Analyse von: RonJay Kristoffer Caragay   
 

Adware.GamePlayLabs (Malwarebytes); GamePlayLabs (v) (Sunbelt); Win32/Toolbar.CrossRider.B (ESET-NOD32); ADWARE/CrossRider.Gen2 (Avira); Toolbar.Win32.CrossRider (Ikarus); Win32:Crossrider-AI [PUP] (Avast); Adware.GamePlayLabs.17 (DrWeb)

 Plattform:

Windows

 Risikobewertung (gesamt):
 Schadenspotenzial::
 Verteilungspotenzial::
 reportedInfection:
 Trend Micro Lösungen:
Niedrig
Mittel
Hoch
Kritisch

  • Malware-Typ:
    Adware

  • Zerstrerisch?:
    Nein

  • Verschlsselt?:
     

  • In the wild::
    Ja

  Überblick

Wird als eine Komponente eines Malware-/Grayware-/Spyware-Pakets übertragen.

  Technische Details

Dateigröße: 1,997,096 bytes
Dateityp: EXE
Erste Muster erhalten am: 07 Mai 2012

Übertragungsdetails

Wird als eine Komponente eines Malware-/Grayware-/Spyware-Pakets übertragen.

Installation

Schleust die folgenden Dateien ein:

  • %Program Files%\{Application Name}\{Application Name}.dll
  • %Program Files%\{Application Name}\{Application Name}.exe
  • %Program Files%\{Application Name}\{Application Name}.ico
  • %Program Files%\{Application Name}\Uninstall.exe
  • %AppDataLocal%\{Application Name}\Chrome\{Application Name}.crx
  • %User Temp%\{Application Name}Installer_{number}.log
  • %User Temp%\ns{random}.tmp\{Application Name}.xpi
  • %User Temp%\ns{random}.tmp\{Application Name}_tmp
  • %User Temp%\ns{random}.tmp\{App ID}_tmp
  • %User Temp%\ns{random}.tmp\CleanChromePrefs.vbs
  • %User Temp%\ns{random}.tmp\Dialer.dll
  • %User Temp%\ns{random}.tmp\ExecDos.dll
  • %User Temp%\ns{random}.tmp\inetc.dll
  • %User Temp%\ns{random}.tmp\md5dll.dll
  • %User Temp%\ns{random}.tmp\nsislog.dll
  • %User Temp%\ns{random}.tmp\nsisos.dll
  • %User Temp%\ns{random}.tmp\Processes.dll
  • %User Temp%\ns{random}.tmp\RemoveFromList.vbs
  • %User Temp%\ns{random}.tmp\StdUtils.dll
  • %User Temp%\ns{random}.tmp\System.dll
  • %User Temp%\ns{random}.tmp\UserInfo.dll
  • %User Temp%\ns{random}.tmp\ZipDLL.dll

(Hinweis: %Program Files%ist der Standardordner 'Programme', normalerweise C:\Programme.. %User Temp% ist der Ordner 'Temp' des aktuellen Benutzers, normalerweise C:\Dokumente und Einstellungen\{Benutzername}\Lokale Einstellungen\Temp unter Windows 2000, XP und Server 2003.)

Erstellt die folgenden Ordner:

  • %User Temp%\ns{random}.tmp
  • %Program Files%\{Application Name}
  • %AppDataLocal%\{Application Name}
  • %Application Data%\Mozilla\Firefox\Profiles\{random}.default\extensions\crossriderapp{App ID}@crossrider.com

Andere Systemänderungen

Fügt die folgenden Registrierungsschlüssel hinzu:

HKEY_CURRENT_USER\Software\{Application Name}

HKEY_CURRENT_USER\Software\{Application Name}\
Installer

HKEY_CURRENT_USER\Software\Crossrider

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CrossriderApp000{App ID}.BHO

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CrossriderApp000{App ID}.FBAp

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CrossriderApp000{App ID}.Sandbox

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{11111111-1111-1111-1111-110011{ID}11{ID}}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{22222222-2222-2222-2222-220022{ID}22{ID}}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{33333333-3333-3333-3333-330033{ID}33{ID}}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
TypeLib\{44444444-4444-4444-4444-440044{ID}44{ID}}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{55555555-5555-5555-5555-550055{ID}55{ID}}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{66666666-6666-6666-6666-660066{ID}66{ID}}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{77777777-7777-7777-7777-770077{ID}77{ID}}

Fügt die folgenden Registrierungseinträge hinzu:

HKEY_CURRENT_USER\Software\{Application Name}\
Installer
Folder = "%Program Files%\{Application Name}"

HKEY_CURRENT_USER\Software\Crossrider
215AppVerifier = "{hex values}"

HKEY_CURRENT_USER\Software\Crossrider
Bic = "{hex values}"

HKEY_CURRENT_USER\Software\Crossrider
Verifier = "{hex values}"

HKEY_CURRENT_USER\Software\Crossrider\
Testing
IsTesting = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CrossriderApp000{App ID}.BHO
(Default) = "CrossriderApp000{App ID}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CrossriderApp000{App ID}.BHO\CLSID
(Default) = "{11111111-1111-1111-1111-110011{ID}11{ID}}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CrossriderApp000{App ID}.BHO\CurVer
(Default) = "CrossriderApp000{App ID}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CrossriderApp000{App ID}.BHO.1
(Default) = "CrossriderApp000{App ID}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CrossriderApp000{App ID}.BHO.1\CLSID
(Default) = "{11111111-1111-1111-1111-110011{ID}11{ID}}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CrossriderApp000{App ID}.FBApi
(Default) = "CrossriderApp000{App ID}.FBApi"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CrossriderApp000{App ID}.FBApi\CLSID
(Default) = "{33333333-3333-3333-3333-330033{ID}33{ID}}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CrossriderApp000{App ID}.FBApi\CurVer
(Default) = "CrossriderApp000{App ID}.FBApi.1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CrossriderApp000{App ID}.FBApi.1
(Default) = "CrossriderApp000{App ID}.FBApi"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CrossriderApp000{App ID}.FBApi.1\CLSID
(Default) = "{33333333-3333-3333-3333-330033{ID}33{ID}}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CrossriderApp000{App ID}.Sandbox
(Default) = "CrossriderApp000{App ID}.Sandbox"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CrossriderApp000{App ID}.Sandbox\CLSID
(Default) = "{22222222-2222-2222-2222-220022{ID}22{ID}}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CrossriderApp000{App ID}.Sandbox\CurVer
(Default) = "CrossriderApp000{App ID}.Sandbox"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CrossriderApp000{App ID}.Sandbox.1
(Default) = "CrossriderApp000{App ID}.Sandbox"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CrossriderApp000{App ID}.Sandbox.1\CLSID
(Default) = "{22222222-2222-2222-2222-220022{ID}22{ID}}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{11111111-1111-1111-1111-110011{ID}11{ID}}
(Default) = "{Application Name}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{11111111-1111-1111-1111-110011{ID}11{ID}}\InprocServer32
(Default) = "%Program Files%\{Application Name}\{Application Name}.dll"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{11111111-1111-1111-1111-110011{ID}11{ID}}\ProgID
(Default) = "CrossriderApp000{App ID}.BHO.1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{11111111-1111-1111-1111-110011{ID}11{ID}}\TypeLib
(Default) = "{44444444-4444-4444-4444-440044{ID}44{ID}}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{11111111-1111-1111-1111-110011{ID}11{ID}}\VersionIndependentProgID
(Default) = "CrossriderApp000{App ID}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{22222222-2222-2222-2222-220022{ID}22{ID}}
(Default) = "CrossriderApp000{App ID}.Sandbox"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{22222222-2222-2222-2222-220022{ID}22{ID}}\InprocServer32
(Default) = "%Program Files%\{Application Name}\{Application Name}.dll"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{22222222-2222-2222-2222-220022{ID}22{ID}}\ProgID
(Default) = "CrossriderApp000{App ID}.Sandbox.1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{22222222-2222-2222-2222-220022{ID}22{ID}}\TypeLib
(Default) = "{44444444-4444-4444-4444-440044{ID}44{ID}}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{22222222-2222-2222-2222-220022{ID}22{ID}}\VersionIndependentProgID
(Default) = "CrossriderApp000{App ID}.Sandbox"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{33333333-3333-3333-3333-330033{ID}33{ID}}
(Default) = "CrossriderApp000{App ID}.FBApi"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{33333333-3333-3333-3333-330033{ID}33{ID}}\InprocServer32
(Default) = "%Program Files%\{Application Name}\{Application Name}.dll"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{33333333-3333-3333-3333-330033{ID}33{ID}}\ProgID
(Default) = "CrossriderApp000{App ID}.FBApi.1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{33333333-3333-3333-3333-330033{ID}33{ID}}\TypeLib
(Default) = "{44444444-4444-4444-4444-440044{ID}44{ID}}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{33333333-3333-3333-3333-330033{ID}33{ID}}\VersionIndependentProgID
(Default) = "CrossriderApp000{App ID}.FBApi"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{55555555-5555-5555-5555-550055{ID}55{ID}}
(Default) = "ICrossriderBHO"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{55555555-5555-5555-5555-550055{ID}55{ID}}\TypeLib
(Default) = "{44444444-4444-4444-4444-440044{ID}44{ID}}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{66666666-6666-6666-6666-660066{ID}66{ID}}
(Default) = "ISandBox"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{66666666-6666-6666-6666-660066{ID}66{ID}}\TypeLib
(Default) = "{44444444-4444-4444-4444-440044{ID}44{ID}}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{77777777-7777-7777-7777-770077{ID}77{ID}}
(Default) = "IFBApi"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{77777777-7777-7777-7777-770077{ID}77{ID}}\TypeLib
(Default) = "{44444444-4444-4444-4444-440044{ID}44{ID}}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
TypeLib\{44444444-4444-4444-4444-440044{ID}44{ID}}\1.0
(Default) = "CrossriderApp000{App ID} Type Library"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
TypeLib\{44444444-4444-4444-4444-440044{ID}44{ID}}\1.0\
0\win32
(Default) = "%Program Files%\{Application Name}\{Application Name}.dll"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
TypeLib\{44444444-4444-4444-4444-440044{ID}44{ID}}\1.0\
HELPDIR
(Default) = "%Program Files%\{Application Name}"

HKEY_LOCAL_MACHINE\SOFTWARE\Google\
Chrome\Extensions\{random name 1}
path = "%AppDataLocal%\{Application Name}\Chrome\{Application Name}.crx"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Google\Chrome\Extensions\
{random name 1}
path = "%AppDataLocal%\{Application Name}\Chrome\{Application Name}.crx"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Ext\PreApproved\{11111111-1111-1111-1111-110011{ID}11{ID}}
(Default) = ""

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Internet Explorer\Low Rights\ElevationPolicy\
{11111111-1111-1111-1111-110011{ID}11{ID}}
AppName = "{Application Name}.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Internet Explorer\Low Rights\ElevationPolicy\
{11111111-1111-1111-1111-110011{ID}11{ID}}
AppPath = "%Program Files%\{Application Name}"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
Browser Helper Objects\{11111111-1111-1111-1111-110011{ID}11{ID}}
(Default) = "CrossriderApp000{App ID}"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Ext\
PreApproved\{11111111-1111-1111-1111-110011{ID}11{ID}}
(Default) = ""

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{Application Name}
DisplayIcon = "%Program Files%\{Application Name}\Uninstall.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{Application Name}
DisplayName = "{Application Name}"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{Application Name}
UninstallString = "%Program Files%\{Application Name}\Uninstall.exe"