Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'RPC Window Player Client AuthIP Thread Proxy' = 'C:\wegnpdhttbxg\tepudmvclsqc.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Peer DHCP Software Center Routing] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- 'C:\wegnpdhttbxg\yazshxambwl.exe' "c:\wegnpdhttbxg\tepudmvclsqc.exe"
- 'C:\wegnpdhttbxg\tepudmvclsqc.exe'
- 'C:\wegnpdhttbxg\ogmu22niswmac2msjojo.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\wegnpdhttbxg\tepudmvclsqc.exe
- C:\wegnpdhttbxg\yazshxambwl.exe
- C:\wegnpdhttbxg\q2ituhdiaihy
- %WINDIR%\wegnpdhttbxg\moa33pybt
- C:\wegnpdhttbxg\moa33pybt
- C:\wegnpdhttbxg\ogmu22niswmac2msjojo.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\wegnpdhttbxg\yazshxambwl.exe
- C:\wegnpdhttbxg\tepudmvclsqc.exe
Удаляет следующие файлы:
- C:\wegnpdhttbxg\ogmu22niswmac2msjojo.exe
- %WINDIR%\wegnpdhttbxg\moa33pybt
Сетевая активность:
Подключается к:
- 'tw####master.net':80
- 'mi####master.net':80
- 'tw####continue.net':80
- 'mi####discover.net':80
- 'tw####wonder.net':80
- 'mi####wonder.net':80
- 'mi####continue.net':80
- 'of###wonder.net':80
- 'al###master.net':80
- 'of###master.net':80
- 'al####iscover.net':80
- 'of####iscover.net':80
- 'al###wonder.net':80
- 'st####econtinue.net':80
- 'mo####gdiscover.net':80
- 'ra####discover.net':80
- 'hi####ymaster.net':80
- 'st####emaster.net':80
- 'hi####ycontinue.net':80
- 'mo####gwonder.net':80
- 'mo####gcontinue.net':80
- 'ra####continue.net':80
- 'tw####discover.net':80
- 'ra####wonder.net':80
- 'mo####gmaster.net':80
- 'ra####master.net':80
- 'pr####tcontinue.net':80
- 'th####ontinue.net':80
- 'cl###caught.net':80
- 'th###wonder.net':80
- 'pr####tmaster.net':80
- 'th###master.net':80
- 'th###caught.net':80
- 'th####rouble.net':80
- 'cl###strong.net':80
- 'th###strong.net':80
- 'cl####resident.net':80
- 'th####resident.net':80
- 'cl####rouble.net':80
- 'ch####iscover.net':80
- 'co####ewonder.net':80
- 'ch###wonder.net':80
- 'al####ontinue.net':80
- 'of####ontinue.net':80
- 'co####ediscover.net':80
- 'co####emaster.net':80
- 'pr####tdiscover.net':80
- 'th####iscover.net':80
- 'pr####twonder.net':80
- 'ch###master.net':80
- 'co####econtinue.net':80
- 'ch####ontinue.net':80
TCP:
Запросы HTTP GET:
- http://tw####master.net/index.php?me########
- http://mi####master.net/index.php?me########
- http://tw####continue.net/index.php?me########
- http://mi####discover.net/index.php?me########
- http://tw####wonder.net/index.php?me########
- http://mi####wonder.net/index.php?me########
- http://mi####continue.net/index.php?me########
- http://of###wonder.net/index.php?me########
- http://al###master.net/index.php?me########
- http://of###master.net/index.php?me########
- http://al####iscover.net/index.php?me########
- http://of####iscover.net/index.php?me########
- http://al###wonder.net/index.php?me########
- http://st####econtinue.net/index.php?me########
- http://mo####gdiscover.net/index.php?me########
- http://ra####discover.net/index.php?me########
- http://hi####ymaster.net/index.php?me########
- http://st####emaster.net/index.php?me########
- http://hi####ycontinue.net/index.php?me########
- http://mo####gwonder.net/index.php?me########
- http://mo####gcontinue.net/index.php?me########
- http://ra####continue.net/index.php?me########
- http://tw####discover.net/index.php?me########
- http://ra####wonder.net/index.php?me########
- http://mo####gmaster.net/index.php?me########
- http://ra####master.net/index.php?me########
- http://pr####tcontinue.net/index.php?me########
- http://th####ontinue.net/index.php?me########
- http://cl###caught.net/index.php?me########
- http://th###wonder.net/index.php?me########
- http://pr####tmaster.net/index.php?me########
- http://th###master.net/index.php?me########
- http://th###caught.net/index.php?me########
- http://th####rouble.net/index.php?me########
- http://cl###strong.net/index.php?me########
- http://th###strong.net/index.php?me########
- http://cl####resident.net/index.php?me########
- http://th####resident.net/index.php?me########
- http://cl####rouble.net/index.php?me########
- http://ch####iscover.net/index.php?me########
- http://co####ewonder.net/index.php?me########
- http://ch###wonder.net/index.php?me########
- http://al####ontinue.net/index.php?me########
- http://of####ontinue.net/index.php?me########
- http://co####ediscover.net/index.php?me########
- http://co####emaster.net/index.php?me########
- http://pr####tdiscover.net/index.php?me########
- http://th####iscover.net/index.php?me########
- http://pr####twonder.net/index.php?me########
- http://ch###master.net/index.php?me########
- http://co####econtinue.net/index.php?me########
- http://ch####ontinue.net/index.php?me########
UDP:
- DNS ASK mi####wonder.net
- DNS ASK tw####master.net
- DNS ASK mi####master.net
- DNS ASK tw####discover.net
- DNS ASK mi####discover.net
- DNS ASK tw####wonder.net
- DNS ASK tw####continue.net
- DNS ASK al###wonder.net
- DNS ASK of###wonder.net
- DNS ASK al###master.net
- DNS ASK mi####continue.net
- DNS ASK al####iscover.net
- DNS ASK of####iscover.net
- DNS ASK hi####ycontinue.net
- DNS ASK st####econtinue.net
- DNS ASK mo####gdiscover.net
- DNS ASK st####ewonder.net
- DNS ASK hi####ymaster.net
- DNS ASK st####emaster.net
- DNS ASK ra####discover.net
- DNS ASK ra####master.net
- DNS ASK mo####gcontinue.net
- DNS ASK ra####continue.net
- DNS ASK mo####gwonder.net
- DNS ASK ra####wonder.net
- DNS ASK mo####gmaster.net
- DNS ASK of###master.net
- DNS ASK pr####tcontinue.net
- DNS ASK th####ontinue.net
- DNS ASK cl###caught.net
- DNS ASK th###wonder.net
- DNS ASK pr####tmaster.net
- DNS ASK th###master.net
- DNS ASK th###caught.net
- DNS ASK th####rouble.net
- DNS ASK cl###strong.net
- DNS ASK th###strong.net
- DNS ASK cl####resident.net
- DNS ASK th####resident.net
- DNS ASK cl####rouble.net
- DNS ASK ch####iscover.net
- DNS ASK co####ewonder.net
- DNS ASK ch###wonder.net
- DNS ASK al####ontinue.net
- DNS ASK of####ontinue.net
- DNS ASK co####ediscover.net
- DNS ASK co####emaster.net
- DNS ASK pr####tdiscover.net
- DNS ASK th####iscover.net
- DNS ASK pr####twonder.net
- DNS ASK ch###master.net
- DNS ASK co####econtinue.net
- DNS ASK ch####ontinue.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
