Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Cryptographic NetBIOS Portable Virtual Client' = 'C:\vvdqorqvnzhnu\lzvldrrb.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Discovery Intelligent Collector Network Smart] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- 'C:\vvdqorqvnzhnu\ehslrnqqzzr.exe' "c:\vvdqorqvnzhnu\lzvldrrb.exe"
- 'C:\vvdqorqvnzhnu\lzvldrrb.exe'
- 'C:\vvdqorqvnzhnu\mjbr2v5zeadqcdfy.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\vvdqorqvnzhnu\lzvldrrb.exe
- C:\vvdqorqvnzhnu\ehslrnqqzzr.exe
- C:\vvdqorqvnzhnu\x7rmyutykj
- %WINDIR%\vvdqorqvnzhnu\zvyhbwci
- C:\vvdqorqvnzhnu\zvyhbwci
- C:\vvdqorqvnzhnu\mjbr2v5zeadqcdfy.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\vvdqorqvnzhnu\ehslrnqqzzr.exe
- C:\vvdqorqvnzhnu\lzvldrrb.exe
Удаляет следующие файлы:
- C:\vvdqorqvnzhnu\mjbr2v5zeadqcdfy.exe
- %WINDIR%\vvdqorqvnzhnu\zvyhbwci
Сетевая активность:
Подключается к:
- 'ma####esuppose.net':80
- 'pe####service.net':80
- 'pe####suppose.net':80
- 'pe####mister.net':80
- 'ma####emister.net':80
- 'su####mister.net':80
- 'fo####nmister.net':80
- 'ma####eriver.net':80
- 'ma####eservice.net':80
- 'pe###nriver.net':80
- 'be####emister.net':80
- 'ex####suppose.net':80
- 'ex####mister.net':80
- 'ei####article.net':80
- 'en####harticle.net':80
- 'ex###triver.net':80
- 'be####eriver.net':80
- 'be####eservice.net':80
- 'be####esuppose.net':80
- 'ex####service.net':80
- 'ri###river.net':80
- 'fi####mister.net':80
- 'wh####rriver.net':80
- 'wh####rservice.net':80
- 'ri####ervice.net':80
- 'fi####service.net':80
- 'th####service.net':80
- 'th####suppose.net':80
- 'th####mister.net':80
- 'fi####suppose.net':80
- 'fo####nservice.net':80
- 'su###nriver.net':80
- 'su####service.net':80
- 'su####suppose.net':80
- 'fo####nsuppose.net':80
- 'wh####rsuppose.net':80
- 'ri####uppose.net':80
- 'ri###mister.net':80
- 'fo####nriver.net':80
- 'wh####rmister.net':80
- 'en####hangry.net':80
- 'fi####fifteen.net':80
- 'th####fifteen.net':80
- 'th###hdried.net':80
- 'ri####rticle.net':80
- 'fi###edried.net':80
- 'th####article.net':80
- 'pi####edried.net':80
- 'fi####article.net':80
- 'fi###eangry.net':80
- 'th###hangry.net':80
- 'wh####rdried.net':80
- 'ri###dried.net':80
- 'fo####narticle.net':80
- 'fo####nangry.net':80
- 'su####article.net':80
- 'ri###angry.net':80
- 'wh####rarticle.net':80
- 'wh####rangry.net':80
- 'wh####rfifteen.net':80
- 'ri####ifteen.net':80
- 'ch####enarticle.net':80
- 'fa####article.net':80
- 'fa###yangry.net':80
- 'fa####fifteen.net':80
- 'ch####enangry.net':80
- 'en####hfifteen.net':80
- 'ei###rangry.net':80
- 'ei####fifteen.net':80
- 'ei###rdried.net':80
- 'en####hdried.net':80
- 'pi####eangry.net':80
- 'ci####tteangry.net':80
- 'ci#####tefifteen.net':80
- 'ci####ttedried.net':80
- 'pi####efifteen.net':80
- 'fa###ydried.net':80
- 'ch####enfifteen.net':80
- 'ch####endried.net':80
- 'pi####earticle.net':80
- 'ci#####tearticle.net':80
TCP:
Запросы HTTP GET:
- http://ma####esuppose.net/index.php?me########
- http://pe####service.net/index.php?me########
- http://pe####suppose.net/index.php?me########
- http://pe####mister.net/index.php?me########
- http://ma####emister.net/index.php?me########
- http://su####mister.net/index.php?me########
- http://fo####nmister.net/index.php?me########
- http://ma####eriver.net/index.php?me########
- http://ma####eservice.net/index.php?me########
- http://pe###nriver.net/index.php?me########
- http://be####emister.net/index.php?me########
- http://ex####suppose.net/index.php?me########
- http://ex####mister.net/index.php?me########
- http://ei####article.net/index.php?me########
- http://en####harticle.net/index.php?me########
- http://ex###triver.net/index.php?me########
- http://be####eriver.net/index.php?me########
- http://be####eservice.net/index.php?me########
- http://be####esuppose.net/index.php?me########
- http://ex####service.net/index.php?me########
- http://ri###river.net/index.php?me########
- http://fi####mister.net/index.php?me########
- http://wh####rriver.net/index.php?me########
- http://wh####rservice.net/index.php?me########
- http://ri####ervice.net/index.php?me########
- http://fi####service.net/index.php?me########
- http://th####service.net/index.php?me########
- http://th####suppose.net/index.php?me########
- http://th####mister.net/index.php?me########
- http://fi####suppose.net/index.php?me########
- http://fo####nservice.net/index.php?me########
- http://su###nriver.net/index.php?me########
- http://su####service.net/index.php?me########
- http://su####suppose.net/index.php?me########
- http://fo####nsuppose.net/index.php?me########
- http://wh####rsuppose.net/index.php?me########
- http://ri####uppose.net/index.php?me########
- http://ri###mister.net/index.php?me########
- http://fo####nriver.net/index.php?me########
- http://wh####rmister.net/index.php?me########
- http://en####hangry.net/index.php?me########
- http://fi####fifteen.net/index.php?me########
- http://th####fifteen.net/index.php?me########
- http://th###hdried.net/index.php?me########
- http://ri####rticle.net/index.php?me########
- http://fi###edried.net/index.php?me########
- http://th####article.net/index.php?me########
- http://pi####edried.net/index.php?me########
- http://fi####article.net/index.php?me########
- http://fi###eangry.net/index.php?me########
- http://th###hangry.net/index.php?me########
- http://wh####rdried.net/index.php?me########
- http://ri###dried.net/index.php?me########
- http://fo####narticle.net/index.php?me########
- http://fo####nangry.net/index.php?me########
- http://su####article.net/index.php?me########
- http://ri###angry.net/index.php?me########
- http://wh####rarticle.net/index.php?me########
- http://wh####rangry.net/index.php?me########
- http://wh####rfifteen.net/index.php?me########
- http://ri####ifteen.net/index.php?me########
- http://ch####enarticle.net/index.php?me########
- http://fa####article.net/index.php?me########
- http://fa###yangry.net/index.php?me########
- http://fa####fifteen.net/index.php?me########
- http://ch####enangry.net/index.php?me########
- http://en####hfifteen.net/index.php?me########
- http://ei###rangry.net/index.php?me########
- http://ei####fifteen.net/index.php?me########
- http://ei###rdried.net/index.php?me########
- http://en####hdried.net/index.php?me########
- http://pi####eangry.net/index.php?me########
- http://ci####tteangry.net/index.php?me########
- http://ci#####tefifteen.net/index.php?me########
- http://ci####ttedried.net/index.php?me########
- http://pi####efifteen.net/index.php?me########
- http://fa###ydried.net/index.php?me########
- http://ch####enfifteen.net/index.php?me########
- http://ch####endried.net/index.php?me########
- http://pi####earticle.net/index.php?me########
- http://ci#####tearticle.net/index.php?me########
UDP:
- DNS ASK ma####esuppose.net
- DNS ASK pe####service.net
- DNS ASK pe####suppose.net
- DNS ASK pe####mister.net
- DNS ASK ma####emister.net
- DNS ASK su####mister.net
- DNS ASK fo####nmister.net
- DNS ASK ma####eriver.net
- DNS ASK ma####eservice.net
- DNS ASK pe###nriver.net
- DNS ASK be####emister.net
- DNS ASK ex####suppose.net
- DNS ASK ex####mister.net
- DNS ASK ei####article.net
- DNS ASK en####harticle.net
- DNS ASK ex###triver.net
- DNS ASK be####eriver.net
- DNS ASK be####eservice.net
- DNS ASK be####esuppose.net
- DNS ASK ex####service.net
- DNS ASK su####suppose.net
- DNS ASK fi####mister.net
- DNS ASK th####mister.net
- DNS ASK ri###river.net
- DNS ASK ri####ervice.net
- DNS ASK wh####rriver.net
- DNS ASK th####service.net
- DNS ASK fi###eriver.net
- DNS ASK fi####service.net
- DNS ASK fi####suppose.net
- DNS ASK th####suppose.net
- DNS ASK su###nriver.net
- DNS ASK fo####nriver.net
- DNS ASK fo####nservice.net
- DNS ASK fo####nsuppose.net
- DNS ASK su####service.net
- DNS ASK ri####uppose.net
- DNS ASK wh####rservice.net
- DNS ASK wh####rsuppose.net
- DNS ASK wh####rmister.net
- DNS ASK ri###mister.net
- DNS ASK fi####fifteen.net
- DNS ASK th####fifteen.net
- DNS ASK th###hdried.net
- DNS ASK ri####rticle.net
- DNS ASK fi###edried.net
- DNS ASK th####article.net
- DNS ASK pi####edried.net
- DNS ASK fi####article.net
- DNS ASK fi###eangry.net
- DNS ASK th###hangry.net
- DNS ASK wh####rdried.net
- DNS ASK ri###dried.net
- DNS ASK fo####narticle.net
- DNS ASK fo####nangry.net
- DNS ASK su####article.net
- DNS ASK ri###angry.net
- DNS ASK wh####rarticle.net
- DNS ASK wh####rangry.net
- DNS ASK wh####rfifteen.net
- DNS ASK ri####ifteen.net
- DNS ASK ci####ttedried.net
- DNS ASK fa####article.net
- DNS ASK ei###rdried.net
- DNS ASK ch####enarticle.net
- DNS ASK ch####enangry.net
- DNS ASK fa###yangry.net
- DNS ASK ei###rangry.net
- DNS ASK en####hangry.net
- DNS ASK en####hfifteen.net
- DNS ASK en####hdried.net
- DNS ASK ei####fifteen.net
- DNS ASK ci####tteangry.net
- DNS ASK pi####earticle.net
- DNS ASK pi####eangry.net
- DNS ASK pi####efifteen.net
- DNS ASK ci#####tefifteen.net
- DNS ASK ch####enfifteen.net
- DNS ASK fa####fifteen.net
- DNS ASK fa###ydried.net
- DNS ASK ci#####tearticle.net
- DNS ASK ch####endried.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
