Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Hardware Routing Port Web' = 'C:\fzamweqb\kvjzpvlw.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Proxy Machine Themes Controls Intelligent] 'ImagePath' = 'C:\fzamweqb\kvjzpvlw.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Proxy Machine Themes Controls Intelligent] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- 'C:\fzamweqb\ybespif.exe' "c:\fzamweqb\kvjzpvlw.exe"
- 'C:\fzamweqb\kvjzpvlw.exe'
- 'C:\fzamweqb\ddkc2oa5hd1hniyjbgz.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\fzamweqb\kvjzpvlw.exe
- C:\fzamweqb\ybespif.exe
- C:\fzamweqb\ddkc2oa5hd1hniyjbgz.exe
- %WINDIR%\fzamweqb\dyvsiq
- C:\fzamweqb\dyvsiq
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\fzamweqb\ybespif.exe
- C:\fzamweqb\kvjzpvlw.exe
Удаляет следующие файлы:
- C:\fzamweqb\ddkc2oa5hd1hniyjbgz.exe
- %WINDIR%\fzamweqb\dyvsiq
Подменяет следующие файлы:
- %WINDIR%\fzamweqb\dyvsiq
Сетевая активность:
Подключается к:
- 'ge####manreason.net':80
- 'al####yalmost.net':80
- 'al####yreason.net':80
- 'al####yorderly.net':80
- 'ge#####anorderly.net':80
- 'ex#####nceorderly.net':80
- 'fr####rderly.net':80
- 'fr###value.net':80
- 'ge####manalmost.net':80
- 'ex####encevalue.net':80
- 'ge####manvalue.net':80
- 'me####orderly.net':80
- 'fo####orderly.net':80
- 'fo###wvalue.net':80
- 'be###almost.net':80
- 'me###rvalue.net':80
- 'fo####almost.net':80
- 'al####yvalue.net':80
- 'me####almost.net':80
- 'me####reason.net':80
- 'fo####reason.net':80
- 'ex#####ncereason.net':80
- 'ch####enwrite.net':80
- 'fa###yniece.net':80
- 'fa###ywrite.net':80
- 'fa####oclock.net':80
- 'ch####enoclock.net':80
- 'ci####tteoclock.net':80
- 'pi####eoclock.net':80
- 'ch####enspeak.net':80
- 'ch####enniece.net':80
- 'fa###yspeak.net':80
- 'ei###rspeak.net':80
- 'en####hoclock.net':80
- 'ei####oclock.net':80
- 'fr###almost.net':80
- 'fr###reason.net':80
- 'ex#####ncealmost.net':80
- 'ei###rniece.net':80
- 'en####hspeak.net':80
- 'en####hniece.net':80
- 'en####hwrite.net':80
- 'ei###rwrite.net':80
TCP:
Запросы HTTP GET:
- http://ge####manreason.net/index.php
- http://al####yalmost.net/index.php
- http://al####yreason.net/index.php
- http://al####yorderly.net/index.php
- http://ge#####anorderly.net/index.php
- http://ex#####nceorderly.net/index.php
- http://fr####rderly.net/index.php
- http://fr###value.net/index.php
- http://ge####manalmost.net/index.php
- http://ex####encevalue.net/index.php
- http://ge####manvalue.net/index.php
- http://me####orderly.net/index.php
- http://fo####orderly.net/index.php
- http://fo###wvalue.net/index.php
- http://be###almost.net/index.php
- http://me###rvalue.net/index.php
- http://fo####almost.net/index.php
- http://al####yvalue.net/index.php
- http://me####almost.net/index.php
- http://me####reason.net/index.php
- http://fo####reason.net/index.php
- http://ex#####ncereason.net/index.php
- http://ch####enwrite.net/index.php
- http://fa###yniece.net/index.php
- http://fa###ywrite.net/index.php
- http://fa####oclock.net/index.php
- http://ch####enoclock.net/index.php
- http://ci####tteoclock.net/index.php
- http://pi####eoclock.net/index.php
- http://ch####enspeak.net/index.php
- http://ch####enniece.net/index.php
- http://fa###yspeak.net/index.php
- http://ei###rspeak.net/index.php
- http://en####hoclock.net/index.php
- http://ei####oclock.net/index.php
- http://fr###almost.net/index.php
- http://fr###reason.net/index.php
- http://ex#####ncealmost.net/index.php
- http://ei###rniece.net/index.php
- http://en####hspeak.net/index.php
- http://en####hniece.net/index.php
- http://en####hwrite.net/index.php
- http://ei###rwrite.net/index.php
UDP:
- DNS ASK al####yreason.net
- DNS ASK ge####manreason.net
- DNS ASK ge#####anorderly.net
- DNS ASK ge####manvalue.net
- DNS ASK al####yorderly.net
- DNS ASK al####yalmost.net
- DNS ASK ex#####nceorderly.net
- DNS ASK fr####rderly.net
- DNS ASK fr###value.net
- DNS ASK ge####manalmost.net
- DNS ASK ex####encevalue.net
- DNS ASK fo###wvalue.net
- DNS ASK me####orderly.net
- DNS ASK me###rvalue.net
- DNS ASK kn###almost.net
- DNS ASK be###almost.net
- DNS ASK fo####orderly.net
- DNS ASK fo####almost.net
- DNS ASK al####yvalue.net
- DNS ASK me####almost.net
- DNS ASK me####reason.net
- DNS ASK fo####reason.net
- DNS ASK fa###ywrite.net
- DNS ASK ch####enwrite.net
- DNS ASK ch####enoclock.net
- DNS ASK ei###rspeak.net
- DNS ASK fa####oclock.net
- DNS ASK fa###yniece.net
- DNS ASK ci####tteoclock.net
- DNS ASK pi####eoclock.net
- DNS ASK ch####enspeak.net
- DNS ASK ch####enniece.net
- DNS ASK fa###yspeak.net
- DNS ASK fr###almost.net
- DNS ASK en####hoclock.net
- DNS ASK ex#####ncealmost.net
- DNS ASK ex#####ncereason.net
- DNS ASK fr###reason.net
- DNS ASK ei####oclock.net
- DNS ASK ei###rniece.net
- DNS ASK en####hspeak.net
- DNS ASK en####hniece.net
- DNS ASK en####hwrite.net
- DNS ASK ei###rwrite.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
