Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Visual Acquisition Profile Thread Procedure' = 'C:\fqssawsrubdkc\tokuhzua.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Protocol Telephony Encrypting Authentication] 'ImagePath' = 'C:\fqssawsrubdkc\tokuhzua.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Protocol Telephony Encrypting Authentication] 'Start' = '00000002'
Вредоносные функции:
Запускает на исполнение:
- 'C:\fqssawsrubdkc\icxpyckal.exe' "c:\fqssawsrubdkc\tokuhzua.exe"
- 'C:\fqssawsrubdkc\tokuhzua.exe'
- 'C:\fqssawsrubdkc\dc9qg3f6wfi5zwahzxj9.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\fqssawsrubdkc\tokuhzua.exe
- C:\fqssawsrubdkc\icxpyckal.exe
- C:\fqssawsrubdkc\dc9qg3f6wfi5zwahzxj9.exe
- %WINDIR%\fqssawsrubdkc\oqjlybzfjtuv
- C:\fqssawsrubdkc\oqjlybzfjtuv
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\fqssawsrubdkc\icxpyckal.exe
- C:\fqssawsrubdkc\tokuhzua.exe
Удаляет следующие файлы:
- C:\fqssawsrubdkc\dc9qg3f6wfi5zwahzxj9.exe
- %WINDIR%\fqssawsrubdkc\oqjlybzfjtuv
Подменяет следующие файлы:
- %WINDIR%\fqssawsrubdkc\oqjlybzfjtuv
Сетевая активность:
Подключается к:
- 'ge####orderly.net':80
- 'he####rderly.net':80
- 'ge###evalue.net':80
- 're####almost.net':80
- 'va####salmost.net':80
- 'ge####reason.net':80
- 'he###nvalue.net':80
- 'le###rvalue.net':80
- 'he###almost.net':80
- 'he###reason.net':80
- 'ge####almost.net':80
- 'va####sreason.net':80
- 'de####meeting.net':80
- 'fo####dchance.net':80
- 'fo####dmeeting.net':80
- 'fo####dtwenty.net':80
- 'de####twenty.net':80
- 'de####chance.net':80
- 'va####sorderly.net':80
- 're####reason.net':80
- 're####orderly.net':80
- 're###nvalue.net':80
- 'va####svalue.net':80
- 'pl####ntvalue.net':80
- 'ne#####ryorderly.net':80
- 'ne####aryvalue.net':80
- 're####ealmost.net':80
- 'or###almost.net':80
- 'pl####ntorderly.net':80
- 'pl####ntalmost.net':80
- 'he###value.net':80
- 'ne####aryalmost.net':80
- 'ne####aryreason.net':80
- 'pl####ntreason.net':80
- 'or###reason.net':80
- 'le####reason.net':80
- 'he####almost.net':80
- 'he####reason.net':80
- 'he####orderly.net':80
- 'le####orderly.net':80
- 'le####almost.net':80
- 'or####rderly.net':80
- 're####ereason.net':80
- 're####eorderly.net':80
- 're####evalue.net':80
- 'or###value.net':80
TCP:
Запросы HTTP GET:
- http://ge####orderly.net/index.php
- http://he####rderly.net/index.php
- http://ge###evalue.net/index.php
- http://re####almost.net/index.php
- http://va####salmost.net/index.php
- http://ge####reason.net/index.php
- http://he###nvalue.net/index.php
- http://le###rvalue.net/index.php
- http://he###almost.net/index.php
- http://he###reason.net/index.php
- http://ge####almost.net/index.php
- http://va####sreason.net/index.php
- http://de####meeting.net/index.php
- http://fo####dchance.net/index.php
- http://fo####dmeeting.net/index.php
- http://fo####dtwenty.net/index.php
- http://de####twenty.net/index.php
- http://de####chance.net/index.php
- http://va####sorderly.net/index.php
- http://re####reason.net/index.php
- http://re####orderly.net/index.php
- http://re###nvalue.net/index.php
- http://va####svalue.net/index.php
- http://pl####ntvalue.net/index.php
- http://ne#####ryorderly.net/index.php
- http://ne####aryvalue.net/index.php
- http://re####ealmost.net/index.php
- http://or###almost.net/index.php
- http://pl####ntorderly.net/index.php
- http://pl####ntalmost.net/index.php
- http://he###value.net/index.php
- http://ne####aryalmost.net/index.php
- http://ne####aryreason.net/index.php
- http://pl####ntreason.net/index.php
- http://or###reason.net/index.php
- http://le####reason.net/index.php
- http://he####almost.net/index.php
- http://he####reason.net/index.php
- http://he####orderly.net/index.php
- http://le####orderly.net/index.php
- http://le####almost.net/index.php
- http://or####rderly.net/index.php
- http://re####ereason.net/index.php
- http://re####eorderly.net/index.php
- http://re####evalue.net/index.php
- http://or###value.net/index.php
UDP:
- DNS ASK ge###evalue.net
- DNS ASK ge####orderly.net
- DNS ASK va####salmost.net
- DNS ASK va####sreason.net
- DNS ASK re####almost.net
- DNS ASK he####rderly.net
- DNS ASK he###almost.net
- DNS ASK he###nvalue.net
- DNS ASK ge####almost.net
- DNS ASK ge####reason.net
- DNS ASK he###reason.net
- DNS ASK re####reason.net
- DNS ASK fo####dmeeting.net
- DNS ASK de####meeting.net
- DNS ASK de####twenty.net
- DNS ASK de#####nderstood.net
- DNS ASK fo####dtwenty.net
- DNS ASK fo####dchance.net
- DNS ASK re####orderly.net
- DNS ASK va####sorderly.net
- DNS ASK va####svalue.net
- DNS ASK de####chance.net
- DNS ASK re###nvalue.net
- DNS ASK le###rvalue.net
- DNS ASK pl####ntvalue.net
- DNS ASK ne#####ryorderly.net
- DNS ASK ne####aryvalue.net
- DNS ASK re####ealmost.net
- DNS ASK or###almost.net
- DNS ASK pl####ntorderly.net
- DNS ASK pl####ntalmost.net
- DNS ASK he###value.net
- DNS ASK ne####aryalmost.net
- DNS ASK ne####aryreason.net
- DNS ASK pl####ntreason.net
- DNS ASK or###reason.net
- DNS ASK le####reason.net
- DNS ASK he####almost.net
- DNS ASK he####reason.net
- DNS ASK he####orderly.net
- DNS ASK le####orderly.net
- DNS ASK le####almost.net
- DNS ASK or####rderly.net
- DNS ASK re####ereason.net
- DNS ASK re####eorderly.net
- DNS ASK re####evalue.net
- DNS ASK or###value.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
