Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Browser Color Credential Bus Call Player' = 'C:\coxloqff\rmaxjdrtna.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Layer Registry Authentication Logon] 'ImagePath' = 'C:\coxloqff\rmaxjdrtna.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Layer Registry Authentication Logon] 'Start' = '00000002'
Вредоносные функции:
Запускает на исполнение:
- 'C:\coxloqff\nrirmcguth.exe' "c:\coxloqff\rmaxjdrtna.exe"
- 'C:\coxloqff\rmaxjdrtna.exe'
- 'C:\coxloqff\rqffp2w60naytzzvw1k.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\coxloqff\rmaxjdrtna.exe
- C:\coxloqff\nrirmcguth.exe
- C:\coxloqff\tjynwgdpi
- %WINDIR%\coxloqff\arnoekmxvqlo
- C:\coxloqff\arnoekmxvqlo
- C:\coxloqff\rqffp2w60naytzzvw1k.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\coxloqff\nrirmcguth.exe
- C:\coxloqff\rmaxjdrtna.exe
Удаляет следующие файлы:
- C:\coxloqff\rqffp2w60naytzzvw1k.exe
- %WINDIR%\coxloqff\arnoekmxvqlo
Подменяет следующие файлы:
- %WINDIR%\coxloqff\arnoekmxvqlo
Сетевая активность:
Подключается к:
- 'li####travel.net':80
- 'de####ytravel.net':80
- 'li###espace.net':80
- 'de####yclose.net':80
- 'li####yellow.net':80
- 'de####yyellow.net':80
- 'hu####dyellow.net':80
- 'jo####yyellow.net':80
- 'hu####dtravel.net':80
- 'de####yspace.net':80
- 'hu####dclose.net':80
- 'jo####yclose.net':80
- 'li###eclose.net':80
- 'ch###space.net':80
- 'be###gclose.net':80
- 'ri###nclose.net':80
- 'th###travel.net':80
- 'ch###travel.net':80
- 'th###space.net':80
- 'ri####travel.net':80
- 'be###gspace.net':80
- 'ri###nspace.net':80
- 'be####yellow.net':80
- 'ri####yellow.net':80
- 'be####travel.net':80
- 'jo####ytravel.net':80
- 'in####sestation.net':80
- 'fo####station.net':80
- 'th#####childhood.net':80
- 'fo####object.net':80
- 'in####sethird.net':80
- 'fo###tthird.net':80
- 'th####hthird.net':80
- 'ef###tthird.net':80
- 'th####hstation.net':80
- 'ef####childhood.net':80
- 'th####hobject.net':80
- 'ef####object.net':80
- 'in####seobject.net':80
- 'wo####hildhood.net':80
- 're####erobject.net':80
- 'wo###object.net':80
- 'hu####dspace.net':80
- 'jo####yspace.net':80
- 're#####rchildhood.net':80
- 'wo####tation.net':80
- 'in#####echildhood.net':80
- 'fo####childhood.net':80
- 're####erthird.net':80
- 'wo###third.net':80
- 're####erstation.net':80
TCP:
Запросы HTTP GET:
- http://li####travel.net/index.php
- http://de####ytravel.net/index.php
- http://li###espace.net/index.php
- http://de####yclose.net/index.php
- http://li####yellow.net/index.php
- http://de####yyellow.net/index.php
- http://hu####dyellow.net/index.php
- http://jo####yyellow.net/index.php
- http://hu####dtravel.net/index.php
- http://de####yspace.net/index.php
- http://hu####dclose.net/index.php
- http://jo####yclose.net/index.php
- http://li###eclose.net/index.php
- http://ch###space.net/index.php
- http://be###gclose.net/index.php
- http://ri###nclose.net/index.php
- http://th###travel.net/index.php
- http://ch###travel.net/index.php
- http://th###space.net/index.php
- http://ri####travel.net/index.php
- http://be###gspace.net/index.php
- http://ri###nspace.net/index.php
- http://be####yellow.net/index.php
- http://ri####yellow.net/index.php
- http://be####travel.net/index.php
- http://jo####ytravel.net/index.php
- http://in####sestation.net/index.php
- http://fo####station.net/index.php
- http://th#####childhood.net/index.php
- http://fo####object.net/index.php
- http://in####sethird.net/index.php
- http://fo###tthird.net/index.php
- http://th####hthird.net/index.php
- http://ef###tthird.net/index.php
- http://th####hstation.net/index.php
- http://ef####childhood.net/index.php
- http://th####hobject.net/index.php
- http://ef####object.net/index.php
- http://in####seobject.net/index.php
- http://wo####hildhood.net/index.php
- http://re####erobject.net/index.php
- http://wo###object.net/index.php
- http://hu####dspace.net/index.php
- http://jo####yspace.net/index.php
- http://re#####rchildhood.net/index.php
- http://wo####tation.net/index.php
- http://in#####echildhood.net/index.php
- http://fo####childhood.net/index.php
- http://re####erthird.net/index.php
- http://wo###third.net/index.php
- http://re####erstation.net/index.php
UDP:
- DNS ASK li####travel.net
- DNS ASK de####ytravel.net
- DNS ASK li###espace.net
- DNS ASK de####yclose.net
- DNS ASK li####yellow.net
- DNS ASK de####yyellow.net
- DNS ASK hu####dyellow.net
- DNS ASK jo####yyellow.net
- DNS ASK hu####dtravel.net
- DNS ASK de####yspace.net
- DNS ASK hu####dclose.net
- DNS ASK jo####yclose.net
- DNS ASK li###eclose.net
- DNS ASK ch###space.net
- DNS ASK be###gclose.net
- DNS ASK ri###nclose.net
- DNS ASK th###travel.net
- DNS ASK ch###travel.net
- DNS ASK th###space.net
- DNS ASK ri####travel.net
- DNS ASK be###gspace.net
- DNS ASK ri###nspace.net
- DNS ASK be####yellow.net
- DNS ASK ri####yellow.net
- DNS ASK be####travel.net
- DNS ASK jo####ytravel.net
- DNS ASK in####sestation.net
- DNS ASK fo####station.net
- DNS ASK th#####childhood.net
- DNS ASK fo####object.net
- DNS ASK in####sethird.net
- DNS ASK fo###tthird.net
- DNS ASK th####hthird.net
- DNS ASK ef###tthird.net
- DNS ASK th####hstation.net
- DNS ASK ef####childhood.net
- DNS ASK th####hobject.net
- DNS ASK ef####object.net
- DNS ASK in####seobject.net
- DNS ASK wo####hildhood.net
- DNS ASK re####erobject.net
- DNS ASK wo###object.net
- DNS ASK hu####dspace.net
- DNS ASK jo####yspace.net
- DNS ASK re#####rchildhood.net
- DNS ASK wo####tation.net
- DNS ASK in#####echildhood.net
- DNS ASK fo####childhood.net
- DNS ASK re####erthird.net
- DNS ASK wo###third.net
- DNS ASK re####erstation.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
