Техническая информация
Вредоносные функции:
Создает и запускает на исполнение:
- '%PROGRAM_FILES%\duowan\gamebox\3.0.190666.154\yygamebox.exe'
Изменения в файловой системе:
Создает следующие файлы:
- %PROGRAM_FILES%\duowan\gamebox\3.0.190666.154\bugreport.exe
- %PROGRAM_FILES%\duowan\gamebox\3.0.190666.154\zlib1.dll
- %PROGRAM_FILES%\duowan\gamebox\3.0.190666.154\gamebox.exe
- %PROGRAM_FILES%\duowan\gamebox\3.0.190666.154\gameplayer.exe
- %PROGRAM_FILES%\duowan\gamebox\GameboxRun.exe
- %PROGRAM_FILES%\duowan\gamebox\3.0.190666.154\updatemgr.dll
- %PROGRAM_FILES%\duowan\gamebox\3.0.190666.154\requiredmgr.dll
- %PROGRAM_FILES%\duowan\gamebox\3.0.190666.154\miniupnpc.dll
- %PROGRAM_FILES%\duowan\gamebox\3.0.190666.154\taskmodulehttp.dll
- %PROGRAM_FILES%\duowan\gamebox\3.0.190666.154\taskmoduleunzip.dll
- %PROGRAM_FILES%\duowan\gamebox\3.0.190666.154\taskmodulekkdl.dll
- %APPDATA%\duowan\gamebox\config\user.act
- %APPDATA%\duowan\gamebox\config\require.xml
- <SYSTEM32>\d3d9caps.dat
- <SYSTEM32>\d3d9caps.tmp
- %APPDATA%\duowan\gamebox\update\binupdate.xml
- %APPDATA%\duowan\gamebox\config\kkdowndelete.xml
- %APPDATA%\duowan\gamebox\config\config.ini
- %PROGRAM_FILES%\duowan\gamebox\3.0.190666.154\yygamebox.exe
- C:\YYGameBox\logo.ico
- %APPDATA%\duowan\gamebox\config\hiido.ini
- C:\YYGameBox\desktop.ini
- %PROGRAM_FILES%\duowan\gamebox\3.0.190666.154\libexpatw.dll
- %PROGRAM_FILES%\duowan\gamebox\3.0.190666.154\icon\22385.png
- %PROGRAM_FILES%\duowan\gamebox\3.0.190666.154\icon\17614.png
- %PROGRAM_FILES%\duowan\gamebox\3.0.190666.154\icon\65494.png
- %PROGRAM_FILES%\duowan\gamebox\3.0.190666.154\icon\icon_flash_default.png
- %PROGRAM_FILES%\duowan\gamebox\3.0.190666.154\icon\72059.png
- %PROGRAM_FILES%\duowan\gamebox\3.0.190666.154\html\errpage\images\bg.jpg
- %PROGRAM_FILES%\duowan\gamebox\3.0.190666.154\html\errpage\css\style.css
- %PROGRAM_FILES%\duowan\gamebox\3.0.190666.154\html\resource\keyboard.css
- %PROGRAM_FILES%\duowan\gamebox\3.0.190666.154\html\errpage\images\btn_store.gif
- %PROGRAM_FILES%\duowan\gamebox\3.0.190666.154\icon\22171.jpg
- %PROGRAM_FILES%\duowan\gamebox\3.0.190666.154\html\errpage\index.html
- %PROGRAM_FILES%\duowan\gamebox\3.0.190666.154\hiidomgr.dll
- %PROGRAM_FILES%\duowan\gamebox\3.0.190666.154\gameresmgr.dll
- %PROGRAM_FILES%\duowan\gamebox\3.0.190666.154\kkdownload.dll
- %PROGRAM_FILES%\duowan\gamebox\3.0.190666.154\libcurl.dll
- %PROGRAM_FILES%\duowan\gamebox\3.0.190666.154\kktoolset.dll
- %PROGRAM_FILES%\duowan\gamebox\3.0.190666.154\duiengine.dll
- %PROGRAM_FILES%\duowan\gamebox\3.0.190666.154\version.xml
- %PROGRAM_FILES%\duowan\gamebox\3.0.190666.154\html\resource\icon_keys.png
- %PROGRAM_FILES%\duowan\gamebox\3.0.190666.154\7zra.dll
- %PROGRAM_FILES%\duowan\gamebox\3.0.190666.154\crashreport.dll
- %PROGRAM_FILES%\duowan\gamebox\3.0.190666.154\btdownloader.dll
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\YYGameBox\desktop.ini
- C:\YYGameBox\logo.ico
Удаляет следующие файлы:
- <SYSTEM32>\d3d9caps.dat
Перемещает следующие файлы:
- <SYSTEM32>\d3d9caps.tmp в <SYSTEM32>\d3d9caps.dat
Сетевая активность:
Подключается к:
- 'yy##.duowan.com':80
- 'gb.##.hiido.cn':80
- 'kk.###t.kuaikuai.cn':8088
- 'localhost':1040
- 'dl###.##mebox.duowan.com':6636
TCP:
Запросы HTTP GET:
- gb.##.hiido.cn/c.gif?&a#######################################################################################################################################################
- yy##.duowan.com/gamebox/binupdate.xml?16###
UDP:
- DNS ASK cl####.#amebox.duowan.com
- DNS ASK yl##.hiido.com
- DNS ASK gb.##.hiido.cn
- DNS ASK dl###.##mebox.duowan.com
- DNS ASK kk.###t.kuaikuai.cn
- DNS ASK yy##.duowan.com
Другое:
Ищет следующие окна:
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'MPWClass' WindowName: ''
- ClassName: 'SysListView32' WindowName: ''
- ClassName: '' WindowName: '????'
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
