Техническая информация
Вредоносные функции:
Создает и запускает на исполнение:
- '<SYSTEM32>\config\ndfju3eqew.exe'
Запускает на исполнение:
- '<SYSTEM32>\cmd.exe' /c ""<SYSTEM32>\config\ini.bat" "
Ищет следующие окна с целью
обнаружения утилит для анализа:
- ClassName: '(null)' WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'PROCMON_WINDOW_CLASS' WindowName: '(null)'
- ClassName: '(null)' WindowName: 'Registry Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'RegmonClass' WindowName: '(null)'
- ClassName: '(null)' WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'GBDYLLO' WindowName: '(null)'
- ClassName: 'OLLYDBG' WindowName: '(null)'
- ClassName: 'FilemonClass' WindowName: '(null)'
- ClassName: 'pediy06' WindowName: '(null)'
Изменения в файловой системе:
Создает следующие файлы:
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\24[1].jpg
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\23[1].jpg
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\25[1].jpg
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\26[1].jpg
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\27[1].jpg
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\17[1].jpg
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\18[1].jpg
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\20[1].jpg
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\21[1].jpg
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\22[1].jpg
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\34[1].jpg
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\33[1].jpg
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\35[1].jpg
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\37[1].jpg
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\36[1].jpg
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\29[1].jpg
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\28[1].jpg
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\31[1].jpg
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\32[1].jpg
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\30[1].jpg
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\19[1].jpg
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\05[1].jpg
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\01[1].jpg
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\03[1].jpg
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\06[1].jpg
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\04[1].jpg
- <SYSTEM32>\config\ini.bat
- <SYSTEM32>\config\ndfju3eqew.exe
- <SYSTEM32>\config\cornovingativo.html
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\02[1].jpg
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\13[1].jpg
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\12[1].jpg
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\16[1].jpg
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\15[1].jpg
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\14[1].jpg
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\08[1].jpg
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\07[1].jpg
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\10[1].jpg
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\11[1].jpg
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\09[1].jpg
Сетевая активность:
Подключается к:
- 'www.li###osexo.com':80
- 'localhost':1037
TCP:
Запросы HTTP GET:
- www.li###osexo.com/2011/10/cd-perdido-caiu-na--net/27.jpg
- www.li###osexo.com/2011/10/cd-perdido-caiu-na--net/25.jpg
- www.li###osexo.com/2011/10/cd-perdido-caiu-na--net/28.jpg
- www.li###osexo.com/2011/10/cd-perdido-caiu-na--net/26.jpg
- www.li###osexo.com/2011/10/cd-perdido-caiu-na--net/24.jpg
- www.li###osexo.com/2011/10/cd-perdido-caiu-na--net/22.jpg
- www.li###osexo.com/2011/10/cd-perdido-caiu-na--net/20.jpg
- www.li###osexo.com/2011/10/cd-perdido-caiu-na--net/23.jpg
- www.li###osexo.com/2011/10/cd-perdido-caiu-na--net/21.jpg
- www.li###osexo.com/2011/10/cd-perdido-caiu-na--net/35.jpg
- www.li###osexo.com/2011/10/cd-perdido-caiu-na--net/34.jpg
- www.li###osexo.com/2011/10/cd-perdido-caiu-na--net/37.jpg
- www.li###osexo.com/2011/10/cd-perdido-caiu-na--net/36.jpg
- www.li###osexo.com/2011/10/cd-perdido-caiu-na--net/33.jpg
- www.li###osexo.com/2011/10/cd-perdido-caiu-na--net/31.jpg
- www.li###osexo.com/2011/10/cd-perdido-caiu-na--net/29.jpg
- www.li###osexo.com/2011/10/cd-perdido-caiu-na--net/32.jpg
- www.li###osexo.com/2011/10/cd-perdido-caiu-na--net/30.jpg
- www.li###osexo.com/2011/10/cd-perdido-caiu-na--net/17.jpg
- www.li###osexo.com/2011/10/cd-perdido-caiu-na--net/07.jpg
- www.li###osexo.com/2011/10/cd-perdido-caiu-na--net/06.jpg
- www.li###osexo.com/2011/10/cd-perdido-caiu-na--net/10.jpg
- www.li###osexo.com/2011/10/cd-perdido-caiu-na--net/08.jpg
- www.li###osexo.com/2011/10/cd-perdido-caiu-na--net/04.jpg
- www.li###osexo.com/2011/10/cd-perdido-caiu-na--net/01.jpg
- www.li###osexo.com/2011/10/cd-perdido-caiu-na--net/02.jpg
- www.li###osexo.com/2011/10/cd-perdido-caiu-na--net/03.jpg
- www.li###osexo.com/2011/10/cd-perdido-caiu-na--net/05.jpg
- www.li###osexo.com/2011/10/cd-perdido-caiu-na--net/15.jpg
- www.li###osexo.com/2011/10/cd-perdido-caiu-na--net/14.jpg
- www.li###osexo.com/2011/10/cd-perdido-caiu-na--net/18.jpg
- www.li###osexo.com/2011/10/cd-perdido-caiu-na--net/19.jpg
- www.li###osexo.com/2011/10/cd-perdido-caiu-na--net/16.jpg
- www.li###osexo.com/2011/10/cd-perdido-caiu-na--net/11.jpg
- www.li###osexo.com/2011/10/cd-perdido-caiu-na--net/09.jpg
- www.li###osexo.com/2011/10/cd-perdido-caiu-na--net/13.jpg
- www.li###osexo.com/2011/10/cd-perdido-caiu-na--net/12.jpg
UDP:
- DNS ASK www.li###osexo.com
Другое:
Ищет следующие окна:
- ClassName: '' WindowName: '(null)'
- ClassName: 'MS_AutodialMonitor' WindowName: '(null)'
- ClassName: 'MS_WebcheckMonitor' WindowName: '(null)'
- ClassName: 'EDIT' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: '18467-41' WindowName: '(null)'
