Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'CardSpace Mapper Grouping' = 'C:\expzqxcxlh\hnextgghm.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Certificate Tablet Propagation] 'ImagePath' = 'C:\expzqxcxlh\hnextgghm.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Certificate Tablet Propagation] 'Start' = '00000002'
Вредоносные функции:
Запускает на исполнение:
- 'C:\expzqxcxlh\cdmnmtdqtia.exe' "c:\expzqxcxlh\hnextgghm.exe"
- 'C:\expzqxcxlh\hnextgghm.exe'
- 'C:\expzqxcxlh\thzo38fepeh0guj8ibz.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\expzqxcxlh\hnextgghm.exe
- C:\expzqxcxlh\cdmnmtdqtia.exe
- C:\expzqxcxlh\thzo38fepeh0guj8ibz.exe
- %WINDIR%\expzqxcxlh\cagebvxn
- C:\expzqxcxlh\cagebvxn
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\expzqxcxlh\cdmnmtdqtia.exe
- C:\expzqxcxlh\hnextgghm.exe
Удаляет следующие файлы:
- C:\expzqxcxlh\thzo38fepeh0guj8ibz.exe
- %WINDIR%\expzqxcxlh\cagebvxn
Подменяет следующие файлы:
- %WINDIR%\expzqxcxlh\cagebvxn
Сетевая активность:
Подключается к:
- 'ri####fifteen.net':80
- 'be###gdried.net':80
- 'be####fifteen.net':80
- 'be###gangry.net':80
- 'ri###nangry.net':80
- 'li###eangry.net':80
- 'de####yangry.net':80
- 'de####yarticle.net':80
- 'ri###ndried.net':80
- 'li####article.net':80
- 'ch###angry.net':80
- 'th####ifteen.net':80
- 'th###angry.net':80
- 'th####rticle.net':80
- 'ch####rticle.net':80
- 'be####article.net':80
- 'ri####article.net':80
- 'ch###dried.net':80
- 'ch####ifteen.net':80
- 'th###dried.net':80
- 'wo###butter.net':80
- 're####erbehind.net':80
- 're####erbutter.net':80
- 'hu####ddried.net':80
- 'jo####ydried.net':80
- 're#####runderstand.net':80
- 'wo####nderstand.net':80
- 'wo###broad.net':80
- 'wo###behind.net':80
- 're####erbroad.net':80
- 'de####ydried.net':80
- 'hu####darticle.net':80
- 'li###edried.net':80
- 'li####fifteen.net':80
- 'de####yfifteen.net':80
- 'hu####dfifteen.net':80
- 'jo####yfifteen.net':80
- 'jo####yangry.net':80
- 'jo####yarticle.net':80
- 'hu####dangry.net':80
TCP:
Запросы HTTP GET:
- http://ri####fifteen.net/index.php
- http://be###gdried.net/index.php
- http://be####fifteen.net/index.php
- http://be###gangry.net/index.php
- http://ri###nangry.net/index.php
- http://li###eangry.net/index.php
- http://de####yangry.net/index.php
- http://de####yarticle.net/index.php
- http://ri###ndried.net/index.php
- http://li####article.net/index.php
- http://ch###angry.net/index.php
- http://th####ifteen.net/index.php
- http://th###angry.net/index.php
- http://th####rticle.net/index.php
- http://ch####rticle.net/index.php
- http://be####article.net/index.php
- http://ri####article.net/index.php
- http://ch###dried.net/index.php
- http://ch####ifteen.net/index.php
- http://th###dried.net/index.php
- http://wo###butter.net/index.php
- http://re####erbehind.net/index.php
- http://re####erbutter.net/index.php
- http://hu####ddried.net/index.php
- http://jo####ydried.net/index.php
- http://re#####runderstand.net/index.php
- http://wo####nderstand.net/index.php
- http://wo###broad.net/index.php
- http://wo###behind.net/index.php
- http://re####erbroad.net/index.php
- http://de####ydried.net/index.php
- http://hu####darticle.net/index.php
- http://li###edried.net/index.php
- http://li####fifteen.net/index.php
- http://de####yfifteen.net/index.php
- http://hu####dfifteen.net/index.php
- http://jo####yfifteen.net/index.php
- http://jo####yangry.net/index.php
- http://jo####yarticle.net/index.php
- http://hu####dangry.net/index.php
UDP:
- DNS ASK be####fifteen.net
- DNS ASK ri####fifteen.net
- DNS ASK ri###nangry.net
- DNS ASK ri####article.net
- DNS ASK be###gangry.net
- DNS ASK de####yarticle.net
- DNS ASK li###eangry.net
- DNS ASK li####article.net
- DNS ASK be###gdried.net
- DNS ASK ri###ndried.net
- DNS ASK th###angry.net
- DNS ASK ch###angry.net
- DNS ASK ch####rticle.net
- DNS ASK wi###ndried.net
- DNS ASK th####rticle.net
- DNS ASK ch###dried.net
- DNS ASK be####article.net
- DNS ASK th###dried.net
- DNS ASK th####ifteen.net
- DNS ASK ch####ifteen.net
- DNS ASK de####yangry.net
- DNS ASK wo###butter.net
- DNS ASK re####erbehind.net
- DNS ASK re####erbutter.net
- DNS ASK hu####ddried.net
- DNS ASK jo####ydried.net
- DNS ASK re#####runderstand.net
- DNS ASK wo####nderstand.net
- DNS ASK wo###broad.net
- DNS ASK wo###behind.net
- DNS ASK re####erbroad.net
- DNS ASK de####ydried.net
- DNS ASK hu####darticle.net
- DNS ASK li###edried.net
- DNS ASK li####fifteen.net
- DNS ASK de####yfifteen.net
- DNS ASK hu####dfifteen.net
- DNS ASK jo####yfifteen.net
- DNS ASK jo####yangry.net
- DNS ASK jo####yarticle.net
- DNS ASK hu####dangry.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
