Техническая информация
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\regsvr32.exe' /s VbMHWB.dll
- '<SYSTEM32>\regsvr32.exe' /s COMCTL32.ocx
Регистрирует COM-сервер:
- [<HKLM>\SOFTWARE\Classes\CLSID\{373FF7F4-EB8B-11CD-8820-08002B2F4F5A}\InprocServer32] '' = '<SYSTEM32>\COMCTL32.ocx'
- [<HKLM>\SOFTWARE\Classes\CLSID\{6027C2D4-FB28-11CD-8820-08002B2F4F5A}\InprocServer32] '' = '<SYSTEM32>\COMCTL32.ocx'
- [<HKLM>\SOFTWARE\Classes\CLSID\{0713E8D2-850A-101B-AFC0-4210102A8DA7}\InprocServer32] '' = '<SYSTEM32>\COMCTL32.ocx'
- [<HKLM>\SOFTWARE\Classes\CLSID\{6B7E6393-850A-101B-AFC0-4210102A8DA7}\InprocServer32] '' = '<SYSTEM32>\COMCTL32.ocx'
- [<HKLM>\SOFTWARE\Classes\CLSID\{6B7E63A3-850A-101B-AFC0-4210102A8DA7}\InprocServer32] '' = '<SYSTEM32>\COMCTL32.ocx'
- [<HKLM>\SOFTWARE\Classes\CLSID\{373FF7F0-EB8B-11CD-8820-08002B2F4F5A}\InprocServer32] '' = '<SYSTEM32>\COMCTL32.ocx'
- [<HKLM>\SOFTWARE\Classes\CLSID\{5ACBB957-5C57-11CF-8993-00AA00688B10}\InprocServer32] '' = '<SYSTEM32>\COMCTL32.ocx'
- [<HKLM>\SOFTWARE\Classes\CLSID\{5ACBB958-5C57-11CF-8993-00AA00688B10}\InprocServer32] '' = '<SYSTEM32>\COMCTL32.ocx'
- [<HKLM>\SOFTWARE\Classes\CLSID\{20247C83-3429-47B1-817F-C99F29D2BF3A}\InprocServer32] '' = '<SYSTEM32>\VbMHWB.dll'
- [<HKLM>\SOFTWARE\Classes\CLSID\{0713E8D8-850A-101B-AFC0-4210102A8DA7}\InprocServer32] '' = '<SYSTEM32>\COMCTL32.ocx'
- [<HKLM>\SOFTWARE\Classes\CLSID\{5ACBB955-5C57-11CF-8993-00AA00688B10}\InprocServer32] '' = '<SYSTEM32>\COMCTL32.ocx'
- [<HKLM>\SOFTWARE\Classes\CLSID\{5ACBB956-5C57-11CF-8993-00AA00688B10}\InprocServer32] '' = '<SYSTEM32>\COMCTL32.ocx'
- [<HKLM>\SOFTWARE\Classes\CLSID\{6B7E638F-850A-101B-AFC0-4210102A8DA7}\InprocServer32] '' = '<SYSTEM32>\COMCTL32.ocx'
- [<HKLM>\SOFTWARE\Classes\CLSID\{9ED94440-E5E8-101B-B9B5-444553540000}\InprocServer32] '' = '<SYSTEM32>\COMCTL32.ocx'
- [<HKLM>\SOFTWARE\Classes\CLSID\{9ED94444-E5E8-101B-B9B5-444553540000}\InprocServer32] '' = '<SYSTEM32>\COMCTL32.ocx'
- [<HKLM>\SOFTWARE\Classes\CLSID\{B66834C6-2E60-11CE-8748-524153480004}\InprocServer32] '' = '<SYSTEM32>\COMCTL32.ocx'
- [<HKLM>\SOFTWARE\Classes\CLSID\{58DA8D8A-9D6A-101B-AFC0-4210102A8DA7}\InprocServer32] '' = '<SYSTEM32>\COMCTL32.ocx'
- [<HKLM>\SOFTWARE\Classes\CLSID\{0713E8A2-850A-101B-AFC0-4210102A8DA7}\InprocServer32] '' = '<SYSTEM32>\COMCTL32.ocx'
- [<HKLM>\SOFTWARE\Classes\CLSID\{0713E8A8-850A-101B-AFC0-4210102A8DA7}\InprocServer32] '' = '<SYSTEM32>\COMCTL32.ocx'
- [<HKLM>\SOFTWARE\Classes\CLSID\{58DA8D8F-9D6A-101B-AFC0-4210102A8DA7}\InprocServer32] '' = '<SYSTEM32>\COMCTL32.ocx'
- [<HKLM>\SOFTWARE\Classes\CLSID\{58DA8D93-9D6A-101B-AFC0-4210102A8DA7}\InprocServer32] '' = '<SYSTEM32>\COMCTL32.ocx'
- [<HKLM>\SOFTWARE\Classes\CLSID\{58DA8D96-9D6A-101B-AFC0-4210102A8DA7}\InprocServer32] '' = '<SYSTEM32>\COMCTL32.ocx'
- [<HKLM>\SOFTWARE\Classes\CLSID\{612A8624-0FB3-11CE-8747-524153480004}\InprocServer32] '' = '<SYSTEM32>\COMCTL32.ocx'
- [<HKLM>\SOFTWARE\Classes\CLSID\{612A8628-0FB3-11CE-8747-524153480004}\InprocServer32] '' = '<SYSTEM32>\COMCTL32.ocx'
- [<HKLM>\SOFTWARE\Classes\CLSID\{62823C20-41A3-11CE-9E8B-0020AF039CA3}\InprocServer32] '' = '<SYSTEM32>\COMCTL32.ocx'
Изменения в файловой системе:
Создает следующие файлы:
- <Текущая директория>\template.xml
- <Текущая директория>\App.con
- %TEMP%\~DFBD25.tmp
- <SYSTEM32>\COMCTL32.ocx
- <SYSTEM32>\VbMHWB.dll
- <Текущая директория>\Private.xml
Сетевая активность:
Подключается к:
- 'wt.#f3d.com':16888
- 'dx.#f3d.com':16888
- 'ap#.###hecaituku.com':61830
- 'localhost':1036
- 'tk##.wdqz.com':8080
- '3d.#f3d.com':16880
UDP:
- DNS ASK dx.#f3d.com
- DNS ASK ap#.###hecaituku.com
- DNS ASK wt.#f3d.com
- DNS ASK tk##.wdqz.com
- DNS ASK 3d.#f3d.com
Другое:
Ищет следующие окна:
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
