Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Provider Process Secure Coordinator DNS' = 'C:\nhmjezvtpwxm\yevnwrwe.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Brightness Search Filtering Name Locator] 'ImagePath' = 'C:\nhmjezvtpwxm\yevnwrwe.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Brightness Search Filtering Name Locator] 'Start' = '00000002'
Вредоносные функции:
Запускает на исполнение:
- 'C:\nhmjezvtpwxm\scxblhjj.exe' "c:\nhmjezvtpwxm\yevnwrwe.exe"
- 'C:\nhmjezvtpwxm\yevnwrwe.exe'
- 'C:\nhmjezvtpwxm\d72oqnfyrfvetuu3ew.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\nhmjezvtpwxm\yevnwrwe.exe
- C:\nhmjezvtpwxm\scxblhjj.exe
- C:\nhmjezvtpwxm\orlfsiqhu
- %WINDIR%\nhmjezvtpwxm\jwdixsey
- C:\nhmjezvtpwxm\jwdixsey
- C:\nhmjezvtpwxm\d72oqnfyrfvetuu3ew.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\nhmjezvtpwxm\scxblhjj.exe
- C:\nhmjezvtpwxm\yevnwrwe.exe
Удаляет следующие файлы:
- C:\nhmjezvtpwxm\d72oqnfyrfvetuu3ew.exe
- %WINDIR%\nhmjezvtpwxm\jwdixsey
Подменяет следующие файлы:
- %WINDIR%\nhmjezvtpwxm\jwdixsey
Сетевая активность:
Подключается к:
- 'mi####listen.net':80
- 'tw####listen.net':80
- 'tw###ebring.net':80
- 'al###shout.net':80
- 'mi###ebring.net':80
- 'tw###eshout.net':80
- 'ra###rbring.net':80
- 'mi###eshout.net':80
- 'mi####demand.net':80
- 'tw####demand.net':80
- 'of###shout.net':80
- 'co####eshout.net':80
- 'of###bring.net':80
- 'ch###shout.net':80
- 'ch###demand.net':80
- 'co####edemand.net':80
- 'of###demand.net':80
- 'al###demand.net':80
- 'al###listen.net':80
- 'al###bring.net':80
- 'of###listen.net':80
- 'hi####yshout.net':80
- 'am###tbring.net':80
- 'st####eshout.net':80
- 'st####edemand.net':80
- 'hi####ydemand.net':80
- 'am####demand.net':80
- 'we####rdemand.net':80
- 'we####rlisten.net':80
- 'we####rbring.net':80
- 'am####listen.net':80
- 'hi####ylisten.net':80
- 'ra####demand.net':80
- 'mo####gdemand.net':80
- 'mo####glisten.net':80
- 'mo####gbring.net':80
- 'ra####listen.net':80
- 'hi####ybring.net':80
- 'st####elisten.net':80
- 'st####ebring.net':80
- 'ra###rshout.net':80
- 'mo####gshout.net':80
- 'co####elisten.net':80
- 'hi####ylabor.net':80
- 'am####silver.net':80
- 'st####elabor.net':80
- 'st####evalley.net':80
- 'hi####yvalley.net':80
- 'am####valley.net':80
- 'we####rvalley.net':80
- 'we####rsister.net':80
- 'we####rsilver.net':80
- 'am####sister.net':80
- 'hi####ysister.net':80
- 'ra####valley.net':80
- 'mo####gvalley.net':80
- 'mo####gsister.net':80
- 'mo####gsilver.net':80
- 'ra####sister.net':80
- 'hi####ysilver.net':80
- 'st####esister.net':80
- 'st####esilver.net':80
- 'ra###rlabor.net':80
- 'mo####glabor.net':80
- 'th###demand.net':80
- 'pr####tdemand.net':80
- 'pr####tlisten.net':80
- 'pr####tbring.net':80
- 'th###listen.net':80
- 'co####ebring.net':80
- 'ch###listen.net':80
- 'ch###bring.net':80
- 'th###shout.net':80
- 'pr####tshout.net':80
- 'th###bring.net':80
- 'cl###silver.net':80
- 'th###sister.net':80
- 'th###silver.net':80
- 'am###tlabor.net':80
- 'we####rlabor.net':80
- 'th###labor.net':80
- 'cl###labor.net':80
- 'cl###valley.net':80
- 'cl###sister.net':80
- 'th###valley.net':80
TCP:
Запросы HTTP GET:
- http://mi####listen.net/index.php?me########
- http://tw####listen.net/index.php?me########
- http://tw###ebring.net/index.php?me########
- http://al###shout.net/index.php?me########
- http://mi###ebring.net/index.php?me########
- http://tw###eshout.net/index.php?me########
- http://ra###rbring.net/index.php?me########
- http://mi###eshout.net/index.php?me########
- http://mi####demand.net/index.php?me########
- http://tw####demand.net/index.php?me########
- http://of###shout.net/index.php?me########
- http://co####eshout.net/index.php?me########
- http://of###bring.net/index.php?me########
- http://ch###shout.net/index.php?me########
- http://ch###demand.net/index.php?me########
- http://co####edemand.net/index.php?me########
- http://of###demand.net/index.php?me########
- http://al###demand.net/index.php?me########
- http://al###listen.net/index.php?me########
- http://al###bring.net/index.php?me########
- http://of###listen.net/index.php?me########
- http://hi####yshout.net/index.php?me########
- http://am###tbring.net/index.php?me########
- http://st####eshout.net/index.php?me########
- http://st####edemand.net/index.php?me########
- http://hi####ydemand.net/index.php?me########
- http://am####demand.net/index.php?me########
- http://we####rdemand.net/index.php?me########
- http://we####rlisten.net/index.php?me########
- http://we####rbring.net/index.php?me########
- http://am####listen.net/index.php?me########
- http://hi####ylisten.net/index.php?me########
- http://ra####demand.net/index.php?me########
- http://mo####gdemand.net/index.php?me########
- http://mo####glisten.net/index.php?me########
- http://mo####gbring.net/index.php?me########
- http://ra####listen.net/index.php?me########
- http://hi####ybring.net/index.php?me########
- http://st####elisten.net/index.php?me########
- http://st####ebring.net/index.php?me########
- http://ra###rshout.net/index.php?me########
- http://mo####gshout.net/index.php?me########
- http://co####elisten.net/index.php?me########
- http://hi####ylabor.net/index.php?me########
- http://am####silver.net/index.php?me########
- http://st####elabor.net/index.php?me########
- http://st####evalley.net/index.php?me########
- http://hi####yvalley.net/index.php?me########
- http://am####valley.net/index.php?me########
- http://we####rvalley.net/index.php?me########
- http://we####rsister.net/index.php?me########
- http://we####rsilver.net/index.php?me########
- http://am####sister.net/index.php?me########
- http://hi####ysister.net/index.php?me########
- http://ra####valley.net/index.php?me########
- http://mo####gvalley.net/index.php?me########
- http://mo####gsister.net/index.php?me########
- http://mo####gsilver.net/index.php?me########
- http://ra####sister.net/index.php?me########
- http://hi####ysilver.net/index.php?me########
- http://st####esister.net/index.php?me########
- http://st####esilver.net/index.php?me########
- http://ra###rlabor.net/index.php?me########
- http://mo####glabor.net/index.php?me########
- http://th###demand.net/index.php?me########
- http://pr####tdemand.net/index.php?me########
- http://pr####tlisten.net/index.php?me########
- http://pr####tbring.net/index.php?me########
- http://th###listen.net/index.php?me########
- http://co####ebring.net/index.php?me########
- http://ch###listen.net/index.php?me########
- http://ch###bring.net/index.php?me########
- http://th###shout.net/index.php?me########
- http://pr####tshout.net/index.php?me########
- http://th###bring.net/index.php?me########
- http://cl###silver.net/index.php?me########
- http://th###sister.net/index.php?me########
- http://th###silver.net/index.php?me########
- http://am###tlabor.net/index.php?me########
- http://we####rlabor.net/index.php?me########
- http://th###labor.net/index.php?me########
- http://cl###labor.net/index.php?me########
- http://cl###valley.net/index.php?me########
- http://cl###sister.net/index.php?me########
- http://th###valley.net/index.php?me########
UDP:
- DNS ASK mi####listen.net
- DNS ASK tw####listen.net
- DNS ASK tw###ebring.net
- DNS ASK al###shout.net
- DNS ASK mi###ebring.net
- DNS ASK tw###eshout.net
- DNS ASK ra###rbring.net
- DNS ASK mi###eshout.net
- DNS ASK mi####demand.net
- DNS ASK tw####demand.net
- DNS ASK of###shout.net
- DNS ASK co####eshout.net
- DNS ASK of###bring.net
- DNS ASK ch###shout.net
- DNS ASK ch###demand.net
- DNS ASK co####edemand.net
- DNS ASK of###demand.net
- DNS ASK al###demand.net
- DNS ASK al###listen.net
- DNS ASK al###bring.net
- DNS ASK of###listen.net
- DNS ASK hi####yshout.net
- DNS ASK am###tbring.net
- DNS ASK st####eshout.net
- DNS ASK st####edemand.net
- DNS ASK hi####ydemand.net
- DNS ASK am####demand.net
- DNS ASK we####rdemand.net
- DNS ASK we####rlisten.net
- DNS ASK we####rbring.net
- DNS ASK am####listen.net
- DNS ASK hi####ylisten.net
- DNS ASK ra####demand.net
- DNS ASK mo####gdemand.net
- DNS ASK mo####glisten.net
- DNS ASK mo####gbring.net
- DNS ASK ra####listen.net
- DNS ASK hi####ybring.net
- DNS ASK st####elisten.net
- DNS ASK st####ebring.net
- DNS ASK ra###rshout.net
- DNS ASK mo####gshout.net
- DNS ASK co####elisten.net
- DNS ASK hi####ylabor.net
- DNS ASK am####silver.net
- DNS ASK st####elabor.net
- DNS ASK st####evalley.net
- DNS ASK hi####yvalley.net
- DNS ASK am####valley.net
- DNS ASK we####rvalley.net
- DNS ASK we####rsister.net
- DNS ASK we####rsilver.net
- DNS ASK am####sister.net
- DNS ASK hi####ysister.net
- DNS ASK ra####valley.net
- DNS ASK mo####gvalley.net
- DNS ASK mo####gsister.net
- DNS ASK mo####gsilver.net
- DNS ASK ra####sister.net
- DNS ASK hi####ysilver.net
- DNS ASK st####esister.net
- DNS ASK st####esilver.net
- DNS ASK ra###rlabor.net
- DNS ASK mo####glabor.net
- DNS ASK th###demand.net
- DNS ASK pr####tdemand.net
- DNS ASK pr####tlisten.net
- DNS ASK pr####tbring.net
- DNS ASK th###listen.net
- DNS ASK co####ebring.net
- DNS ASK ch###listen.net
- DNS ASK ch###bring.net
- DNS ASK th###shout.net
- DNS ASK pr####tshout.net
- DNS ASK th###bring.net
- DNS ASK cl###silver.net
- DNS ASK th###sister.net
- DNS ASK th###silver.net
- DNS ASK am###tlabor.net
- DNS ASK we####rlabor.net
- DNS ASK th###labor.net
- DNS ASK cl###labor.net
- DNS ASK cl###valley.net
- DNS ASK cl###sister.net
- DNS ASK th###valley.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
