Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Application Power Protocol Adapter' = 'C:\rubvfifql\ahyslmgz.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\ActiveX VC Quality Extensible] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- 'C:\rubvfifql\unlinhgdcy.exe' "c:\rubvfifql\ahyslmgz.exe"
- 'C:\rubvfifql\ahyslmgz.exe'
- 'C:\rubvfifql\izq42uuocaujpflcw.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\rubvfifql\ahyslmgz.exe
- C:\rubvfifql\unlinhgdcy.exe
- C:\rubvfifql\whtyckwm
- %WINDIR%\rubvfifql\csedkzv1m
- C:\rubvfifql\csedkzv1m
- C:\rubvfifql\izq42uuocaujpflcw.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\rubvfifql\unlinhgdcy.exe
- C:\rubvfifql\ahyslmgz.exe
Удаляет следующие файлы:
- C:\rubvfifql\izq42uuocaujpflcw.exe
- %WINDIR%\rubvfifql\csedkzv1m
Сетевая активность:
Подключается к:
- 'we####rarrive.net':80
- 'am####arrive.net':80
- 'we####roffice.net':80
- 'th###supply.net':80
- 'cl####istance.net':80
- 'th####istance.net':80
- 'cl###supply.net':80
- 'am####office.net':80
- 'hi####yarrive.net':80
- 'st####earrive.net':80
- 'hi####yoffice.net':80
- 'am####supply.net':80
- 'we####rdistance.net':80
- 'am####distance.net':80
- 'we####rsupply.net':80
- 'th###office.net':80
- 'pr####tcaught.net':80
- 'th###caught.net':80
- 'pr#####president.net':80
- 'ch###strong.net':80
- 'co####etrouble.net':80
- 'ch####rouble.net':80
- 'co####estrong.net':80
- 'th####resident.net':80
- 'cl###arrive.net':80
- 'th###arrive.net':80
- 'cl###office.net':80
- 'th###strong.net':80
- 'pr####ttrouble.net':80
- 'th####rouble.net':80
- 'pr####tstrong.net':80
- 'mi####supply.net':80
- 'al###arrive.net':80
- 'of###arrive.net':80
- 'tw####supply.net':80
- 'mi####office.net':80
- 'tw####distance.net':80
- 'mi####distance.net':80
- 'al###office.net':80
- 'of###supply.net':80
- 'co####earrive.net':80
- 'ch###arrive.net':80
- 'al###supply.net':80
- 'of###office.net':80
- 'al####istance.net':80
- 'of####istance.net':80
- 'tw####office.net':80
- 'st####esupply.net':80
- 'mo####garrive.net':80
- 'ra####arrive.net':80
- 'hi####ysupply.net':80
- 'st####eoffice.net':80
- 'hi####ydistance.net':80
- 'st####edistance.net':80
- 'mo####goffice.net':80
- 'ra####supply.net':80
- 'tw####arrive.net':80
- 'mi####arrive.net':80
- 'mo####gsupply.net':80
- 'ra####office.net':80
- 'mo####gdistance.net':80
- 'ra####distance.net':80
TCP:
Запросы HTTP GET:
- http://we####rarrive.net/index.php
- http://am####arrive.net/index.php
- http://we####roffice.net/index.php
- http://th###supply.net/index.php
- http://cl####istance.net/index.php
- http://th####istance.net/index.php
- http://cl###supply.net/index.php
- http://am####office.net/index.php
- http://hi####yarrive.net/index.php
- http://st####earrive.net/index.php
- http://hi####yoffice.net/index.php
- http://am####supply.net/index.php
- http://we####rdistance.net/index.php
- http://am####distance.net/index.php
- http://we####rsupply.net/index.php
- http://th###office.net/index.php
- http://pr####tcaught.net/index.php
- http://th###caught.net/index.php
- http://pr#####president.net/index.php
- http://ch###strong.net/index.php
- http://co####etrouble.net/index.php
- http://ch####rouble.net/index.php
- http://co####estrong.net/index.php
- http://th####resident.net/index.php
- http://cl###arrive.net/index.php
- http://th###arrive.net/index.php
- http://cl###office.net/index.php
- http://th###strong.net/index.php
- http://pr####ttrouble.net/index.php
- http://th####rouble.net/index.php
- http://pr####tstrong.net/index.php
- http://mi####supply.net/index.php
- http://al###arrive.net/index.php
- http://of###arrive.net/index.php
- http://tw####supply.net/index.php
- http://mi####office.net/index.php
- http://tw####distance.net/index.php
- http://mi####distance.net/index.php
- http://al###office.net/index.php
- http://of###supply.net/index.php
- http://co####earrive.net/index.php
- http://ch###arrive.net/index.php
- http://al###supply.net/index.php
- http://of###office.net/index.php
- http://al####istance.net/index.php
- http://of####istance.net/index.php
- http://tw####office.net/index.php
- http://st####esupply.net/index.php
- http://mo####garrive.net/index.php
- http://ra####arrive.net/index.php
- http://hi####ysupply.net/index.php
- http://st####eoffice.net/index.php
- http://hi####ydistance.net/index.php
- http://st####edistance.net/index.php
- http://mo####goffice.net/index.php
- http://ra####supply.net/index.php
- http://tw####arrive.net/index.php
- http://mi####arrive.net/index.php
- http://mo####gsupply.net/index.php
- http://ra####office.net/index.php
- http://mo####gdistance.net/index.php
- http://ra####distance.net/index.php
UDP:
- DNS ASK th###supply.net
- DNS ASK we####rarrive.net
- DNS ASK am####arrive.net
- DNS ASK cl###supply.net
- DNS ASK th###office.net
- DNS ASK cl####istance.net
- DNS ASK th####istance.net
- DNS ASK we####roffice.net
- DNS ASK am####supply.net
- DNS ASK hi####yarrive.net
- DNS ASK st####earrive.net
- DNS ASK we####rsupply.net
- DNS ASK am####office.net
- DNS ASK we####rdistance.net
- DNS ASK am####distance.net
- DNS ASK cl###office.net
- DNS ASK ch###strong.net
- DNS ASK pr####tcaught.net
- DNS ASK th###caught.net
- DNS ASK co####estrong.net
- DNS ASK ch####resident.net
- DNS ASK co####etrouble.net
- DNS ASK ch####rouble.net
- DNS ASK pr#####president.net
- DNS ASK th###strong.net
- DNS ASK cl###arrive.net
- DNS ASK th###arrive.net
- DNS ASK pr####tstrong.net
- DNS ASK th####resident.net
- DNS ASK pr####ttrouble.net
- DNS ASK th####rouble.net
- DNS ASK hi####yoffice.net
- DNS ASK mi####supply.net
- DNS ASK al###arrive.net
- DNS ASK of###arrive.net
- DNS ASK tw####supply.net
- DNS ASK mi####office.net
- DNS ASK tw####distance.net
- DNS ASK mi####distance.net
- DNS ASK al###office.net
- DNS ASK of###supply.net
- DNS ASK co####earrive.net
- DNS ASK ch###arrive.net
- DNS ASK al###supply.net
- DNS ASK of###office.net
- DNS ASK al####istance.net
- DNS ASK of####istance.net
- DNS ASK tw####office.net
- DNS ASK st####esupply.net
- DNS ASK mo####garrive.net
- DNS ASK ra####arrive.net
- DNS ASK hi####ysupply.net
- DNS ASK st####eoffice.net
- DNS ASK hi####ydistance.net
- DNS ASK st####edistance.net
- DNS ASK mo####goffice.net
- DNS ASK ra####supply.net
- DNS ASK tw####arrive.net
- DNS ASK mi####arrive.net
- DNS ASK mo####gsupply.net
- DNS ASK ra####office.net
- DNS ASK mo####gdistance.net
- DNS ASK ra####distance.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
