Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Tools Protection Collector Engine Experience' = 'C:\vmkzmcmakmlyvwa\hzkojlcofv.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Debugger Profile Port Configuration] 'ImagePath' = 'C:\vmkzmcmakmlyvwa\hzkojlcofv.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Debugger Profile Port Configuration] 'Start' = '00000002'
Вредоносные функции:
Запускает на исполнение:
- 'C:\vmkzmcmakmlyvwa\tkibfzukouw.exe' "c:\vmkzmcmakmlyvwa\hzkojlcofv.exe"
- 'C:\vmkzmcmakmlyvwa\hzkojlcofv.exe'
- 'C:\vmkzmcmakmlyvwa\rfg2tmujiduguts.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\vmkzmcmakmlyvwa\hzkojlcofv.exe
- C:\vmkzmcmakmlyvwa\tkibfzukouw.exe
- C:\vmkzmcmakmlyvwa\hkntrzgx
- %WINDIR%\vmkzmcmakmlyvwa\qe2bibqcydd1
- C:\vmkzmcmakmlyvwa\qe2bibqcydd1
- C:\vmkzmcmakmlyvwa\rfg2tmujiduguts.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\vmkzmcmakmlyvwa\tkibfzukouw.exe
- C:\vmkzmcmakmlyvwa\hzkojlcofv.exe
Удаляет следующие файлы:
- C:\vmkzmcmakmlyvwa\rfg2tmujiduguts.exe
- %WINDIR%\vmkzmcmakmlyvwa\qe2bibqcydd1
Подменяет следующие файлы:
- %WINDIR%\vmkzmcmakmlyvwa\qe2bibqcydd1
Сетевая активность:
Подключается к:
- 'mi####corner.net':80
- 'tw####corner.net':80
- 'mi####special.net':80
- 'tw####special.net':80
- 'ra####flower.net':80
- 'mo####gminute.net':80
- 'ra####special.net':80
- 'mo####gflower.net':80
- 'ra####minute.net':80
- 'tw####minute.net':80
- 'of####pecial.net':80
- 'al####pecial.net':80
- 'of###minute.net':80
- 'al###minute.net':80
- 'of###corner.net':80
- 'tw####flower.net':80
- 'mi####minute.net':80
- 'al###corner.net':80
- 'mi####flower.net':80
- 'we####rflower.net':80
- 'am####minute.net':80
- 'hi####ycorner.net':80
- 'am####flower.net':80
- 'we####rminute.net':80
- 'am####corner.net':80
- 'we####rcorner.net':80
- 'am####special.net':80
- 'we####rspecial.net':80
- 'st####ecorner.net':80
- 'mo####gcorner.net':80
- 'st####eflower.net':80
- 'mo####gspecial.net':80
- 'ra####corner.net':80
- 'hi####yflower.net':80
- 'st####especial.net':80
- 'hi####yspecial.net':80
- 'st####eminute.net':80
- 'hi####yminute.net':80
- 'al###flower.net':80
- 'we####rbottom.net':80
- 'th###beyond.net':80
- 'we####rforever.net':80
- 'am####bottom.net':80
- 'cl###beyond.net':80
- 'th####orever.net':80
- 'cl####orever.net':80
- 'th###being.net':80
- 'cl###being.net':80
- 'am####forever.net':80
- 'hi####yforever.net':80
- 'st####ebottom.net':80
- 'hi####ybeing.net':80
- 'st####eforever.net':80
- 'hi####ybottom.net':80
- 'am###tbeing.net':80
- 'we####rbeing.net':80
- 'am####beyond.net':80
- 'we####rbeyond.net':80
- 'ch###minute.net':80
- 'co####eminute.net':80
- 'ch###flower.net':80
- 'co####eflower.net':80
- 'ch####pecial.net':80
- 'co####ecorner.net':80
- 'of###flower.net':80
- 'co####especial.net':80
- 'ch###corner.net':80
- 'pr####tcorner.net':80
- 'th###flower.net':80
- 'pr####tflower.net':80
- 'th###bottom.net':80
- 'cl###bottom.net':80
- 'th###minute.net':80
- 'pr####tspecial.net':80
- 'th###corner.net':80
- 'pr####tminute.net':80
- 'th####pecial.net':80
TCP:
Запросы HTTP GET:
- http://mi####corner.net/index.php?me########
- http://tw####corner.net/index.php?me########
- http://mi####special.net/index.php?me########
- http://tw####special.net/index.php?me########
- http://ra####flower.net/index.php?me########
- http://mo####gminute.net/index.php?me########
- http://ra####special.net/index.php?me########
- http://mo####gflower.net/index.php?me########
- http://ra####minute.net/index.php?me########
- http://tw####minute.net/index.php?me########
- http://of####pecial.net/index.php?me########
- http://al####pecial.net/index.php?me########
- http://of###minute.net/index.php?me########
- http://al###minute.net/index.php?me########
- http://of###corner.net/index.php?me########
- http://tw####flower.net/index.php?me########
- http://mi####minute.net/index.php?me########
- http://al###corner.net/index.php?me########
- http://mi####flower.net/index.php?me########
- http://we####rflower.net/index.php?me########
- http://am####minute.net/index.php?me########
- http://hi####ycorner.net/index.php?me########
- http://am####flower.net/index.php?me########
- http://we####rminute.net/index.php?me########
- http://am####corner.net/index.php?me########
- http://we####rcorner.net/index.php?me########
- http://am####special.net/index.php?me########
- http://we####rspecial.net/index.php?me########
- http://st####ecorner.net/index.php?me########
- http://mo####gcorner.net/index.php?me########
- http://st####eflower.net/index.php?me########
- http://mo####gspecial.net/index.php?me########
- http://ra####corner.net/index.php?me########
- http://hi####yflower.net/index.php?me########
- http://st####especial.net/index.php?me########
- http://hi####yspecial.net/index.php?me########
- http://st####eminute.net/index.php?me########
- http://hi####yminute.net/index.php?me########
- http://al###flower.net/index.php?me########
- http://we####rbottom.net/index.php?me########
- http://th###beyond.net/index.php?me########
- http://we####rforever.net/index.php?me########
- http://am####bottom.net/index.php?me########
- http://cl###beyond.net/index.php?me########
- http://th####orever.net/index.php?me########
- http://cl####orever.net/index.php?me########
- http://th###being.net/index.php?me########
- http://cl###being.net/index.php?me########
- http://am####forever.net/index.php?me########
- http://hi####yforever.net/index.php?me########
- http://st####ebottom.net/index.php?me########
- http://hi####ybeing.net/index.php?me########
- http://st####eforever.net/index.php?me########
- http://hi####ybottom.net/index.php?me########
- http://am###tbeing.net/index.php?me########
- http://we####rbeing.net/index.php?me########
- http://am####beyond.net/index.php?me########
- http://we####rbeyond.net/index.php?me########
- http://ch###minute.net/index.php?me########
- http://co####eminute.net/index.php?me########
- http://ch###flower.net/index.php?me########
- http://co####eflower.net/index.php?me########
- http://ch####pecial.net/index.php?me########
- http://co####ecorner.net/index.php?me########
- http://of###flower.net/index.php?me########
- http://co####especial.net/index.php?me########
- http://ch###corner.net/index.php?me########
- http://pr####tcorner.net/index.php?me########
- http://th###flower.net/index.php?me########
- http://pr####tflower.net/index.php?me########
- http://th###bottom.net/index.php?me########
- http://cl###bottom.net/index.php?me########
- http://th###minute.net/index.php?me########
- http://pr####tspecial.net/index.php?me########
- http://th###corner.net/index.php?me########
- http://pr####tminute.net/index.php?me########
- http://th####pecial.net/index.php?me########
UDP:
- DNS ASK mi####corner.net
- DNS ASK tw####corner.net
- DNS ASK mi####special.net
- DNS ASK tw####special.net
- DNS ASK ra####flower.net
- DNS ASK mo####gminute.net
- DNS ASK ra####special.net
- DNS ASK mo####gflower.net
- DNS ASK ra####minute.net
- DNS ASK tw####minute.net
- DNS ASK of####pecial.net
- DNS ASK al####pecial.net
- DNS ASK of###minute.net
- DNS ASK al###minute.net
- DNS ASK of###corner.net
- DNS ASK tw####flower.net
- DNS ASK mi####minute.net
- DNS ASK al###corner.net
- DNS ASK mi####flower.net
- DNS ASK mo####gspecial.net
- DNS ASK am####minute.net
- DNS ASK we####rminute.net
- DNS ASK am####flower.net
- DNS ASK we####rflower.net
- DNS ASK am####special.net
- DNS ASK we####rcorner.net
- DNS ASK cl###flower.net
- DNS ASK we####rspecial.net
- DNS ASK am####corner.net
- DNS ASK hi####ycorner.net
- DNS ASK st####eflower.net
- DNS ASK hi####yflower.net
- DNS ASK ra####corner.net
- DNS ASK mo####gcorner.net
- DNS ASK st####eminute.net
- DNS ASK hi####yspecial.net
- DNS ASK st####ecorner.net
- DNS ASK hi####yminute.net
- DNS ASK st####especial.net
- DNS ASK we####rbottom.net
- DNS ASK th###beyond.net
- DNS ASK we####rforever.net
- DNS ASK am####bottom.net
- DNS ASK cl###beyond.net
- DNS ASK th####orever.net
- DNS ASK cl####orever.net
- DNS ASK th###being.net
- DNS ASK cl###being.net
- DNS ASK am####forever.net
- DNS ASK hi####yforever.net
- DNS ASK st####ebottom.net
- DNS ASK hi####ybeing.net
- DNS ASK st####eforever.net
- DNS ASK hi####ybottom.net
- DNS ASK am###tbeing.net
- DNS ASK we####rbeing.net
- DNS ASK am####beyond.net
- DNS ASK we####rbeyond.net
- DNS ASK th###bottom.net
- DNS ASK co####eminute.net
- DNS ASK ch####pecial.net
- DNS ASK co####eflower.net
- DNS ASK ch###minute.net
- DNS ASK co####especial.net
- DNS ASK of###flower.net
- DNS ASK al###flower.net
- DNS ASK ch###corner.net
- DNS ASK co####ecorner.net
- DNS ASK ch###flower.net
- DNS ASK pr####tflower.net
- DNS ASK th###minute.net
- DNS ASK cl###bottom.net
- DNS ASK th###flower.net
- DNS ASK pr####tminute.net
- DNS ASK th###corner.net
- DNS ASK pr####tcorner.net
- DNS ASK th####pecial.net
- DNS ASK pr####tspecial.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
