Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Control COM Card Scheduler Discovery Call' = 'C:\hkdduphvyqxscvg\nxfihdujxt.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Acquisition WinHTTP Reporting] 'ImagePath' = 'C:\hkdduphvyqxscvg\nxfihdujxt.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Acquisition WinHTTP Reporting] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- 'C:\hkdduphvyqxscvg\mqbawbh.exe' "c:\hkdduphvyqxscvg\nxfihdujxt.exe"
- 'C:\hkdduphvyqxscvg\nxfihdujxt.exe'
- 'C:\hkdduphvyqxscvg\ios2n5sprhhkbdf.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\hkdduphvyqxscvg\nxfihdujxt.exe
- C:\hkdduphvyqxscvg\mqbawbh.exe
- C:\hkdduphvyqxscvg\ios2n5sprhhkbdf.exe
- %WINDIR%\hkdduphvyqxscvg\exuxkle
- C:\hkdduphvyqxscvg\exuxkle
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\hkdduphvyqxscvg\mqbawbh.exe
- C:\hkdduphvyqxscvg\nxfihdujxt.exe
Удаляет следующие файлы:
- C:\hkdduphvyqxscvg\ios2n5sprhhkbdf.exe
- %WINDIR%\hkdduphvyqxscvg\exuxkle
Сетевая активность:
Подключается к:
- 'mo####inforever.net':80
- 'po####lebeing.net':80
- 'mo####inbeing.net':80
- 'po####lebottom.net':80
- 'mo####inbottom.net':80
- 'po####leforever.net':80
- 'si####bottom.net':80
- 'mo####forever.net':80
- 'si####forever.net':80
- 'po####lebeyond.net':80
- 'mo####inbeyond.net':80
- 'mo####bottom.net':80
- 'su####tbeyond.net':80
- 'wi####bottom.net':80
- 'pe####sbottom.net':80
- 'su####tforever.net':80
- 'su####tbeing.net':80
- 'wi###rbeing.net':80
- 'pe####sbeing.net':80
- 'wi####beyond.net':80
- 'pe####sbeyond.net':80
- 'wi####forever.net':80
- 'pe####sforever.net':80
- 'wi###wbeing.net':80
- 'pa###yellow.net':80
- 'fi###travel.net':80
- 'pa###travel.net':80
- 'fi###close.net':80
- 'pa###close.net':80
- 'fi###yellow.net':80
- 'wo###close.net':80
- 'sm###yellow.net':80
- 'wo###yellow.net':80
- 'fi###space.net':80
- 'pa###space.net':80
- 'sm###close.net':80
- 'si####beyond.net':80
- 'la###bottom.net':80
- 'se####bottom.net':80
- 'mo###rbeing.net':80
- 'si###ebeing.net':80
- 'mo####beyond.net':80
- 'se###abeing.net':80
- 'la###beyond.net':80
- 'se####beyond.net':80
- 'la####orever.net':80
- 'se####forever.net':80
- 'la###being.net':80
TCP:
Запросы HTTP GET:
- http://mo####inforever.net/index.php
- http://po####lebeing.net/index.php
- http://mo####inbeing.net/index.php
- http://po####lebottom.net/index.php
- http://mo####inbottom.net/index.php
- http://po####leforever.net/index.php
- http://si####bottom.net/index.php
- http://mo####forever.net/index.php
- http://si####forever.net/index.php
- http://po####lebeyond.net/index.php
- http://mo####inbeyond.net/index.php
- http://mo####bottom.net/index.php
- http://su####tbeyond.net/index.php
- http://wi####bottom.net/index.php
- http://pe####sbottom.net/index.php
- http://su####tforever.net/index.php
- http://su####tbeing.net/index.php
- http://wi###rbeing.net/index.php
- http://pe####sbeing.net/index.php
- http://wi####beyond.net/index.php
- http://pe####sbeyond.net/index.php
- http://wi####forever.net/index.php
- http://pe####sforever.net/index.php
- http://wi###wbeing.net/index.php
- http://pa###yellow.net/index.php
- http://fi###travel.net/index.php
- http://pa###travel.net/index.php
- http://fi###close.net/index.php
- http://pa###close.net/index.php
- http://fi###yellow.net/index.php
- http://wo###close.net/index.php
- http://sm###yellow.net/index.php
- http://wo###yellow.net/index.php
- http://fi###space.net/index.php
- http://pa###space.net/index.php
- http://sm###close.net/index.php
- http://si####beyond.net/index.php
- http://la###bottom.net/index.php
- http://se####bottom.net/index.php
- http://mo###rbeing.net/index.php
- http://si###ebeing.net/index.php
- http://mo####beyond.net/index.php
- http://se###abeing.net/index.php
- http://la###beyond.net/index.php
- http://se####beyond.net/index.php
- http://la####orever.net/index.php
- http://se####forever.net/index.php
- http://la###being.net/index.php
UDP:
- DNS ASK mo####inforever.net
- DNS ASK po####lebeing.net
- DNS ASK mo####inbeing.net
- DNS ASK po####lebottom.net
- DNS ASK mo####inbottom.net
- DNS ASK po####leforever.net
- DNS ASK si####bottom.net
- DNS ASK mo####forever.net
- DNS ASK si####forever.net
- DNS ASK po####lebeyond.net
- DNS ASK mo####inbeyond.net
- DNS ASK mo####bottom.net
- DNS ASK su####tbeyond.net
- DNS ASK wi####bottom.net
- DNS ASK pe####sbottom.net
- DNS ASK su####tforever.net
- DNS ASK su####tbeing.net
- DNS ASK wi###rbeing.net
- DNS ASK pe####sbeing.net
- DNS ASK wi####beyond.net
- DNS ASK pe####sbeyond.net
- DNS ASK wi####forever.net
- DNS ASK pe####sforever.net
- DNS ASK wi###wbeing.net
- DNS ASK pa###yellow.net
- DNS ASK fi###travel.net
- DNS ASK pa###travel.net
- DNS ASK fi###close.net
- DNS ASK pa###close.net
- DNS ASK fi###yellow.net
- DNS ASK wo###close.net
- DNS ASK sm###yellow.net
- DNS ASK wo###yellow.net
- DNS ASK fi###space.net
- DNS ASK pa###space.net
- DNS ASK sm###close.net
- DNS ASK si####beyond.net
- DNS ASK la###bottom.net
- DNS ASK se####bottom.net
- DNS ASK mo###rbeing.net
- DNS ASK si###ebeing.net
- DNS ASK mo####beyond.net
- DNS ASK se###abeing.net
- DNS ASK la###beyond.net
- DNS ASK se####beyond.net
- DNS ASK la####orever.net
- DNS ASK se####forever.net
- DNS ASK la###being.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
