Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\At33.job
- %WINDIR%\Tasks\At32.job
- %WINDIR%\Tasks\At31.job
- %WINDIR%\Tasks\At36.job
- %WINDIR%\Tasks\At35.job
- %WINDIR%\Tasks\At34.job
- %WINDIR%\Tasks\At27.job
- %WINDIR%\Tasks\At26.job
- %WINDIR%\Tasks\At25.job
- %WINDIR%\Tasks\At30.job
- %WINDIR%\Tasks\At29.job
- %WINDIR%\Tasks\At28.job
- %WINDIR%\Tasks\At45.job
- %WINDIR%\Tasks\At44.job
- %WINDIR%\Tasks\At43.job
- %WINDIR%\Tasks\At48.job
- %WINDIR%\Tasks\At47.job
- %WINDIR%\Tasks\At46.job
- %WINDIR%\Tasks\At39.job
- %WINDIR%\Tasks\At38.job
- %WINDIR%\Tasks\At37.job
- %WINDIR%\Tasks\At42.job
- %WINDIR%\Tasks\At41.job
- %WINDIR%\Tasks\At40.job
- %WINDIR%\Tasks\At9.job
- %WINDIR%\Tasks\At8.job
- %WINDIR%\Tasks\At7.job
- %WINDIR%\Tasks\At12.job
- %WINDIR%\Tasks\At11.job
- %WINDIR%\Tasks\At10.job
- %WINDIR%\Tasks\At3.job
- %WINDIR%\Tasks\At2.job
- %WINDIR%\Tasks\At1.job
- %WINDIR%\Tasks\At6.job
- %WINDIR%\Tasks\At5.job
- %WINDIR%\Tasks\At4.job
- %WINDIR%\Tasks\At21.job
- %WINDIR%\Tasks\At20.job
- %WINDIR%\Tasks\At19.job
- %WINDIR%\Tasks\At24.job
- %WINDIR%\Tasks\At23.job
- %WINDIR%\Tasks\At22.job
- %WINDIR%\Tasks\At15.job
- %WINDIR%\Tasks\At14.job
- %WINDIR%\Tasks\At13.job
- %WINDIR%\Tasks\At18.job
- %WINDIR%\Tasks\At17.job
- %WINDIR%\Tasks\At16.job
Вредоносные функции:
Запускает на исполнение:
- <SYSTEM32>\at.exe 16:00 /every:m,t,w,th,f,s,su "%PROGRAM_FILES%\QQ.exe"
- <SYSTEM32>\at.exe 15:30 /every:m,t,w,th,f,s,su "%PROGRAM_FILES%\QQ.exe"
- <SYSTEM32>\at.exe 15:00 /every:m,t,w,th,f,s,su "%PROGRAM_FILES%\QQ.exe"
- <SYSTEM32>\at.exe 17:30 /every:m,t,w,th,f,s,su "%PROGRAM_FILES%\QQ.exe"
- <SYSTEM32>\at.exe 17:00 /every:m,t,w,th,f,s,su "%PROGRAM_FILES%\QQ.exe"
- <SYSTEM32>\at.exe 16:30 /every:m,t,w,th,f,s,su "%PROGRAM_FILES%\QQ.exe"
- <SYSTEM32>\at.exe 13:00 /every:m,t,w,th,f,s,su "%PROGRAM_FILES%\QQ.exe"
- <SYSTEM32>\at.exe 12:30 /every:m,t,w,th,f,s,su "%PROGRAM_FILES%\QQ.exe"
- <SYSTEM32>\at.exe 12:00 /every:m,t,w,th,f,s,su "%PROGRAM_FILES%\QQ.exe"
- <SYSTEM32>\at.exe 14:30 /every:m,t,w,th,f,s,su "%PROGRAM_FILES%\QQ.exe"
- <SYSTEM32>\at.exe 14:00 /every:m,t,w,th,f,s,su "%PROGRAM_FILES%\QQ.exe"
- <SYSTEM32>\at.exe 13:30 /every:m,t,w,th,f,s,su "%PROGRAM_FILES%\QQ.exe"
- <SYSTEM32>\at.exe 22:00 /every:m,t,w,th,f,s,su "%PROGRAM_FILES%\QQ.exe"
- <SYSTEM32>\at.exe 21:30 /every:m,t,w,th,f,s,su "%PROGRAM_FILES%\QQ.exe"
- <SYSTEM32>\at.exe 21:00 /every:m,t,w,th,f,s,su "%PROGRAM_FILES%\QQ.exe"
- <SYSTEM32>\at.exe 23:30 /every:m,t,w,th,f,s,su "%PROGRAM_FILES%\QQ.exe"
- <SYSTEM32>\at.exe 23:00 /every:m,t,w,th,f,s,su "%PROGRAM_FILES%\QQ.exe"
- <SYSTEM32>\at.exe 22:30 /every:m,t,w,th,f,s,su "%PROGRAM_FILES%\QQ.exe"
- <SYSTEM32>\at.exe 19:00 /every:m,t,w,th,f,s,su "%PROGRAM_FILES%\QQ.exe"
- <SYSTEM32>\at.exe 18:30 /every:m,t,w,th,f,s,su "%PROGRAM_FILES%\QQ.exe"
- <SYSTEM32>\at.exe 18:00 /every:m,t,w,th,f,s,su "%PROGRAM_FILES%\QQ.exe"
- <SYSTEM32>\at.exe 20:30 /every:m,t,w,th,f,s,su "%PROGRAM_FILES%\QQ.exe"
- <SYSTEM32>\at.exe 20:00 /every:m,t,w,th,f,s,su "%PROGRAM_FILES%\QQ.exe"
- <SYSTEM32>\at.exe 19:30 /every:m,t,w,th,f,s,su "%PROGRAM_FILES%\QQ.exe"
- <SYSTEM32>\at.exe 11:30 /every:m,t,w,th,f,s,su "%PROGRAM_FILES%\QQ.exe"
- <SYSTEM32>\at.exe 03:30 /every:m,t,w,th,f,s,su "%PROGRAM_FILES%\QQ.exe"
- <SYSTEM32>\at.exe 03:00 /every:m,t,w,th,f,s,su "%PROGRAM_FILES%\QQ.exe"
- <SYSTEM32>\at.exe 02:30 /every:m,t,w,th,f,s,su "%PROGRAM_FILES%\QQ.exe"
- <SYSTEM32>\at.exe 05:00 /every:m,t,w,th,f,s,su "%PROGRAM_FILES%\QQ.exe"
- <SYSTEM32>\at.exe 04:30 /every:m,t,w,th,f,s,su "%PROGRAM_FILES%\QQ.exe"
- <SYSTEM32>\at.exe 04:00 /every:m,t,w,th,f,s,su "%PROGRAM_FILES%\QQ.exe"
- <SYSTEM32>\at.exe 00:30 /every:m,t,w,th,f,s,su "%PROGRAM_FILES%\QQ.exe"
- <SYSTEM32>\at.exe 00:00 /every:m,t,w,th,f,s,su "%PROGRAM_FILES%\QQ.exe"
- <SYSTEM32>\wscript.exe "%PROGRAM_FILES%\QO.vbs" 0
- <SYSTEM32>\at.exe 02:00 /every:m,t,w,th,f,s,su "%PROGRAM_FILES%\QQ.exe"
- <SYSTEM32>\at.exe 01:30 /every:m,t,w,th,f,s,su "%PROGRAM_FILES%\QQ.exe"
- <SYSTEM32>\at.exe 01:00 /every:m,t,w,th,f,s,su "%PROGRAM_FILES%\QQ.exe"
- <SYSTEM32>\at.exe 09:30 /every:m,t,w,th,f,s,su "%PROGRAM_FILES%\QQ.exe"
- <SYSTEM32>\at.exe 09:00 /every:m,t,w,th,f,s,su "%PROGRAM_FILES%\QQ.exe"
- <SYSTEM32>\at.exe 08:30 /every:m,t,w,th,f,s,su "%PROGRAM_FILES%\QQ.exe"
- <SYSTEM32>\at.exe 11:00 /every:m,t,w,th,f,s,su "%PROGRAM_FILES%\QQ.exe"
- <SYSTEM32>\at.exe 10:30 /every:m,t,w,th,f,s,su "%PROGRAM_FILES%\QQ.exe"
- <SYSTEM32>\at.exe 10:00 /every:m,t,w,th,f,s,su "%PROGRAM_FILES%\QQ.exe"
- <SYSTEM32>\at.exe 06:30 /every:m,t,w,th,f,s,su "%PROGRAM_FILES%\QQ.exe"
- <SYSTEM32>\at.exe 06:00 /every:m,t,w,th,f,s,su "%PROGRAM_FILES%\QQ.exe"
- <SYSTEM32>\at.exe 05:30 /every:m,t,w,th,f,s,su "%PROGRAM_FILES%\QQ.exe"
- <SYSTEM32>\at.exe 08:00 /every:m,t,w,th,f,s,su "%PROGRAM_FILES%\QQ.exe"
- <SYSTEM32>\at.exe 07:30 /every:m,t,w,th,f,s,su "%PROGRAM_FILES%\QQ.exe"
- <SYSTEM32>\at.exe 07:00 /every:m,t,w,th,f,s,su "%PROGRAM_FILES%\QQ.exe"
Изменения в файловой системе:
Создает следующие файлы:
- %PROGRAM_FILES%\QO.bat
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\tj[1].asp
- %PROGRAM_FILES%\QQ.t
- %PROGRAM_FILES%\QQ.exe
- %PROGRAM_FILES%\QO.vbs
Сетевая активность:
Подключается к:
- 'www.re##en1.com':80
- 'localhost':1035
TCP:
Запросы HTTP GET:
- www.re##en1.com/system/tj.asp?id#############################
UDP:
- DNS ASK www.re##en1.com
