Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Classes\uuupgrade\shell\open\command] '' = '"%CommonProgramFiles%\uusee\UUUpgrade.exe"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'XuanKusoso' = '%PROGRAM_FILES%\XuanKusoso\Xkssynoki.exe autostart'
- [<HKLM>\SOFTWARE\Classes\UUSEE\shell\open\command] '' = '"%PROGRAM_FILES%\uusee\UUSeeClient.exe" -url "%1"'
- [<HKLM>\SOFTWARE\Classes\UUTRAN\shell\open\command] '' = '"%PROGRAM_FILES%\uusee\UUSeeClient.exe" -url "%1"'
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\uuseeupdatetask.job
Вредоносные функции:
Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] 'C:\pwifl_30287.exe' = 'C:\pwifl_30287.exe:*:Enabled:百度杀毒在线安装程序'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] 'C:\pwifl_30287.exe' = 'C:\pwifl_30287.exe:*:Enabled:百度杀毒在线安装程序'
Создает и запускает на исполнение:
- '%PROGRAM_FILES%\YYMusic3\2014042216\YYSpeed2.exe'
- '%PROGRAM_FILES%\YYMusic3\2014042216\YYMusic2.exe' -tuopan
- '%PROGRAM_FILES%\XuanKusoso\xuankusoso.exe' installstart
- '%TEMP%\nsv3.tmp\ns7.tmp' schtasks /create /tn uuseeupdatetask /tr "\"%CommonProgramFiles%\uusee\UUUpgrade.exe\" -i UUPlayer_2011" /sc onlogon /RU SYSTEM
- '%PROGRAM_FILES%\XuanKusoso\XuanKuSearch.dat' -startup
- '%TEMP%\is-7147G.tmp\setup.tmp' /SL5="$20108,1771711,52736,%TEMP%\setup.exe" /VERYSILENT /SP-
- 'C:\UUSEE_lmqn_Setup_1010.exe'
- 'C:\xkss_50091167642.exe'
- 'C:\setup_3322.exe'
- '%TEMP%\setup.exe' /VERYSILENT /SP-
- 'C:\pwifl_30287.exe'
Запускает на исполнение:
- '<SYSTEM32>\schtasks.exe' /create /tn uuseeupdatetask /tr "\"%CommonProgramFiles%\uusee\UUUpgrade.exe\" -i UUPlayer_2011" /sc onlogon /RU SYSTEM
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\uusee\UUUpgrade.ini
- %CommonProgramFiles%\uusee\Localserver.dll
- %PROGRAM_FILES%\zhibo.ico
- %CommonProgramFiles%\uusee\trafficlight.dll
- %CommonProgramFiles%\uusee\UUSeeMediaCenter.exe
- %CommonProgramFiles%\uusee\MediaCenter.ini
- %PROGRAM_FILES%\uuseeweb.ico
- %CommonProgramFiles%\uusee\UUSeeLUS.exe
- %CommonProgramFiles%\uusee\UUPlayer_2011_path.ini
- %PROGRAM_FILES%\uusee\UUDesktopMN.exe
- %CommonProgramFiles%\uusee\uninst.exe
- %CommonProgramFiles%\uusee\LocalInfo.ini
- %PROGRAM_FILES%\uusee\UUPlayer_2014_update.ini
- %HOMEPATH%\Start Menu\Programs\YYMusic3\№Щ·ЅЦчТі.lnk
- %HOMEPATH%\Start Menu\Programs\YYMusic3\ЕдЦГ№¤ѕЯ\Р¶ФШYYMusic3.lnk
- %PROGRAM_FILES%\YYMusic3\2014042216\Data\user2.ini
- %ALLUSERSPROFILE%\Desktop\ј«ЛЩЛСЛС.lnk
- %PROGRAM_FILES%\XuanKusoso\unins000.dat
- %HOMEPATH%\Start Menu\Programs\YYMusic3\YYMusic3.lnk
- %ALLUSERSPROFILE%\Application Data\Baidu\Common\Global.db
- %CommonProgramFiles%\uusee\in_net.dll
- %CommonProgramFiles%\uusee\UUNet.dll
- %CommonProgramFiles%\uusee\UUUpgrade.exe
- %TEMP%\nsv3.tmp\AccessControl.dll
- %CommonProgramFiles%\uusee\StartService.ocx
- %CommonProgramFiles%\uusee\npstartservicep.dll
- %PROGRAM_FILES%\uusee\UUDesktopPP.exe
- %ALLUSERSPROFILE%\Desktop\УЖКУЦ±ІҐ.lnk
- %PROGRAM_FILES%\Mozilla Firefox\plugins\npuuseep.dll
- %PROGRAM_FILES%\Mozilla Firefox\plugins\npstartservicep.dll
- %HOMEPATH%\Desktop\极速搜搜.lnk
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\УЖКУЦ±ІҐ.lnk
- %ALLUSERSPROFILE%\Desktop\УЖКУНш.lnk
- %PROGRAM_FILES%\XuanKusoso\DownLoad.ini
- %TEMP%\nsv3.tmp\ns9.tmp
- %TEMP%\nsv3.tmp\nsA.tmp
- %TEMP%\sckj.exe
- %TEMP%\nsv3.tmp\Math.dll
- %TEMP%\nsv3.tmp\nsExec.dll
- %TEMP%\nsv3.tmp\ns7.tmp
- %PROGRAM_FILES%\uusee\UUDesktop\skin\state.html
- %PROGRAM_FILES%\uusee\UUDesktop\skin\wk_state.jpg
- %PROGRAM_FILES%\uusee\UUDesktop\skin\wk_state.png
- %PROGRAM_FILES%\uusee\UUSeeClient.exe
- %PROGRAM_FILES%\uusee\skin.zip
- %PROGRAM_FILES%\uusee\uninstuusee.exe
- %PROGRAM_FILES%\uusee\UUDesktop\skin\wk_state_logo.png
- %ALLUSERSPROFILE%\Start Menu\Programs\УЖКУЦ±ІҐ\·ГОКUUSee НшХѕ.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\УЖКУЦ±ІҐ\Р¶ФШУЖКУЦ±ІҐ.lnk
- %ALLUSERSPROFILE%\Start Menu\УЖКУЦ±ІҐ.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\УЖКУЦ±ІҐ\Жф¶ЇУЖКУЦ±ІҐ.lnk
- %PROGRAM_FILES%\uusee\UUSee.url
- %ALLUSERSPROFILE%\Start Menu\Programs\УЖКУЦ±ІҐ\УЖКУЦ±ІҐ.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\ј«ЛЩЛСЛС\Р¶ФШ.lnk
- %TEMP%\nsd6.tmp\BDLogicUtils.dll
- %TEMP%\nsd6.tmp\BDMNetGetInfo.dll
- <SYSTEM32>\nsis_loader.dll
- %TEMP%\nsd6.tmp\dl.dll
- %TEMP%\is-7147G.tmp\setup.tmp
- %TEMP%\nsd6.tmp\hu.dll
- %TEMP%\nsv3.tmp\UUSeeLog.dll
- %PROGRAM_FILES%\XuanKusoso\is-5KGRU.tmp
- %PROGRAM_FILES%\XuanKusoso\is-HGRU2.tmp
- %PROGRAM_FILES%\XuanKusoso\is-5A5R0.tmp
- %TEMP%\is-6PB7O.tmp\_isetup\_shfoldr.dll
- %TEMP%\nsd6.tmp\tmp7wtmdh.dll
- %TEMP%\is-6PB7O.tmp\InstallerDLL.dll
- C:\xkss_50091167642.exe
- %TEMP%\setup.exe
- %TEMP%\nsf2.tmp
- C:\setup_3322.exe
- C:\UUSEE_lmqn_Setup_1010.exe
- C:\pwifl_30287.exe
- %TEMP%\nsv3.tmp\System.dll
- %TEMP%\nsd6.tmp\BDMSkin.dll
- %TEMP%\nsv3.tmp\FindProcDLL.dll
- %TEMP%\nsd6.tmp\BDMDownload.dll
- %TEMP%\nsx5.tmp
- %TEMP%\nsd6.tmp\System.dll
- %TEMP%\nsd6.tmp\res\onlineWnd.zip
- %PROGRAM_FILES%\XuanKusoso\is-ASS6S.tmp
- %PROGRAM_FILES%\YYMusic3\2014042216\Data\client.ini
- %PROGRAM_FILES%\YYMusic3\2014042216\Data\dh.ini
- %PROGRAM_FILES%\YYMusic3\2014042216\Data\setup.ini
- %PROGRAM_FILES%\XuanKusoso\is-FKCO2.tmp
- %PROGRAM_FILES%\YYMusic3\2014042216\YYMusic2.exe
- %PROGRAM_FILES%\XuanKusoso\is-0GO3E.tmp
- %PROGRAM_FILES%\YYMusic3\2014042216\Data\version.ini
- %PROGRAM_FILES%\YYMusic3\2014042216\avformat-54.dll
- %PROGRAM_FILES%\YYMusic3\2014042216\avutil-52.dll
- %ALLUSERSPROFILE%\Start Menu\Programs\ј«ЛЩЛСЛС\ј«ЛЩЛСЛС.lnk
- %PROGRAM_FILES%\YYMusic3\2014042216\audio.dll
- %PROGRAM_FILES%\YYMusic3\2014042216\avcodec-54.dll
- %PROGRAM_FILES%\YYMusic3\2014042216\avcore.dll
- %PROGRAM_FILES%\XuanKusoso\is-82CAG.tmp
- %PROGRAM_FILES%\XuanKusoso\is-CM65S.tmp
- %PROGRAM_FILES%\YYMusic3\2014042216\favorfm.xml
- %PROGRAM_FILES%\YYMusic3\2014042216\YYSpeed2.exe
- %PROGRAM_FILES%\YYMusic3\2014042216\channels.xml
- %PROGRAM_FILES%\YYMusic3\2014042216\DuiLib.dll
- %PROGRAM_FILES%\YYMusic3\2014042216\libav.dll
- %PROGRAM_FILES%\YYMusic3\2014042216\swresample-0.dll
- %PROGRAM_FILES%\YYMusic3\2014042216\SysConfig.ini
- %PROGRAM_FILES%\YYMusic3\2014042216\Unins.exe
- %PROGRAM_FILES%\XuanKusoso\is-83TT1.tmp
- %PROGRAM_FILES%\YYMusic3\2014042216\pthreadGC2.dll
- %PROGRAM_FILES%\YYMusic3\2014042216\source.dll
Удаляет следующие файлы:
- %TEMP%\nsv3.tmp\Math.dll
- %TEMP%\nsv3.tmp\FindProcDLL.dll
- %TEMP%\nsv3.tmp\AccessControl.dll
- %TEMP%\nsv3.tmp\UUSeeLog.dll
- %TEMP%\nsv3.tmp\System.dll
- %TEMP%\nsv3.tmp\nsExec.dll
- %TEMP%\is-7147G.tmp\setup.tmp
- %PROGRAM_FILES%\uusee\UUPlayer_2014_update.ini
- <SYSTEM32>\nsis_loader.dll
- %TEMP%\nsv3.tmp\nsA.tmp
- %TEMP%\nsv3.tmp\ns9.tmp
- %TEMP%\nsv3.tmp\ns7.tmp
Перемещает следующие файлы:
- %PROGRAM_FILES%\XuanKusoso\is-83TT1.tmp в %PROGRAM_FILES%\XuanKusoso\Malware.dll
- %PROGRAM_FILES%\XuanKusoso\is-CM65S.tmp в %PROGRAM_FILES%\XuanKusoso\InstallerDLL.dll
- %PROGRAM_FILES%\XuanKusoso\is-FKCO2.tmp в %PROGRAM_FILES%\XuanKusoso\UpdateFile.exe
- %PROGRAM_FILES%\XuanKusoso\xuankusoso.exe в %PROGRAM_FILES%\XuanKusoso\Xkssynoki.exe
- %PROGRAM_FILES%\XuanKusoso\is-0GO3E.tmp в %PROGRAM_FILES%\XuanKusoso\WinService.exe
- %PROGRAM_FILES%\XuanKusoso\is-HGRU2.tmp в %PROGRAM_FILES%\XuanKusoso\xuankusoso.exe
- %PROGRAM_FILES%\XuanKusoso\is-5KGRU.tmp в %PROGRAM_FILES%\XuanKusoso\unins000.exe
- %PROGRAM_FILES%\XuanKusoso\is-5A5R0.tmp в %PROGRAM_FILES%\XuanKusoso\Everything.ini
- %PROGRAM_FILES%\XuanKusoso\is-82CAG.tmp в %PROGRAM_FILES%\XuanKusoso\Everything.dll
- %PROGRAM_FILES%\XuanKusoso\is-ASS6S.tmp в %PROGRAM_FILES%\XuanKusoso\XuanKuSearch.dat
Сетевая активность:
Подключается к:
- '12#.#25.114.144':80
UDP:
- DNS ASK up####.yinyue.fm
- DNS ASK sh###.baidu.com
- DNS ASK wh###.#conline.com.cn
- DNS ASK in#.###ol.sina.com.cn
- DNS ASK lo####ver.uusee.com
- DNS ASK p.#.#aidu.com
- DNS ASK ji####.shuafenba.com
- DNS ASK lo#.#usee.com
- 'lo####ver.uusee.com':17200
- '24.##8.144.124':17200
Другое:
Ищет следующие окна:
- ClassName: '#32770' WindowName: '(null)'
- ClassName: 'Indicator' WindowName: '(null)'
- ClassName: 'OnLineWnd' WindowName: '(null)'
- ClassName: 'EDIT' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
