Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Isolation Routing Locator Access' = 'C:\tyhkvamryyxtfs\vgurkisy.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\UserMode Routing Block Visual Counter] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- 'C:\tyhkvamryyxtfs\pmgkxewesn.exe' "c:\tyhkvamryyxtfs\vgurkisy.exe"
- 'C:\tyhkvamryyxtfs\vgurkisy.exe'
- 'C:\tyhkvamryyxtfs\uwz3jfoyqnzqs5jc.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\tyhkvamryyxtfs\vgurkisy.exe
- C:\tyhkvamryyxtfs\pmgkxewesn.exe
- C:\tyhkvamryyxtfs\wnlxyjmudis
- %WINDIR%\tyhkvamryyxtfs\rsllsfi
- C:\tyhkvamryyxtfs\rsllsfi
- C:\tyhkvamryyxtfs\uwz3jfoyqnzqs5jc.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\tyhkvamryyxtfs\pmgkxewesn.exe
- C:\tyhkvamryyxtfs\vgurkisy.exe
Удаляет следующие файлы:
- C:\tyhkvamryyxtfs\uwz3jfoyqnzqs5jc.exe
- %WINDIR%\tyhkvamryyxtfs\rsllsfi
Сетевая активность:
Подключается к:
- 're####article.net':80
- 'de####mister.net':80
- 'fo####dmister.net':80
- 'va####sarticle.net':80
- 're####fifteen.net':80
- 'va####sangry.net':80
- 're###nangry.net':80
- 'de###eriver.net':80
- 'fo####driver.net':80
- 'an####mister.net':80
- 'fo####dservice.net':80
- 'de####suppose.net':80
- 'fo####dsuppose.net':80
- 'de####service.net':80
- 'ge###edried.net':80
- 'he####ifteen.net':80
- 'ge####fifteen.net':80
- 'he###dried.net':80
- 'le###rangry.net':80
- 'le####article.net':80
- 'he####article.net':80
- 'va####sdried.net':80
- 're###ndried.net':80
- 'va####sfifteen.net':80
- 'ge####article.net':80
- 'he###angry.net':80
- 'ge###eangry.net':80
- 'he####rticle.net':80
TCP:
Запросы HTTP GET:
- http://re####article.net/index.php?me########
- http://de####mister.net/index.php?me########
- http://fo####dmister.net/index.php?me########
- http://va####sarticle.net/index.php?me########
- http://re####fifteen.net/index.php?me########
- http://va####sangry.net/index.php?me########
- http://re###nangry.net/index.php?me########
- http://de###eriver.net/index.php?me########
- http://fo####driver.net/index.php?me########
- http://an####mister.net/index.php?me########
- http://fo####dservice.net/index.php?me########
- http://de####suppose.net/index.php?me########
- http://fo####dsuppose.net/index.php?me########
- http://de####service.net/index.php?me########
- http://ge###edried.net/index.php?me########
- http://he####ifteen.net/index.php?me########
- http://ge####fifteen.net/index.php?me########
- http://he###dried.net/index.php?me########
- http://le###rangry.net/index.php?me########
- http://le####article.net/index.php?me########
- http://he####article.net/index.php?me########
- http://va####sdried.net/index.php?me########
- http://re###ndried.net/index.php?me########
- http://va####sfifteen.net/index.php?me########
- http://ge####article.net/index.php?me########
- http://he###angry.net/index.php?me########
- http://ge###eangry.net/index.php?me########
- http://he####rticle.net/index.php?me########
UDP:
- DNS ASK re####article.net
- DNS ASK de####mister.net
- DNS ASK fo####dmister.net
- DNS ASK va####sarticle.net
- DNS ASK re####fifteen.net
- DNS ASK va####sangry.net
- DNS ASK re###nangry.net
- DNS ASK de###eriver.net
- DNS ASK fo####driver.net
- DNS ASK an####mister.net
- DNS ASK fo####dservice.net
- DNS ASK de####suppose.net
- DNS ASK fo####dsuppose.net
- DNS ASK de####service.net
- DNS ASK va####sfifteen.net
- DNS ASK he###dried.net
- DNS ASK ge###edried.net
- DNS ASK he####ifteen.net
- DNS ASK he####article.net
- DNS ASK le###rangry.net
- DNS ASK he###nangry.net
- DNS ASK le####article.net
- DNS ASK ge####article.net
- DNS ASK va####sdried.net
- DNS ASK re###ndried.net
- DNS ASK he####rticle.net
- DNS ASK ge####fifteen.net
- DNS ASK he###angry.net
- DNS ASK ge###eangry.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
