Техническая информация
Вредоносные функции:
Создает и запускает на исполнение:
- %WINDIR%\iexplorer.exe /pid=6496
- %WINDIR%\iexplorer.exe /pid=6464
- %WINDIR%\iexplorer.exe /pid=2716
- %WINDIR%\iexplorer.exe /pid=3228
- %WINDIR%\iexplorer.exe /pid=7084
- %WINDIR%\iexplorer.exe /pid=7292
- %WINDIR%\iexplorer.exe /pid=6272
- %WINDIR%\iexplorer.exe /pid=6932
- %WINDIR%\iexplorer.exe /pid=1416
- %WINDIR%\iexplorer.exe /pid=6008
- %WINDIR%\iexplorer.exe /pid=5208
- %WINDIR%\iexplorer.exe /pid=5592
- %WINDIR%\iexplorer.exe /pid=5224
- %WINDIR%\iexplorer.exe /pid=5036
- %WINDIR%\iexplorer.exe /pid=880
- %WINDIR%\iexplorer.exe /pid=2572
- %WINDIR%\iexplorer.exe /pid=4008
- %WINDIR%\iexplorer.exe /pid=7252
- %WINDIR%\iexplorer.exe /pid=5260
- %WINDIR%\iexplorer.exe /pid=5112
- %WINDIR%\iexplorer.exe /pid=8060
- %WINDIR%\iexplorer.exe /pid=7804
- %WINDIR%\iexplorer.exe /pid=7852
- %WINDIR%\iexplorer.exe /pid=6596
- %WINDIR%\iexplorer.exe /pid=5604
- %WINDIR%\iexplorer.exe /pid=7980
- %WINDIR%\iexplorer.exe /pid=8108
- %WINDIR%\iexplorer.exe /pid=7740
- %WINDIR%\iexplorer.exe /pid=7788
- %WINDIR%\iexplorer.exe /pid=7452
- %WINDIR%\iexplorer.exe /pid=7748
- %WINDIR%\iexplorer.exe /pid=7716
- %WINDIR%\iexplorer.exe /pid=7524
- %WINDIR%\iexplorer.exe /pid=7500
- %WINDIR%\iexplorer.exe /pid=7264
- %WINDIR%\iexplorer.exe -A "Mozilla/5.0 (Windows; U; Windows NT 6.0; en-GB; rv:1.9.0.4)" --header "Accept-Language: en-US" --header "Accept: */*" --header "Accept-Encoding: gzip, deflate" -o data.tmp http://1r###.book1188.com/StreamingSchedule.aspx
- %WINDIR%\iexplorer.exe -A "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; YTB720; GTB6; .NET CLR 1.1.4322)" --header "Accept-Language: en-US" --header "Accept: */*" --header "Accept-Encoding: gzip, deflate" -o data.tmp http://1r###.book1188.com/template/ibet888/en/flash/Nickname.swf
- %WINDIR%\iexplorer.exe -A "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)" --header "Accept-Language: en-US" --header "Accept: */*" --header "Accept-Encoding: gzip, deflate" -o data.tmp http://1r###.book1188.com/StreamingSchedule.aspx
- %WINDIR%\iexplorer.exe -A "Mozilla/5.0 (Windows; U; Windows NT 6.0; en-GB; rv:1.9.0.4)" --header "Accept-Language: en-US" --header "Accept: */*" --header "Accept-Encoding: gzip, deflate" -o data.tmp http://1r###.book1188.com/template/ibet888/en/flash/Nickname.swf
- %WINDIR%\iexplorer.exe -A "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; .NET CLR 1.1.4322)" --header "Accept-Language: en-US" --header "Accept: */*" --header "Accept-Encoding: gzip, deflate" -o data.tmp http://1r###.book1188.com/StreamingSchedule.aspx
- %WINDIR%\iexplorer.exe -A "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; .NET CLR 1.1.4322)" --header "Accept-Language: en-US" --header "Accept: */*" --header "Accept-Encoding: gzip, deflate" -o data.tmp http://1r###.book1188.com/template/ibet888/en/flash/MyFavorite.swf
- %WINDIR%\iexplorer.exe -A "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; YTB720; GTB6; .NET CLR 1.1.4322)" --header "Accept-Language: en-US" --header "Accept: */*" --header "Accept-Encoding: gzip, deflate" -o data.tmp http://1r###.book1188.com/StreamingSchedule.aspx
- %WINDIR%\iexplorer.exe -A "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; YTB720; GTB6; .NET CLR 1.1.4322)" --header "Accept-Language: en-US" --header "Accept: */*" --header "Accept-Encoding: gzip, deflate" -o data.tmp http://1r###.book1188.com/template/ibet888/en/flash/MyFavorite.swf
- %WINDIR%\iexplorer.exe -A "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)" --header "Accept-Language: en-US" --header "Accept: */*" --header "Accept-Encoding: gzip, deflate" -o data.tmp http://1r###.book1188.com/template/ibet888/en/flash/Nickname.swf
- %WINDIR%\iexplorer.exe -A "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)" --header "Accept-Language: en-US" --header "Accept: */*" --header "Accept-Encoding: gzip, deflate" -o data.tmp http://1r###.book1188.com/template/ibet888/en/flash/MyFavorite.swf
- %WINDIR%\iexplorer.exe -A "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)" --header "Accept-Language: en-US" --header "Accept: */*" --header "Accept-Encoding: gzip, deflate" -o data.tmp http://1r###.book1188.com/news/en/20120419.swf
- %WINDIR%\iexplorer.exe -A "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4321)" --header "Accept-Language: en-US" --header "Accept: */*" --header "Accept-Encoding: gzip, deflate" -o data.tmp http://1r###.book1188.com/template/ibet888/en/flash/MyFavorite.swf
- %WINDIR%\iexplorer.exe -A "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4321)" --header "Accept-Language: en-US" --header "Accept: */*" --header "Accept-Encoding: gzip, deflate" -o data.tmp http://1r###.book1188.com/news/en/20120419.swf
- %WINDIR%\iexplorer.exe -A "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Maxthon)" --header "Accept-Language: en-US" --header "Accept: */*" --header "Accept-Encoding: gzip, deflate" -o data.tmp http://1r###.book1188.com/news/en/20120419.swf
- %WINDIR%\iexplorer.exe -A "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Maxthon)" --header "Accept-Language: en-US" --header "Accept: */*" --header "Accept-Encoding: gzip, deflate" -o data.tmp http://1r###.book1188.com/template/ibet888/en/flash/Nickname.swf
- %WINDIR%\iexplorer.exe -A "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322; MS-RTC LM 8)" --header "Accept-Language: en-US" --header "Accept: */*" --header "Accept-Encoding: gzip, deflate" -o data.tmp http://1r###.book1188.com/news/en/20120419.swf
- %WINDIR%\iexplorer.exe -A "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322; MS-RTC LM 8)" --header "Accept-Language: en-US" --header "Accept: */*" --header "Accept-Encoding: gzip, deflate" -o data.tmp http://1r###.book1188.com/template/ibet888/en/flash/Nickname.swf
- %WINDIR%\iexplorer.exe /pid=5280
- %WINDIR%\iexplorer.exe /pid=5520
- %WINDIR%\iexplorer.exe /pid=5744
- %WINDIR%\iexplorer.exe /pid=5264
- %WINDIR%\iexplorer.exe /pid=5808
- %WINDIR%\iexplorer.exe /pid=6040
- %WINDIR%\iexplorer.exe /pid=5536
- %WINDIR%\iexplorer.exe /pid=5472
- %WINDIR%\iexplorer.exe /pid=5248
- %WINDIR%\iexplorer.exe /pid=4084
- %WINDIR%\iexplorer.exe /pid=4928
- %WINDIR%\iexplorer.exe -A "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.0.3705; .NET CLR 1.1.4322)" --header "Accept-Language: en-US" --header "Accept: */*" --header "Accept-Encoding: gzip, deflate" -o data.tmp http://1r###.book1188.com/template/ibet888/en/flash/MyFavorite.swf
- %WINDIR%\iexplorer.exe -A "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; GTB6; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.0.30618; .NET CLR 3.5.30729)" --header "Accept-Language: en-US" --header "Accept: */*" --header "Accept-Encoding: gzip, deflate" -o data.tmp http://1r###.book1188.com/template/ibet888/en/flash/MyFavorite.swf
- %WINDIR%\iexplorer.exe /pid=3308
- %WINDIR%\iexplorer.exe /pid=5312
- %WINDIR%\iexplorer.exe /pid=4816
- %WINDIR%\iexplorer.exe /pid=4656
- %WINDIR%\iexplorer.exe (загружен из сети Интернет)
Изменения в файловой системе:
Создает следующие файлы:
- %WINDIR%\iexplorer.exe
Сетевая активность:
Подключается к:
- 'rg###s.3322.org':80
TCP:
Запросы HTTP GET:
- rg###s.3322.org/iexplorer.exe?17#####
UDP:
- DNS ASK rg###s.3322.org
