Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Net.Tcp Multimedia Problem Counter WWAN Windows' = 'C:\itymxnqwwdwbla\zbgpofw.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Location Coordinator Microsoft Access SSDP] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- 'C:\itymxnqwwdwbla\bmazbudb.exe' "c:\itymxnqwwdwbla\zbgpofw.exe"
- 'C:\itymxnqwwdwbla\zbgpofw.exe'
- 'C:\itymxnqwwdwbla\p0uft3kotulpekhnrms.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\itymxnqwwdwbla\zbgpofw.exe
- C:\itymxnqwwdwbla\bmazbudb.exe
- C:\itymxnqwwdwbla\slh74onl5
- %WINDIR%\itymxnqwwdwbla\ludzkaxv
- C:\itymxnqwwdwbla\ludzkaxv
- C:\itymxnqwwdwbla\p0uft3kotulpekhnrms.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\itymxnqwwdwbla\bmazbudb.exe
- C:\itymxnqwwdwbla\zbgpofw.exe
Удаляет следующие файлы:
- C:\itymxnqwwdwbla\p0uft3kotulpekhnrms.exe
- %WINDIR%\itymxnqwwdwbla\ludzkaxv
Сетевая активность:
Подключается к:
- 'ca####ndiscover.net':80
- 'la####iscover.net':80
- 're####continue.net':80
- 're####master.net':80
- 'el#####ccontinue.net':80
- 'la###master.net':80
- 'ca####ncontinue.net':80
- 'ca####nmaster.net':80
- 'ca####nwonder.net':80
- 'la###wonder.net':80
- 'tr####ontinue.net':80
- 'st####continue.net':80
- 'st####master.net':80
- 'st####wonder.net':80
- 'tr###master.net':80
- 're####wonder.net':80
- 'el####icmaster.net':80
- 'el####icwonder.net':80
- 'el#####cdiscover.net':80
- 're####discover.net':80
- 'la####ontinue.net':80
- 'ag####tmaster.net':80
- 'do####ontinue.net':80
- 'do###master.net':80
- 'do###wonder.net':80
- 'ag####twonder.net':80
- 'se####president.net':80
- 'qu####resident.net':80
- 'qu###caught.net':80
- 'ag####tcontinue.net':80
- 'se####caught.net':80
- 'ni###wonder.net':80
- 'de####master.net':80
- 'de####wonder.net':80
- 'de####discover.net':80
- 'ni####iscover.net':80
- 'do####iscover.net':80
- 'ag####tdiscover.net':80
- 'ni####ontinue.net':80
- 'ni###master.net':80
- 'de####continue.net':80
TCP:
Запросы HTTP GET:
- http://ca####ndiscover.net/index.php?me########
- http://la####iscover.net/index.php?me########
- http://re####continue.net/index.php?me########
- http://re####master.net/index.php?me########
- http://el#####ccontinue.net/index.php?me########
- http://la###master.net/index.php?me########
- http://ca####ncontinue.net/index.php?me########
- http://ca####nmaster.net/index.php?me########
- http://ca####nwonder.net/index.php?me########
- http://la###wonder.net/index.php?me########
- http://tr####ontinue.net/index.php?me########
- http://st####continue.net/index.php?me########
- http://st####master.net/index.php?me########
- http://st####wonder.net/index.php?me########
- http://tr###master.net/index.php?me########
- http://re####wonder.net/index.php?me########
- http://el####icmaster.net/index.php?me########
- http://el####icwonder.net/index.php?me########
- http://el#####cdiscover.net/index.php?me########
- http://re####discover.net/index.php?me########
- http://la####ontinue.net/index.php?me########
- http://ag####tmaster.net/index.php?me########
- http://do####ontinue.net/index.php?me########
- http://do###master.net/index.php?me########
- http://do###wonder.net/index.php?me########
- http://ag####twonder.net/index.php?me########
- http://se####president.net/index.php?me########
- http://qu####resident.net/index.php?me########
- http://qu###caught.net/index.php?me########
- http://ag####tcontinue.net/index.php?me########
- http://se####caught.net/index.php?me########
- http://ni###wonder.net/index.php?me########
- http://de####master.net/index.php?me########
- http://de####wonder.net/index.php?me########
- http://de####discover.net/index.php?me########
- http://ni####iscover.net/index.php?me########
- http://do####iscover.net/index.php?me########
- http://ag####tdiscover.net/index.php?me########
- http://ni####ontinue.net/index.php?me########
- http://ni###master.net/index.php?me########
- http://de####continue.net/index.php?me########
UDP:
- DNS ASK ca####ndiscover.net
- DNS ASK la####iscover.net
- DNS ASK re####continue.net
- DNS ASK re####master.net
- DNS ASK el#####ccontinue.net
- DNS ASK la###master.net
- DNS ASK ca####ncontinue.net
- DNS ASK ca####nmaster.net
- DNS ASK ca####nwonder.net
- DNS ASK la###wonder.net
- DNS ASK el####icmaster.net
- DNS ASK st####master.net
- DNS ASK tr####ontinue.net
- DNS ASK tr###master.net
- DNS ASK tr###wonder.net
- DNS ASK st####wonder.net
- DNS ASK el####icwonder.net
- DNS ASK re####wonder.net
- DNS ASK re####discover.net
- DNS ASK st####continue.net
- DNS ASK el#####cdiscover.net
- DNS ASK ag####tmaster.net
- DNS ASK do####ontinue.net
- DNS ASK do###master.net
- DNS ASK do###wonder.net
- DNS ASK ag####twonder.net
- DNS ASK se####president.net
- DNS ASK qu####resident.net
- DNS ASK qu###caught.net
- DNS ASK ag####tcontinue.net
- DNS ASK se####caught.net
- DNS ASK ag####tdiscover.net
- DNS ASK de####wonder.net
- DNS ASK ni###wonder.net
- DNS ASK ni####iscover.net
- DNS ASK la####ontinue.net
- DNS ASK de####discover.net
- DNS ASK ni####ontinue.net
- DNS ASK do####iscover.net
- DNS ASK de####continue.net
- DNS ASK de####master.net
- DNS ASK ni###master.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
