Техническая информация
Вредоносные функции:
Для затруднения выявления своего присутствия в системе
блокирует отображение:
- скрытых файлов
Создает и запускает на исполнение:
- %WINDIR%\iexplore\iexplore.exe
Запускает на исполнение:
- <SYSTEM32>\systeminfo.exe
- <SYSTEM32>\cmd.exe /c ""%WINDIR%\Set.bat" "
Внедряет код в
следующие системные процессы:
- <SYSTEM32>\svchost.exe
Изменения в файловой системе:
Создает следующие файлы:
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\Data[3].txt
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\645325[1]
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\Data[3].txt
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\Data[3].txt
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\data[1]
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\Data[2].txt
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\636265[1]
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\585215[1]
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\Data[3].txt
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\Data[5].txt
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\Data[5].txt
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\Data[5].txt
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\Data[5].txt
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\Data[4].txt
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\Data[4].txt
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\Data[4].txt
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\Data[4].txt
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\Data[2].txt
- %WINDIR%\iexplore\unzip32.dll
- %WINDIR%\iexplore\SureKeyboardState.dll
- %WINDIR%\21087572.Comid
- %WINDIR%\Macro.ini
- %WINDIR%\iexplore\gslib_ui_defresu.dll
- %WINDIR%\iexplore\Explorer.exe
- %WINDIR%\iexplore\PlayerAssistant.dll
- %WINDIR%\iexplore\iexplore.exe
- %WINDIR%\Set.bat
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\Data[1].txt
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\Data[1].txt
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\Data[2].txt
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\Data[2].txt
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\766334[1]
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\640753[1]
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\Data[1].txt
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\Data[1].txt
Присваивает атрибут 'скрытый' для следующих файлов:
- %WINDIR%\iexplore\PlayerAssistant.dll
- %WINDIR%\iexplore\SureKeyboardState.dll
- %WINDIR%\iexplore\unzip32.dll
- %WINDIR%\iexplore\Explorer.exe
- %WINDIR%\iexplore\gslib_ui_defresu.dll
- %WINDIR%\iexplore\iexplore.exe
Сетевая активность:
Подключается к:
- 'tq####yu.eb2a.com':80
- 'gu####fs.eb2a.com':80
- 'qj####gv.eb2a.com':80
- 'localhost':1060
- 'tq#####u.yolasite.com':80
- 'localhost':1054
- 'localhost':1057
- 'qj#####v.yolasite.com':80
- 'gu####fs.funpic.org':80
- 'tq####yu.ueuo.com':80
- 'gu####fs.ueuo.com':80
- 'qj####gv.ueuo.com':80
- 'localhost':1069
- 'tq####yu.funpic.org':80
- 'localhost':1063
- 'localhost':1066
- 'qj####gv.funpic.org':80
- 'pl####wa.eb2a.com':80
- 'kj#####d.yolasite.com':80
- 'kj####id.eb2a.com':80
- 'localhost':1042
- '67.##5.160.76':80
- 'localhost':1036
- 'localhost':1039
- 'pl#####a.yolasite.com':80
- 'pl####wa.funpic.org':80
- 'localhost':1050
- 'kj####id.ueuo.com':80
- 'gu#####s.yolasite.com':80
- '74.##5.232.51':80
- 'kj####id.funpic.org':80
- 'localhost':1045
- 'localhost':1048
- 'pl####wa.ueuo.com':80
TCP:
Запросы HTTP GET:
- qj#####v.yolasite.com/resources/Data.txt
- gu####fs.eb2a.com/Data.txt
- tq####yu.eb2a.com/Data.txt
- 67.##5.160.76/qjfo/articles/645325
- gu#####s.yolasite.com/resources/Data.txt
- tq#####u.yolasite.com/resources/Data.txt
- qj####gv.eb2a.com/Data.txt
- gu####fs.ueuo.com/Data.txt
- tq####yu.ueuo.com/Data.txt
- qj####gv.ueuo.com/Data.txt
- gu####fs.funpic.org/Data.txt
- tq####yu.funpic.org/Data.txt
- qj####gv.funpic.org/Data.txt
- kj#####d.yolasite.com/resources/Data.txt
- pl####wa.eb2a.com/Data.txt
- kj####id.eb2a.com/Data.txt
- 67.##5.160.76/plcm/articles/640753
- 67.##5.160.76/kjvf/articles/766334
- pl#####a.yolasite.com/resources/Data.txt
- pl####wa.funpic.org/Data.txt
- 74.##5.232.51/site/ktol688/data
- 67.##5.160.76/gulr/articles/585215
- 67.##5.160.76/tqj/articles/636265
- kj####id.funpic.org/Data.txt
- pl####wa.ueuo.com/Data.txt
- kj####id.ueuo.com/Data.txt
UDP:
- DNS ASK gu####fs.eb2a.com
- DNS ASK tq####yu.eb2a.com
- DNS ASK qj####gv.eb2a.com
- DNS ASK gu#####s.yolasite.com
- DNS ASK tq#####u.yolasite.com
- DNS ASK qj#####v.yolasite.com
- DNS ASK gu####fs.ueuo.com
- DNS ASK tq####yu.ueuo.com
- DNS ASK qj####gv.ueuo.com
- DNS ASK gu####fs.funpic.org
- DNS ASK tq####yu.funpic.org
- DNS ASK qj####gv.funpic.org
- DNS ASK kj#####d.yolasite.com
- DNS ASK pl####wa.eb2a.com
- DNS ASK pl#####a.yolasite.com
- DNS ASK google.com
- DNS ASK bl##.yahoo.com
- DNS ASK kj####id.eb2a.com
- DNS ASK kj####id.ueuo.com
- DNS ASK si###.google.com
- DNS ASK pl####wa.ueuo.com
- DNS ASK pl####wa.funpic.org
- DNS ASK kj####id.funpic.org
- '74.##5.232.51':0
Другое:
Ищет следующие окна:
- ClassName: '' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'WSGSMACRODISPATCHER' WindowName: ''
