Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Sharing Log Foundation Provider' = '<SYSTEM32>\yutnhueqrgcp.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Cryptographic Telephony Support] 'ImagePath' = '<SYSTEM32>\yutnhueqrgcp.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Cryptographic Telephony Support] 'Start' = '00000002'
Вредоносные функции:
Для затруднения выявления своего присутствия в системе
блокирует:
- Центр обеспечения безопасности (Security Center)
Запускает на исполнение:
- '<SYSTEM32>\cvapgdjoc.exe' "<SYSTEM32>\yutnhueqrgcp.exe"
- '%WINDIR%\Temp\kmmhiy3j1cj2.exe' -r 40274 tcp
- '%TEMP%\kmmhiy3c53j2dpthkx.exe'
- '<SYSTEM32>\yutnhueqrgcp.exe'
Изменения в файловой системе:
Создает следующие файлы:
- <SYSTEM32>\vomuwjyiluiba\run
- <SYSTEM32>\vomuwjyiluiba\rng
- %WINDIR%\Temp\kmmhiy3j1cj2.exe
- <SYSTEM32>\vomuwjyiluiba\cfg
- <SYSTEM32>\cvapgdjoc.exe
- %TEMP%\kmmhiy3c53j2dpthkx.exe
- <SYSTEM32>\vomuwjyiluiba\tst
- <SYSTEM32>\yutnhueqrgcp.exe
- <SYSTEM32>\vomuwjyiluiba\etc
Присваивает атрибут 'скрытый' для следующих файлов:
- <SYSTEM32>\cvapgdjoc.exe
- <SYSTEM32>\yutnhueqrgcp.exe
Удаляет следующие файлы:
- %WINDIR%\Temp\kmmhiy3j1cj2.exe
- <DRIVERS>\etc\hosts
- %TEMP%\kmmhiy3c53j2dpthkx.exe
Подменяет файл HOSTS.
Сетевая активность:
Подключается к:
- 'fe###tudy.net':80
- 'lo###ncle.net':80
- 'fe###ncle.net':80
- 'lo###tudy.net':80
- 'fe###nce.net':80
- 'lo###oss.net':80
- 'fe###oss.net':80
- 'wh###nce.net':80
- 'hi###tudy.net':80
- 'wh###ncle.net':80
- 'hi###ncle.net':80
- 'wh###tudy.net':80
- 'hi###nce.net':80
- 'wh###oss.net':80
- 'hi###oss.net':80
- 'wi###oss.net':80
- 'dr###loss.net':80
- 'wi###tudy.net':80
- 'dr###once.net':80
- 'ab###ree.net':80
- 'kn###ree.net':80
- 'wi###nce.net':80
- 'dr###study.net':80
- 'th###study.net':80
- 'th###uncle.net':80
- 'lo###nce.net':80
- 'th###loss.net':80
- 'wi###ncle.net':80
- 'dr###uncle.net':80
- 'th###once.net':80
- 'ju###nce.net':80
- 'so###tudy.net':80
- 'pi###tudy.net':80
- 'so###ncle.net':80
- 'pi###oss.net':80
- 'so###nce.net':80
- 'pi###nce.net':80
- 'so###oss.net':80
- 'pi###ncle.net':80
- 'th###while.net':80
- 'ri###nstorm.net':80
- 'jo####ymeasure.net':80
- 'ef###tbuilt.net':80
- 'ab###nce.net':80
- 'kn###nce.net':80
- 'ab###oss.net':80
- 'mo###tudy.net':80
- 'ju###ncle.net':80
- 'mo###ncle.net':80
- 'ju###tudy.net':80
- 'mo###nce.net':80
- 'ju###oss.net':80
- 'mo###oss.net':80
- 'si###nce.net':80
- 'ro###tudy.net':80
- 'si###ncle.net':80
- 'ro###ncle.net':80
- 'si###tudy.net':80
- 'ro###nce.net':80
- 'si###oss.net':80
- 'ro###oss.net':80
TCP:
Запросы HTTP GET:
- http://fe###tudy.net/index.php
- http://lo###ncle.net/index.php
- http://fe###ncle.net/index.php
- http://lo###tudy.net/index.php
- http://fe###nce.net/index.php
- http://lo###oss.net/index.php
- http://fe###oss.net/index.php
- http://wh###nce.net/index.php
- http://hi###tudy.net/index.php
- http://wh###ncle.net/index.php
- http://hi###ncle.net/index.php
- http://wh###tudy.net/index.php
- http://hi###nce.net/index.php
- http://wh###oss.net/index.php
- http://hi###oss.net/index.php
- http://wi###oss.net/index.php
- http://dr###loss.net/index.php
- http://wi###tudy.net/index.php
- http://dr###once.net/index.php
- http://ab###ree.net/index.php
- http://kn###ree.net/index.php
- http://wi###nce.net/index.php
- http://dr###study.net/index.php
- http://th###study.net/index.php
- http://th###uncle.net/index.php
- http://lo###nce.net/index.php
- http://th###loss.net/index.php
- http://wi###ncle.net/index.php
- http://dr###uncle.net/index.php
- http://th###once.net/index.php
- http://ju###nce.net/index.php
- http://so###tudy.net/index.php
- http://pi###tudy.net/index.php
- http://so###ncle.net/index.php
- http://pi###oss.net/index.php
- http://so###nce.net/index.php
- http://pi###nce.net/index.php
- http://so###oss.net/index.php
- http://pi###ncle.net/index.php
- http://th###while.net/index.php
- http://ri###nstorm.net/index.php
- http://jo####ymeasure.net/index.php
- http://ef###tbuilt.net/index.php
- http://ab###nce.net/index.php
- http://kn###nce.net/index.php
- http://ab###oss.net/index.php
- http://mo###tudy.net/index.php
- http://ju###ncle.net/index.php
- http://mo###ncle.net/index.php
- http://ju###tudy.net/index.php
- http://mo###nce.net/index.php
- http://ju###oss.net/index.php
- http://mo###oss.net/index.php
- http://si###nce.net/index.php
- http://ro###tudy.net/index.php
- http://si###ncle.net/index.php
- http://ro###ncle.net/index.php
- http://si###tudy.net/index.php
- http://ro###nce.net/index.php
- http://si###oss.net/index.php
- http://ro###oss.net/index.php
UDP:
- DNS ASK lo###ncle.net
- DNS ASK fe###ncle.net
- DNS ASK wh###nce.net
- DNS ASK fe###tudy.net
- DNS ASK lo###oss.net
- DNS ASK fe###oss.net
- DNS ASK lo###tudy.net
- DNS ASK hi###nce.net
- DNS ASK wh###ncle.net
- DNS ASK hi###ncle.net
- DNS ASK ju###nce.net
- DNS ASK hi###tudy.net
- DNS ASK wh###oss.net
- DNS ASK hi###oss.net
- DNS ASK wh###tudy.net
- DNS ASK fe###nce.net
- DNS ASK wi###oss.net
- DNS ASK dr###loss.net
- DNS ASK wi###tudy.net
- DNS ASK dr###once.net
- DNS ASK ab###ree.net
- DNS ASK kn###ree.net
- DNS ASK wi###nce.net
- DNS ASK dr###study.net
- DNS ASK th###study.net
- DNS ASK th###uncle.net
- DNS ASK lo###nce.net
- DNS ASK th###loss.net
- DNS ASK wi###ncle.net
- DNS ASK dr###uncle.net
- DNS ASK th###once.net
- DNS ASK so###tudy.net
- DNS ASK pi###tudy.net
- DNS ASK so###ncle.net
- DNS ASK pi###oss.net
- DNS ASK so###nce.net
- DNS ASK pi###nce.net
- DNS ASK so###oss.net
- DNS ASK pi###ncle.net
- DNS ASK th###while.net
- DNS ASK ri###nstorm.net
- DNS ASK jo####ymeasure.net
- DNS ASK ef###tbuilt.net
- DNS ASK ab###nce.net
- DNS ASK kn###nce.net
- DNS ASK ab###oss.net
- DNS ASK mo###tudy.net
- DNS ASK ju###ncle.net
- DNS ASK mo###ncle.net
- DNS ASK ju###tudy.net
- DNS ASK mo###nce.net
- DNS ASK ju###oss.net
- DNS ASK mo###oss.net
- DNS ASK si###nce.net
- DNS ASK ro###tudy.net
- DNS ASK si###ncle.net
- DNS ASK ro###ncle.net
- DNS ASK si###tudy.net
- DNS ASK ro###nce.net
- DNS ASK si###oss.net
- DNS ASK ro###oss.net
- '23#.#55.255.250':1900
