Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Link-Layer Cache Process Compatibility' = 'C:\kgjsrmcrmm\jxvdunt.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Launcher Copy Ordering Keying] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- 'C:\kgjsrmcrmm\ozmuctcc.exe' "c:\kgjsrmcrmm\jxvdunt.exe"
- 'C:\kgjsrmcrmm\jxvdunt.exe'
- 'C:\kgjsrmcrmm\kfoa3aqbwqfpukhypt.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\kgjsrmcrmm\jxvdunt.exe
- C:\kgjsrmcrmm\ozmuctcc.exe
- C:\kgjsrmcrmm\xikhkg
- %WINDIR%\kgjsrmcrmm\loeuwkonu
- C:\kgjsrmcrmm\loeuwkonu
- C:\kgjsrmcrmm\kfoa3aqbwqfpukhypt.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\kgjsrmcrmm\ozmuctcc.exe
- C:\kgjsrmcrmm\jxvdunt.exe
Удаляет следующие файлы:
- C:\kgjsrmcrmm\kfoa3aqbwqfpukhypt.exe
- %WINDIR%\kgjsrmcrmm\loeuwkonu
Сетевая активность:
Подключается к:
- 'th####htrain.net':80
- 'ef###ttrain.net':80
- 'ef#####lectricity.net':80
- 'ef####delight.net':80
- 'th#####electricity.net':80
- 'th####hborrow.net':80
- 'su#####lectricity.net':80
- 'wi#####lectricity.net':80
- 'wi####delight.net':80
- 'ef####borrow.net':80
- 'su####delight.net':80
- 'th####hdelight.net':80
- 'in####sedelight.net':80
- 'fo####delight.net':80
- 'wo###borrow.net':80
- 'wo###train.net':80
- 're####erborrow.net':80
- 'in#####eelectricity.net':80
- 'in####seborrow.net':80
- 'fo####borrow.net':80
- 'fo###ttrain.net':80
- 'fo#####lectricity.net':80
- 'in####setrain.net':80
- 'su###rtrain.net':80
- 'be###gtrain.net':80
- 'ri###ntrain.net':80
- 'ri#####lectricity.net':80
- 'ri####delight.net':80
- 'be#####lectricity.net':80
- 'be####borrow.net':80
- 'li#####lectricity.net':80
- 'de#####electricity.net':80
- 'de####ydelight.net':80
- 'ri####borrow.net':80
- 'li####delight.net':80
- 'be####delight.net':80
- 'th####elight.net':80
- 'ch####elight.net':80
- 'wi####borrow.net':80
- 'wi###ntrain.net':80
- 'su####borrow.net':80
- 'th#####ectricity.net':80
- 'th###borrow.net':80
- 'ch###borrow.net':80
- 'ch###train.net':80
- 'ch#####ectricity.net':80
- 'th###train.net':80
TCP:
Запросы HTTP GET:
- http://th####htrain.net/index.php?me########
- http://ef###ttrain.net/index.php?me########
- http://ef#####lectricity.net/index.php?me########
- http://ef####delight.net/index.php?me########
- http://th#####electricity.net/index.php?me########
- http://th####hborrow.net/index.php?me########
- http://su#####lectricity.net/index.php?me########
- http://wi#####lectricity.net/index.php?me########
- http://wi####delight.net/index.php?me########
- http://ef####borrow.net/index.php?me########
- http://su####delight.net/index.php?me########
- http://th####hdelight.net/index.php?me########
- http://in####sedelight.net/index.php?me########
- http://fo####delight.net/index.php?me########
- http://wo###borrow.net/index.php?me########
- http://wo###train.net/index.php?me########
- http://re####erborrow.net/index.php?me########
- http://in#####eelectricity.net/index.php?me########
- http://in####seborrow.net/index.php?me########
- http://fo####borrow.net/index.php?me########
- http://fo###ttrain.net/index.php?me########
- http://fo#####lectricity.net/index.php?me########
- http://in####setrain.net/index.php?me########
- http://su###rtrain.net/index.php?me########
- http://be###gtrain.net/index.php?me########
- http://ri###ntrain.net/index.php?me########
- http://ri#####lectricity.net/index.php?me########
- http://ri####delight.net/index.php?me########
- http://be#####lectricity.net/index.php?me########
- http://be####borrow.net/index.php?me########
- http://li#####lectricity.net/index.php?me########
- http://de#####electricity.net/index.php?me########
- http://de####ydelight.net/index.php?me########
- http://ri####borrow.net/index.php?me########
- http://li####delight.net/index.php?me########
- http://be####delight.net/index.php?me########
- http://th####elight.net/index.php?me########
- http://ch####elight.net/index.php?me########
- http://wi####borrow.net/index.php?me########
- http://wi###ntrain.net/index.php?me########
- http://su####borrow.net/index.php?me########
- http://th#####ectricity.net/index.php?me########
- http://th###borrow.net/index.php?me########
- http://ch###borrow.net/index.php?me########
- http://ch###train.net/index.php?me########
- http://ch#####ectricity.net/index.php?me########
- http://th###train.net/index.php?me########
UDP:
- DNS ASK th####htrain.net
- DNS ASK ef###ttrain.net
- DNS ASK ef#####lectricity.net
- DNS ASK ef####delight.net
- DNS ASK th#####electricity.net
- DNS ASK th####hborrow.net
- DNS ASK su#####lectricity.net
- DNS ASK wi#####lectricity.net
- DNS ASK wi####delight.net
- DNS ASK ef####borrow.net
- DNS ASK su####delight.net
- DNS ASK th####hdelight.net
- DNS ASK in####sedelight.net
- DNS ASK fo####delight.net
- DNS ASK wo###borrow.net
- DNS ASK wo###train.net
- DNS ASK re####erborrow.net
- DNS ASK in#####eelectricity.net
- DNS ASK in####seborrow.net
- DNS ASK fo####borrow.net
- DNS ASK fo###ttrain.net
- DNS ASK fo#####lectricity.net
- DNS ASK in####setrain.net
- DNS ASK su###rtrain.net
- DNS ASK be###gtrain.net
- DNS ASK ri###ntrain.net
- DNS ASK ri#####lectricity.net
- DNS ASK ri####delight.net
- DNS ASK be#####lectricity.net
- DNS ASK be####borrow.net
- DNS ASK li#####lectricity.net
- DNS ASK de#####electricity.net
- DNS ASK de####ydelight.net
- DNS ASK ri####borrow.net
- DNS ASK li####delight.net
- DNS ASK be####delight.net
- DNS ASK th####elight.net
- DNS ASK ch####elight.net
- DNS ASK wi####borrow.net
- DNS ASK wi###ntrain.net
- DNS ASK su####borrow.net
- DNS ASK th#####ectricity.net
- DNS ASK th###borrow.net
- DNS ASK ch###borrow.net
- DNS ASK ch###train.net
- DNS ASK ch#####ectricity.net
- DNS ASK th###train.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
