Техническая информация
Вредоносные функции:
Ищет следующие окна с целью
обнаружения утилит для анализа:
- ClassName: '' WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'PROCMON_WINDOW_CLASS' WindowName: ''
- ClassName: '' WindowName: 'Registry Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'RegmonClass' WindowName: ''
- ClassName: '' WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'GBDYLLO' WindowName: ''
- ClassName: 'OLLYDBG' WindowName: ''
- ClassName: 'FilemonClass' WindowName: ''
- ClassName: 'pediy06' WindowName: ''
Изменяет следующие настройки браузера Windows Internet Explorer:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'ProxyServer' = '127.0.0.1:9666'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'ProxyOverride' = '127.0.0.1'
- [<HKLM>\SYSTEM\ControlSet001\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings] 'ProxyEnable' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1C00' = '{00,00,00,00}'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] 'CurrentLevel' = '{00,00,00,00}'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'ProxyEnable' = '00000001'
Изменения в файловой системе:
Создает следующие файлы:
- <Текущая директория>\utmp\~pdddzhthltx0u4j
- <Текущая директория>\utmp\~fecqejjrjji0t1a
- <Текущая директория>\utmp\~hjnkfdildii9h9f
Сетевая активность:
Подключается к:
- '65.#9.2.10':443
- '21#.#63.17.252':443
- '65.#9.14.13':443
- '72.##.176.100':443
- '65.#9.2.15':443
- '61.##1.230.241':443
- '65.#9.2.11':443
- '65.#9.2.23':443
- '65.#9.2.16':443
- '11#.#42.14.212':443
- '11#.#5.182.57':443
- '21#.#4.110.97':443
- '20#.#6.104.198':443
- '59.##2.83.15':443
- '12#.#.76.208':443
- 'bi#####.iyoyo.com.cn':443
- '22#.#42.178.110':443
- '64.##9.235.176':443
- '19#.#28.29.9':443
- '11#.#05.123.188':443
- '21#.#60.109.6':443
- '21#.#26.191.109':443
- '59.##6.108.86':443
UDP:
- DNS ASK go##le.net
- DNS ASK go##lie.com
- DNS ASK vn####k.wqvdgj.info
- DNS ASK go##gle.com
- DNS ASK go##le.ro
- DNS ASK ry.##vdgj.info
- DNS ASK em###.wqvdgj.info
- DNS ASK cb##.#qvdgj.info
- DNS ASK go##le.mu
- DNS ASK gg##gle.com
- DNS ASK ri#.#qvdgj.info
- DNS ASK go##le.es
- DNS ASK go##el.com
- DNS ASK cd####o.wqvdgj.info
- DNS ASK gq#.#qvdgj.info
- DNS ASK go##le.no
- DNS ASK vj##.#qvdgj.info
- DNS ASK cm#.#qvdgj.info
- DNS ASK hh####.wqvdgj.info
- DNS ASK ak####.wqvdgj.info
- DNS ASK xn####e.wqvdgj.info
- DNS ASK go###e.com.au
- DNS ASK www.he##z.com
- DNS ASK ti####.wqvdgj.info
- DNS ASK id.##vdgj.info
- DNS ASK bn####u.wqvdgj.info
- DNS ASK bi#####.iyoyo.com.cn
- DNS ASK fi#.#qvdgj.info
- DNS ASK go##le.nl
- DNS ASK go###e.co.hu
- DNS ASK ab#.#qvdgj.info
- DNS ASK ww.##vdgj.info
- DNS ASK s3.###zonaws.com
- DNS ASK go###e.co.jp
- DNS ASK go##le.lk
- DNS ASK go###e.co.za
- DNS ASK de####per.skype.com
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: '18467-41' WindowName: ''
