Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Compatibility Level Microsoft Routing' = 'C:\zewcorypc\efjmhpc.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Extensible Backup Player User] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- 'C:\zewcorypc\azieqcwl.exe' "c:\zewcorypc\efjmhpc.exe"
- 'C:\zewcorypc\efjmhpc.exe'
- 'C:\zewcorypc\dxf3n41t9k42gdr.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\zewcorypc\efjmhpc.exe
- C:\zewcorypc\azieqcwl.exe
- C:\zewcorypc\jvrkf8m7xo2a
- %WINDIR%\zewcorypc\rlliqt5b65l
- C:\zewcorypc\rlliqt5b65l
- C:\zewcorypc\dxf3n41t9k42gdr.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\zewcorypc\azieqcwl.exe
- C:\zewcorypc\efjmhpc.exe
Удаляет следующие файлы:
- C:\zewcorypc\dxf3n41t9k42gdr.exe
- %WINDIR%\zewcorypc\rlliqt5b65l
Сетевая активность:
Подключается к:
- 're####ewhile.net':80
- 'or####uestion.net':80
- 're####eschool.net':80
- 'or###while.net':80
- 're#####therefore.net':80
- 'le####school.net':80
- 're####equestion.net':80
- 'or####herefore.net':80
- 'ne####arywhile.net':80
- 'pl#####tquestion.net':80
- 'ne####aryschool.net':80
- 'pl####ntwhile.net':80
- 'ne#####rytherefore.net':80
- 'or###school.net':80
- 'ne#####ryquestion.net':80
- 'pl#####ttherefore.net':80
- 'he####school.net':80
- 'va####sschool.net':80
- 're####school.net':80
- 'ge####question.net':80
- 'ge####therefore.net':80
- 'va####squestion.net':80
- 're####question.net':80
- 'va####swhile.net':80
- 're###nwhile.net':80
- 'le####question.net':80
- 'he####question.net':80
- 'le###rwhile.net':80
- 'he###nwhile.net':80
- 'ge####school.net':80
- 'ge###ewhile.net':80
- 'le####therefore.net':80
- 'he####therefore.net':80
- 'pl####ntschool.net':80
- 'fo####dschool.net':80
- 'de###ewhile.net':80
- 're####forest.net':80
- 'de####school.net':80
- 'fo####dquestion.net':80
- 'de####therefore.net':80
- 'fo####dwhile.net':80
- 'de####question.net':80
- 're###nwheat.net':80
- 'va####sanger.net':80
- 'ge####forest.net':80
- 'va####swheat.net':80
- 're####always.net':80
- 'va####sforest.net':80
- 're###nanger.net':80
- 'va####salways.net':80
- 'fo#####therefore.net':80
- 'di####ultwhile.net':80
- 'he###while.net':80
- 'di####ultschool.net':80
- 'he###school.net':80
- 'di#####lttherefore.net':80
- 'he####herefore.net':80
- 'di#####ltquestion.net':80
- 'he####uestion.net':80
- 'an###rwhile.net':80
- 'gl###while.net':80
- 'an####school.net':80
- 'gl###school.net':80
- 'an####therefore.net':80
- 'gl####herefore.net':80
- 'an####question.net':80
- 'gl####uestion.net':80
TCP:
Запросы HTTP GET:
- http://re####ewhile.net/index.php?me########
- http://or####uestion.net/index.php?me########
- http://re####eschool.net/index.php?me########
- http://or###while.net/index.php?me########
- http://re#####therefore.net/index.php?me########
- http://le####school.net/index.php?me########
- http://re####equestion.net/index.php?me########
- http://or####herefore.net/index.php?me########
- http://ne####arywhile.net/index.php?me########
- http://pl#####tquestion.net/index.php?me########
- http://ne####aryschool.net/index.php?me########
- http://pl####ntwhile.net/index.php?me########
- http://ne#####rytherefore.net/index.php?me########
- http://or###school.net/index.php?me########
- http://ne#####ryquestion.net/index.php?me########
- http://pl#####ttherefore.net/index.php?me########
- http://he####school.net/index.php?me########
- http://va####sschool.net/index.php?me########
- http://re####school.net/index.php?me########
- http://ge####question.net/index.php?me########
- http://ge####therefore.net/index.php?me########
- http://va####squestion.net/index.php?me########
- http://re####question.net/index.php?me########
- http://va####swhile.net/index.php?me########
- http://re###nwhile.net/index.php?me########
- http://le####question.net/index.php?me########
- http://he####question.net/index.php?me########
- http://le###rwhile.net/index.php?me########
- http://he###nwhile.net/index.php?me########
- http://ge####school.net/index.php?me########
- http://ge###ewhile.net/index.php?me########
- http://le####therefore.net/index.php?me########
- http://he####therefore.net/index.php?me########
- http://pl####ntschool.net/index.php?me########
- http://fo####dschool.net/index.php?me########
- http://de###ewhile.net/index.php?me########
- http://re####forest.net/index.php?me########
- http://de####school.net/index.php?me########
- http://fo####dquestion.net/index.php?me########
- http://de####therefore.net/index.php?me########
- http://fo####dwhile.net/index.php?me########
- http://de####question.net/index.php?me########
- http://re###nwheat.net/index.php?me########
- http://va####sanger.net/index.php?me########
- http://ge####forest.net/index.php?me########
- http://va####swheat.net/index.php?me########
- http://re####always.net/index.php?me########
- http://va####sforest.net/index.php?me########
- http://re###nanger.net/index.php?me########
- http://va####salways.net/index.php?me########
- http://fo#####therefore.net/index.php?me########
- http://di####ultwhile.net/index.php?me########
- http://he###while.net/index.php?me########
- http://di####ultschool.net/index.php?me########
- http://he###school.net/index.php?me########
- http://di#####lttherefore.net/index.php?me########
- http://he####herefore.net/index.php?me########
- http://di#####ltquestion.net/index.php?me########
- http://he####uestion.net/index.php?me########
- http://an###rwhile.net/index.php?me########
- http://gl###while.net/index.php?me########
- http://an####school.net/index.php?me########
- http://gl###school.net/index.php?me########
- http://an####therefore.net/index.php?me########
- http://gl####herefore.net/index.php?me########
- http://an####question.net/index.php?me########
- http://gl####uestion.net/index.php?me########
UDP:
- DNS ASK or####uestion.net
- DNS ASK re####equestion.net
- DNS ASK or###while.net
- DNS ASK re####ewhile.net
- DNS ASK le####school.net
- DNS ASK he####school.net
- DNS ASK or####herefore.net
- DNS ASK re#####therefore.net
- DNS ASK re####eschool.net
- DNS ASK ne####arywhile.net
- DNS ASK pl#####tquestion.net
- DNS ASK ne####aryschool.net
- DNS ASK pl####ntwhile.net
- DNS ASK ne#####rytherefore.net
- DNS ASK or###school.net
- DNS ASK ne#####ryquestion.net
- DNS ASK pl#####ttherefore.net
- DNS ASK re####school.net
- DNS ASK va####swhile.net
- DNS ASK ge####therefore.net
- DNS ASK va####sschool.net
- DNS ASK re####question.net
- DNS ASK va#####therefore.net
- DNS ASK re###nwhile.net
- DNS ASK va####squestion.net
- DNS ASK ge####question.net
- DNS ASK le####question.net
- DNS ASK he####question.net
- DNS ASK le###rwhile.net
- DNS ASK he###nwhile.net
- DNS ASK ge####school.net
- DNS ASK ge###ewhile.net
- DNS ASK le####therefore.net
- DNS ASK he####therefore.net
- DNS ASK de###ewhile.net
- DNS ASK fo####dwhile.net
- DNS ASK de####school.net
- DNS ASK fo####dschool.net
- DNS ASK de####therefore.net
- DNS ASK fo#####therefore.net
- DNS ASK de####question.net
- DNS ASK fo####dquestion.net
- DNS ASK re####forest.net
- DNS ASK re###nwheat.net
- DNS ASK va####sanger.net
- DNS ASK ge####forest.net
- DNS ASK va####swheat.net
- DNS ASK re####always.net
- DNS ASK va####sforest.net
- DNS ASK re###nanger.net
- DNS ASK va####salways.net
- DNS ASK he###while.net
- DNS ASK di#####ltquestion.net
- DNS ASK he###school.net
- DNS ASK di####ultwhile.net
- DNS ASK he####herefore.net
- DNS ASK pl####ntschool.net
- DNS ASK he####uestion.net
- DNS ASK di#####lttherefore.net
- DNS ASK di####ultschool.net
- DNS ASK an###rwhile.net
- DNS ASK gl###while.net
- DNS ASK an####school.net
- DNS ASK gl###school.net
- DNS ASK an####therefore.net
- DNS ASK gl####herefore.net
- DNS ASK an####question.net
- DNS ASK gl####uestion.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
