Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Ticno iO' = '"%PROGRAM_FILES%\Ticno\Ticno iO\iO.exe"'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\TicnoShExtMng] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- '%PROGRAM_FILES%\Ticno\Ticno iO\iO.exe'
- '%PROGRAM_FILES%\Ticno\ShExtMng\ShExtMng.exe'
- '%PROGRAM_FILES%\Ticno\ShExtMng\ShExtMngService.exe'
- '<LS_APPDATA>\Ticno\iO\Temp\0.1.51.0.exe' /S _?="<LS_APPDATA>\Ticno\iO\Temp"
- '%PROGRAM_FILES%\Ticno\ShExtMng\ShExtMngService.exe' -i
Изменения в файловой системе:
Создает следующие файлы:
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\planner_plus.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\on_off.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\prev1.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\prev.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\next.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\main_window_bg.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\on-off.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\next1.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\scroll.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\selector_open_agile_right_top.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\selector_open_agile_right_bottom.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\selector_open_center_center.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\selector_open_center_bottom.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\selector_arrow.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\scrollfone.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\selector_open_agile_left_top.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\selector_open_agile_left_bottom.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\ground_planner_bottom.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\ground_center.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\ground_planner_top.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\ground_planner_center.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\closemain.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\close_button.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\ground_bottom.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\delete.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\ground_top.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\key_left.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\key_center.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\list-item.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\key_right.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\input_left.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\input_center.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\key-button.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\input_right.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\selector_open_center_left.png
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\rss[1].png
- %ALLUSERSPROFILE%\Application Data\boost_interprocess\20130417180111.468750\ShExtMngPort
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\pets[1].png
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\icon_programms_64x64[1].png
- %ALLUSERSPROFILE%\Application Data\boost_interprocess\20130417180111.468750\ShExtMngQuit
- %PROGRAM_FILES%\Ticno\ShExtMng\unping.txt
- %APPDATA%\Ticno\iO\feed-en.xml
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\heart[1].png
- %APPDATA%\Ticno\iO\Icons\9.png
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bs[1].png
- %APPDATA%\Ticno\iO\Icons\10.png
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\fw[1].png
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\star[1].png
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\icon_programms_64x64_3[1].png
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\money[1].png
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\chrome[1].png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\slider_point.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\slider_left.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\tab.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\slider_right.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\selector_open_center_top.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\selector_open_center_right.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\slider_full.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\slider_center.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\tab_active.png
- %PROGRAM_FILES%\Ticno\ShExtMng\Uninstall.exe
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\window-sidebar.png
- %TEMP%\nsg6.tmp\NSISdl.dll
- %TEMP%\nsg6.tmp\System.dll
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\tab_plus.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\tab_active_tplus.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\window-right.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\window-center.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\close1.png
- %PROGRAM_FILES%\Ticno\Ticno iO\skin\Window\Bg\top_left.png
- %PROGRAM_FILES%\Ticno\Ticno iO\skin\Window\Bg\top.png
- %PROGRAM_FILES%\Ticno\Ticno iO\skin\Window\Hover\hover_bottomleft.png
- %PROGRAM_FILES%\Ticno\Ticno iO\skin\Window\Bg\top_right.png
- %PROGRAM_FILES%\Ticno\Ticno iO\skin\Window\Bg\center.png
- %PROGRAM_FILES%\Ticno\Ticno iO\skin\Window\Bg\bottom_right.png
- %PROGRAM_FILES%\Ticno\Ticno iO\skin\Window\Bg\right.png
- %PROGRAM_FILES%\Ticno\Ticno iO\skin\Window\Bg\left.png
- %PROGRAM_FILES%\Ticno\Ticno iO\skin\Window\Hover\hover_bottomright.png
- %PROGRAM_FILES%\Ticno\Ticno iO\skin\Window\Settings\checkbox.png
- %PROGRAM_FILES%\Ticno\Ticno iO\skin\Window\Separator\separator_y.png
- %PROGRAM_FILES%\Ticno\Ticno iO\skin\Window\Settings\preloader.png
- %PROGRAM_FILES%\Ticno\Ticno iO\skin\Window\Settings\content_button.png
- %PROGRAM_FILES%\Ticno\Ticno iO\skin\Window\Hover\hover_topleft.png
- %PROGRAM_FILES%\Ticno\Ticno iO\skin\Window\Hover\hover_inside.png
- %PROGRAM_FILES%\Ticno\Ticno iO\skin\Window\Separator\separator_x.png
- %PROGRAM_FILES%\Ticno\Ticno iO\skin\Window\Hover\hover_topright.png
- %PROGRAM_FILES%\Ticno\Ticno iO\feed-ru.xml
- %PROGRAM_FILES%\Ticno\Ticno iO\feed-en.xml
- %PROGRAM_FILES%\Ticno\Ticno iO\lang\lang.lng
- %PROGRAM_FILES%\Ticno\Ticno iO\iO.exe
- %TEMP%\nso3.tmp\UAC.dll
- %TEMP%\nsi2.tmp
- %PROGRAM_FILES%\Ticno\Ticno iO\ShExtMng.dll
- %TEMP%\iO_un\KillProcDLL.dll
- %PROGRAM_FILES%\Ticno\Ticno iO\skin\Button\bottom.png
- %PROGRAM_FILES%\Ticno\Ticno iO\skin\Window\settings_icon.png
- %PROGRAM_FILES%\Ticno\Ticno iO\skin\Window\empty_icon.png
- %PROGRAM_FILES%\Ticno\Ticno iO\skin\Window\Bg\bottom_left.png
- %PROGRAM_FILES%\Ticno\Ticno iO\skin\Window\Bg\bottom.png
- %PROGRAM_FILES%\Ticno\Ticno iO\skin\Button\left.png
- %PROGRAM_FILES%\Ticno\Ticno iO\skin\Button\center.png
- %PROGRAM_FILES%\Ticno\Ticno iO\skin\Button\top.png
- %PROGRAM_FILES%\Ticno\Ticno iO\skin\Button\right.png
- %PROGRAM_FILES%\Ticno\Ticno iO\skin\Window\Title\title_center.png
- %PROGRAM_FILES%\Ticno\ShExtMng\updater.dll
- %PROGRAM_FILES%\Ticno\ShExtMng\lang.ru.dll
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\ScreenShooter.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\DESIGN.bmp
- %PROGRAM_FILES%\Ticno\ShExtMng\ShExtMng.dll
- %TEMP%\nsg6.tmp\UAC.dll
- %PROGRAM_FILES%\Ticno\ShExtMng\ShExtMngService.exe
- %PROGRAM_FILES%\Ticno\ShExtMng\ShExtMng.exe
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\add_plus.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\cliper_arrow_left.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\button_presshover.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\close.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\cliper_arrow_right.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\button_hover.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\button.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\button_press.png
- %PROGRAM_FILES%\Ticno\ShExtMng\skin\button_normal.png
- %APPDATA%\Ticno\iO\Icons\3.png
- %APPDATA%\Ticno\iO\Icons\2.png
- %APPDATA%\Ticno\iO\Icons\5.png
- %APPDATA%\Ticno\iO\Icons\4.png
- %PROGRAM_FILES%\Ticno\Ticno iO\skin\Window\Title\title_right.png
- %PROGRAM_FILES%\Ticno\Ticno iO\skin\Window\Title\title_left.png
- %APPDATA%\Ticno\iO\Icons\1.png
- <LS_APPDATA>\Ticno\iO\Temp\0.1.51.0.exe
- %APPDATA%\Ticno\iO\Icons\6.png
- %ALLUSERSPROFILE%\Desktop\TicnoIo.lnk
- %TEMP%\nso3.tmp\NSISdl.dll
- %TEMP%\nsb5.tmp
- %ALLUSERSPROFILE%\Start Menu\Programs\Ticno\TicnoIo.lnk
- %APPDATA%\Ticno\iO\Icons\8.png
- %APPDATA%\Ticno\iO\Icons\7.png
- %PROGRAM_FILES%\Ticno\Ticno iO\Uninstall.exe
- %WINDIR%\Fonts\Ubuntu-R.ttf
Удаляет следующие файлы:
- <LS_APPDATA>\Ticno\iO\Temp\0.1.51.0.exe
- %TEMP%\nso3.tmp\NSISdl.dll
- %TEMP%\nso3.tmp\UAC.dll
- %TEMP%\nsg6.tmp\UAC.dll
- %TEMP%\iO_un\KillProcDLL.dll
- %TEMP%\nsg6.tmp\NSISdl.dll
- %TEMP%\nsg6.tmp\System.dll
Сетевая активность:
Подключается к:
- 'localhost':2000
- 'ti##o.com':80
- 'ad###.#tatrec.ticno.com':80
TCP:
Запросы HTTP GET:
- ti##o.com/icons/chrome.png
- ti##o.com/icons/star.png
- ti##o.com/icons/icon_programms_64x64_3.png
- ti##o.com/icons/fw.png
- ti##o.com/icons/bs.png
- ti##o.com/icons/money.png
- ti##o.com/?pi#################################################
- ti##o.com/icons/rss.png
- ad###.#tatrec.ticno.com/?pi###########################
- ti##o.com/icons/heart.png
- ti##o.com/icons/pets.png
- ti##o.com/icons/icon_programms_64x64.png
UDP:
- DNS ASK st####c.ticno.com
- DNS ASK ti##o.com
- DNS ASK ad###.#tatrec.ticno.com
Другое:
Ищет следующие окна:
- ClassName: 'MainMultibarWindow' WindowName: 'Multibar'
- ClassName: 'Indicator' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'Ticno_iOMainWindow' WindowName: ''
