Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'File TCP/IP Logon Session NGEN Storage' = 'C:\ujejyjogvcxpa\nsvgqcj.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Biometric Studio Gateway Topology Configuration] 'ImagePath' = 'C:\ujejyjogvcxpa\nsvgqcj.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Biometric Studio Gateway Topology Configuration] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- 'C:\ujejyjogvcxpa\cxmplxamzh.exe' "c:\ujejyjogvcxpa\nsvgqcj.exe"
- 'C:\ujejyjogvcxpa\nsvgqcj.exe'
- 'C:\ujejyjogvcxpa\ew3fjho5wiskazc.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\ujejyjogvcxpa\nsvgqcj.exe
- C:\ujejyjogvcxpa\cxmplxamzh.exe
- C:\ujejyjogvcxpa\ew3fjho5wiskazc.exe
- %WINDIR%\ujejyjogvcxpa\gcdprmctaml
- C:\ujejyjogvcxpa\gcdprmctaml
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\ujejyjogvcxpa\cxmplxamzh.exe
- C:\ujejyjogvcxpa\nsvgqcj.exe
Удаляет следующие файлы:
- C:\ujejyjogvcxpa\ew3fjho5wiskazc.exe
- %WINDIR%\ujejyjogvcxpa\gcdprmctaml
Подменяет следующие файлы:
- %WINDIR%\ujejyjogvcxpa\gcdprmctaml
Сетевая активность:
Подключается к:
- 'se###anorth.net':80
- 'la####nclude.net':80
- 'se####include.net':80
- 'mo###rclear.net':80
- 'si###eclear.net':80
- 'la###north.net':80
- 'se###aclear.net':80
- 'ma####alduring.net':80
- 'se####lduring.net':80
- 'la####eneral.net':80
- 'se####general.net':80
- 'la###clear.net':80
- 'si####general.net':80
- 'po####legeneral.net':80
- 'mo####ingeneral.net':80
- 'po####leclear.net':80
- 'mo####innorth.net':80
- 'po####leinclude.net':80
- 'mo####ininclude.net':80
- 'mo####include.net':80
- 'si####include.net':80
- 'mo####general.net':80
- 'mo####inclear.net':80
- 'mo###rnorth.net':80
- 'si###enorth.net':80
- 'ma####alindeed.net':80
- 'fi####indeed.net':80
- 'le###notice.net':80
- 'fi####notice.net':80
- 'le###during.net':80
- 'fi####during.net':80
- 'le###indeed.net':80
- 'wi####during.net':80
- 'su####tindeed.net':80
- 'wi####indeed.net':80
- 'le###length.net':80
- 'fi####length.net':80
- 'su####tduring.net':80
- 'sw###length.net':80
- 'ma####allength.net':80
- 'se####llength.net':80
- 'pr####lyduring.net':80
- 'se####lindeed.net':80
- 'ma####alnotice.net':80
- 'se####lnotice.net':80
- 'pr####lynotice.net':80
- 'sw###notice.net':80
- 'pr####lylength.net':80
- 'sw###during.net':80
- 'pr####lyindeed.net':80
- 'sw###indeed.net':80
TCP:
Запросы HTTP GET:
- http://se###anorth.net/index.php
- http://la####nclude.net/index.php
- http://se####include.net/index.php
- http://mo###rclear.net/index.php
- http://si###eclear.net/index.php
- http://la###north.net/index.php
- http://se###aclear.net/index.php
- http://ma####alduring.net/index.php
- http://se####lduring.net/index.php
- http://la####eneral.net/index.php
- http://se####general.net/index.php
- http://la###clear.net/index.php
- http://si####general.net/index.php
- http://po####legeneral.net/index.php
- http://mo####ingeneral.net/index.php
- http://po####leclear.net/index.php
- http://mo####innorth.net/index.php
- http://po####leinclude.net/index.php
- http://mo####ininclude.net/index.php
- http://mo####include.net/index.php
- http://si####include.net/index.php
- http://mo####general.net/index.php
- http://mo####inclear.net/index.php
- http://mo###rnorth.net/index.php
- http://si###enorth.net/index.php
- http://ma####alindeed.net/index.php
- http://fi####indeed.net/index.php
- http://le###notice.net/index.php
- http://fi####notice.net/index.php
- http://le###during.net/index.php
- http://fi####during.net/index.php
- http://le###indeed.net/index.php
- http://wi####during.net/index.php
- http://su####tindeed.net/index.php
- http://wi####indeed.net/index.php
- http://le###length.net/index.php
- http://fi####length.net/index.php
- http://su####tduring.net/index.php
- http://sw###length.net/index.php
- http://ma####allength.net/index.php
- http://se####llength.net/index.php
- http://pr####lyduring.net/index.php
- http://se####lindeed.net/index.php
- http://ma####alnotice.net/index.php
- http://se####lnotice.net/index.php
- http://pr####lynotice.net/index.php
- http://sw###notice.net/index.php
- http://pr####lylength.net/index.php
- http://sw###during.net/index.php
- http://pr####lyindeed.net/index.php
- http://sw###indeed.net/index.php
UDP:
- DNS ASK se###anorth.net
- DNS ASK la####nclude.net
- DNS ASK se####include.net
- DNS ASK mo###rclear.net
- DNS ASK si###eclear.net
- DNS ASK la###north.net
- DNS ASK se###aclear.net
- DNS ASK ma####alduring.net
- DNS ASK se####lduring.net
- DNS ASK la####eneral.net
- DNS ASK se####general.net
- DNS ASK la###clear.net
- DNS ASK si####general.net
- DNS ASK po####legeneral.net
- DNS ASK mo####ingeneral.net
- DNS ASK po####leclear.net
- DNS ASK mo####innorth.net
- DNS ASK po####leinclude.net
- DNS ASK mo####ininclude.net
- DNS ASK mo####include.net
- DNS ASK si####include.net
- DNS ASK mo####general.net
- DNS ASK mo####inclear.net
- DNS ASK mo###rnorth.net
- DNS ASK si###enorth.net
- DNS ASK ma####alindeed.net
- DNS ASK fi####indeed.net
- DNS ASK le###notice.net
- DNS ASK fi####notice.net
- DNS ASK le###during.net
- DNS ASK fi####during.net
- DNS ASK le###indeed.net
- DNS ASK wi####during.net
- DNS ASK su####tindeed.net
- DNS ASK wi####indeed.net
- DNS ASK le###length.net
- DNS ASK fi####length.net
- DNS ASK su####tduring.net
- DNS ASK sw###length.net
- DNS ASK ma####allength.net
- DNS ASK se####llength.net
- DNS ASK pr####lyduring.net
- DNS ASK se####lindeed.net
- DNS ASK ma####alnotice.net
- DNS ASK se####lnotice.net
- DNS ASK pr####lynotice.net
- DNS ASK sw###notice.net
- DNS ASK pr####lylength.net
- DNS ASK sw###during.net
- DNS ASK pr####lyindeed.net
- DNS ASK sw###indeed.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
