Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Helper Center Panel Sharing Class IPsec' = 'C:\taopicyzmka\wquxtgy.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Virtual Task Networking DHCP Accounts] 'ImagePath' = 'C:\taopicyzmka\wquxtgy.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Virtual Task Networking DHCP Accounts] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- 'C:\taopicyzmka\xpxbyslwr.exe' "c:\taopicyzmka\wquxtgy.exe"
- 'C:\taopicyzmka\wquxtgy.exe'
- 'C:\taopicyzmka\afe3bmflwjiitmciw.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\taopicyzmka\wquxtgy.exe
- C:\taopicyzmka\xpxbyslwr.exe
- C:\taopicyzmka\afe3bmflwjiitmciw.exe
- %WINDIR%\taopicyzmka\ofypvgkjnr
- C:\taopicyzmka\ofypvgkjnr
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\taopicyzmka\xpxbyslwr.exe
- C:\taopicyzmka\wquxtgy.exe
Удаляет следующие файлы:
- C:\taopicyzmka\afe3bmflwjiitmciw.exe
- %WINDIR%\taopicyzmka\ofypvgkjnr
Подменяет следующие файлы:
- %WINDIR%\taopicyzmka\ofypvgkjnr
Сетевая активность:
Подключается к:
- 'mi####osition.net':80
- 'st####osition.net':80
- 'st###strike.net':80
- 'st####artial.net':80
- 'mi###strike.net':80
- 'mi###number.net':80
- 'ev####gstrike.net':80
- 'bu####ngstrike.net':80
- 'bu####ngpartial.net':80
- 'st###number.net':80
- 'ev####gpartial.net':80
- 'do####partial.net':80
- 'pr####strike.net':80
- 'pr####partial.net':80
- 'fe####position.net':80
- 'fe####number.net':80
- 'do####strike.net':80
- 'do####number.net':80
- 'mi####artial.net':80
- 'pr####number.net':80
- 'pr####position.net':80
- 'do####position.net':80
- 'ev####gposition.net':80
- 'st#####helectricity.net':80
- 'st###train.net':80
- 'st#####ectricity.net':80
- 'st####elight.net':80
- 'st####thdelight.net':80
- 'st####thtrain.net':80
- 'pr####edelight.net':80
- 'de#####lectricity.net':80
- 'de####delight.net':80
- 'st###borrow.net':80
- 'st####thborrow.net':80
- 'ou####epartial.net':80
- 'mo####ntpartial.net':80
- 'bu####ngnumber.net':80
- 'bu#####gposition.net':80
- 'ev####gnumber.net':80
- 'ou####estrike.net':80
- 'ou####enumber.net':80
- 'mo####ntnumber.net':80
- 'mo#####tposition.net':80
- 'mo####ntstrike.net':80
- 'ou####eposition.net':80
TCP:
Запросы HTTP GET:
- http://mi####osition.net/index.php
- http://st####osition.net/index.php
- http://st###strike.net/index.php
- http://st####artial.net/index.php
- http://mi###strike.net/index.php
- http://mi###number.net/index.php
- http://ev####gstrike.net/index.php
- http://bu####ngstrike.net/index.php
- http://bu####ngpartial.net/index.php
- http://st###number.net/index.php
- http://ev####gpartial.net/index.php
- http://do####partial.net/index.php
- http://pr####strike.net/index.php
- http://pr####partial.net/index.php
- http://fe####position.net/index.php
- http://fe####number.net/index.php
- http://do####strike.net/index.php
- http://do####number.net/index.php
- http://mi####artial.net/index.php
- http://pr####number.net/index.php
- http://pr####position.net/index.php
- http://do####position.net/index.php
- http://ev####gposition.net/index.php
- http://st#####helectricity.net/index.php
- http://st###train.net/index.php
- http://st#####ectricity.net/index.php
- http://st####elight.net/index.php
- http://st####thdelight.net/index.php
- http://st####thtrain.net/index.php
- http://pr####edelight.net/index.php
- http://de#####lectricity.net/index.php
- http://de####delight.net/index.php
- http://st###borrow.net/index.php
- http://st####thborrow.net/index.php
- http://ou####epartial.net/index.php
- http://mo####ntpartial.net/index.php
- http://bu####ngnumber.net/index.php
- http://bu#####gposition.net/index.php
- http://ev####gnumber.net/index.php
- http://ou####estrike.net/index.php
- http://ou####enumber.net/index.php
- http://mo####ntnumber.net/index.php
- http://mo#####tposition.net/index.php
- http://mo####ntstrike.net/index.php
- http://ou####eposition.net/index.php
UDP:
- DNS ASK mi####osition.net
- DNS ASK st####osition.net
- DNS ASK st###strike.net
- DNS ASK st####artial.net
- DNS ASK mi###strike.net
- DNS ASK mi###number.net
- DNS ASK ev####gstrike.net
- DNS ASK bu####ngstrike.net
- DNS ASK bu####ngpartial.net
- DNS ASK st###number.net
- DNS ASK ev####gpartial.net
- DNS ASK do####partial.net
- DNS ASK pr####strike.net
- DNS ASK pr####partial.net
- DNS ASK fe####position.net
- DNS ASK fe####number.net
- DNS ASK do####strike.net
- DNS ASK do####number.net
- DNS ASK mi####artial.net
- DNS ASK pr####number.net
- DNS ASK pr####position.net
- DNS ASK do####position.net
- DNS ASK ev####gposition.net
- DNS ASK st#####helectricity.net
- DNS ASK st###train.net
- DNS ASK st#####ectricity.net
- DNS ASK st####elight.net
- DNS ASK st####thdelight.net
- DNS ASK st####thtrain.net
- DNS ASK pr####edelight.net
- DNS ASK de#####lectricity.net
- DNS ASK de####delight.net
- DNS ASK st###borrow.net
- DNS ASK st####thborrow.net
- DNS ASK ou####epartial.net
- DNS ASK mo####ntpartial.net
- DNS ASK bu####ngnumber.net
- DNS ASK bu#####gposition.net
- DNS ASK ev####gnumber.net
- DNS ASK ou####estrike.net
- DNS ASK ou####enumber.net
- DNS ASK mo####ntnumber.net
- DNS ASK mo#####tposition.net
- DNS ASK mo####ntstrike.net
- DNS ASK ou####eposition.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
