Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Configuration Awareness Process' = '<LS_APPDATA>\jbhjcwbeisuxa\clrppheoxyc.exe'
Вредоносные функции:
Создает и запускает на исполнение:
- '<LS_APPDATA>\jbhjcwbeisuxa\qdxhvtvyvar.exe' "<LS_APPDATA>\jbhjcwbeisuxa\clrppheoxyc.exe"
- '<LS_APPDATA>\jbhjcwbeisuxa\clrppheoxyc.exe'
Изменения в файловой системе:
Создает следующие файлы:
- <LS_APPDATA>\jbhjcwbeisuxa\clrppheoxyc.narjs
- <LS_APPDATA>\jbhjcwbeisuxa\qdxhvtvyvar.exe
- <LS_APPDATA>\jbhjcwbeisuxa\clrppheoxyc.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- <LS_APPDATA>\jbhjcwbeisuxa\qdxhvtvyvar.exe
- <LS_APPDATA>\jbhjcwbeisuxa\clrppheoxyc.exe
Сетевая активность:
Подключается к:
- 're###ddress.net':80
- 'el####icpublic.net':80
- 're####public.net':80
- 'tr###catch.net':80
- 'st###tcatch.net':80
- 'el####icdress.net':80
- 're###dcatch.net':80
- 'ca####ndress.net':80
- 'la###dress.net':80
- 'el####iceearly.net':80
- 're####eearly.net':80
- 'el####iccatch.net':80
- 'st####eearly.net':80
- 'ga####eearly.net':80
- 'be####eearly.net':80
- 'ga###rcatch.net':80
- 'be###rdress.net':80
- 'ga####public.net':80
- 'be####public.net':80
- 'tr###public.net':80
- 'st####public.net':80
- 'tr###eearly.net':80
- 'be###rcatch.net':80
- 'tr###dress.net':80
- 'st###tdress.net':80
- 'do###public.net':80
- 'ag####tpublic.net':80
- 'do###eearly.net':80
- 'ni###catch.net':80
- 'do###dress.net':80
- 'ag####tdress.net':80
- 'se####distant.net':80
- 'qu####istant.net':80
- 'se####clothes.net':80
- 'ag####teearly.net':80
- 'do###catch.net':80
- 'ag####tcatch.net':80
- 'de###ecatch.net':80
- 'la###eearly.net':80
- 'ca####ncatch.net':80
- 'la###catch.net':80
- 'ca####npublic.net':80
- 'la###public.net':80
- 'ca####neearly.net':80
- 'ni###public.net':80
- 'de####eearly.net':80
- 'ni###eearly.net':80
- 'de###edress.net':80
- 'ni###dress.net':80
- 'de####public.net':80
TCP:
Запросы HTTP GET:
- re###ddress.net/forum/search.php?em##############################
- el####icpublic.net/forum/search.php?em##############################
- re####public.net/forum/search.php?em##############################
- tr###catch.net/forum/search.php?em##############################
- st###tcatch.net/forum/search.php?em##############################
- el####icdress.net/forum/search.php?em##############################
- re###dcatch.net/forum/search.php?em##############################
- ca####ndress.net/forum/search.php?em##############################
- la###dress.net/forum/search.php?em##############################
- el####iceearly.net/forum/search.php?em##############################
- re####eearly.net/forum/search.php?em##############################
- el####iccatch.net/forum/search.php?em##############################
- st####eearly.net/forum/search.php?em##############################
- ga####eearly.net/forum/search.php?em##############################
- be####eearly.net/forum/search.php?em##############################
- ga###rcatch.net/forum/search.php?em##############################
- be###rdress.net/forum/search.php?em##############################
- ga####public.net/forum/search.php?em##############################
- be####public.net/forum/search.php?em##############################
- tr###public.net/forum/search.php?em##############################
- st####public.net/forum/search.php?em##############################
- tr###eearly.net/forum/search.php?em##############################
- be###rcatch.net/forum/search.php?em##############################
- tr###dress.net/forum/search.php?em##############################
- st###tdress.net/forum/search.php?em##############################
- do###public.net/forum/search.php?em##############################
- ag####tpublic.net/forum/search.php?em##############################
- do###eearly.net/forum/search.php?em##############################
- ni###catch.net/forum/search.php?em##############################
- do###dress.net/forum/search.php?em##############################
- ag####tdress.net/forum/search.php?em##############################
- se####distant.net/forum/search.php?em##############################
- qu####istant.net/forum/search.php?em##############################
- se####clothes.net/forum/search.php?em##############################
- ag####teearly.net/forum/search.php?em##############################
- do###catch.net/forum/search.php?em##############################
- ag####tcatch.net/forum/search.php?em##############################
- de###ecatch.net/forum/search.php?em##############################
- la###eearly.net/forum/search.php?em##############################
- ca####ncatch.net/forum/search.php?em##############################
- la###catch.net/forum/search.php?em##############################
- ca####npublic.net/forum/search.php?em##############################
- la###public.net/forum/search.php?em##############################
- ca####neearly.net/forum/search.php?em##############################
- ni###public.net/forum/search.php?em##############################
- de####eearly.net/forum/search.php?em##############################
- ni###eearly.net/forum/search.php?em##############################
- de###edress.net/forum/search.php?em##############################
- ni###dress.net/forum/search.php?em##############################
- de####public.net/forum/search.php?em##############################
UDP:
- DNS ASK el####icdress.net
- DNS ASK re###ddress.net
- DNS ASK el####icpublic.net
- DNS ASK st####eearly.net
- DNS ASK tr###catch.net
- DNS ASK st###tcatch.net
- DNS ASK el####iccatch.net
- DNS ASK re###dcatch.net
- DNS ASK ca####ndress.net
- DNS ASK re####public.net
- DNS ASK el####iceearly.net
- DNS ASK re####eearly.net
- DNS ASK tr###eearly.net
- DNS ASK be####public.net
- DNS ASK ga####eearly.net
- DNS ASK be####eearly.net
- DNS ASK ga###rdress.net
- DNS ASK be###rdress.net
- DNS ASK ga####public.net
- DNS ASK st###tdress.net
- DNS ASK tr###public.net
- DNS ASK st####public.net
- DNS ASK ga###rcatch.net
- DNS ASK be###rcatch.net
- DNS ASK tr###dress.net
- DNS ASK la###dress.net
- DNS ASK do###public.net
- DNS ASK ag####tpublic.net
- DNS ASK do###eearly.net
- DNS ASK ni###catch.net
- DNS ASK do###dress.net
- DNS ASK ag####tdress.net
- DNS ASK se####distant.net
- DNS ASK qu####istant.net
- DNS ASK se####clothes.net
- DNS ASK ag####teearly.net
- DNS ASK do###catch.net
- DNS ASK ag####tcatch.net
- DNS ASK de###ecatch.net
- DNS ASK la###eearly.net
- DNS ASK ca####ncatch.net
- DNS ASK la###catch.net
- DNS ASK ca####npublic.net
- DNS ASK la###public.net
- DNS ASK ca####neearly.net
- DNS ASK ni###public.net
- DNS ASK de####eearly.net
- DNS ASK ni###eearly.net
- DNS ASK de###edress.net
- DNS ASK ni###dress.net
- DNS ASK de####public.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'Indicator' WindowName: '(null)'
