Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Experience RPC Telephony Card Health' = 'C:\gwuelmkgvpug\vuouenefvb.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Process Transaction WLAN Link Installer COM+] 'ImagePath' = 'C:\gwuelmkgvpug\vuouenefvb.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Process Transaction WLAN Link Installer COM+] 'Start' = '00000002'
Вредоносные функции:
Запускает на исполнение:
- 'C:\gwuelmkgvpug\ttwfxmz.exe' "c:\gwuelmkgvpug\vuouenefvb.exe"
- 'C:\gwuelmkgvpug\vuouenefvb.exe'
- 'C:\gwuelmkgvpug\ns2um0pfsvou4jbd.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\gwuelmkgvpug\vuouenefvb.exe
- C:\gwuelmkgvpug\ttwfxmz.exe
- C:\gwuelmkgvpug\ns2um0pfsvou4jbd.exe
- %WINDIR%\gwuelmkgvpug\ic96dkhiygs
- C:\gwuelmkgvpug\ic96dkhiygs
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\gwuelmkgvpug\ttwfxmz.exe
- C:\gwuelmkgvpug\vuouenefvb.exe
Удаляет следующие файлы:
- C:\gwuelmkgvpug\ns2um0pfsvou4jbd.exe
- %WINDIR%\gwuelmkgvpug\ic96dkhiygs
Подменяет следующие файлы:
- %WINDIR%\gwuelmkgvpug\ic96dkhiygs
Сетевая активность:
Подключается к:
- 'fo####nshare.net':80
- 'su###nshare.net':80
- 'fo####nshake.net':80
- 'wh####rhappen.net':80
- 'ri###nearly.net':80
- 'wh####rnearly.net':80
- 'su###nshake.net':80
- 'su####nearly.net':80
- 'ma####eshare.net':80
- 'pe###nshare.net':80
- 'fo####nhappen.net':80
- 'su####happen.net':80
- 'fo####nnearly.net':80
- 'fi###eshake.net':80
- 'th####happen.net':80
- 'fi####happen.net':80
- 'th###hshare.net':80
- 'fi###eshare.net':80
- 'th###hshake.net':80
- 'th####nearly.net':80
- 'ri###shake.net':80
- 'wh####rshake.net':80
- 'ri###happen.net':80
- 'fi####nearly.net':80
- 'ri###share.net':80
- 'wh####rshare.net':80
- 'ma####eshake.net':80
- 'ei####service.net':80
- 'en####hsuppose.net':80
- 'ei####suppose.net':80
- 'en####hriver.net':80
- 'ei###rriver.net':80
- 'en####hservice.net':80
- 'en####hmister.net':80
- 'fa####service.net':80
- 'ch####enservice.net':80
- 'fa####suppose.net':80
- 'ei####mister.net':80
- 'fa###yriver.net':80
- 'ch####enriver.net':80
- 'ma####enearly.net':80
- 'pe####nearly.net':80
- 'be####eshare.net':80
- 'pe###nshake.net':80
- 'ma####ehappen.net':80
- 'pe####happen.net':80
- 'ex###tshare.net':80
- 'ex####happen.net':80
- 'be####enearly.net':80
- 'ex####nearly.net':80
- 'be####eshake.net':80
- 'ex###tshake.net':80
- 'be####ehappen.net':80
TCP:
Запросы HTTP GET:
- http://fo####nshare.net/index.php
- http://su###nshare.net/index.php
- http://fo####nshake.net/index.php
- http://wh####rhappen.net/index.php
- http://ri###nearly.net/index.php
- http://wh####rnearly.net/index.php
- http://su###nshake.net/index.php
- http://su####nearly.net/index.php
- http://ma####eshare.net/index.php
- http://pe###nshare.net/index.php
- http://fo####nhappen.net/index.php
- http://su####happen.net/index.php
- http://fo####nnearly.net/index.php
- http://fi###eshake.net/index.php
- http://th####happen.net/index.php
- http://fi####happen.net/index.php
- http://th###hshare.net/index.php
- http://fi###eshare.net/index.php
- http://th###hshake.net/index.php
- http://th####nearly.net/index.php
- http://ri###shake.net/index.php
- http://wh####rshake.net/index.php
- http://ri###happen.net/index.php
- http://fi####nearly.net/index.php
- http://ri###share.net/index.php
- http://wh####rshare.net/index.php
- http://ma####eshake.net/index.php
- http://ei####service.net/index.php
- http://en####hsuppose.net/index.php
- http://ei####suppose.net/index.php
- http://en####hriver.net/index.php
- http://ei###rriver.net/index.php
- http://en####hservice.net/index.php
- http://en####hmister.net/index.php
- http://fa####service.net/index.php
- http://ch####enservice.net/index.php
- http://fa####suppose.net/index.php
- http://ei####mister.net/index.php
- http://fa###yriver.net/index.php
- http://ch####enriver.net/index.php
- http://ma####enearly.net/index.php
- http://pe####nearly.net/index.php
- http://be####eshare.net/index.php
- http://pe###nshake.net/index.php
- http://ma####ehappen.net/index.php
- http://pe####happen.net/index.php
- http://ex###tshare.net/index.php
- http://ex####happen.net/index.php
- http://be####enearly.net/index.php
- http://ex####nearly.net/index.php
- http://be####eshake.net/index.php
- http://ex###tshake.net/index.php
- http://be####ehappen.net/index.php
UDP:
- DNS ASK fo####nshare.net
- DNS ASK su###nshare.net
- DNS ASK fo####nshake.net
- DNS ASK wh####rhappen.net
- DNS ASK ri###nearly.net
- DNS ASK wh####rnearly.net
- DNS ASK su###nshake.net
- DNS ASK su####nearly.net
- DNS ASK ma####eshare.net
- DNS ASK pe###nshare.net
- DNS ASK fo####nhappen.net
- DNS ASK su####happen.net
- DNS ASK fo####nnearly.net
- DNS ASK fi###eshake.net
- DNS ASK th####happen.net
- DNS ASK fi####happen.net
- DNS ASK th###hshare.net
- DNS ASK fi###eshare.net
- DNS ASK th###hshake.net
- DNS ASK th####nearly.net
- DNS ASK ri###shake.net
- DNS ASK wh####rshake.net
- DNS ASK ri###happen.net
- DNS ASK fi####nearly.net
- DNS ASK ri###share.net
- DNS ASK wh####rshare.net
- DNS ASK ma####eshake.net
- DNS ASK ei####service.net
- DNS ASK en####hsuppose.net
- DNS ASK ei####suppose.net
- DNS ASK en####hriver.net
- DNS ASK ei###rriver.net
- DNS ASK en####hservice.net
- DNS ASK en####hmister.net
- DNS ASK fa####service.net
- DNS ASK ch####enservice.net
- DNS ASK fa####suppose.net
- DNS ASK ei####mister.net
- DNS ASK fa###yriver.net
- DNS ASK ch####enriver.net
- DNS ASK ma####enearly.net
- DNS ASK pe####nearly.net
- DNS ASK be####eshare.net
- DNS ASK pe###nshake.net
- DNS ASK ma####ehappen.net
- DNS ASK pe####happen.net
- DNS ASK ex###tshare.net
- DNS ASK ex####happen.net
- DNS ASK be####enearly.net
- DNS ASK ex####nearly.net
- DNS ASK be####eshake.net
- DNS ASK ex###tshake.net
- DNS ASK be####ehappen.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
