Техническая информация
Вредоносные функции:
Создает и запускает на исполнение:
- '%TEMP%\DM\<Имя вируса>.exe\b1D5WVqd95rGK35\<Имя вируса>.exe' /path="<Полный путь к вирусу>"
- '%TEMP%\DM\<Имя вируса>.exe\b1D5WVqd95rGK35\Launcher.exe' /in="e<Имя вируса>.exe" /out="<Имя вируса>.exe" /psw="952cbe682fbe401aa537c6a61cf687b8" /typ=dec
Запускает на исполнение:
- '<SYSTEM32>\wermgr.exe' -queuereporting
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\DM\<Имя вируса>.exe\b1D5WVqd95rGK35\Launcher.exe
- %TEMP%\DM\<Имя вируса>.exe\b1D5WVqd95rGK35\<Имя вируса>.exe.config
- %TEMP%\DM\<Имя вируса>.exe\b1D5WVqd95rGK35\config.dll
- %TEMP%\DM\<Имя вируса>.exe\b1D5WVqd95rGK35\<Имя вируса>.exe
- %TEMP%\nse1CF4.tmp\pwgen.dll
- %TEMP%\nst1CC4.tmp
- %TEMP%\DM\<Имя вируса>.exe\b1D5WVqd95rGK35\e<Имя вируса>.exe
- %TEMP%\DM\<Имя вируса>.exe\b1D5WVqd95rGK35\installer.exe
Удаляет следующие файлы:
- %TEMP%\DM\<Имя вируса>.exe\b1D5WVqd95rGK35\e<Имя вируса>.exe
- %TEMP%\nse1CF4.tmp\pwgen.dll
- %TEMP%\DM\<Имя вируса>.exe\b1D5WVqd95rGK35\Launcher.exe
- %TEMP%\DM\<Имя вируса>.exe\b1D5WVqd95rGK35\Launcher.exe.config
Сетевая активность:
Подключается к:
- 'st######.sslsecure10.com':80
- 'st#####r.sslsecure9.com':80
- 'tr###.#2.sslsecure1.com':80
- 'tr###.#2.madodls.com':80
- 'st#####r.sslsecure6.com':80
- 'st#####r.sslsecure5.com':80
- 'st#####r.sslsecure8.com':80
- 'st#####r.sslsecure7.com':80
- 'tr###.#2.sslsecure2.com':80
- 'tr###.#2.sslsecure8.com':80
- 'tr###.#2.sslsecure7.com':80
- 'tr###.##.sslsecure10.com':80
- 'tr###.#2.sslsecure9.com':80
- 'tr###.#2.sslsecure4.com':80
- 'tr###.#2.sslsecure3.com':80
- 'tr###.#2.sslsecure6.com':80
- 'tr###.#2.sslsecure5.com':80
- 'ap#.##.sslsecure4.com':80
- 'ap#.##.sslsecure3.com':80
- 'ap#.##.sslsecure6.com':80
- 'ap#.##.sslsecure5.com':80
- 'ap#.##.madodls.com':80
- 'dt####.secdls.com':80
- 'ap#.##.sslsecure2.com':80
- 'ap#.##.sslsecure1.com':80
- 'ap#.##.sslsecure7.com':80
- 'st#####r.sslsecure2.com':80
- 'st#####r.sslsecure1.com':80
- 'st#####r.sslsecure4.com':80
- 'st#####r.sslsecure3.com':80
- 'ap#.##.sslsecure9.com':80
- 'ap#.##.sslsecure8.com':80
- 'st#####r.paleokits.net':80
- 'ap#.##.sslsecure10.com':80
TCP:
Запросы HTTP GET:
- st#####r.sslsecure8.com/test.html
- st#####r.sslsecure7.com/test.html
- st#####r.sslsecure6.com/test.html
- tr###.#2.madodls.com/test.html
- st######.sslsecure10.com/test.html
- st#####r.sslsecure9.com/test.html
- st#####r.sslsecure2.com/test.html
- st#####r.sslsecure1.com/test.html
- dt####.secdls.com/debug/Domains/paleokits_net/KO
- st#####r.sslsecure5.com/test.html
- st#####r.sslsecure4.com/test.html
- st#####r.sslsecure3.com/test.html
- tr###.#2.sslsecure1.com/test.html
- tr###.##.sslsecure10.com/test.html
- tr###.#2.sslsecure9.com/test.html
- tr###.#2.sslsecure8.com/test.html
- dt####.secdls.com/debug/TraceErrors/RecievingXml
- ap#.##.madodls.com/index.php/api/151/Player_Setup/479/547/English.xml
- dt####.secdls.com/debug/trace/GetXmlDataRequisites
- tr###.#2.sslsecure4.com/test.html
- tr###.#2.sslsecure3.com/test.html
- tr###.#2.sslsecure2.com/test.html
- tr###.#2.sslsecure7.com/test.html
- tr###.#2.sslsecure6.com/test.html
- tr###.#2.sslsecure5.com/test.html
- st#####r.paleokits.net/test.html
- dt####.secdls.com/debug/Domains/sslsecure2_com/KO
- ap#.##.sslsecure2.com/test.html
- dt####.secdls.com/debug/Domains/sslsecure1_com/KO
- ap#.##.sslsecure4.com/test.html
- dt####.secdls.com/debug/Domains/sslsecure3_com/KO
- ap#.##.sslsecure3.com/test.html
- dt####.secdls.com/debug/trace/GetBinaryData
- dt####.secdls.com/debug/framework/False
- dt####.secdls.com/debug/trace/Start
- ap#.##.sslsecure1.com/test.html
- dt####.secdls.com/debug/Domains/madodls_com/KO
- ap#.##.madodls.com/test.html
- dt####.secdls.com/debug/Domains/sslsecure4_com/KO
- ap#.##.sslsecure9.com/test.html
- dt####.secdls.com/debug/Domains/sslsecure8_com/KO
- ap#.##.sslsecure8.com/test.html
- dt####.secdls.com/debug/Domains/sslsecure10_com/KO
- ap#.##.sslsecure10.com/test.html
- dt####.secdls.com/debug/Domains/sslsecure9_com/KO
- ap#.##.sslsecure6.com/test.html
- dt####.secdls.com/debug/Domains/sslsecure5_com/KO
- ap#.##.sslsecure5.com/test.html
- dt####.secdls.com/debug/Domains/sslsecure7_com/KO
- ap#.##.sslsecure7.com/test.html
- dt####.secdls.com/debug/Domains/sslsecure6_com/KO
Запросы HTTP POST:
- dt####.secdls.com/debugMessage/
UDP:
- DNS ASK st######.sslsecure10.com
- DNS ASK st#####r.sslsecure9.com
- DNS ASK tr###.#2.sslsecure1.com
- DNS ASK tr###.#2.madodls.com
- DNS ASK st#####r.sslsecure6.com
- DNS ASK st#####r.sslsecure5.com
- DNS ASK st#####r.sslsecure8.com
- DNS ASK st#####r.sslsecure7.com
- DNS ASK tr###.#2.sslsecure2.com
- DNS ASK tr###.#2.sslsecure8.com
- DNS ASK tr###.#2.sslsecure7.com
- DNS ASK tr###.##.sslsecure10.com
- DNS ASK tr###.#2.sslsecure9.com
- DNS ASK tr###.#2.sslsecure4.com
- DNS ASK tr###.#2.sslsecure3.com
- DNS ASK tr###.#2.sslsecure6.com
- DNS ASK tr###.#2.sslsecure5.com
- DNS ASK ap#.##.sslsecure4.com
- DNS ASK ap#.##.sslsecure3.com
- DNS ASK ap#.##.sslsecure6.com
- DNS ASK ap#.##.sslsecure5.com
- DNS ASK ap#.##.madodls.com
- DNS ASK dt####.secdls.com
- DNS ASK ap#.##.sslsecure2.com
- DNS ASK ap#.##.sslsecure1.com
- DNS ASK ap#.##.sslsecure7.com
- DNS ASK st#####r.sslsecure2.com
- DNS ASK st#####r.sslsecure1.com
- DNS ASK st#####r.sslsecure4.com
- DNS ASK st#####r.sslsecure3.com
- DNS ASK ap#.##.sslsecure9.com
- DNS ASK ap#.##.sslsecure8.com
- DNS ASK st#####r.paleokits.net
- DNS ASK ap#.##.sslsecure10.com
Другое:
Ищет следующие окна:
- ClassName: 'OleMainThreadWndClass' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
