Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'User-mode Reports Player Driver' = 'C:\igvivvdur\jqlbiqoagnjb.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Auto-Discovery Connection Volume] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- 'C:\igvivvdur\hjuiwqda.exe' "c:\igvivvdur\jqlbiqoagnjb.exe"
- 'C:\igvivvdur\jqlbiqoagnjb.exe'
- 'C:\igvivvdur\avdw3ae5picfupadq.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\igvivvdur\jqlbiqoagnjb.exe
- C:\igvivvdur\hjuiwqda.exe
- C:\igvivvdur\f5reqompjuak
- %WINDIR%\igvivvdur\anbq395m
- C:\igvivvdur\anbq395m
- C:\igvivvdur\avdw3ae5picfupadq.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\igvivvdur\hjuiwqda.exe
- C:\igvivvdur\jqlbiqoagnjb.exe
Удаляет следующие файлы:
- C:\igvivvdur\avdw3ae5picfupadq.exe
- %WINDIR%\igvivvdur\anbq395m
Сетевая активность:
Подключается к:
- 'wi####training.net':80
- 'su####hunger.net':80
- 'wi###nstorm.net':80
- 'su####training.net':80
- 'ch###thrown.net':80
- 'th###storm.net':80
- 'wi####hunger.net':80
- 'th###thrown.net':80
- 'su###rstorm.net':80
- 'th####htraining.net':80
- 'ef####training.net':80
- 'th####hstorm.net':80
- 'ef###tstorm.net':80
- 'su####thrown.net':80
- 'wi####thrown.net':80
- 'th####hhunger.net':80
- 'ef####hunger.net':80
- 'ch###storm.net':80
- 'ri####hunger.net':80
- 'li####thrown.net':80
- 'ri####training.net':80
- 'be####hunger.net':80
- 'de####ystorm.net':80
- 'li####training.net':80
- 'de####ythrown.net':80
- 'li###estorm.net':80
- 'be####training.net':80
- 'th###hunger.net':80
- 'ch###hunger.net':80
- 'th####raining.net':80
- 'ch####raining.net':80
- 'be###gstorm.net':80
- 'ri###nstorm.net':80
- 'be####thrown.net':80
- 'ri####thrown.net':80
TCP:
Запросы HTTP GET:
- http://wi####training.net/index.php?me########
- http://su####hunger.net/index.php?me########
- http://wi###nstorm.net/index.php?me########
- http://su####training.net/index.php?me########
- http://ch###thrown.net/index.php?me########
- http://th###storm.net/index.php?me########
- http://wi####hunger.net/index.php?me########
- http://th###thrown.net/index.php?me########
- http://su###rstorm.net/index.php?me########
- http://th####htraining.net/index.php?me########
- http://ef####training.net/index.php?me########
- http://th####hstorm.net/index.php?me########
- http://ef###tstorm.net/index.php?me########
- http://su####thrown.net/index.php?me########
- http://wi####thrown.net/index.php?me########
- http://th####hhunger.net/index.php?me########
- http://ef####hunger.net/index.php?me########
- http://ch###storm.net/index.php?me########
- http://ri####hunger.net/index.php?me########
- http://li####thrown.net/index.php?me########
- http://ri####training.net/index.php?me########
- http://be####hunger.net/index.php?me########
- http://de####ystorm.net/index.php?me########
- http://li####training.net/index.php?me########
- http://de####ythrown.net/index.php?me########
- http://li###estorm.net/index.php?me########
- http://be####training.net/index.php?me########
- http://th###hunger.net/index.php?me########
- http://ch###hunger.net/index.php?me########
- http://th####raining.net/index.php?me########
- http://ch####raining.net/index.php?me########
- http://be###gstorm.net/index.php?me########
- http://ri###nstorm.net/index.php?me########
- http://be####thrown.net/index.php?me########
- http://ri####thrown.net/index.php?me########
UDP:
- DNS ASK su####training.net
- DNS ASK wi####training.net
- DNS ASK su###rstorm.net
- DNS ASK wi###nstorm.net
- DNS ASK su####hunger.net
- DNS ASK ch###thrown.net
- DNS ASK th###storm.net
- DNS ASK wi####hunger.net
- DNS ASK th###thrown.net
- DNS ASK ef###tstorm.net
- DNS ASK th####htraining.net
- DNS ASK ef####thrown.net
- DNS ASK th####hstorm.net
- DNS ASK ef####training.net
- DNS ASK su####thrown.net
- DNS ASK wi####thrown.net
- DNS ASK th####hhunger.net
- DNS ASK ef####hunger.net
- DNS ASK be####hunger.net
- DNS ASK ri####hunger.net
- DNS ASK be####training.net
- DNS ASK ri####training.net
- DNS ASK li####thrown.net
- DNS ASK de####ystorm.net
- DNS ASK li####training.net
- DNS ASK de####ythrown.net
- DNS ASK li###estorm.net
- DNS ASK ch####raining.net
- DNS ASK th###hunger.net
- DNS ASK ch###storm.net
- DNS ASK th####raining.net
- DNS ASK ch###hunger.net
- DNS ASK be###gstorm.net
- DNS ASK ri###nstorm.net
- DNS ASK be####thrown.net
- DNS ASK ri####thrown.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
