Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Logs Multimedia Now Solutions Auto' = '<SYSTEM32>\qidolbqyw.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\DCOM Process Client Control Now] 'Start' = '00000002'
Вредоносные функции:
Для затруднения выявления своего присутствия в системе
блокирует:
- Центр обеспечения безопасности (Security Center)
Создает и запускает на исполнение:
- '<SYSTEM32>\iaiquju.exe' "<SYSTEM32>\qidolbqyw.exe"
- '%WINDIR%\Temp\vav9ejz93rx8suazk.exe' -r 28966 tcp
- '%TEMP%\vav9ejz93kd3suazkddbyfl.exe'
- '<SYSTEM32>\qidolbqyw.exe'
Изменения в файловой системе:
Создает следующие файлы:
- <SYSTEM32>\fedtapvzq\run
- <SYSTEM32>\fedtapvzq\rng
- %WINDIR%\Temp\vav9ejz93rx8suazk.exe
- <SYSTEM32>\fedtapvzq\cfg
- <SYSTEM32>\iaiquju.exe
- %TEMP%\vav9ejz93kd3suazkddbyfl.exe
- <SYSTEM32>\fedtapvzq\tst
- <SYSTEM32>\qidolbqyw.exe
- <SYSTEM32>\fedtapvzq\etc
Присваивает атрибут 'скрытый' для следующих файлов:
- <SYSTEM32>\iaiquju.exe
- <SYSTEM32>\qidolbqyw.exe
Удаляет следующие файлы:
- %WINDIR%\Temp\vav9ejz93rx8suazk.exe
- <DRIVERS>\etc\hosts
- %TEMP%\vav9ejz93kd3suazkddbyfl.exe
Подменяет файл HOSTS.
Сетевая активность:
Подключается к:
- 'eq###loud.net':80
- 'gr####housand.net':80
- 'eq####housand.net':80
- 'gr###loud.net':80
- 'sp####aturday.net':80
- 'gr###tree.net':80
- 'eq###tree.net':80
- 'gr####aturday.net':80
- 'gl###oud.net':80
- 'ta####housand.net':80
- 'gl####ousand.net':80
- 'ta###loud.net':80
- 'eq####aturday.net':80
- 'ta###tree.net':80
- 'gl###ree.net':80
- 'fa####ousand.net':80
- 'wa####housand.net':80
- 'fa####turday.net':80
- 'wa###loud.net':80
- 'fa###ree.net':80
- 'wa###tree.net':80
- 'fa###oud.net':80
- 'wa####aturday.net':80
- 'vi####housand.net':80
- 'sp####housand.net':80
- 'vi####aturday.net':80
- 'sp###loud.net':80
- 'vi###tree.net':80
- 'sp###tree.net':80
- 'vi###loud.net':80
- 'ta####aturday.net':80
- 'ca####nbring.net':80
- 'pr####tbottom.net':80
- 'mo###olor.net':80
- 'al###being.net':80
- 'wh####aturday.net':80
- 'up####turday.net':80
- 'ri###nstorm.net':80
- 'ab###ell.net':80
- 'jo####ymeasure.net':80
- 'th###while.net':80
- 'ef###tbuilt.net':80
- 'cr#####onaraminta.net':80
- 'mi###hown.net':80
- 'mo###ugust.net':80
- 'le###form.net':80
- 'sp###oud.net':80
- 'sa####ousand.net':80
- 'sp####ousand.net':80
- 'sa###oud.net':80
- 'gl####turday.net':80
- 'sa###ree.net':80
- 'sp###ree.net':80
- 'sa####turday.net':80
- 'up###oud.net':80
- 'wh####housand.net':80
- 'up####ousand.net':80
- 'wh###loud.net':80
- 'sp####turday.net':80
- 'wh###tree.net':80
- 'up###ree.net':80
TCP:
Запросы HTTP GET:
- http://eq###loud.net/index.php
- http://gr####housand.net/index.php
- http://eq####housand.net/index.php
- http://gr###loud.net/index.php
- http://sp####aturday.net/index.php
- http://gr###tree.net/index.php
- http://eq###tree.net/index.php
- http://gr####aturday.net/index.php
- http://gl###oud.net/index.php
- http://ta####housand.net/index.php
- http://gl####ousand.net/index.php
- http://ta###loud.net/index.php
- http://eq####aturday.net/index.php
- http://ta###tree.net/index.php
- http://gl###ree.net/index.php
- http://fa####ousand.net/index.php
- http://wa####housand.net/index.php
- http://fa####turday.net/index.php
- http://wa###loud.net/index.php
- http://fa###ree.net/index.php
- http://wa###tree.net/index.php
- http://fa###oud.net/index.php
- http://wa####aturday.net/index.php
- http://vi####housand.net/index.php
- http://sp####housand.net/index.php
- http://vi####aturday.net/index.php
- http://sp###loud.net/index.php
- http://vi###tree.net/index.php
- http://sp###tree.net/index.php
- http://vi###loud.net/index.php
- http://ta####aturday.net/index.php
- http://ca####nbring.net/index.php
- http://pr####tbottom.net/index.php
- http://mo###olor.net/index.php
- http://al###being.net/index.php
- http://wh####aturday.net/index.php
- http://up####turday.net/index.php
- http://ri###nstorm.net/index.php
- http://ab###ell.net/index.php
- http://jo####ymeasure.net/index.php
- http://th###while.net/index.php
- http://ef###tbuilt.net/index.php
- http://cr#####onaraminta.net/index.php
- http://mi###hown.net/index.php
- http://mo###ugust.net/index.php
- http://le###form.net/index.php
- http://sp###oud.net/index.php
- http://sa####ousand.net/index.php
- http://sp####ousand.net/index.php
- http://sa###oud.net/index.php
- http://gl####turday.net/index.php
- http://sa###ree.net/index.php
- http://sp###ree.net/index.php
- http://sa####turday.net/index.php
- http://up###oud.net/index.php
- http://wh####housand.net/index.php
- http://up####ousand.net/index.php
- http://wh###loud.net/index.php
- http://sp####turday.net/index.php
- http://wh###tree.net/index.php
- http://up###ree.net/index.php
UDP:
- DNS ASK gr####housand.net
- DNS ASK eq####housand.net
- DNS ASK gr####aturday.net
- DNS ASK eq###loud.net
- DNS ASK gr###tree.net
- DNS ASK eq###tree.net
- DNS ASK gr###loud.net
- DNS ASK eq####aturday.net
- DNS ASK ta####housand.net
- DNS ASK gl####ousand.net
- DNS ASK ta####aturday.net
- DNS ASK gl###oud.net
- DNS ASK ta###tree.net
- DNS ASK gl###ree.net
- DNS ASK ta###loud.net
- DNS ASK sp####aturday.net
- DNS ASK fa####ousand.net
- DNS ASK wa####housand.net
- DNS ASK fa####turday.net
- DNS ASK wa###loud.net
- DNS ASK fa###ree.net
- DNS ASK wa###tree.net
- DNS ASK fa###oud.net
- DNS ASK wa####aturday.net
- DNS ASK vi####housand.net
- DNS ASK sp####housand.net
- DNS ASK vi####aturday.net
- DNS ASK sp###loud.net
- DNS ASK vi###tree.net
- DNS ASK sp###tree.net
- DNS ASK vi###loud.net
- DNS ASK ca####nbring.net
- DNS ASK pr####tbottom.net
- DNS ASK mo###olor.net
- DNS ASK al###being.net
- DNS ASK wh####aturday.net
- DNS ASK up####turday.net
- DNS ASK ri###nstorm.net
- DNS ASK ab###ell.net
- DNS ASK jo####ymeasure.net
- DNS ASK th###while.net
- DNS ASK ef###tbuilt.net
- DNS ASK cr#####onaraminta.net
- DNS ASK mi###hown.net
- DNS ASK mo###ugust.net
- DNS ASK le###form.net
- DNS ASK sp###oud.net
- DNS ASK sa####ousand.net
- DNS ASK sp####ousand.net
- DNS ASK sa###oud.net
- DNS ASK gl####turday.net
- DNS ASK sa###ree.net
- DNS ASK sp###ree.net
- DNS ASK sa####turday.net
- DNS ASK up###oud.net
- DNS ASK wh####housand.net
- DNS ASK up####ousand.net
- DNS ASK wh###loud.net
- DNS ASK sp####turday.net
- DNS ASK wh###tree.net
- DNS ASK up###ree.net
- '23#.#55.255.250':1900
