Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Upgrade Store Instrumentation' = '<LS_APPDATA>\fhekkljnm\ukayfrak.exe'
Вредоносные функции:
Создает и запускает на исполнение:
- <LS_APPDATA>\fhekkljnm\ootwjsgmdf.exe "<LS_APPDATA>\fhekkljnm\ukayfrak.exe"
- <LS_APPDATA>\fhekkljnm\ukayfrak.exe
Изменения в файловой системе:
Создает следующие файлы:
- <LS_APPDATA>\fhekkljnm\ootwjsgmdf.exe
- <LS_APPDATA>\fhekkljnm\ukayfrak.tykhr
- <LS_APPDATA>\fhekkljnm\ukayfrak.exe
- <SYSTEM32>\wbem\Performance\WmiApRpl_new.ini
Присваивает атрибут 'скрытый' для следующих файлов:
- <LS_APPDATA>\fhekkljnm\ootwjsgmdf.exe
- <LS_APPDATA>\fhekkljnm\ukayfrak.exe
Сетевая активность:
Подключается к:
- 'mo####instead.net':80
- 'si####explain.net':80
- 'la###inside.net':80
- 'si####instead.net':80
- 'mo####explain.net':80
- 'si####inside.net':80
- 'mo####inside.net':80
- 'si####bright.net':80
- 'mo####bright.net':80
- 'se####inside.net':80
- 'ma####alappear.net':80
- 'se####instead.net':80
- 'ma#####lbusiness.net':80
- 'se####lappear.net':80
- 'la####nstead.net':80
- 'se####bright.net':80
- 'la###bright.net':80
- 'se####explain.net':80
- 'la####xplain.net':80
- 'pe####sbright.net':80
- 'wi####bright.net':80
- 'pe####sexplain.net':80
- 'wi####explain.net':80
- 'pe####sinside.net':80
- 'su####texplain.net':80
- 'su####tbright.net':80
- 'wi####inside.net':80
- 'su####tinstead.net':80
- 'wi####instead.net':80
- 'mo####inexplain.net':80
- 'po####leexplain.net':80
- 'mo####ininstead.net':80
- 'po####leinstead.net':80
- 'mo####inbright.net':80
- 'po####leinside.net':80
- 'pe####sinstead.net':80
- 'po####lebright.net':80
- 'mo####ininside.net':80
- 'se####lbusiness.net':80
- 'pe####sappear.net':80
- 'wi####appear.net':80
- 'pe####sbusiness.net':80
- 'wi####business.net':80
- 'su####tmanner.net':80
- 'su####tappear.net':80
- 'fi####manner.net':80
- 'su####tanother.net':80
- 'su####tbusiness.net':80
- 'wi####another.net':80
- 'mo#####nbusiness.net':80
- 'po#####ebusiness.net':80
- 'mo####inanother.net':80
- 'po####leanother.net':80
- 'mo####inappear.net':80
- 'wi####manner.net':80
- 'pe####sanother.net':80
- 'po####leappear.net':80
- 'pe####smanner.net':80
- 'pr#####ybusiness.net':80
- 'sw###appear.net':80
- 'pr####lyanother.net':80
- 'sw####usiness.net':80
- 'pr####lyappear.net':80
- 'se####lanother.net':80
- 'ma####alanother.net':80
- 'se####lmanner.net':80
- 'ma####almanner.net':80
- 'sw####nother.net':80
- 'le####nother.net':80
- 'fi####business.net':80
- 'le###manner.net':80
- 'fi####another.net':80
- 'le####usiness.net':80
- 'sw###manner.net':80
- 'pr####lymanner.net':80
- 'fi####appear.net':80
- 'le###appear.net':80
TCP:
Запросы HTTP GET:
- mo####instead.net/forum/search.php?em##################################
- si####explain.net/forum/search.php?em##################################
- la###inside.net/forum/search.php?em##################################
- si####instead.net/forum/search.php?em##################################
- mo####explain.net/forum/search.php?em##################################
- si####inside.net/forum/search.php?em##################################
- mo####inside.net/forum/search.php?em##################################
- si####bright.net/forum/search.php?em##################################
- mo####bright.net/forum/search.php?em##################################
- se####inside.net/forum/search.php?em##################################
- ma####alappear.net/forum/search.php?em##################################
- se####instead.net/forum/search.php?em##################################
- ma#####lbusiness.net/forum/search.php?em##################################
- se####lappear.net/forum/search.php?em##################################
- la####nstead.net/forum/search.php?em##################################
- se####bright.net/forum/search.php?em##################################
- la###bright.net/forum/search.php?em##################################
- se####explain.net/forum/search.php?em##################################
- la####xplain.net/forum/search.php?em##################################
- pe####sbright.net/forum/search.php?em##################################
- wi####bright.net/forum/search.php?em##################################
- pe####sexplain.net/forum/search.php?em##################################
- wi####explain.net/forum/search.php?em##################################
- pe####sinside.net/forum/search.php?em##################################
- su####texplain.net/forum/search.php?em##################################
- su####tbright.net/forum/search.php?em##################################
- wi####inside.net/forum/search.php?em##################################
- su####tinstead.net/forum/search.php?em##################################
- wi####instead.net/forum/search.php?em##################################
- mo####inexplain.net/forum/search.php?em##################################
- po####leexplain.net/forum/search.php?em##################################
- mo####ininstead.net/forum/search.php?em##################################
- po####leinstead.net/forum/search.php?em##################################
- mo####inbright.net/forum/search.php?em##################################
- po####leinside.net/forum/search.php?em##################################
- pe####sinstead.net/forum/search.php?em##################################
- po####lebright.net/forum/search.php?em##################################
- mo####ininside.net/forum/search.php?em##################################
- se####lbusiness.net/forum/search.php?em##################################
- pe####sappear.net/forum/search.php?em##################################
- wi####appear.net/forum/search.php?em##################################
- pe####sbusiness.net/forum/search.php?em##################################
- wi####business.net/forum/search.php?em##################################
- su####tmanner.net/forum/search.php?em##################################
- su####tappear.net/forum/search.php?em##################################
- fi####manner.net/forum/search.php?em##################################
- su####tanother.net/forum/search.php?em##################################
- su####tbusiness.net/forum/search.php?em##################################
- wi####another.net/forum/search.php?em##################################
- mo#####nbusiness.net/forum/search.php?em##################################
- po#####ebusiness.net/forum/search.php?em##################################
- mo####inanother.net/forum/search.php?em##################################
- po####leanother.net/forum/search.php?em##################################
- mo####inappear.net/forum/search.php?em##################################
- wi####manner.net/forum/search.php?em##################################
- pe####sanother.net/forum/search.php?em##################################
- po####leappear.net/forum/search.php?em##################################
- pe####smanner.net/forum/search.php?em##################################
- pr#####ybusiness.net/forum/search.php?em##################################
- sw###appear.net/forum/search.php?em##################################
- pr####lyanother.net/forum/search.php?em##################################
- sw####usiness.net/forum/search.php?em##################################
- pr####lyappear.net/forum/search.php?em##################################
- se####lanother.net/forum/search.php?em##################################
- ma####alanother.net/forum/search.php?em##################################
- se####lmanner.net/forum/search.php?em##################################
- ma####almanner.net/forum/search.php?em##################################
- sw####nother.net/forum/search.php?em##################################
- le####nother.net/forum/search.php?em##################################
- fi####business.net/forum/search.php?em##################################
- le###manner.net/forum/search.php?em##################################
- fi####another.net/forum/search.php?em##################################
- le####usiness.net/forum/search.php?em##################################
- sw###manner.net/forum/search.php?em##################################
- pr####lymanner.net/forum/search.php?em##################################
- fi####appear.net/forum/search.php?em##################################
- le###appear.net/forum/search.php?em##################################
UDP:
- DNS ASK mo####instead.net
- DNS ASK si####explain.net
- DNS ASK la###inside.net
- DNS ASK si####instead.net
- DNS ASK mo####explain.net
- DNS ASK si####inside.net
- DNS ASK mo####inside.net
- DNS ASK si####bright.net
- DNS ASK mo####bright.net
- DNS ASK se####inside.net
- DNS ASK ma####alappear.net
- DNS ASK se####instead.net
- DNS ASK ma#####lbusiness.net
- DNS ASK se####lappear.net
- DNS ASK la####nstead.net
- DNS ASK se####bright.net
- DNS ASK la###bright.net
- DNS ASK se####explain.net
- DNS ASK la####xplain.net
- DNS ASK pe####sbright.net
- DNS ASK wi####bright.net
- DNS ASK pe####sexplain.net
- DNS ASK wi####explain.net
- DNS ASK pe####sinside.net
- DNS ASK su####texplain.net
- DNS ASK su####tbright.net
- DNS ASK wi####inside.net
- DNS ASK su####tinstead.net
- DNS ASK wi####instead.net
- DNS ASK mo####inexplain.net
- DNS ASK po####leexplain.net
- DNS ASK mo####ininstead.net
- DNS ASK po####leinstead.net
- DNS ASK mo####inbright.net
- DNS ASK po####leinside.net
- DNS ASK pe####sinstead.net
- DNS ASK po####lebright.net
- DNS ASK mo####ininside.net
- DNS ASK se####lbusiness.net
- DNS ASK pe####sappear.net
- DNS ASK wi####appear.net
- DNS ASK pe####sbusiness.net
- DNS ASK wi####business.net
- DNS ASK su####tmanner.net
- DNS ASK su####tappear.net
- DNS ASK fi####manner.net
- DNS ASK su####tanother.net
- DNS ASK su####tbusiness.net
- DNS ASK wi####another.net
- DNS ASK mo#####nbusiness.net
- DNS ASK po#####ebusiness.net
- DNS ASK mo####inanother.net
- DNS ASK po####leanother.net
- DNS ASK mo####inappear.net
- DNS ASK wi####manner.net
- DNS ASK pe####sanother.net
- DNS ASK po####leappear.net
- DNS ASK pe####smanner.net
- DNS ASK pr#####ybusiness.net
- DNS ASK sw###appear.net
- DNS ASK pr####lyanother.net
- DNS ASK sw####usiness.net
- DNS ASK pr####lyappear.net
- DNS ASK se####lanother.net
- DNS ASK ma####alanother.net
- DNS ASK se####lmanner.net
- DNS ASK ma####almanner.net
- DNS ASK sw####nother.net
- DNS ASK le####nother.net
- DNS ASK fi####business.net
- DNS ASK le###manner.net
- DNS ASK fi####another.net
- DNS ASK le####usiness.net
- DNS ASK sw###manner.net
- DNS ASK pr####lymanner.net
- DNS ASK fi####appear.net
- DNS ASK le###appear.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'Indicator' WindowName: ''
