Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt] 'DLLName' = 'crypts.dll'
Вредоносные функции:
Внедряет код в
следующие системные процессы:
- %WINDIR%\Explorer.EXE
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\FF9.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[16].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[16].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[16].php
- %TEMP%\121C.tmp
- %TEMP%\A3D.tmp
- %TEMP%\E87C.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[15].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[15].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[16].php
- %TEMP%\7FB.tmp
- %TEMP%\1420.tmp
- %TEMP%\4FF0.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[17].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[18].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[18].php
- %TEMP%\6E46.tmp
- %TEMP%\2863.tmp
- %TEMP%\15C6.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[17].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[17].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[17].php
- %TEMP%\1B44.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[13].php
- %TEMP%\2C31.tmp
- %TEMP%\2DB8.tmp
- %TEMP%\46ED.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[13].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[13].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[12].php
- %TEMP%\256B.tmp
- %TEMP%\274F.tmp
- %TEMP%\29DF.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[13].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[14].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[15].php
- %TEMP%\76B7.tmp
- %TEMP%\9B18.tmp
- %TEMP%\C0FF.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[15].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[14].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[14].php
- %TEMP%\5218.tmp
- %TEMP%\53ED.tmp
- %TEMP%\56EA.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[14].php
- %TEMP%\76A3.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[22].php
- %TEMP%\B4C5.tmp
- %TEMP%\CA60.tmp
- %TEMP%\CD00.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[22].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[22].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[21].php
- %TEMP%\9CD8.tmp
- %TEMP%\9E7E.tmp
- %TEMP%\A2A4.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[21].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[22].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[23].php
- %TEMP%\DA3F.tmp
- %TEMP%\E923.tmp
- %TEMP%\650.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[24].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[23].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[23].php
- %TEMP%\D33A.tmp
- %TEMP%\D666.tmp
- %TEMP%\D83B.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[23].php
- %TEMP%\8EAF.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[19].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[19].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[19].php
- %TEMP%\9036.tmp
- %TEMP%\8D19.tmp
- %TEMP%\7FF9.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[18].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[18].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[19].php
- %TEMP%\85C6.tmp
- %TEMP%\91AD.tmp
- %TEMP%\98C1.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[20].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[21].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[21].php
- %TEMP%\9B13.tmp
- %TEMP%\971B.tmp
- %TEMP%\9333.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[20].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[20].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[20].php
- %TEMP%\94BA.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[12].php
- %TEMP%\2CD2.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[4].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[4].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[5].php
- %TEMP%\2E39.tmp
- %TEMP%\2B6B.tmp
- %TEMP%\2792.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[3].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[4].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[4].php
- %TEMP%\29F4.tmp
- %TEMP%\2FD0.tmp
- %TEMP%\3723.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[6].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[6].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[6].php
- %TEMP%\38C8.tmp
- %TEMP%\351F.tmp
- %TEMP%\3195.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[5].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[5].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[5].php
- %TEMP%\330C.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[1].php
- %TEMP%\D1D1.tmp
- %TEMP%\E421.tmp
- %TEMP%\F6ED.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[2].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[1].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[1].php
- <SYSTEM32>\crypts.dll
- %TEMP%\ACE4.tmp
- %TEMP%\CCD0.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[1].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[2].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[3].php
- %TEMP%\204F.tmp
- %TEMP%\2437.tmp
- %TEMP%\260C.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[3].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[3].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[2].php
- %TEMP%\600.tmp
- %TEMP%\B9E.tmp
- %TEMP%\19C7.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[2].php
- %TEMP%\3BE5.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[10].php
- %TEMP%\C6DF.tmp
- %TEMP%\C895.tmp
- %TEMP%\CA2B.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[10].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[10].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[9].php
- %TEMP%\B924.tmp
- %TEMP%\BEF0.tmp
- %TEMP%\C0A6.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[10].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[11].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[12].php
- %TEMP%\A61.tmp
- %TEMP%\1B2A.tmp
- %TEMP%\2367.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[12].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[11].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[11].php
- %TEMP%\D4DA.tmp
- %TEMP%\E545.tmp
- %TEMP%\F8FC.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[11].php
- %TEMP%\67E7.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[7].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[7].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[8].php
- %TEMP%\69EB.tmp
- %TEMP%\5CDB.tmp
- %TEMP%\4125.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[6].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[7].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[7].php
- %TEMP%\4D99.tmp
- %TEMP%\6CB9.tmp
- %TEMP%\7C59.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[9].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[9].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[9].php
- %TEMP%\9531.tmp
- %TEMP%\7312.tmp
- %TEMP%\6FF5.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[8].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[8].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[8].php
- %TEMP%\719B.tmp
Удаляет следующие файлы:
- %TEMP%\121C.tmp
- %TEMP%\1420.tmp
- %TEMP%\FF9.tmp
- %TEMP%\7FB.tmp
- %TEMP%\A3D.tmp
- %TEMP%\15C6.tmp
- %TEMP%\6E46.tmp
- %TEMP%\76A3.tmp
- %TEMP%\4FF0.tmp
- %TEMP%\1B44.tmp
- %TEMP%\2863.tmp
- %TEMP%\E87C.tmp
- %TEMP%\2DB8.tmp
- %TEMP%\46ED.tmp
- %TEMP%\2C31.tmp
- %TEMP%\274F.tmp
- %TEMP%\29DF.tmp
- %TEMP%\5218.tmp
- %TEMP%\9B18.tmp
- %TEMP%\C0FF.tmp
- %TEMP%\76B7.tmp
- %TEMP%\53ED.tmp
- %TEMP%\56EA.tmp
- %TEMP%\CA60.tmp
- %TEMP%\CD00.tmp
- %TEMP%\B4C5.tmp
- %TEMP%\9E7E.tmp
- %TEMP%\A2A4.tmp
- %TEMP%\D33A.tmp
- %TEMP%\E923.tmp
- %TEMP%\650.tmp
- %TEMP%\DA3F.tmp
- %TEMP%\D666.tmp
- %TEMP%\D83B.tmp
- %TEMP%\9CD8.tmp
- %TEMP%\8EAF.tmp
- %TEMP%\9036.tmp
- %TEMP%\8D19.tmp
- %TEMP%\7FF9.tmp
- %TEMP%\85C6.tmp
- %TEMP%\91AD.tmp
- %TEMP%\98C1.tmp
- %TEMP%\9B13.tmp
- %TEMP%\971B.tmp
- %TEMP%\9333.tmp
- %TEMP%\94BA.tmp
- %TEMP%\256B.tmp
- %TEMP%\2E39.tmp
- %TEMP%\2FD0.tmp
- %TEMP%\2CD2.tmp
- %TEMP%\29F4.tmp
- %TEMP%\2B6B.tmp
- %TEMP%\3195.tmp
- %TEMP%\38C8.tmp
- %TEMP%\3BE5.tmp
- %TEMP%\3723.tmp
- %TEMP%\330C.tmp
- %TEMP%\351F.tmp
- %TEMP%\2792.tmp
- %TEMP%\E421.tmp
- %TEMP%\F6ED.tmp
- %TEMP%\D1D1.tmp
- %TEMP%\ACE4.tmp
- %TEMP%\CCD0.tmp
- %TEMP%\600.tmp
- %TEMP%\2437.tmp
- %TEMP%\260C.tmp
- %TEMP%\204F.tmp
- %TEMP%\B9E.tmp
- %TEMP%\19C7.tmp
- %TEMP%\C895.tmp
- %TEMP%\CA2B.tmp
- %TEMP%\C6DF.tmp
- %TEMP%\BEF0.tmp
- %TEMP%\C0A6.tmp
- %TEMP%\D4DA.tmp
- %TEMP%\1B2A.tmp
- %TEMP%\2367.tmp
- %TEMP%\A61.tmp
- %TEMP%\E545.tmp
- %TEMP%\F8FC.tmp
- %TEMP%\B924.tmp
- %TEMP%\67E7.tmp
- %TEMP%\69EB.tmp
- %TEMP%\5CDB.tmp
- %TEMP%\4125.tmp
- %TEMP%\4D99.tmp
- %TEMP%\6CB9.tmp
- %TEMP%\7C59.tmp
- %TEMP%\9531.tmp
- %TEMP%\7312.tmp
- %TEMP%\6FF5.tmp
- %TEMP%\719B.tmp
Сетевая активность:
Подключается к:
- 'b0###fe5531.com':80
- 'b0###531c4.com':80
- 'localhost':1036
TCP:
Запросы HTTP GET:
- b0###fe5531.com/bt.php?mo################################################
- b0###531c4.com/bt.php?mo################################################
UDP:
- DNS ASK b0###fe5531.com
- DNS ASK b0###531c4.com
