Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Auto Portable Connectivity Modules Base' = 'C:\eqipljnp\tpbohei.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Browser Font Extender Parental Collector] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- 'C:\eqipljnp\kjpkdga.exe' "c:\eqipljnp\tpbohei.exe"
- 'C:\eqipljnp\tpbohei.exe'
- 'C:\eqipljnp\otjti3atszwmnxwerwfw.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\eqipljnp\tpbohei.exe
- C:\eqipljnp\kjpkdga.exe
- C:\eqipljnp\tnaoei7
- %WINDIR%\eqipljnp\podwcgyj
- C:\eqipljnp\podwcgyj
- C:\eqipljnp\otjti3atszwmnxwerwfw.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\eqipljnp\kjpkdga.exe
- C:\eqipljnp\tpbohei.exe
Удаляет следующие файлы:
- C:\eqipljnp\otjti3atszwmnxwerwfw.exe
- %WINDIR%\eqipljnp\podwcgyj
Сетевая активность:
Подключается к:
- 'el####icmeasure.net':80
- 're####measure.net':80
- 're####dinner.net':80
- 're####afraid.net':80
- 'el####icdinner.net':80
- 'ca####ncircle.net':80
- 'ca####ndinner.net':80
- 'la###dinner.net':80
- 'la###afraid.net':80
- 'la###circle.net':80
- 'ca####nafraid.net':80
- 'st####afraid.net':80
- 'tr###dinner.net':80
- 'tr###afraid.net':80
- 'tr###circle.net':80
- 'st####circle.net':80
- 'st####dinner.net':80
- 're####circle.net':80
- 'el####icafraid.net':80
- 'el####iccircle.net':80
- 'tr####easure.net':80
- 'st####measure.net':80
- 'do###dinner.net':80
- 'ag####tdinner.net':80
- 'ag####tafraid.net':80
- 'ag####tcircle.net':80
- 'do###afraid.net':80
- 'do####easure.net':80
- 'se###nbuilt.net':80
- 'qu###built.net':80
- 'qu###carry.net':80
- 'ag####tmeasure.net':80
- 'se###ncarry.net':80
- 'ni###circle.net':80
- 'de####afraid.net':80
- 'de####circle.net':80
- 'ca####nmeasure.net':80
- 'la####easure.net':80
- 'ni###afraid.net':80
- 'ni####easure.net':80
- 'do###circle.net':80
- 'de####measure.net':80
- 'de####dinner.net':80
- 'ni###dinner.net':80
TCP:
Запросы HTTP GET:
- http://el####icmeasure.net/index.php?me########
- http://re####measure.net/index.php?me########
- http://re####dinner.net/index.php?me########
- http://re####afraid.net/index.php?me########
- http://el####icdinner.net/index.php?me########
- http://ca####ncircle.net/index.php?me########
- http://ca####ndinner.net/index.php?me########
- http://la###dinner.net/index.php?me########
- http://la###afraid.net/index.php?me########
- http://la###circle.net/index.php?me########
- http://ca####nafraid.net/index.php?me########
- http://st####afraid.net/index.php?me########
- http://tr###dinner.net/index.php?me########
- http://tr###afraid.net/index.php?me########
- http://tr###circle.net/index.php?me########
- http://st####circle.net/index.php?me########
- http://st####dinner.net/index.php?me########
- http://re####circle.net/index.php?me########
- http://el####icafraid.net/index.php?me########
- http://el####iccircle.net/index.php?me########
- http://tr####easure.net/index.php?me########
- http://st####measure.net/index.php?me########
- http://do###dinner.net/index.php?me########
- http://ag####tdinner.net/index.php?me########
- http://ag####tafraid.net/index.php?me########
- http://ag####tcircle.net/index.php?me########
- http://do###afraid.net/index.php?me########
- http://do####easure.net/index.php?me########
- http://se###nbuilt.net/index.php?me########
- http://qu###built.net/index.php?me########
- http://qu###carry.net/index.php?me########
- http://ag####tmeasure.net/index.php?me########
- http://se###ncarry.net/index.php?me########
- http://ni###circle.net/index.php?me########
- http://de####afraid.net/index.php?me########
- http://de####circle.net/index.php?me########
- http://ca####nmeasure.net/index.php?me########
- http://la####easure.net/index.php?me########
- http://ni###afraid.net/index.php?me########
- http://ni####easure.net/index.php?me########
- http://do###circle.net/index.php?me########
- http://de####measure.net/index.php?me########
- http://de####dinner.net/index.php?me########
- http://ni###dinner.net/index.php?me########
UDP:
- DNS ASK re####dinner.net
- DNS ASK el####icmeasure.net
- DNS ASK el####icdinner.net
- DNS ASK el####icafraid.net
- DNS ASK re####afraid.net
- DNS ASK re####measure.net
- DNS ASK la###afraid.net
- DNS ASK ca####ndinner.net
- DNS ASK ca####nafraid.net
- DNS ASK ca####ncircle.net
- DNS ASK la###circle.net
- DNS ASK tr###afraid.net
- DNS ASK st####afraid.net
- DNS ASK st####circle.net
- DNS ASK be####measure.net
- DNS ASK tr###circle.net
- DNS ASK tr###dinner.net
- DNS ASK el####iccircle.net
- DNS ASK re####circle.net
- DNS ASK st####measure.net
- DNS ASK st####dinner.net
- DNS ASK tr####easure.net
- DNS ASK la###dinner.net
- DNS ASK do###dinner.net
- DNS ASK ag####tdinner.net
- DNS ASK ag####tafraid.net
- DNS ASK ag####tcircle.net
- DNS ASK do###afraid.net
- DNS ASK do####easure.net
- DNS ASK se###nbuilt.net
- DNS ASK qu###built.net
- DNS ASK qu###carry.net
- DNS ASK ag####tmeasure.net
- DNS ASK se###ncarry.net
- DNS ASK ni###circle.net
- DNS ASK de####afraid.net
- DNS ASK de####circle.net
- DNS ASK ca####nmeasure.net
- DNS ASK la####easure.net
- DNS ASK ni###afraid.net
- DNS ASK ni####easure.net
- DNS ASK do###circle.net
- DNS ASK de####measure.net
- DNS ASK de####dinner.net
- DNS ASK ni###dinner.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
