Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Defender Location Service' = 'C:\itmfpsvve\jdkeltculzjt.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\UPnP System BranchCache DCOM Center] 'ImagePath' = 'C:\itmfpsvve\jdkeltculzjt.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\UPnP System BranchCache DCOM Center] 'Start' = '00000002'
Вредоносные функции:
Запускает на исполнение:
- 'C:\itmfpsvve\lqulgevvczi.exe' "c:\itmfpsvve\jdkeltculzjt.exe"
- 'C:\itmfpsvve\jdkeltculzjt.exe'
- 'C:\itmfpsvve\c7vcq2w4pkpnkfp0466i.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\itmfpsvve\jdkeltculzjt.exe
- C:\itmfpsvve\lqulgevvczi.exe
- C:\itmfpsvve\d8lklshjxbfb
- %WINDIR%\itmfpsvve\uwlzxr
- C:\itmfpsvve\uwlzxr
- C:\itmfpsvve\c7vcq2w4pkpnkfp0466i.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\itmfpsvve\lqulgevvczi.exe
- C:\itmfpsvve\jdkeltculzjt.exe
Удаляет следующие файлы:
- C:\itmfpsvve\c7vcq2w4pkpnkfp0466i.exe
- %WINDIR%\itmfpsvve\uwlzxr
Подменяет следующие файлы:
- %WINDIR%\itmfpsvve\uwlzxr
Сетевая активность:
Подключается к:
- 'jo####yfancy.net':80
- 'hu####dlaughter.net':80
- 'hu####dfancy.net':80
- 'hu####dconsider.net':80
- 'jo####yconsider.net':80
- 'jo####ylaughter.net':80
- 'wo###system.net':80
- 're####erneither.net':80
- 're####ersystem.net':80
- 're####ertrust.net':80
- 'wo###trust.net':80
- 'jo####yfriend.net':80
- 'de####yfriend.net':80
- 'li####consider.net':80
- 'li####friend.net':80
- 'be####laughter.net':80
- 'ri####laughter.net':80
- 'de####yconsider.net':80
- 'de####ylaughter.net':80
- 'hu####dfriend.net':80
- 'li####laughter.net':80
- 'li###efancy.net':80
- 'de####yfancy.net':80
- 'wo####either.net':80
- 'ef####neither.net':80
- 'th####hhonor.net':80
- 'th####hneither.net':80
- 'th####hsystem.net':80
- 'ef####system.net':80
- 'ef###thonor.net':80
- 'wi####system.net':80
- 'su####neither.net':80
- 'su####system.net':80
- 'su###rtrust.net':80
- 'wi###ntrust.net':80
- 'ef###ttrust.net':80
- 'fo###ttrust.net':80
- 'in####sesystem.net':80
- 'in####setrust.net':80
- 're####erhonor.net':80
- 'wo###honor.net':80
- 'fo####system.net':80
- 'fo###thonor.net':80
- 'th####htrust.net':80
- 'in####sehonor.net':80
- 'in####seneither.net':80
- 'fo####neither.net':80
TCP:
Запросы HTTP GET:
- http://jo####yfancy.net/index.php
- http://hu####dlaughter.net/index.php
- http://hu####dfancy.net/index.php
- http://hu####dconsider.net/index.php
- http://jo####yconsider.net/index.php
- http://jo####ylaughter.net/index.php
- http://wo###system.net/index.php
- http://re####erneither.net/index.php
- http://re####ersystem.net/index.php
- http://re####ertrust.net/index.php
- http://wo###trust.net/index.php
- http://jo####yfriend.net/index.php
- http://de####yfriend.net/index.php
- http://li####consider.net/index.php
- http://li####friend.net/index.php
- http://be####laughter.net/index.php
- http://ri####laughter.net/index.php
- http://de####yconsider.net/index.php
- http://de####ylaughter.net/index.php
- http://hu####dfriend.net/index.php
- http://li####laughter.net/index.php
- http://li###efancy.net/index.php
- http://de####yfancy.net/index.php
- http://wo####either.net/index.php
- http://ef####neither.net/index.php
- http://th####hhonor.net/index.php
- http://th####hneither.net/index.php
- http://th####hsystem.net/index.php
- http://ef####system.net/index.php
- http://ef###thonor.net/index.php
- http://wi####system.net/index.php
- http://su####neither.net/index.php
- http://su####system.net/index.php
- http://su###rtrust.net/index.php
- http://wi###ntrust.net/index.php
- http://ef###ttrust.net/index.php
- http://fo###ttrust.net/index.php
- http://in####sesystem.net/index.php
- http://in####setrust.net/index.php
- http://re####erhonor.net/index.php
- http://wo###honor.net/index.php
- http://fo####system.net/index.php
- http://fo###thonor.net/index.php
- http://th####htrust.net/index.php
- http://in####sehonor.net/index.php
- http://in####seneither.net/index.php
- http://fo####neither.net/index.php
UDP:
- DNS ASK hu####dfancy.net
- DNS ASK jo####yfancy.net
- DNS ASK hu####dlaughter.net
- DNS ASK jo####yfriend.net
- DNS ASK hu####dconsider.net
- DNS ASK jo####yconsider.net
- DNS ASK re####ersystem.net
- DNS ASK wo###system.net
- DNS ASK re####erneither.net
- DNS ASK jo####ylaughter.net
- DNS ASK re####ertrust.net
- DNS ASK wo###trust.net
- DNS ASK li####friend.net
- DNS ASK de####yfriend.net
- DNS ASK li####consider.net
- DNS ASK ri###nfancy.net
- DNS ASK be####laughter.net
- DNS ASK ri####laughter.net
- DNS ASK li####laughter.net
- DNS ASK de####ylaughter.net
- DNS ASK hu####dfriend.net
- DNS ASK de####yconsider.net
- DNS ASK li###efancy.net
- DNS ASK de####yfancy.net
- DNS ASK th####hneither.net
- DNS ASK ef####neither.net
- DNS ASK th####hhonor.net
- DNS ASK ef###ttrust.net
- DNS ASK th####hsystem.net
- DNS ASK ef####system.net
- DNS ASK su####system.net
- DNS ASK wi####system.net
- DNS ASK su####neither.net
- DNS ASK ef###thonor.net
- DNS ASK su###rtrust.net
- DNS ASK wi###ntrust.net
- DNS ASK in####setrust.net
- DNS ASK fo###ttrust.net
- DNS ASK in####sesystem.net
- DNS ASK wo####either.net
- DNS ASK re####erhonor.net
- DNS ASK wo###honor.net
- DNS ASK in####sehonor.net
- DNS ASK fo###thonor.net
- DNS ASK th####htrust.net
- DNS ASK fo####system.net
- DNS ASK in####seneither.net
- DNS ASK fo####neither.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
