Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Health Block Distributed Volume' = 'C:\olvedfwmr\thmnqfvny.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Source File Manager List HomeGroup WLAN] 'ImagePath' = 'C:\olvedfwmr\thmnqfvny.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Source File Manager List HomeGroup WLAN] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- 'C:\olvedfwmr\mycdeugdqvm.exe' "c:\olvedfwmr\thmnqfvny.exe"
- 'C:\olvedfwmr\thmnqfvny.exe'
- 'C:\olvedfwmr\nm38n7oycukv7azli0.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\olvedfwmr\thmnqfvny.exe
- C:\olvedfwmr\mycdeugdqvm.exe
- C:\olvedfwmr\nm38n7oycukv7azli0.exe
- %WINDIR%\olvedfwmr\g9lznqscej
- C:\olvedfwmr\g9lznqscej
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\olvedfwmr\mycdeugdqvm.exe
- C:\olvedfwmr\thmnqfvny.exe
Удаляет следующие файлы:
- C:\olvedfwmr\nm38n7oycukv7azli0.exe
- %WINDIR%\olvedfwmr\g9lznqscej
Подменяет следующие файлы:
- %WINDIR%\olvedfwmr\g9lznqscej
Сетевая активность:
Подключается к:
- 'ci####tteafraid.net':80
- 'pi####eafraid.net':80
- 'ci####ttedinner.net':80
- 'ch####enmeasure.net':80
- 'ci####ttecircle.net':80
- 'pi####ecircle.net':80
- 'th####circle.net':80
- 'fi####circle.net':80
- 'th####afraid.net':80
- 'pi####edinner.net':80
- 'ci#####temeasure.net':80
- 'pi####emeasure.net':80
- 'en####hmeasure.net':80
- 'ei####measure.net':80
- 'fa####circle.net':80
- 'ei####afraid.net':80
- 'en####hdinner.net':80
- 'ei####dinner.net':80
- 'fa####dinner.net':80
- 'ch####endinner.net':80
- 'fa####measure.net':80
- 'ch####encircle.net':80
- 'fa####afraid.net':80
- 'ch####enafraid.net':80
- 'fi####afraid.net':80
- 'su####afraid.net':80
- 'fo####ndinner.net':80
- 'su####dinner.net':80
- 'fo####ncircle.net':80
- 'su####circle.net':80
- 'fo####nafraid.net':80
- 'pe####circle.net':80
- 'ma####eafraid.net':80
- 'pe####afraid.net':80
- 'fo####nmeasure.net':80
- 'su####measure.net':80
- 'ma####ecircle.net':80
- 'fi####measure.net':80
- 'ri###circle.net':80
- 'wh####rcircle.net':80
- 'th####dinner.net':80
- 'fi####dinner.net':80
- 'th####measure.net':80
- 'wh####rdinner.net':80
- 'ri####easure.net':80
- 'wh####rmeasure.net':80
- 'ri###afraid.net':80
- 'wh####rafraid.net':80
- 'ri###dinner.net':80
TCP:
Запросы HTTP GET:
- http://ci####tteafraid.net/index.php
- http://pi####eafraid.net/index.php
- http://ci####ttedinner.net/index.php
- http://ch####enmeasure.net/index.php
- http://ci####ttecircle.net/index.php
- http://pi####ecircle.net/index.php
- http://th####circle.net/index.php
- http://fi####circle.net/index.php
- http://th####afraid.net/index.php
- http://pi####edinner.net/index.php
- http://ci#####temeasure.net/index.php
- http://pi####emeasure.net/index.php
- http://en####hmeasure.net/index.php
- http://ei####measure.net/index.php
- http://fa####circle.net/index.php
- http://ei####afraid.net/index.php
- http://en####hdinner.net/index.php
- http://ei####dinner.net/index.php
- http://fa####dinner.net/index.php
- http://ch####endinner.net/index.php
- http://fa####measure.net/index.php
- http://ch####encircle.net/index.php
- http://fa####afraid.net/index.php
- http://ch####enafraid.net/index.php
- http://fi####afraid.net/index.php
- http://su####afraid.net/index.php
- http://fo####ndinner.net/index.php
- http://su####dinner.net/index.php
- http://fo####ncircle.net/index.php
- http://su####circle.net/index.php
- http://fo####nafraid.net/index.php
- http://pe####circle.net/index.php
- http://ma####eafraid.net/index.php
- http://pe####afraid.net/index.php
- http://fo####nmeasure.net/index.php
- http://su####measure.net/index.php
- http://ma####ecircle.net/index.php
- http://fi####measure.net/index.php
- http://ri###circle.net/index.php
- http://wh####rcircle.net/index.php
- http://th####dinner.net/index.php
- http://fi####dinner.net/index.php
- http://th####measure.net/index.php
- http://wh####rdinner.net/index.php
- http://ri####easure.net/index.php
- http://wh####rmeasure.net/index.php
- http://ri###afraid.net/index.php
- http://wh####rafraid.net/index.php
- http://ri###dinner.net/index.php
UDP:
- DNS ASK ci####tteafraid.net
- DNS ASK pi####eafraid.net
- DNS ASK ci####ttedinner.net
- DNS ASK ch####enmeasure.net
- DNS ASK ci####ttecircle.net
- DNS ASK pi####ecircle.net
- DNS ASK th####circle.net
- DNS ASK fi####circle.net
- DNS ASK th####afraid.net
- DNS ASK pi####edinner.net
- DNS ASK ci#####temeasure.net
- DNS ASK pi####emeasure.net
- DNS ASK fa####measure.net
- DNS ASK ei####dinner.net
- DNS ASK en####hmeasure.net
- DNS ASK ei####measure.net
- DNS ASK en####hafraid.net
- DNS ASK ei####afraid.net
- DNS ASK en####hdinner.net
- DNS ASK ch####enafraid.net
- DNS ASK fa####dinner.net
- DNS ASK ch####endinner.net
- DNS ASK fa####circle.net
- DNS ASK ch####encircle.net
- DNS ASK fa####afraid.net
- DNS ASK su####afraid.net
- DNS ASK fo####ndinner.net
- DNS ASK su####dinner.net
- DNS ASK fo####ncircle.net
- DNS ASK su####circle.net
- DNS ASK fo####nafraid.net
- DNS ASK pe####circle.net
- DNS ASK ma####eafraid.net
- DNS ASK pe####afraid.net
- DNS ASK fo####nmeasure.net
- DNS ASK su####measure.net
- DNS ASK ma####ecircle.net
- DNS ASK wh####rmeasure.net
- DNS ASK th####measure.net
- DNS ASK fi####measure.net
- DNS ASK ri###circle.net
- DNS ASK fi####afraid.net
- DNS ASK th####dinner.net
- DNS ASK fi####dinner.net
- DNS ASK ri###dinner.net
- DNS ASK wh####rdinner.net
- DNS ASK ri####easure.net
- DNS ASK wh####rcircle.net
- DNS ASK ri###afraid.net
- DNS ASK wh####rafraid.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
