Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Network Client Wired Upgrade Microsoft' = 'C:\jovgmdso\vnpshmjk.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\SNMP Identity Player Distributed] 'ImagePath' = 'C:\jovgmdso\vnpshmjk.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\SNMP Identity Player Distributed] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- 'C:\jovgmdso\lphmlbjgtzf.exe' "c:\jovgmdso\vnpshmjk.exe"
- 'C:\jovgmdso\vnpshmjk.exe'
- 'C:\jovgmdso\av3csylcskewrcnbr.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\jovgmdso\vnpshmjk.exe
- C:\jovgmdso\lphmlbjgtzf.exe
- C:\jovgmdso\av3csylcskewrcnbr.exe
- %WINDIR%\jovgmdso\vsmqeazfaak
- C:\jovgmdso\vsmqeazfaak
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\jovgmdso\lphmlbjgtzf.exe
- C:\jovgmdso\vnpshmjk.exe
Удаляет следующие файлы:
- C:\jovgmdso\av3csylcskewrcnbr.exe
- %WINDIR%\jovgmdso\vsmqeazfaak
Подменяет следующие файлы:
- %WINDIR%\jovgmdso\vsmqeazfaak
Сетевая активность:
Подключается к:
- 'hi####yboard.net':80
- 'st####eboard.net':80
- 'hi####yladder.net':80
- 'am####character.net':80
- 'hi####yenter.net':80
- 'st####eenter.net':80
- 'mo####genter.net':80
- 'ra###renter.net':80
- 'mo####gboard.net':80
- 'st####eladder.net':80
- 'hi#####character.net':80
- 'st#####character.net':80
- 'cl####haracter.net':80
- 'th####haracter.net':80
- 'we####renter.net':80
- 'th###board.net':80
- 'cl###ladder.net':80
- 'th###ladder.net':80
- 'we####rladder.net':80
- 'am####ladder.net':80
- 'we#####character.net':80
- 'am###tenter.net':80
- 'we####rboard.net':80
- 'am###tboard.net':80
- 'ra###rboard.net':80
- 'of###board.net':80
- 'al###ladder.net':80
- 'of###ladder.net':80
- 'al###enter.net':80
- 'of###enter.net':80
- 'al###board.net':80
- 'ch###enter.net':80
- 'co####eboard.net':80
- 'ch###board.net':80
- 'al####haracter.net':80
- 'of####haracter.net':80
- 'co####eenter.net':80
- 'ra####character.net':80
- 'tw###eenter.net':80
- 'mi###eenter.net':80
- 'mo####gladder.net':80
- 'ra####ladder.net':80
- 'mo#####character.net':80
- 'mi####ladder.net':80
- 'tw####character.net':80
- 'mi####character.net':80
- 'tw###eboard.net':80
- 'mi###eboard.net':80
- 'tw####ladder.net':80
TCP:
Запросы HTTP GET:
- http://hi####yboard.net/index.php
- http://st####eboard.net/index.php
- http://hi####yladder.net/index.php
- http://am####character.net/index.php
- http://hi####yenter.net/index.php
- http://st####eenter.net/index.php
- http://mo####genter.net/index.php
- http://ra###renter.net/index.php
- http://mo####gboard.net/index.php
- http://st####eladder.net/index.php
- http://hi#####character.net/index.php
- http://st#####character.net/index.php
- http://cl####haracter.net/index.php
- http://th####haracter.net/index.php
- http://we####renter.net/index.php
- http://th###board.net/index.php
- http://cl###ladder.net/index.php
- http://th###ladder.net/index.php
- http://we####rladder.net/index.php
- http://am####ladder.net/index.php
- http://we#####character.net/index.php
- http://am###tenter.net/index.php
- http://we####rboard.net/index.php
- http://am###tboard.net/index.php
- http://ra###rboard.net/index.php
- http://of###board.net/index.php
- http://al###ladder.net/index.php
- http://of###ladder.net/index.php
- http://al###enter.net/index.php
- http://of###enter.net/index.php
- http://al###board.net/index.php
- http://ch###enter.net/index.php
- http://co####eboard.net/index.php
- http://ch###board.net/index.php
- http://al####haracter.net/index.php
- http://of####haracter.net/index.php
- http://co####eenter.net/index.php
- http://ra####character.net/index.php
- http://tw###eenter.net/index.php
- http://mi###eenter.net/index.php
- http://mo####gladder.net/index.php
- http://ra####ladder.net/index.php
- http://mo#####character.net/index.php
- http://mi####ladder.net/index.php
- http://tw####character.net/index.php
- http://mi####character.net/index.php
- http://tw###eboard.net/index.php
- http://mi###eboard.net/index.php
- http://tw####ladder.net/index.php
UDP:
- DNS ASK hi####yboard.net
- DNS ASK st####eboard.net
- DNS ASK hi####yladder.net
- DNS ASK am####character.net
- DNS ASK hi####yenter.net
- DNS ASK st####eenter.net
- DNS ASK mo####genter.net
- DNS ASK ra###renter.net
- DNS ASK mo####gboard.net
- DNS ASK st####eladder.net
- DNS ASK hi#####character.net
- DNS ASK st#####character.net
- DNS ASK we#####character.net
- DNS ASK th###ladder.net
- DNS ASK cl####haracter.net
- DNS ASK th####haracter.net
- DNS ASK cl###board.net
- DNS ASK th###board.net
- DNS ASK cl###ladder.net
- DNS ASK am###tboard.net
- DNS ASK we####rladder.net
- DNS ASK am####ladder.net
- DNS ASK we####renter.net
- DNS ASK am###tenter.net
- DNS ASK we####rboard.net
- DNS ASK of###board.net
- DNS ASK al###ladder.net
- DNS ASK of###ladder.net
- DNS ASK al###enter.net
- DNS ASK of###enter.net
- DNS ASK al###board.net
- DNS ASK ch###enter.net
- DNS ASK co####eboard.net
- DNS ASK ch###board.net
- DNS ASK al####haracter.net
- DNS ASK of####haracter.net
- DNS ASK co####eenter.net
- DNS ASK mi####character.net
- DNS ASK mo#####character.net
- DNS ASK ra####character.net
- DNS ASK tw###eenter.net
- DNS ASK ra###rboard.net
- DNS ASK mo####gladder.net
- DNS ASK ra####ladder.net
- DNS ASK tw####ladder.net
- DNS ASK mi####ladder.net
- DNS ASK tw####character.net
- DNS ASK mi###eenter.net
- DNS ASK tw###eboard.net
- DNS ASK mi###eboard.net
