Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Information Fax Font Extender' = 'C:\mscirkglawtmtmu\wtirlsmuq.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\VC IKE Themes Multimedia Framework] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- 'C:\mscirkglawtmtmu\nltcrsar.exe' "c:\mscirkglawtmtmu\wtirlsmuq.exe"
- 'C:\mscirkglawtmtmu\wtirlsmuq.exe'
- 'C:\mscirkglawtmtmu\vpjzk2kpox6fvaya111sbv.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\mscirkglawtmtmu\wtirlsmuq.exe
- C:\mscirkglawtmtmu\nltcrsar.exe
- C:\mscirkglawtmtmu\ddx5qoypx
- %WINDIR%\mscirkglawtmtmu\zn1msi
- C:\mscirkglawtmtmu\zn1msi
- C:\mscirkglawtmtmu\vpjzk2kpox6fvaya111sbv.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\mscirkglawtmtmu\nltcrsar.exe
- C:\mscirkglawtmtmu\wtirlsmuq.exe
Удаляет следующие файлы:
- C:\mscirkglawtmtmu\vpjzk2kpox6fvaya111sbv.exe
- %WINDIR%\mscirkglawtmtmu\zn1msi
Сетевая активность:
Подключается к:
- 're####eanimal.net':80
- 'or###animal.net':80
- 're####eescape.net':80
- 'or###modern.net':80
- 're####eproblem.net':80
- 'or####roblem.net':80
- 'ne#####ryproblem.net':80
- 'pl####ntproblem.net':80
- 'ne####aryanimal.net':80
- 'or###escape.net':80
- 'ne####arymodern.net':80
- 'pl####ntmodern.net':80
- 'he####modern.net':80
- 'le####modern.net':80
- 'he####problem.net':80
- 'ge####problem.net':80
- 'ge####animal.net':80
- 'ge####escape.net':80
- 'he####escape.net':80
- 'le####escape.net':80
- 're####emodern.net':80
- 'le####problem.net':80
- 'he####animal.net':80
- 'le####animal.net':80
- 'pl####ntanimal.net':80
- 'an####animal.net':80
- 'gl###escape.net':80
- 'an####escape.net':80
- 'gl####roblem.net':80
- 'an####problem.net':80
- 'gl###animal.net':80
- 'de####problem.net':80
- 'de####animal.net':80
- 'fo####descape.net':80
- 'fo####dmodern.net':80
- 'de####modern.net':80
- 'fo####dproblem.net':80
- 'di####ultmodern.net':80
- 'he####roblem.net':80
- 'di#####ltproblem.net':80
- 'ne####aryescape.net':80
- 'pl####ntescape.net':80
- 'he###modern.net':80
- 'di####ultescape.net':80
- 'gl###modern.net':80
- 'an####modern.net':80
- 'he###animal.net':80
- 'di####ultanimal.net':80
- 'he###escape.net':80
TCP:
Запросы HTTP GET:
- http://re####eanimal.net/index.php
- http://or###animal.net/index.php
- http://re####eescape.net/index.php
- http://or###modern.net/index.php
- http://re####eproblem.net/index.php
- http://or####roblem.net/index.php
- http://ne#####ryproblem.net/index.php
- http://pl####ntproblem.net/index.php
- http://ne####aryanimal.net/index.php
- http://or###escape.net/index.php
- http://ne####arymodern.net/index.php
- http://pl####ntmodern.net/index.php
- http://he####modern.net/index.php
- http://le####modern.net/index.php
- http://he####problem.net/index.php
- http://ge####problem.net/index.php
- http://ge####animal.net/index.php
- http://ge####escape.net/index.php
- http://he####escape.net/index.php
- http://le####escape.net/index.php
- http://re####emodern.net/index.php
- http://le####problem.net/index.php
- http://he####animal.net/index.php
- http://le####animal.net/index.php
- http://pl####ntanimal.net/index.php
- http://an####animal.net/index.php
- http://gl###escape.net/index.php
- http://an####escape.net/index.php
- http://gl####roblem.net/index.php
- http://an####problem.net/index.php
- http://gl###animal.net/index.php
- http://de####problem.net/index.php
- http://de####animal.net/index.php
- http://fo####descape.net/index.php
- http://fo####dmodern.net/index.php
- http://de####modern.net/index.php
- http://fo####dproblem.net/index.php
- http://di####ultmodern.net/index.php
- http://he####roblem.net/index.php
- http://di#####ltproblem.net/index.php
- http://ne####aryescape.net/index.php
- http://pl####ntescape.net/index.php
- http://he###modern.net/index.php
- http://di####ultescape.net/index.php
- http://gl###modern.net/index.php
- http://an####modern.net/index.php
- http://he###animal.net/index.php
- http://di####ultanimal.net/index.php
- http://he###escape.net/index.php
UDP:
- DNS ASK or###animal.net
- DNS ASK re####eescape.net
- DNS ASK or###escape.net
- DNS ASK re####eproblem.net
- DNS ASK or####roblem.net
- DNS ASK re####eanimal.net
- DNS ASK pl####ntproblem.net
- DNS ASK ne####aryanimal.net
- DNS ASK pl####ntanimal.net
- DNS ASK ne####arymodern.net
- DNS ASK pl####ntmodern.net
- DNS ASK ne#####ryproblem.net
- DNS ASK or###modern.net
- DNS ASK he####modern.net
- DNS ASK le####modern.net
- DNS ASK he####problem.net
- DNS ASK ge####problem.net
- DNS ASK ge####animal.net
- DNS ASK ge####escape.net
- DNS ASK he####escape.net
- DNS ASK le####escape.net
- DNS ASK re####emodern.net
- DNS ASK le####problem.net
- DNS ASK he####animal.net
- DNS ASK le####animal.net
- DNS ASK gl###escape.net
- DNS ASK an####escape.net
- DNS ASK fo####dmodern.net
- DNS ASK an####problem.net
- DNS ASK gl###animal.net
- DNS ASK an####animal.net
- DNS ASK fo####danimal.net
- DNS ASK de####animal.net
- DNS ASK fo####descape.net
- DNS ASK de####modern.net
- DNS ASK fo####dproblem.net
- DNS ASK de####problem.net
- DNS ASK gl####roblem.net
- DNS ASK di####ultmodern.net
- DNS ASK he####roblem.net
- DNS ASK di#####ltproblem.net
- DNS ASK ne####aryescape.net
- DNS ASK pl####ntescape.net
- DNS ASK he###modern.net
- DNS ASK di####ultescape.net
- DNS ASK gl###modern.net
- DNS ASK an####modern.net
- DNS ASK he###animal.net
- DNS ASK di####ultanimal.net
- DNS ASK he###escape.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
