Техническая информация
Вредоносные функции:
Запускает на исполнение:
- '%ProgramFiles%\Internet Explorer\IEXPLORE.EXE'
Сетевая активность:
Подключается к:
- 'vo###upvtry.pw':80
- 'rv#####afvallctv.biz':80
- 'ci###sqpvs.su':80
- 'ol####yncsss.biz':80
- 'qj####gxmaf.info':80
- 'ii##dpqw.ru':80
- 'ac####fiuxybnl.su':80
- '5.##7.0.137':80
- '77.##2.54.202':80
- '18#.#.250.135':80
- 'xo#####joqlnbwdwe.pl':80
- 'ss####ecetwmty.su':80
- '18#.#18.66.83':80
TCP:
Запросы HTTP POST:
- http://vo###upvtry.pw/upload/_dispatch.php
- http://rv#####afvallctv.biz/upload/_dispatch.php
- http://ci###sqpvs.su/upload/_dispatch.php
- http://ol####yncsss.biz/upload/_dispatch.php
- http://qj####gxmaf.info/upload/_dispatch.php
- http://ii##dpqw.ru/upload/_dispatch.php
- http://ac####fiuxybnl.su/upload/_dispatch.php
- http://5.##7.0.137/upload/_dispatch.php
- http://77.##2.54.202/upload/_dispatch.php
- http://18#.#.250.135/upload/_dispatch.php
- http://xo#####joqlnbwdwe.pl/upload/_dispatch.php
- http://ss####ecetwmty.su/upload/_dispatch.php
- http://18#.#18.66.83/upload/_dispatch.php
UDP:
- DNS ASK ii##dpqw.ru
- DNS ASK vo###upvtry.pw
- DNS ASK ol####yncsss.biz
- DNS ASK qj####gxmaf.info
- DNS ASK rv#####afvallctv.biz
- DNS ASK xo#####joqlnbwdwe.pl
- DNS ASK ss####ecetwmty.su
- DNS ASK ci###sqpvs.su
- DNS ASK ac####fiuxybnl.su
Другое:
Ищет следующие окна:
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
