Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'WLAN Block Visual DNS Offline' = 'C:\hzwlnflcb\httviyxlmkw.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Protection Function Access Resource Policy] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- 'C:\hzwlnflcb\lvailiyb.exe' "c:\hzwlnflcb\httviyxlmkw.exe"
- 'C:\hzwlnflcb\httviyxlmkw.exe'
- 'C:\hzwlnflcb\sxqas2rztykdt0y0bcxag.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\hzwlnflcb\httviyxlmkw.exe
- C:\hzwlnflcb\lvailiyb.exe
- C:\hzwlnflcb\ynkaax
- %WINDIR%\hzwlnflcb\bbvt5hmwow
- C:\hzwlnflcb\bbvt5hmwow
- C:\hzwlnflcb\sxqas2rztykdt0y0bcxag.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\hzwlnflcb\lvailiyb.exe
- C:\hzwlnflcb\httviyxlmkw.exe
Удаляет следующие файлы:
- C:\hzwlnflcb\sxqas2rztykdt0y0bcxag.exe
- %WINDIR%\hzwlnflcb\bbvt5hmwow
Сетевая активность:
Подключается к:
- 'cr###chance.net':80
- 'su####meeting.net':80
- 'kn####nderstood.net':80
- 'su####chance.net':80
- 'cr###twenty.net':80
- 'su#####nderstood.net':80
- 'cr####eeting.net':80
- 'su####twenty.net':80
- 'be####nderstood.net':80
- 'be###chance.net':80
- 'kn###chance.net':80
- 'fo#####nderstood.net':80
- 'me#####nderstood.net':80
- 'be###twenty.net':80
- 'kn###twenty.net':80
- 'be####eeting.net':80
- 'kn####eeting.net':80
- 'cr####nderstood.net':80
- 'sm####eeting.net':80
- 'wo###twenty.net':80
- 'sm###chance.net':80
- 'wo####eeting.net':80
- 'sm####nderstood.net':80
- 'pa###chance.net':80
- 'sm###twenty.net':80
- 'wo####nderstood.net':80
- 'wo###chance.net':80
- 'th####tmeeting.net':80
- 'wa####eeting.net':80
- 'th####tchance.net':80
- 'wa###chance.net':80
- 'th#####understood.net':80
- 'wa####nderstood.net':80
- 'th####ttwenty.net':80
- 'wa###twenty.net':80
- 'pa###value.net':80
- 'fi###value.net':80
- 'pa####rderly.net':80
- 'fi####rderly.net':80
- 'fr####eeting.net':80
- 'ex#####ncemeeting.net':80
- 'fr###chance.net':80
- 'ex#####ncechance.net':80
- 'fi###reason.net':80
- 'sm####rderly.net':80
- 'wo###value.net':80
- 'sm###reason.net':80
- 'wo####rderly.net':80
- 'fi###almost.net':80
- 'pa###reason.net':80
- 'sm###value.net':80
- 'pa###almost.net':80
- 'fr###twenty.net':80
- 'fo####chance.net':80
- 'me####chance.net':80
- 'ge#####anunderstood.net':80
- 'al#####understood.net':80
- 'fo####twenty.net':80
- 'me####twenty.net':80
- 'fo####meeting.net':80
- 'me####meeting.net':80
- 'al####ytwenty.net':80
- 'ex######ceunderstood.net':80
- 'ge####manchance.net':80
- 'ex#####ncetwenty.net':80
- 'fr####nderstood.net':80
- 'al####ymeeting.net':80
- 'ge####mantwenty.net':80
- 'al####ychance.net':80
- 'ge#####anmeeting.net':80
TCP:
Запросы HTTP GET:
- http://cr###chance.net/index.php?me########
- http://su####meeting.net/index.php?me########
- http://kn####nderstood.net/index.php?me########
- http://su####chance.net/index.php?me########
- http://cr###twenty.net/index.php?me########
- http://su#####nderstood.net/index.php?me########
- http://cr####eeting.net/index.php?me########
- http://su####twenty.net/index.php?me########
- http://be####nderstood.net/index.php?me########
- http://be###chance.net/index.php?me########
- http://kn###chance.net/index.php?me########
- http://fo#####nderstood.net/index.php?me########
- http://me#####nderstood.net/index.php?me########
- http://be###twenty.net/index.php?me########
- http://kn###twenty.net/index.php?me########
- http://be####eeting.net/index.php?me########
- http://kn####eeting.net/index.php?me########
- http://cr####nderstood.net/index.php?me########
- http://sm####eeting.net/index.php?me########
- http://wo###twenty.net/index.php?me########
- http://sm###chance.net/index.php?me########
- http://wo####eeting.net/index.php?me########
- http://sm####nderstood.net/index.php?me########
- http://pa###chance.net/index.php?me########
- http://sm###twenty.net/index.php?me########
- http://wo####nderstood.net/index.php?me########
- http://wo###chance.net/index.php?me########
- http://th####tmeeting.net/index.php?me########
- http://wa####eeting.net/index.php?me########
- http://th####tchance.net/index.php?me########
- http://wa###chance.net/index.php?me########
- http://th#####understood.net/index.php?me########
- http://wa####nderstood.net/index.php?me########
- http://th####ttwenty.net/index.php?me########
- http://wa###twenty.net/index.php?me########
- http://pa###value.net/index.php?me########
- http://fi###value.net/index.php?me########
- http://pa####rderly.net/index.php?me########
- http://fi####rderly.net/index.php?me########
- http://fr####eeting.net/index.php?me########
- http://ex#####ncemeeting.net/index.php?me########
- http://fr###chance.net/index.php?me########
- http://ex#####ncechance.net/index.php?me########
- http://fi###reason.net/index.php?me########
- http://sm####rderly.net/index.php?me########
- http://wo###value.net/index.php?me########
- http://sm###reason.net/index.php?me########
- http://wo####rderly.net/index.php?me########
- http://fi###almost.net/index.php?me########
- http://pa###reason.net/index.php?me########
- http://sm###value.net/index.php?me########
- http://pa###almost.net/index.php?me########
- http://fr###twenty.net/index.php?me########
- http://fo####chance.net/index.php?me########
- http://me####chance.net/index.php?me########
- http://ge#####anunderstood.net/index.php?me########
- http://al#####understood.net/index.php?me########
- http://fo####twenty.net/index.php?me########
- http://me####twenty.net/index.php?me########
- http://fo####meeting.net/index.php?me########
- http://me####meeting.net/index.php?me########
- http://al####ytwenty.net/index.php?me########
- http://ex######ceunderstood.net/index.php?me########
- http://ge####manchance.net/index.php?me########
- http://ex#####ncetwenty.net/index.php?me########
- http://fr####nderstood.net/index.php?me########
- http://al####ymeeting.net/index.php?me########
- http://ge####mantwenty.net/index.php?me########
- http://al####ychance.net/index.php?me########
- http://ge#####anmeeting.net/index.php?me########
UDP:
- DNS ASK su####meeting.net
- DNS ASK cr####eeting.net
- DNS ASK su####chance.net
- DNS ASK cr###chance.net
- DNS ASK su#####nderstood.net
- DNS ASK cr####nderstood.net
- DNS ASK su####twenty.net
- DNS ASK cr###twenty.net
- DNS ASK kn####nderstood.net
- DNS ASK kn###chance.net
- DNS ASK be####eeting.net
- DNS ASK me#####nderstood.net
- DNS ASK be###chance.net
- DNS ASK kn###twenty.net
- DNS ASK be####nderstood.net
- DNS ASK kn####eeting.net
- DNS ASK be###twenty.net
- DNS ASK th####tchance.net
- DNS ASK wo###twenty.net
- DNS ASK sm###twenty.net
- DNS ASK wo####eeting.net
- DNS ASK sm####eeting.net
- DNS ASK pa###chance.net
- DNS ASK fi###chance.net
- DNS ASK wo####nderstood.net
- DNS ASK sm####nderstood.net
- DNS ASK sm###chance.net
- DNS ASK wa####eeting.net
- DNS ASK th####ttwenty.net
- DNS ASK wa###chance.net
- DNS ASK th####tmeeting.net
- DNS ASK wa####nderstood.net
- DNS ASK wo###chance.net
- DNS ASK wa###twenty.net
- DNS ASK th#####understood.net
- DNS ASK fo#####nderstood.net
- DNS ASK pa###value.net
- DNS ASK fi###value.net
- DNS ASK pa####rderly.net
- DNS ASK fi####rderly.net
- DNS ASK fr####eeting.net
- DNS ASK ex#####ncemeeting.net
- DNS ASK fr###chance.net
- DNS ASK ex#####ncechance.net
- DNS ASK fi###reason.net
- DNS ASK sm####rderly.net
- DNS ASK wo###value.net
- DNS ASK sm###reason.net
- DNS ASK wo####rderly.net
- DNS ASK fi###almost.net
- DNS ASK pa###reason.net
- DNS ASK sm###value.net
- DNS ASK pa###almost.net
- DNS ASK fr###twenty.net
- DNS ASK fo####chance.net
- DNS ASK me####chance.net
- DNS ASK ge#####anunderstood.net
- DNS ASK al#####understood.net
- DNS ASK fo####twenty.net
- DNS ASK me####twenty.net
- DNS ASK fo####meeting.net
- DNS ASK me####meeting.net
- DNS ASK al####ytwenty.net
- DNS ASK ex######ceunderstood.net
- DNS ASK ge####manchance.net
- DNS ASK ex#####ncetwenty.net
- DNS ASK fr####nderstood.net
- DNS ASK al####ymeeting.net
- DNS ASK ge####mantwenty.net
- DNS ASK al####ychance.net
- DNS ASK ge#####anmeeting.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
