Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Microsoft Program Power IPsec Manager' = 'C:\yrrctdl\atxmzprk.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Driver Search VC Sharing] 'ImagePath' = 'C:\yrrctdl\atxmzprk.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Driver Search VC Sharing] 'Start' = '00000002'
Изменения в файловой системе:
Создает следующие файлы:
- C:\yrrctdl\atxmzprk.exe
- C:\yrrctdl\pxrlrrympnr.exe
- C:\yrrctdl\skg8vxxt
- %WINDIR%\yrrctdl\wiknbe0j
- C:\yrrctdl\wiknbe0j
- C:\yrrctdl\sgkft1ja2ru6ubjickv7cw.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\yrrctdl\pxrlrrympnr.exe
- C:\yrrctdl\atxmzprk.exe
Удаляет следующие файлы:
- C:\yrrctdl\sgkft1ja2ru6ubjickv7cw.exe
- %WINDIR%\yrrctdl\wiknbe0j
Подменяет следующие файлы:
- %WINDIR%\yrrctdl\wiknbe0j
Сетевая активность:
Подключается к:
- 're#####nnesamuelson.net':80
- 'ch#####belsamuelson.net':80
- 're#####nnestevenson.net':80
- 'ch#####belcristians.net':80
- 're#####nnethompsett.net':80
- 'ch#####belthompsett.net':80
- 'ch#####belstevenson.net':80
- 'ki######ighthompsett.net':80
- 'be#####ttesamuelson.net':80
- 'ki######ighsamuelson.net':80
- 'be#####ttecristians.net':80
- 'ki######ighcristians.net':80
- 'be#####ttethompsett.net':80
- 'ch######nnestevenson.net':80
- 'ja#####inecristians.net':80
- 'ge#####nnacristians.net':80
- 'ma#####ttasamuelson.net':80
- 'ch######nnesamuelson.net':80
- 'ma#####ttastevenson.net':80
- 'ja#####inethompsett.net':80
- 'ja#####inestevenson.net':80
- 'ge#####nnastevenson.net':80
- 're#####nnecristians.net':80
- 'ge#####nnathompsett.net':80
- 'ja#####inesamuelson.net':80
- 'ge#####nnasamuelson.net':80
- 'be#####ttestevenson.net':80
- 'al#####reapickering.net':80
- 'mo#####erygrenville.net':80
- 'ch#####belgrenville.net':80
- 'er#####udeeccleston.net':80
- 'al#####reaeccleston.net':80
- 'er#####udepickering.net':80
- 'mo#####erygeorgeson.net':80
- 'mo#####erypickering.net':80
- 'ch#####belpickering.net':80
- 'te#####ncegrenville.net':80
- 'ch#####belgeorgeson.net':80
- 'mo#####eryeccleston.net':80
- 'ch#####beleccleston.net':80
- 'al#####riathompsett.net':80
- 'ch######ellethompsett.net':80
- 'al#####riasamuelson.net':80
- 'ki######ighstevenson.net':80
- 'al#####riacristians.net':80
- 'ch######ellecristians.net':80
- 'ch######ellesamuelson.net':80
- 'al#####reagrenville.net':80
- 'er#####udegeorgeson.net':80
- 'al#####reageorgeson.net':80
- 'al#####riastevenson.net':80
- 'ch######ellestevenson.net':80
- 'er#####udegrenville.net':80
TCP:
Запросы HTTP GET:
- http://re#####nnesamuelson.net/index.php
- http://ch#####belsamuelson.net/index.php
- http://re#####nnestevenson.net/index.php
- http://ch#####belcristians.net/index.php
- http://re#####nnethompsett.net/index.php
- http://ch#####belthompsett.net/index.php
- http://ch#####belstevenson.net/index.php
- http://ki######ighthompsett.net/index.php
- http://be#####ttesamuelson.net/index.php
- http://ki######ighsamuelson.net/index.php
- http://be#####ttecristians.net/index.php
- http://ki######ighcristians.net/index.php
- http://be#####ttethompsett.net/index.php
- http://ch######nnestevenson.net/index.php
- http://ja#####inecristians.net/index.php
- http://ge#####nnacristians.net/index.php
- http://ma#####ttasamuelson.net/index.php
- http://ch######nnesamuelson.net/index.php
- http://ma#####ttastevenson.net/index.php
- http://ja#####inethompsett.net/index.php
- http://ja#####inestevenson.net/index.php
- http://ge#####nnastevenson.net/index.php
- http://re#####nnecristians.net/index.php
- http://ge#####nnathompsett.net/index.php
- http://ja#####inesamuelson.net/index.php
- http://ge#####nnasamuelson.net/index.php
- http://be#####ttestevenson.net/index.php
- http://al#####reapickering.net/index.php
- http://mo#####erygrenville.net/index.php
- http://ch#####belgrenville.net/index.php
- http://er#####udeeccleston.net/index.php
- http://al#####reaeccleston.net/index.php
- http://er#####udepickering.net/index.php
- http://mo#####erygeorgeson.net/index.php
- http://mo#####erypickering.net/index.php
- http://ch#####belpickering.net/index.php
- http://te#####ncegrenville.net/index.php
- http://ch#####belgeorgeson.net/index.php
- http://mo#####eryeccleston.net/index.php
- http://ch#####beleccleston.net/index.php
- http://al#####riathompsett.net/index.php
- http://ch######ellethompsett.net/index.php
- http://al#####riasamuelson.net/index.php
- http://ki######ighstevenson.net/index.php
- http://al#####riacristians.net/index.php
- http://ch######ellecristians.net/index.php
- http://ch######ellesamuelson.net/index.php
- http://al#####reagrenville.net/index.php
- http://er#####udegeorgeson.net/index.php
- http://al#####reageorgeson.net/index.php
- http://al#####riastevenson.net/index.php
- http://ch######ellestevenson.net/index.php
- http://er#####udegrenville.net/index.php
UDP:
- DNS ASK re#####nnesamuelson.net
- DNS ASK ch#####belsamuelson.net
- DNS ASK re#####nnestevenson.net
- DNS ASK ch#####belcristians.net
- DNS ASK re#####nnethompsett.net
- DNS ASK ch#####belthompsett.net
- DNS ASK ch#####belstevenson.net
- DNS ASK ki######ighthompsett.net
- DNS ASK be#####ttesamuelson.net
- DNS ASK ki######ighsamuelson.net
- DNS ASK be#####ttecristians.net
- DNS ASK ki######ighcristians.net
- DNS ASK be#####ttethompsett.net
- DNS ASK re#####nnecristians.net
- DNS ASK ma#####ttastevenson.net
- DNS ASK ch######nnestevenson.net
- DNS ASK ja#####inecristians.net
- DNS ASK ch######nnethompsett.net
- DNS ASK ma#####ttasamuelson.net
- DNS ASK ch######nnesamuelson.net
- DNS ASK ge#####nnacristians.net
- DNS ASK ge#####nnasamuelson.net
- DNS ASK ja#####inestevenson.net
- DNS ASK ge#####nnastevenson.net
- DNS ASK ja#####inethompsett.net
- DNS ASK ge#####nnathompsett.net
- DNS ASK ja#####inesamuelson.net
- DNS ASK al#####reapickering.net
- DNS ASK mo#####erygrenville.net
- DNS ASK ch#####belgrenville.net
- DNS ASK er#####udeeccleston.net
- DNS ASK al#####reaeccleston.net
- DNS ASK er#####udepickering.net
- DNS ASK mo#####erygeorgeson.net
- DNS ASK mo#####erypickering.net
- DNS ASK ch#####belpickering.net
- DNS ASK te#####ncegrenville.net
- DNS ASK ch#####belgeorgeson.net
- DNS ASK mo#####eryeccleston.net
- DNS ASK ch#####beleccleston.net
- DNS ASK al#####reageorgeson.net
- DNS ASK ch######ellecristians.net
- DNS ASK al#####riathompsett.net
- DNS ASK ch######ellethompsett.net
- DNS ASK be#####ttestevenson.net
- DNS ASK ki######ighstevenson.net
- DNS ASK al#####riacristians.net
- DNS ASK al#####riasamuelson.net
- DNS ASK er#####udegrenville.net
- DNS ASK al#####reagrenville.net
- DNS ASK er#####udegeorgeson.net
- DNS ASK ch######ellesamuelson.net
- DNS ASK al#####riastevenson.net
- DNS ASK ch######ellestevenson.net
Другое:
Создает и запускает на исполнение:
- 'C:\yrrctdl\pxrlrrympnr.exe' "c:\yrrctdl\atxmzprk.exe"
- 'C:\yrrctdl\atxmzprk.exe'
- 'C:\yrrctdl\sgkft1ja2ru6ubjickv7cw.exe'
