Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'DAEMON Tools Lite' = '"%PROGRAM_FILES%\DAEMON Tools Lite\DTLite.exe" -autorun'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\redbook] 'Start' = '00000001'
- [<HKLM>\SYSTEM\ControlSet001\Services\Imapi] 'Start' = '00000001'
- [<HKLM>\SYSTEM\ControlSet001\Services\dtsoftbus01] 'Start' = '00000001'
- [<HKLM>\SYSTEM\ControlSet001\Services\Cdrom] 'Start' = '00000001'
Вредоносные функции:
Создает и запускает на исполнение:
- '%TEMP%\nsm3.tmp\DTSetupHelper.exe'
- '%TEMP%\DTLite4452-0287.exe' /S /nogadget /notoolbar /freeserial /D="C:\\Program Files
Запускает на исполнение:
- '<SYSTEM32>\rundll32.exe' newdev.dll,ClientSideInstall \\.\pipe\PNP_Device_Install_Pipe_0.{D700E688-3700-419F-855B-1621CB68D6BE}
- '<SYSTEM32>\rundll32.exe' shell32.dll,Activate_RunDLL
- '<SYSTEM32>\runonce.exe' -r
- '<SYSTEM32>\wbem\wmiadap.exe' /R /T
Внедряет код в
следующие системные процессы:
- %WINDIR%\Explorer.EXE
Изменения в файловой системе:
Создает следующие файлы:
- %PROGRAM_FILES%\DAEMON Tools Lite\Lang\ELL.dll
- %PROGRAM_FILES%\DAEMON Tools Lite\Lang\DEU.dll
- %PROGRAM_FILES%\DAEMON Tools Lite\Lang\ESN.dll
- %PROGRAM_FILES%\DAEMON Tools Lite\Lang\ENU.dll
- %PROGRAM_FILES%\DAEMON Tools Lite\Lang\CHT.dll
- %PROGRAM_FILES%\DAEMON Tools Lite\Lang\CHS.dll
- %PROGRAM_FILES%\DAEMON Tools Lite\Lang\DAN.dll
- %PROGRAM_FILES%\DAEMON Tools Lite\Lang\CSY.dll
- %PROGRAM_FILES%\DAEMON Tools Lite\Lang\HUN.dll
- %PROGRAM_FILES%\DAEMON Tools Lite\Lang\HRV.dll
- %PROGRAM_FILES%\DAEMON Tools Lite\Lang\IND.dll
- %PROGRAM_FILES%\DAEMON Tools Lite\Lang\HYE.dll
- %PROGRAM_FILES%\DAEMON Tools Lite\Lang\FRA.dll
- %PROGRAM_FILES%\DAEMON Tools Lite\Lang\FIN.dll
- %PROGRAM_FILES%\DAEMON Tools Lite\Lang\HEB.dll
- %PROGRAM_FILES%\DAEMON Tools Lite\Lang\GLC.dll
- %PROGRAM_FILES%\DAEMON Tools Lite\Lang\CAT.dll
- %PROGRAM_FILES%\DAEMON Tools Lite\DTShellHlp.exe
- %PROGRAM_FILES%\DAEMON Tools Lite\DTHelper.exe
- %PROGRAM_FILES%\DAEMON Tools Lite\SPTDinst-x64.exe
- %PROGRAM_FILES%\DAEMON Tools Lite\SPTDinst-x86.exe
- %PROGRAM_FILES%\DAEMON Tools Lite\DTCommonRes.dll
- %PROGRAM_FILES%\DAEMON Tools Lite\uninst.exe
- %PROGRAM_FILES%\DAEMON Tools Lite\imgengine.dll
- %PROGRAM_FILES%\DAEMON Tools Lite\DTLite.exe
- %PROGRAM_FILES%\DAEMON Tools Lite\Lang\ARA.dll
- %PROGRAM_FILES%\DAEMON Tools Lite\Lang\AFK.dll
- %PROGRAM_FILES%\DAEMON Tools Lite\Lang\BIH.dll
- %PROGRAM_FILES%\DAEMON Tools Lite\Lang\BGR.dll
- %PROGRAM_FILES%\DAEMON Tools Lite\DTGadget64.dll
- %PROGRAM_FILES%\DAEMON Tools Lite\DTGadget32.dll
- %PROGRAM_FILES%\DAEMON Tools Lite\InstallGadget.exe
- %PROGRAM_FILES%\DAEMON Tools Lite\DT.gadget
- %PROGRAM_FILES%\DAEMON Tools Lite\Lang\ITA.dll
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004
- %TEMP%\Cab4.tmp
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
- %PROGRAM_FILES%\DAEMON Tools Lite\dtsoftbus01.inf
- %PROGRAM_FILES%\DAEMON Tools Lite\dtsoftbus01.sys
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004
- %PROGRAM_FILES%\DAEMON Tools Lite\dtsoftbus01.cat
- %TEMP%\CabD.tmp
- <DRIVERS>\SETC.tmp
- %WINDIR%\inf\INFCACHE.0
- %TEMP%\CabF.tmp
- %TEMP%\CabA.tmp
- %TEMP%\Cab8.tmp
- %WINDIR%\inf\oem3.PNF
- %WINDIR%\inf\oem3.inf
- %PROGRAM_FILES%\DAEMON Tools Lite\Lang\UKR.dll
- %PROGRAM_FILES%\DAEMON Tools Lite\Lang\NLB.dll
- %PROGRAM_FILES%\DAEMON Tools Lite\Lang\LVI.dll
- %PROGRAM_FILES%\DAEMON Tools Lite\Lang\PLK.dll
- %PROGRAM_FILES%\DAEMON Tools Lite\Lang\NOR.dll
- %PROGRAM_FILES%\DAEMON Tools Lite\Lang\KAT.dll
- %PROGRAM_FILES%\DAEMON Tools Lite\Lang\JPN.dll
- %PROGRAM_FILES%\DAEMON Tools Lite\Lang\LTH.dll
- %PROGRAM_FILES%\DAEMON Tools Lite\Lang\KOR.dll
- %PROGRAM_FILES%\DAEMON Tools Lite\Lang\SRL.dll
- %PROGRAM_FILES%\DAEMON Tools Lite\Lang\SLV.dll
- %PROGRAM_FILES%\DAEMON Tools Lite\Lang\TRK.dll
- %PROGRAM_FILES%\DAEMON Tools Lite\Lang\SVE.dll
- %PROGRAM_FILES%\DAEMON Tools Lite\Lang\ROM.dll
- %PROGRAM_FILES%\DAEMON Tools Lite\Lang\PTB.dll
- %PROGRAM_FILES%\DAEMON Tools Lite\Lang\SKY.dll
- %PROGRAM_FILES%\DAEMON Tools Lite\Lang\RUS.dll
- %TEMP%\nsm3.tmp\moutspace-bg.bmp
- %TEMP%\nsm3.tmp\GoogleToolbar.ini
- %TEMP%\nsm3.tmp\dtsetup.ini
- %TEMP%\nsm3.tmp\MountSpace.ini
- %TEMP%\nsm3.tmp\share-icon.bmp
- %TEMP%\nsm3.tmp\favicon.bmp
- %TEMP%\nsm3.tmp\GoogleChrome.ini
- %TEMP%\nsm3.tmp\translate-icon.bmp
- %TEMP%\nsm3.tmp\Lang\CHS.dll
- %TEMP%\nsm3.tmp\Lang\CAT.dll
- %TEMP%\nsm3.tmp\Lang\CSY.dll
- %TEMP%\nsm3.tmp\Lang\CHT.dll
- %TEMP%\nsm3.tmp\Lang\ARA.dll
- %TEMP%\nsm3.tmp\Lang\AFK.dll
- %TEMP%\nsm3.tmp\Lang\BIH.dll
- %TEMP%\nsm3.tmp\Lang\BGR.dll
- %TEMP%\nsm3.tmp\GoogleToolbar.bmp
- %TEMP%\nsm3.tmp\System.dll
- %TEMP%\nsb2.tmp
- %TEMP%\nsm3.tmp\SetupHelper.exe
- %TEMP%\nsm3.tmp\DTSetupHelper.exe
- %TEMP%\$inst\temp_0.tmp
- %TEMP%\$inst\2.tmp
- %TEMP%\$inst\0001.tmp
- %TEMP%\DTLite4452-0287.exe
- %TEMP%\nsm3.tmp\JRYI-Toolbar.exe
- %TEMP%\nsm3.tmp\JRYI-Chrome.exe
- %TEMP%\nsm3.tmp\GoogleChromeIcon.bmp
- %TEMP%\nsm3.tmp\DAEMON_Chrome.bmp
- %TEMP%\nsm3.tmp\SetupWaitPage.bmp
- %TEMP%\nsm3.tmp\WaitPage.ini
- %TEMP%\nsm3.tmp\gtapi.dll
- %TEMP%\nsm3.tmp\gcapi_dll.dll
- %TEMP%\nsm3.tmp\Lang\DAN.dll
- %TEMP%\nsm3.tmp\Lang\ROM.dll
- %TEMP%\nsm3.tmp\Lang\PTB.dll
- %TEMP%\nsm3.tmp\Lang\SKY.dll
- %TEMP%\nsm3.tmp\Lang\RUS.dll
- %TEMP%\nsm3.tmp\Lang\NLB.dll
- %TEMP%\nsm3.tmp\Lang\LVI.dll
- %TEMP%\nsm3.tmp\Lang\PLK.dll
- %TEMP%\nsm3.tmp\Lang\NOR.dll
- %TEMP%\nsm3.tmp\setuphlp.dll
- %TEMP%\nsm3.tmp\Lang\UKR.dll
- %PROGRAM_FILES%\DAEMON Tools Lite\Engine.dll
- %ALLUSERSPROFILE%\Application Data\DAEMON Tools Lite\license.dat
- %TEMP%\nsm3.tmp\Lang\SRL.dll
- %TEMP%\nsm3.tmp\Lang\SLV.dll
- %TEMP%\nsm3.tmp\Lang\TRK.dll
- %TEMP%\nsm3.tmp\Lang\SVE.dll
- %TEMP%\nsm3.tmp\Lang\LTH.dll
- %TEMP%\nsm3.tmp\Lang\FRA.dll
- %TEMP%\nsm3.tmp\Lang\FIN.dll
- %TEMP%\nsm3.tmp\Lang\HEB.dll
- %TEMP%\nsm3.tmp\Lang\GLC.dll
- %TEMP%\nsm3.tmp\Lang\ELL.dll
- %TEMP%\nsm3.tmp\Lang\DEU.dll
- %TEMP%\nsm3.tmp\Lang\ESN.dll
- %TEMP%\nsm3.tmp\Lang\ENU.dll
- %TEMP%\nsm3.tmp\Lang\JPN.dll
- %TEMP%\nsm3.tmp\Lang\ITA.dll
- %TEMP%\nsm3.tmp\Lang\KOR.dll
- %TEMP%\nsm3.tmp\Lang\KAT.dll
- %TEMP%\nsm3.tmp\Lang\HUN.dll
- %TEMP%\nsm3.tmp\Lang\HRV.dll
- %TEMP%\nsm3.tmp\Lang\IND.dll
- %TEMP%\nsm3.tmp\Lang\HYE.dll
Удаляет следующие файлы:
- %TEMP%\CabA.tmp
- %TEMP%\Cab8.tmp
- %TEMP%\CabF.tmp
- %TEMP%\CabD.tmp
- %TEMP%\$inst\0001.tmp
- %TEMP%\$inst\temp_0.tmp
- %TEMP%\Cab4.tmp
- %TEMP%\$inst\2.tmp
Перемещает следующие системные файлы:
- %WINDIR%\inf\INFCACHE.2 в %WINDIR%\inf\OLDCACHE.000
- %WINDIR%\inf\INFCACHE.1 в %WINDIR%\inf\INFCACHE.2
Перемещает следующие файлы:
- <DRIVERS>\SETC.tmp в <DRIVERS>\dtsoftbus01.sys
Сетевая активность:
Подключается к:
- 'www.download.windowsupdate.com':80
- 'wp#d':80
- 'dt.####search-home.com':80
TCP:
Запросы HTTP GET:
- www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt
- www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
- dt.####search-home.com/getsettings?qu############################################################################################################################################################################################
- wp#d/wpad.dat
UDP:
- DNS ASK www.download.windowsupdate.com
- DNS ASK wp#d
- DNS ASK dt.####search-home.com
Другое:
Ищет следующие окна:
- ClassName: 'Indicator' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
Добавляет корневой сертификат
