СёАЧVIPЧрПн°ж\Program\TorrentFile.ico
- %ProgramFiles%\СёАЧVIPЧрПн°ж\Program\UACTool.dll
- %ProgramFiles%\СёАЧVIPЧрПн°ж\Program\XLBugHandler.dll
- %ProgramFiles%\СёАЧVIPЧрПн°ж\Program\XLGraphic.dll
- %ProgramFiles%\СёАЧVIPЧрПн°ж\Program\XLGraphicPlus.dll
- %ProgramFiles%\СёАЧVIPЧрПн°ж\Program\XLLiveUD.exe
- %ProgramFiles%\СёАЧVIPЧрПн°ж\Program\XLCrypto.dll
- %ProgramFiles%\СёАЧVIPЧрПн°ж\Program\XLDownloadList.ico
- %ProgramFiles%\СёАЧVIPЧрПн°ж\Program\XLFSIO.dll
Подменяет следующие файлы:
- %HOMEPATH%\Start Menu\Programs\Internet Explorer.lnk
Сетевая активность:
Подключается к:
- 'www.du##.com':80
- 'localhost':1038
TCP:
Запросы HTTP GET:
- http://www.du##.com/?un#########
UDP:
- DNS ASK www.du##.com
Другое:
Ищет следующие окна:
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
