Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'exexc10' = '%TEMP%\RarSFX0\a\sppsvd.exe '
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\taskkill.exe' /F /im sppsvd.exe
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\RarSFX0\1.bat
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\google[6]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\m245games[1]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\m258games[1]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\google[5]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\m85games[1]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\m254games[1]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\m99games[1]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\m97games[1]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\m94games[1]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\m246games[1]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\google[5]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\m92games[2]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\m92games[1]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\google[6]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\google[3]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\google[9]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\m242games[1]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\google[11]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\m101games[1]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\google[10]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\m97games[2]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\google[7]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\google[4]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\m251games[1]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\m251games[1]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\google[6]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\m99games[2]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\m100games[1]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\google[7]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\m249games[1]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\m84games[1]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\m93games[1]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\m89games[2]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\m89games[1]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\google[8]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\google[2]
- %TEMP%\RarSFX0\a\sppsvd.exe
- %TEMP%\RarSFX0\0.exe
- %TEMP%\RarSFX0\0.vbs
- %TEMP%\RarSFX1\Interop.SHDocVw.dll
- %TEMP%\RarSFX1\smss.exe
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\google[8]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\google[1]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\google[3]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\google[2]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\google[1]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\google[2]
- <LS_APPDATA>\Microsoft\Internet Explorer\MSIMGSIZ.DAT
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\google[1]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\google[1]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\m97games[1]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\google[4]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\google[3]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\m61games[1]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\google[7]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\google[6]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\google[5]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\m92games[1]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\m256games[1]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\m83games[1]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\google[5]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\google[2]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\m83games[1]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\google[3]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\m84games[1]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\m91games[1]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\google[4]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\google[4]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\m82games[1]
Удаляет следующие файлы:
- %TEMP%\RarSFX0\0.exe
Сетевая активность:
Подключается к:
- 'wp#d':80
- 'ku##er.com':80
- 'localhost':1039
- '74.##5.232.51':80
TCP:
Запросы HTTP GET:
- http://11#.#11.111.1/wpad.dat via wp#d
- http://ku##er.com/m101games/?
- http://ku##er.com/m100games/?
- http://ku##er.com/m249games/?
- http://ku##er.com/m93games/?
- http://ku##er.com/m254games/?
- http://ku##er.com/m251games/?
- http://ku##er.com/m245games/?
- http://ku##er.com/m258games/?
- http://ku##er.com/m85games/?
- http://ku##er.com/m99games/?
- http://ku##er.com/m97games/?
- http://ku##er.com/m242games/?
- http://ku##er.com/m94games/?
- http://ku##er.com/m89games/?
- http://ku##er.com/m92games/?
- http://ku##er.com/m256games/?
- http://ku##er.com/m84games/?
- http://ku##er.com/m91games/?
- http://ku##er.com/m83games/?
- http://ku##er.com/m61games/?
- http://google.com/ via 74.##5.232.51
- http://ku##er.com/advnew/tdv11.txt
- http://ku##er.com/advnew/tdvt8.txt
- http://ku##er.com/advnew/tdvt14.txt
- http://ku##er.com/m246games/?
- http://ku##er.com/m82games/?
UDP:
- DNS ASK wp#d
- DNS ASK ku##er.com
- DNS ASK google.com
Другое:
Ищет следующие окна:
- ClassName: 'EDIT' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: '' WindowName: ''
Создает и запускает на исполнение:
- '<SYSTEM32>\wscript.exe' "%TEMP%\RarSFX0\0.vbs"
- '%TEMP%\RarSFX0\a\sppsvd.exe' /start
- '%TEMP%\RarSFX0\0.exe' /start
- '%TEMP%\RarSFX1\smss.exe'
Запускает на исполнение:
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\RarSFX0\1.bat" /start"
- '<SYSTEM32>\reg.exe' delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f
- '<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v exexc10 /t REG_SZ /d "%TEMP%\RarSFX0\a\sppsvd.exe
- '<SYSTEM32>\ping.exe' -n 5 127.1
