Technical Information
Malicious functions:
Executes the following:
- '<SYSTEM32>\taskkill.exe' /f /im rutserv.exe
- '<SYSTEM32>\taskkill.exe' /f /im rfusclient.exe
Modifies file system:
Creates the following files:
- %TEMP%\$inst\2.tmp
- %ProgramFiles%\GreenTree Applications\YTD Video Downloader\plugins\audio_mixer\is-CHNRV.tmp
- %ProgramFiles%\GreenTree Applications\YTD Video Downloader\plugins\audio_output\is-BM428.tmp
- %ProgramFiles%\GreenTree Applications\YTD Video Downloader\plugins\codec\is-7883S.tmp
- %ProgramFiles%\GreenTree Applications\YTD Video Downloader\plugins\video_filter\is-TQ7N8.tmp
- %ProgramFiles%\GreenTree Applications\YTD Video Downloader\plugins\video_output\is-OS6GF.tmp
- %ProgramFiles%\GreenTree Applications\YTD Video Downloader\plugins\video_output\is-GEC7N.tmp
- %ProgramFiles%\GreenTree Applications\YTD Video Downloader\plugins\video_output\is-GKBQB.tmp
- %ProgramFiles%\GreenTree Applications\YTD Video Downloader\plugins\video_output\is-AG0EK.tmp
- %ProgramFiles%\GreenTree Applications\YTD Video Downloader\is-AE18B.tmp
- %ProgramFiles%\GreenTree Applications\YTD Video Downloader\is-L3DE6.tmp
- %ProgramFiles%\GreenTree Applications\YTD Video Downloader\is-2NR5J.tmp
- %TEMP%\is-J75FH.tmp\InstallerImage.png
- %ProgramFiles%\GreenTree Applications\YTD Video Downloader\is-FFRTR.tmp
- %ProgramFiles%\GreenTree Applications\YTD Video Downloader\is-2BS8B.tmp
- %ProgramFiles%\GreenTree Applications\YTD Video Downloader\is-SEL3B.tmp
- %ProgramFiles%\GreenTree Applications\YTD Video Downloader\is-VRCPK.tmp
- %ProgramFiles%\GreenTree Applications\YTD Video Downloader\is-KCKLA.tmp
- %ProgramFiles%\GreenTree Applications\YTD Video Downloader\is-EEQSU.tmp
- %ProgramFiles%\GreenTree Applications\YTD Video Downloader\is-1QSLC.tmp
- %ProgramFiles%\GreenTree Applications\YTD Video Downloader\is-GMQAO.tmp
- %ProgramFiles%\GreenTree Applications\YTD Video Downloader\is-53UTS.tmp
- %ALLUSERSPROFILE%\Start Menu\Programs\YTD Video Downloader\YTD Video Downloader.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\YTD Video Downloader\Visit YTD Video Downloader.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\YTD Video Downloader\Удалить YTD Video Downloader.lnk
- %ProgramFiles%\GreenTree Applications\YTD Video Downloader\plugins\audio_filter\is-3U78D.tmp
- %ProgramFiles%\GreenTree Applications\YTD Video Downloader\plugins\audio_mixer\is-TIDMV.tmp
- %ProgramFiles%\GreenTree Applications\YTD Video Downloader\plugins\audio_filter\is-E7NUU.tmp
- %ProgramFiles%\GreenTree Applications\YTD Video Downloader\plugins\audio_filter\is-PFKB3.tmp
- %ProgramFiles%\GreenTree Applications\YTD Video Downloader\plugins\access\is-HPN0V.tmp
- <DRIVERS>\install.cmd
- <DRIVERS>\install.exe
- <DRIVERS>\svchоst.exe
- %TEMP%\YTD Video Downloader\5.9.4.1\setup.cmd
- %TEMP%\YTD Video Downloader\5.9.4.1\setup.exe
- %TEMP%\$inst\0001.tmp
- %TEMP%\is-GL42J.tmp\setup.tmp
- %TEMP%\is-J75FH.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-J75FH.tmp\isgsg.dll
- %TEMP%\is-J75FH.tmp\innocallback.dll
- %TEMP%\is-J75FH.tmp\ru.png
- %ALLUSERSPROFILE%\Desktop\YTD Video Downloader.lnk
- %ProgramFiles%\GreenTree Applications\YTD Video Downloader\is-DCK7C.tmp
- %TEMP%\is-J75FH.tmp\en.png
- %TEMP%\is-J75FH.tmp\DirImage.png
- %TEMP%\is-J75FH.tmp\GroupImage.png
- %TEMP%\is-J75FH.tmp\b2p.dll
- %TEMP%\is-J75FH.tmp\botva2.dll
- %TEMP%\is-J75FH.tmp\Icon.png
- %TEMP%\is-J75FH.tmp\Logo.png
- %TEMP%\is-J75FH.tmp\Splash.png
- %ProgramFiles%\GreenTree Applications\YTD Video Downloader\is-9BASJ.tmp
- %ProgramFiles%\GreenTree Applications\YTD Video Downloader\is-CD824.tmp
- %ProgramFiles%\GreenTree Applications\YTD Video Downloader\Lang\is-C4CJ3.tmp
- %ProgramFiles%\GreenTree Applications\YTD Video Downloader\Lang\is-OP8I7.tmp
- %TEMP%\$inst\temp_0.tmp
- %TEMP%\is-J75FH.tmp\PortableImage.png
- %ProgramFiles%\GreenTree Applications\YTD Video Downloader\unins000.dat
Sets the 'hidden' attribute to the following files:
- %ProgramFiles%\GreenTree Applications\YTD Video Downloader\UninstallSmallImage.bmp
Deletes the following files:
- %TEMP%\$inst\temp_0.tmp
- %TEMP%\$inst\0001.tmp
- %TEMP%\$inst\2.tmp
Moves the following files:
- from %ProgramFiles%\GreenTree Applications\YTD Video Downloader\is-9BASJ.tmp to %ProgramFiles%\GreenTree Applications\YTD Video Downloader\unins000.exe
- from %ProgramFiles%\GreenTree Applications\YTD Video Downloader\is-1QSLC.tmp to %ProgramFiles%\GreenTree Applications\YTD Video Downloader\ytd.exe
- from %ProgramFiles%\GreenTree Applications\YTD Video Downloader\is-EEQSU.tmp to %ProgramFiles%\GreenTree Applications\YTD Video Downloader\scripts.yds
- from %ProgramFiles%\GreenTree Applications\YTD Video Downloader\is-KCKLA.tmp to %ProgramFiles%\GreenTree Applications\YTD Video Downloader\manual.bat
- from %ProgramFiles%\GreenTree Applications\YTD Video Downloader\is-VRCPK.tmp to %ProgramFiles%\GreenTree Applications\YTD Video Downloader\LICENSE
- from %ProgramFiles%\GreenTree Applications\YTD Video Downloader\is-SEL3B.tmp to %ProgramFiles%\GreenTree Applications\YTD Video Downloader\libvlccore.dll
- from %ProgramFiles%\GreenTree Applications\YTD Video Downloader\is-2BS8B.tmp to %ProgramFiles%\GreenTree Applications\YTD Video Downloader\libvlc.dll
- from %ProgramFiles%\GreenTree Applications\YTD Video Downloader\is-DCK7C.tmp to %ProgramFiles%\GreenTree Applications\YTD Video Downloader\librtmp.dll
- from %ProgramFiles%\GreenTree Applications\YTD Video Downloader\is-FFRTR.tmp to %ProgramFiles%\GreenTree Applications\YTD Video Downloader\FFMPEG.EXE
- from %ProgramFiles%\GreenTree Applications\YTD Video Downloader\is-2NR5J.tmp to %ProgramFiles%\GreenTree Applications\YTD Video Downloader\COPYING.LGPLv3
- from %ProgramFiles%\GreenTree Applications\YTD Video Downloader\is-L3DE6.tmp to %ProgramFiles%\GreenTree Applications\YTD Video Downloader\COPYING.LGPLv2
- from %ProgramFiles%\GreenTree Applications\YTD Video Downloader\is-AE18B.tmp to %ProgramFiles%\GreenTree Applications\YTD Video Downloader\COPYING.Apachev2
- from %ProgramFiles%\GreenTree Applications\YTD Video Downloader\plugins\video_output\is-AG0EK.tmp to %ProgramFiles%\GreenTree Applications\YTD Video Downloader\plugins\video_output\libwingdi_plugin.dll
- from %ProgramFiles%\GreenTree Applications\YTD Video Downloader\plugins\video_output\is-GKBQB.tmp to %ProgramFiles%\GreenTree Applications\YTD Video Downloader\plugins\video_output\libvmem_plugin.dll
- from %ProgramFiles%\GreenTree Applications\YTD Video Downloader\plugins\video_output\is-GEC7N.tmp to %ProgramFiles%\GreenTree Applications\YTD Video Downloader\plugins\video_output\libdrawable_plugin.dll
- from %ProgramFiles%\GreenTree Applications\YTD Video Downloader\plugins\video_output\is-OS6GF.tmp to %ProgramFiles%\GreenTree Applications\YTD Video Downloader\plugins\video_output\libdirect3d_plugin.dll
- from %ProgramFiles%\GreenTree Applications\YTD Video Downloader\plugins\video_filter\is-TQ7N8.tmp to %ProgramFiles%\GreenTree Applications\YTD Video Downloader\plugins\video_filter\libswscale_plugin.dll
- from %ProgramFiles%\GreenTree Applications\YTD Video Downloader\plugins\codec\is-7883S.tmp to %ProgramFiles%\GreenTree Applications\YTD Video Downloader\plugins\codec\libavcodec_plugin.dll
- from %ProgramFiles%\GreenTree Applications\YTD Video Downloader\plugins\audio_output\is-BM428.tmp to %ProgramFiles%\GreenTree Applications\YTD Video Downloader\plugins\audio_output\libdirectsound_plugin.dll
- from %ProgramFiles%\GreenTree Applications\YTD Video Downloader\plugins\audio_mixer\is-CHNRV.tmp to %ProgramFiles%\GreenTree Applications\YTD Video Downloader\plugins\audio_mixer\libinteger_mixer_plugin.dll
- from %ProgramFiles%\GreenTree Applications\YTD Video Downloader\plugins\audio_mixer\is-TIDMV.tmp to %ProgramFiles%\GreenTree Applications\YTD Video Downloader\plugins\audio_mixer\libfloat_mixer_plugin.dll
- from %ProgramFiles%\GreenTree Applications\YTD Video Downloader\plugins\audio_filter\is-3U78D.tmp to %ProgramFiles%\GreenTree Applications\YTD Video Downloader\plugins\audio_filter\libugly_resampler_plugin.dll
- from %ProgramFiles%\GreenTree Applications\YTD Video Downloader\plugins\audio_filter\is-E7NUU.tmp to %ProgramFiles%\GreenTree Applications\YTD Video Downloader\plugins\audio_filter\libtrivial_channel_mixer_plugin.dll
- from %ProgramFiles%\GreenTree Applications\YTD Video Downloader\plugins\audio_filter\is-PFKB3.tmp to %ProgramFiles%\GreenTree Applications\YTD Video Downloader\plugins\audio_filter\libaudio_format_plugin.dll
- from %ProgramFiles%\GreenTree Applications\YTD Video Downloader\plugins\access\is-HPN0V.tmp to %ProgramFiles%\GreenTree Applications\YTD Video Downloader\plugins\access\libfilesystem_plugin.dll
- from %ProgramFiles%\GreenTree Applications\YTD Video Downloader\Lang\is-OP8I7.tmp to %ProgramFiles%\GreenTree Applications\YTD Video Downloader\Lang\res1049.ini
- from %ProgramFiles%\GreenTree Applications\YTD Video Downloader\Lang\is-C4CJ3.tmp to %ProgramFiles%\GreenTree Applications\YTD Video Downloader\Lang\res1033.ini
- from %ProgramFiles%\GreenTree Applications\YTD Video Downloader\is-CD824.tmp to %ProgramFiles%\GreenTree Applications\YTD Video Downloader\UninstallSmallImage.bmp
- from %ProgramFiles%\GreenTree Applications\YTD Video Downloader\is-GMQAO.tmp to %ProgramFiles%\GreenTree Applications\YTD Video Downloader\Website.url
- from %ProgramFiles%\GreenTree Applications\YTD Video Downloader\is-53UTS.tmp to %ProgramFiles%\GreenTree Applications\YTD Video Downloader\Home.ico
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: ''
Creates and executes the following:
- '%TEMP%\YTD Video Downloader\5.9.4.1\setup.exe' /VERYSILENT /I /RU
- '%TEMP%\is-GL42J.tmp\setup.tmp' /SL5="$1013A,8958259,203776,%TEMP%\YTD Video Downloader\5.9.4.1\setup.exe" /VERYSILENT /I /RU
Executes the following:
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\YTD Video Downloader\5.9.4.1\setup.cmd" "
- '<SYSTEM32>\cmd.exe' /c ""<DRIVERS>\install.cmd" "
- '<SYSTEM32>\chcp.com' 1251
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\Remote Manipulator System" /f
