Техническая информация
Вредоносные функции:
Создает и запускает на исполнение:
- %WINDIR%\Temp\love15.exe
- %WINDIR%\Temp\love14.exe
- %WINDIR%\Temp\love17.exe
- %WINDIR%\Temp\love16.exe
- %WINDIR%\Temp\love11.exe
- %WINDIR%\Temp\love10.exe
- %WINDIR%\Temp\love13.exe
- %WINDIR%\Temp\love12.exe
- %WINDIR%\Temp\love23.exe
- %WINDIR%\Temp\love22.exe
- %WINDIR%\Temp\love25.exe
- %WINDIR%\Temp\love24.exe
- %WINDIR%\Temp\love19.exe
- %WINDIR%\Temp\love18.exe
- %WINDIR%\Temp\love21.exe
- %WINDIR%\Temp\love20.exe
- %WINDIR%\Temp\love9.exe
- %WINDIR%\Temp\love2.exe
- %WINDIR%\Temp\love5.exe
- %WINDIR%\Temp\love7.exe
- %WINDIR%\Temp\love6.exe
- %WINDIR%\Temp\love3.exe
- %WINDIR%\Temp\love1.exe
- %WINDIR%\Temp\love8.exe
- %WINDIR%\Temp\love4.exe
- %WINDIR%\Temp\love19.exe (загружен из сети Интернет)
- %WINDIR%\Temp\love20.exe (загружен из сети Интернет)
- %WINDIR%\Temp\love25.exe (загружен из сети Интернет)
- %WINDIR%\Temp\love3.exe (загружен из сети Интернет)
- %WINDIR%\Temp\love23.exe (загружен из сети Интернет)
- %WINDIR%\Temp\love1.exe (загружен из сети Интернет)
- %WINDIR%\Temp\love24.exe (загружен из сети Интернет)
- %WINDIR%\Temp\love21.exe (загружен из сети Интернет)
- %WINDIR%\Temp\love2.exe (загружен из сети Интернет)
- %WINDIR%\Temp\love22.exe (загружен из сети Интернет)
- %WINDIR%\Temp\love18.exe (загружен из сети Интернет)
- %WINDIR%\Temp\love7.exe (загружен из сети Интернет)
- %WINDIR%\Temp\love12.exe (загружен из сети Интернет)
- %WINDIR%\Temp\love13.exe (загружен из сети Интернет)
- %WINDIR%\Temp\love11.exe (загружен из сети Интернет)
- %WINDIR%\Temp\love9.exe (загружен из сети Интернет)
- %WINDIR%\Temp\love8.exe (загружен из сети Интернет)
- %WINDIR%\Temp\love10.exe (загружен из сети Интернет)
- %WINDIR%\Temp\love16.exe (загружен из сети Интернет)
- %WINDIR%\Temp\love17.exe (загружен из сети Интернет)
- %WINDIR%\Temp\love4.exe (загружен из сети Интернет)
- %WINDIR%\Temp\love5.exe (загружен из сети Интернет)
- %WINDIR%\Temp\love6.exe (загружен из сети Интернет)
- %WINDIR%\Temp\love14.exe (загружен из сети Интернет)
- %WINDIR%\Temp\love15.exe (загружен из сети Интернет)
Изменения в файловой системе:
Создает следующие файлы:
- %WINDIR%\Temp\love17.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\love17[1].exe
- %WINDIR%\Temp\love16.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\love19[1].exe
- %WINDIR%\Temp\love18.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\love18[1].exe
- %WINDIR%\Temp\love14.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\love14[1].exe
- %WINDIR%\Temp\love13.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\love16[1].exe
- %WINDIR%\Temp\love15.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\love15[1].exe
- %WINDIR%\Temp\love19.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\love24[1].exe
- %WINDIR%\Temp\love23.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\love23[1].exe
- %WINDIR%\Temp\love25.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\love25[1].exe
- %WINDIR%\Temp\love24.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\love21[1].exe
- %WINDIR%\Temp\love20.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\love20[1].exe
- %WINDIR%\Temp\love22.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\love22[1].exe
- %WINDIR%\Temp\love21.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\love5[1].exe
- %WINDIR%\Temp\love4.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\love4[1].exe
- %WINDIR%\Temp\love6.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\love6[1].exe
- %WINDIR%\Temp\love5.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\love2[1].exe
- %WINDIR%\Temp\love1.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\love1[1].exe
- %WINDIR%\Temp\love3.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\love3[1].exe
- %WINDIR%\Temp\love2.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\love7[1].exe
- %WINDIR%\Temp\love11.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\love11[1].exe
- %WINDIR%\Temp\love10.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\love13[1].exe
- %WINDIR%\Temp\love12.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\love12[1].exe
- %WINDIR%\Temp\love8.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\love8[1].exe
- %WINDIR%\Temp\love7.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\love10[1].exe
- %WINDIR%\Temp\love9.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\love9[1].exe
Удаляет следующие файлы:
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\love17[1].exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\love18[1].exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\love19[1].exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\love14[1].exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\love15[1].exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\love16[1].exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\love23[1].exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\love24[1].exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\love25[1].exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\love20[1].exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\love21[1].exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\love22[1].exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\love13[1].exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\love4[1].exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\love5[1].exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\love6[1].exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\love1[1].exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\love2[1].exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\love3[1].exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\love10[1].exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\love11[1].exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\love12[1].exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\love7[1].exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\love8[1].exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\love9[1].exe
Сетевая активность:
Подключается к:
- 'lo####.ddns.info':80
- 'localhost':1035
TCP:
Запросы HTTP GET:
- lo####.ddns.info/love2/love17.exe
- lo####.ddns.info/love2/love18.exe
- lo####.ddns.info/love2/love19.exe
- lo####.ddns.info/love2/love14.exe
- lo####.ddns.info/love2/love15.exe
- lo####.ddns.info/love2/love16.exe
- lo####.ddns.info/love2/love23.exe
- lo####.ddns.info/love2/love24.exe
- lo####.ddns.info/love2/love25.exe
- lo####.ddns.info/love2/love20.exe
- lo####.ddns.info/love2/love21.exe
- lo####.ddns.info/love2/love22.exe
- lo####.ddns.info/love2/love13.exe
- lo####.ddns.info/love2/love4.exe
- lo####.ddns.info/love2/love5.exe
- lo####.ddns.info/love2/love6.exe
- lo####.ddns.info/love2/love1.exe
- lo####.ddns.info/love2/love2.exe
- lo####.ddns.info/love2/love3.exe
- lo####.ddns.info/love2/love10.exe
- lo####.ddns.info/love2/love11.exe
- lo####.ddns.info/love2/love12.exe
- lo####.ddns.info/love2/love7.exe
- lo####.ddns.info/love2/love8.exe
- lo####.ddns.info/love2/love9.exe
UDP:
- DNS ASK lo####.ddns.info
