Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Connect DLL SPP Auto-Discovery AutoConfig' = 'C:\cfqvfnyruslu\dlhuuzvswmze.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\PNRP Auto Credential Plug] 'ImagePath' = 'C:\cfqvfnyruslu\dlhuuzvswmze.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\PNRP Auto Credential Plug] 'Start' = '00000002'
Вредоносные функции:
Запускает на исполнение:
- 'C:\cfqvfnyruslu\hguynyhtihc.exe' "c:\cfqvfnyruslu\dlhuuzvswmze.exe"
- 'C:\cfqvfnyruslu\dlhuuzvswmze.exe'
- 'C:\cfqvfnyruslu\jun2xtwo7vysegkv.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\cfqvfnyruslu\dlhuuzvswmze.exe
- C:\cfqvfnyruslu\hguynyhtihc.exe
- C:\cfqvfnyruslu\nwucnyo7zz
- %WINDIR%\cfqvfnyruslu\pnipcczckui
- C:\cfqvfnyruslu\pnipcczckui
- C:\cfqvfnyruslu\jun2xtwo7vysegkv.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\cfqvfnyruslu\hguynyhtihc.exe
- C:\cfqvfnyruslu\dlhuuzvswmze.exe
Удаляет следующие файлы:
- C:\cfqvfnyruslu\jun2xtwo7vysegkv.exe
- %WINDIR%\cfqvfnyruslu\pnipcczckui
Подменяет следующие файлы:
- %WINDIR%\cfqvfnyruslu\pnipcczckui
Сетевая активность:
Подключается к:
- 'ge#####nderstood.net':80
- 'ge####twenty.net':80
- 'ge####meeting.net':80
- 'va####smeeting.net':80
- 're####chance.net':80
- 'va####schance.net':80
- 'le#####nderstood.net':80
- 'he####twenty.net':80
- 'le####twenty.net':80
- 'ge####chance.net':80
- 'he###chance.net':80
- 'he#####nderstood.net':80
- 're####meeting.net':80
- 'de#####lectricity.net':80
- 'fo####dtrain.net':80
- 'de###etrain.net':80
- 'fo####ddelight.net':80
- 'de####delight.net':80
- 'fo#####electricity.net':80
- 'va#####understood.net':80
- 're####twenty.net':80
- 'va####stwenty.net':80
- 'fo####dborrow.net':80
- 'de####borrow.net':80
- 're#####nderstood.net':80
- 'he####meeting.net':80
- 'pl####ntmeeting.net':80
- 'ne####arychance.net':80
- 'pl####ntchance.net':80
- 'ne####arytwenty.net':80
- 'pl####nttwenty.net':80
- 'ne#####rymeeting.net':80
- 'di####ulttwenty.net':80
- 'he####eeting.net':80
- 'di#####ltmeeting.net':80
- 'he####nderstood.net':80
- 'di#####ltunderstood.net':80
- 'he###twenty.net':80
- 'pl#####tunderstood.net':80
- 're#####understood.net':80
- 'or####nderstood.net':80
- 're####etwenty.net':80
- 'le####meeting.net':80
- 'he####chance.net':80
- 'le####chance.net':80
- 're####echance.net':80
- 'or###chance.net':80
- 'ne#####ryunderstood.net':80
- 'or###twenty.net':80
- 're####emeeting.net':80
- 'or####eeting.net':80
TCP:
Запросы HTTP GET:
- http://ge#####nderstood.net/index.php?me########
- http://ge####twenty.net/index.php?me########
- http://ge####meeting.net/index.php?me########
- http://va####smeeting.net/index.php?me########
- http://re####chance.net/index.php?me########
- http://va####schance.net/index.php?me########
- http://le#####nderstood.net/index.php?me########
- http://he####twenty.net/index.php?me########
- http://le####twenty.net/index.php?me########
- http://ge####chance.net/index.php?me########
- http://he###chance.net/index.php?me########
- http://he#####nderstood.net/index.php?me########
- http://re####meeting.net/index.php?me########
- http://de#####lectricity.net/index.php?me########
- http://fo####dtrain.net/index.php?me########
- http://de###etrain.net/index.php?me########
- http://fo####ddelight.net/index.php?me########
- http://de####delight.net/index.php?me########
- http://fo#####electricity.net/index.php?me########
- http://va#####understood.net/index.php?me########
- http://re####twenty.net/index.php?me########
- http://va####stwenty.net/index.php?me########
- http://fo####dborrow.net/index.php?me########
- http://de####borrow.net/index.php?me########
- http://re#####nderstood.net/index.php?me########
- http://he####meeting.net/index.php?me########
- http://pl####ntmeeting.net/index.php?me########
- http://ne####arychance.net/index.php?me########
- http://pl####ntchance.net/index.php?me########
- http://ne####arytwenty.net/index.php?me########
- http://pl####nttwenty.net/index.php?me########
- http://ne#####rymeeting.net/index.php?me########
- http://di####ulttwenty.net/index.php?me########
- http://he####eeting.net/index.php?me########
- http://di#####ltmeeting.net/index.php?me########
- http://he####nderstood.net/index.php?me########
- http://di#####ltunderstood.net/index.php?me########
- http://he###twenty.net/index.php?me########
- http://pl#####tunderstood.net/index.php?me########
- http://re#####understood.net/index.php?me########
- http://or####nderstood.net/index.php?me########
- http://re####etwenty.net/index.php?me########
- http://le####meeting.net/index.php?me########
- http://he####chance.net/index.php?me########
- http://le####chance.net/index.php?me########
- http://re####echance.net/index.php?me########
- http://or###chance.net/index.php?me########
- http://ne#####ryunderstood.net/index.php?me########
- http://or###twenty.net/index.php?me########
- http://re####emeeting.net/index.php?me########
- http://or####eeting.net/index.php?me########
UDP:
- DNS ASK va####schance.net
- DNS ASK ge#####nderstood.net
- DNS ASK ge####twenty.net
- DNS ASK re####meeting.net
- DNS ASK va####smeeting.net
- DNS ASK re####chance.net
- DNS ASK ge####meeting.net
- DNS ASK le#####nderstood.net
- DNS ASK he####twenty.net
- DNS ASK le####twenty.net
- DNS ASK ge####chance.net
- DNS ASK he###chance.net
- DNS ASK he#####nderstood.net
- DNS ASK fo#####electricity.net
- DNS ASK de#####lectricity.net
- DNS ASK fo####dtrain.net
- DNS ASK an####borrow.net
- DNS ASK fo####ddelight.net
- DNS ASK de####delight.net
- DNS ASK de###etrain.net
- DNS ASK va#####understood.net
- DNS ASK re####twenty.net
- DNS ASK va####stwenty.net
- DNS ASK fo####dborrow.net
- DNS ASK de####borrow.net
- DNS ASK re#####nderstood.net
- DNS ASK ne#####rymeeting.net
- DNS ASK pl####ntmeeting.net
- DNS ASK ne####arychance.net
- DNS ASK pl#####tunderstood.net
- DNS ASK ne####arytwenty.net
- DNS ASK pl####nttwenty.net
- DNS ASK pl####ntchance.net
- DNS ASK di####ulttwenty.net
- DNS ASK he####eeting.net
- DNS ASK di#####ltmeeting.net
- DNS ASK he####nderstood.net
- DNS ASK di#####ltunderstood.net
- DNS ASK he###twenty.net
- DNS ASK le####chance.net
- DNS ASK re#####understood.net
- DNS ASK or####nderstood.net
- DNS ASK he####meeting.net
- DNS ASK le####meeting.net
- DNS ASK he####chance.net
- DNS ASK re####etwenty.net
- DNS ASK re####echance.net
- DNS ASK or###chance.net
- DNS ASK ne#####ryunderstood.net
- DNS ASK or###twenty.net
- DNS ASK re####emeeting.net
- DNS ASK or####eeting.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
