Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Certificate TCP/IP Virtual Initiator' = 'C:\mfyyerunmroqs\bqugzqd.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Plug Engine Office Interactive SSDP] 'ImagePath' = 'C:\mfyyerunmroqs\bqugzqd.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Plug Engine Office Interactive SSDP] 'Start' = '00000002'
Вредоносные функции:
Запускает на исполнение:
- 'C:\mfyyerunmroqs\lfjvkhaezz.exe' "c:\mfyyerunmroqs\bqugzqd.exe"
- 'C:\mfyyerunmroqs\bqugzqd.exe'
- 'C:\mfyyerunmroqs\lgor2p5tlvwulntxil3h.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\mfyyerunmroqs\bqugzqd.exe
- C:\mfyyerunmroqs\lfjvkhaezz.exe
- C:\mfyyerunmroqs\iiaebfqgt
- %WINDIR%\mfyyerunmroqs\wy1cvqj4vu
- C:\mfyyerunmroqs\wy1cvqj4vu
- C:\mfyyerunmroqs\lgor2p5tlvwulntxil3h.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\mfyyerunmroqs\lfjvkhaezz.exe
- C:\mfyyerunmroqs\bqugzqd.exe
Удаляет следующие файлы:
- C:\mfyyerunmroqs\lgor2p5tlvwulntxil3h.exe
- %WINDIR%\mfyyerunmroqs\wy1cvqj4vu
Подменяет следующие файлы:
- %WINDIR%\mfyyerunmroqs\wy1cvqj4vu
Сетевая активность:
Подключается к:
- 'le###famous.net':80
- 'fi####famous.net':80
- 'le####entury.net':80
- 'fi###hpower.net':80
- 'le####ountry.net':80
- 'fi####country.net':80
- 'le###power.net':80
- 'su####tfamous.net':80
- 'su####tcentury.net':80
- 'wi####country.net':80
- 'wi###rpower.net':80
- 'fi####century.net':80
- 'su####tcountry.net':80
- 'su####tpower.net':80
- 'sw####entury.net':80
- 'se####lfamous.net':80
- 'ma####alcentury.net':80
- 'se####lcentury.net':80
- 'ma####alfamous.net':80
- 'se####lcountry.net':80
- 'ma####alpower.net':80
- 'se####lpower.net':80
- 'pr####lyfamous.net':80
- 'sw###famous.net':80
- 'pr####lycentury.net':80
- 'sw###power.net':80
- 'pr####lycountry.net':80
- 'sw####ountry.net':80
- 'pr####lypower.net':80
- 'mo####famous.net':80
- 'si####famous.net':80
- 'mo####century.net':80
- 'si###epower.net':80
- 'mo####country.net':80
- 'si####country.net':80
- 'mo###rpower.net':80
- 'se###apower.net':80
- 'la###famous.net':80
- 'se####famous.net':80
- 'la###power.net':80
- 'si####century.net':80
- 'la####ountry.net':80
- 'se####country.net':80
- 'mo####incentury.net':80
- 'pe####sfamous.net':80
- 'wi####century.net':80
- 'pe####scentury.net':80
- 'wi####famous.net':80
- 'pe####scountry.net':80
- 'wi###wpower.net':80
- 'pe####spower.net':80
- 'po####lefamous.net':80
- 'mo####infamous.net':80
- 'po####lecentury.net':80
- 'mo####inpower.net':80
- 'po####lecountry.net':80
- 'mo####incountry.net':80
- 'po####lepower.net':80
TCP:
Запросы HTTP GET:
- http://le###famous.net/index.php
- http://fi####famous.net/index.php
- http://le####entury.net/index.php
- http://fi###hpower.net/index.php
- http://le####ountry.net/index.php
- http://fi####country.net/index.php
- http://le###power.net/index.php
- http://su####tfamous.net/index.php
- http://su####tcentury.net/index.php
- http://wi####country.net/index.php
- http://wi###rpower.net/index.php
- http://fi####century.net/index.php
- http://su####tcountry.net/index.php
- http://su####tpower.net/index.php
- http://sw####entury.net/index.php
- http://se####lfamous.net/index.php
- http://ma####alcentury.net/index.php
- http://se####lcentury.net/index.php
- http://ma####alfamous.net/index.php
- http://se####lcountry.net/index.php
- http://ma####alpower.net/index.php
- http://se####lpower.net/index.php
- http://pr####lyfamous.net/index.php
- http://sw###famous.net/index.php
- http://pr####lycentury.net/index.php
- http://sw###power.net/index.php
- http://pr####lycountry.net/index.php
- http://sw####ountry.net/index.php
- http://pr####lypower.net/index.php
- http://mo####famous.net/index.php
- http://si####famous.net/index.php
- http://mo####century.net/index.php
- http://si###epower.net/index.php
- http://mo####country.net/index.php
- http://si####country.net/index.php
- http://mo###rpower.net/index.php
- http://se###apower.net/index.php
- http://la###famous.net/index.php
- http://se####famous.net/index.php
- http://la###power.net/index.php
- http://si####century.net/index.php
- http://la####ountry.net/index.php
- http://se####country.net/index.php
- http://mo####incentury.net/index.php
- http://pe####sfamous.net/index.php
- http://wi####century.net/index.php
- http://pe####scentury.net/index.php
- http://wi####famous.net/index.php
- http://pe####scountry.net/index.php
- http://wi###wpower.net/index.php
- http://pe####spower.net/index.php
- http://po####lefamous.net/index.php
- http://mo####infamous.net/index.php
- http://po####lecentury.net/index.php
- http://mo####inpower.net/index.php
- http://po####lecountry.net/index.php
- http://mo####incountry.net/index.php
- http://po####lepower.net/index.php
UDP:
- DNS ASK fi###hpower.net
- DNS ASK le###famous.net
- DNS ASK fi####famous.net
- DNS ASK le###power.net
- DNS ASK sw####entury.net
- DNS ASK le####ountry.net
- DNS ASK fi####country.net
- DNS ASK wi###rpower.net
- DNS ASK su####tfamous.net
- DNS ASK su####tcentury.net
- DNS ASK su####tpower.net
- DNS ASK le####entury.net
- DNS ASK fi####century.net
- DNS ASK su####tcountry.net
- DNS ASK pr####lycentury.net
- DNS ASK ma####alfamous.net
- DNS ASK se####lfamous.net
- DNS ASK ma####alcentury.net
- DNS ASK se####lpower.net
- DNS ASK ma####alcountry.net
- DNS ASK se####lcountry.net
- DNS ASK ma####alpower.net
- DNS ASK sw###power.net
- DNS ASK pr####lyfamous.net
- DNS ASK sw###famous.net
- DNS ASK pr####lypower.net
- DNS ASK se####lcentury.net
- DNS ASK pr####lycountry.net
- DNS ASK sw####ountry.net
- DNS ASK wi####country.net
- DNS ASK mo####famous.net
- DNS ASK si####famous.net
- DNS ASK mo####century.net
- DNS ASK si###epower.net
- DNS ASK mo####country.net
- DNS ASK si####country.net
- DNS ASK mo###rpower.net
- DNS ASK se###apower.net
- DNS ASK la###famous.net
- DNS ASK se####famous.net
- DNS ASK la###power.net
- DNS ASK si####century.net
- DNS ASK la####ountry.net
- DNS ASK se####country.net
- DNS ASK mo####incentury.net
- DNS ASK pe####sfamous.net
- DNS ASK wi####century.net
- DNS ASK pe####scentury.net
- DNS ASK wi####famous.net
- DNS ASK pe####scountry.net
- DNS ASK wi###wpower.net
- DNS ASK pe####spower.net
- DNS ASK po####lefamous.net
- DNS ASK mo####infamous.net
- DNS ASK po####lecentury.net
- DNS ASK mo####inpower.net
- DNS ASK po####lecountry.net
- DNS ASK mo####incountry.net
- DNS ASK po####lepower.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
