Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Problem Workstation Call Mapper IPsec' = '<LS_APPDATA>\wsyymilgiloqpxk\aiidiulzjhuy.exe'
Вредоносные функции:
Создает и запускает на исполнение:
- '<LS_APPDATA>\wsyymilgiloqpxk\iwdnhnda.exe' "<LS_APPDATA>\wsyymilgiloqpxk\aiidiulzjhuy.exe"
- '<LS_APPDATA>\wsyymilgiloqpxk\aiidiulzjhuy.exe'
Изменения в файловой системе:
Создает следующие файлы:
- <LS_APPDATA>\wsyymilgiloqpxk\aiidiulzjhuy.futkb
- <LS_APPDATA>\wsyymilgiloqpxk\iwdnhnda.exe
- <LS_APPDATA>\wsyymilgiloqpxk\aiidiulzjhuy.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- <LS_APPDATA>\wsyymilgiloqpxk\iwdnhnda.exe
- <LS_APPDATA>\wsyymilgiloqpxk\aiidiulzjhuy.exe
Сетевая активность:
Подключается к:
- 'ne#####ryservice.net':80
- 'pl####ntriver.net':80
- 'pl####ntservice.net':80
- 'pl####ntsuppose.net':80
- 'ne#####rysuppose.net':80
- 'or####uppose.net':80
- 're####esuppose.net':80
- 're####emister.net':80
- 'ne####aryriver.net':80
- 'or###mister.net':80
- 'he####uppose.net':80
- 'di#####ltservice.net':80
- 'di#####ltsuppose.net':80
- 'di####ultmister.net':80
- 'he###mister.net':80
- 'pl####ntmister.net':80
- 'ne####arymister.net':80
- 'he###river.net':80
- 'he####ervice.net':80
- 'di####ultriver.net':80
- 'ge####suppose.net':80
- 'ge####service.net':80
- 'ge####mister.net':80
- 'le###rriver.net':80
- 'he###nriver.net':80
- 'va####ssuppose.net':80
- 're####suppose.net':80
- 're####mister.net':80
- 'ge###eriver.net':80
- 'va####smister.net':80
- 're####eriver.net':80
- 'le####mister.net':80
- 'or###river.net':80
- 'or####ervice.net':80
- 're####eservice.net':80
- 'le####service.net':80
- 'he####service.net':80
- 'he####suppose.net':80
- 'he####mister.net':80
- 'le####suppose.net':80
- 'gl###river.net':80
- 'he###angry.net':80
- 'ge###eangry.net':80
- 'ge####fifteen.net':80
- 'ge###edried.net':80
- 'he####ifteen.net':80
- 're###ndried.net':80
- 'va####sfifteen.net':80
- 'va####sdried.net':80
- 'he####rticle.net':80
- 'ge####article.net':80
- 'le####fifteen.net':80
- 'he####fifteen.net':80
- 'he###ndried.net':80
- 're####earticle.net':80
- 'le###rdried.net':80
- 'he####article.net':80
- 'he###dried.net':80
- 'le####article.net':80
- 'le###rangry.net':80
- 'he###nangry.net':80
- 'an####mister.net':80
- 'gl###mister.net':80
- 'fo####driver.net':80
- 'fo####dservice.net':80
- 'de###eriver.net':80
- 'gl####ervice.net':80
- 'an###rriver.net':80
- 'an####service.net':80
- 'an####suppose.net':80
- 'gl####uppose.net':80
- 'va####sarticle.net':80
- 're####article.net':80
- 're###nangry.net':80
- 're####fifteen.net':80
- 'va####sangry.net':80
- 'fo####dsuppose.net':80
- 'de####service.net':80
- 'de####suppose.net':80
- 'de####mister.net':80
- 'fo####dmister.net':80
TCP:
Запросы HTTP GET:
- ne#####ryservice.net/forum/search.php?em###############################
- pl####ntriver.net/forum/search.php?em###############################
- pl####ntservice.net/forum/search.php?em###############################
- pl####ntsuppose.net/forum/search.php?em###############################
- ne#####rysuppose.net/forum/search.php?em###############################
- or####uppose.net/forum/search.php?em###############################
- re####esuppose.net/forum/search.php?em###############################
- re####emister.net/forum/search.php?em###############################
- ne####aryriver.net/forum/search.php?em###############################
- or###mister.net/forum/search.php?em###############################
- he####uppose.net/forum/search.php?em###############################
- di#####ltservice.net/forum/search.php?em###############################
- di#####ltsuppose.net/forum/search.php?em###############################
- di####ultmister.net/forum/search.php?em###############################
- he###mister.net/forum/search.php?em###############################
- pl####ntmister.net/forum/search.php?em###############################
- ne####arymister.net/forum/search.php?em###############################
- he###river.net/forum/search.php?em###############################
- he####ervice.net/forum/search.php?em###############################
- di####ultriver.net/forum/search.php?em###############################
- ge####suppose.net/forum/search.php?em###############################
- ge####service.net/forum/search.php?em###############################
- ge####mister.net/forum/search.php?em###############################
- le###rriver.net/forum/search.php?em###############################
- he###nriver.net/forum/search.php?em###############################
- va####ssuppose.net/forum/search.php?em###############################
- re####suppose.net/forum/search.php?em###############################
- re####mister.net/forum/search.php?em###############################
- ge###eriver.net/forum/search.php?em###############################
- va####smister.net/forum/search.php?em###############################
- re####eriver.net/forum/search.php?em###############################
- le####mister.net/forum/search.php?em###############################
- or###river.net/forum/search.php?em###############################
- or####ervice.net/forum/search.php?em###############################
- re####eservice.net/forum/search.php?em###############################
- le####service.net/forum/search.php?em###############################
- he####service.net/forum/search.php?em###############################
- he####suppose.net/forum/search.php?em###############################
- he####mister.net/forum/search.php?em###############################
- le####suppose.net/forum/search.php?em###############################
- gl###river.net/forum/search.php?em###############################
- he###angry.net/forum/search.php?em###############################
- ge###eangry.net/forum/search.php?em###############################
- ge####fifteen.net/forum/search.php?em###############################
- ge###edried.net/forum/search.php?em###############################
- he####ifteen.net/forum/search.php?em###############################
- re###ndried.net/forum/search.php?em###############################
- va####sfifteen.net/forum/search.php?em###############################
- va####sdried.net/forum/search.php?em###############################
- he####rticle.net/forum/search.php?em###############################
- ge####article.net/forum/search.php?em###############################
- le####fifteen.net/forum/search.php?em###############################
- he####fifteen.net/forum/search.php?em###############################
- he###ndried.net/forum/search.php?em###############################
- re####earticle.net/forum/search.php?em###############################
- le###rdried.net/forum/search.php?em###############################
- he####article.net/forum/search.php?em###############################
- he###dried.net/forum/search.php?em###############################
- le####article.net/forum/search.php?em###############################
- le###rangry.net/forum/search.php?em###############################
- he###nangry.net/forum/search.php?em###############################
- an####mister.net/forum/search.php?em###############################
- gl###mister.net/forum/search.php?em###############################
- fo####driver.net/forum/search.php?em###############################
- fo####dservice.net/forum/search.php?em###############################
- de###eriver.net/forum/search.php?em###############################
- gl####ervice.net/forum/search.php?em###############################
- an###rriver.net/forum/search.php?em###############################
- an####service.net/forum/search.php?em###############################
- an####suppose.net/forum/search.php?em###############################
- gl####uppose.net/forum/search.php?em###############################
- va####sarticle.net/forum/search.php?em###############################
- re####article.net/forum/search.php?em###############################
- re###nangry.net/forum/search.php?em###############################
- re####fifteen.net/forum/search.php?em###############################
- va####sangry.net/forum/search.php?em###############################
- fo####dsuppose.net/forum/search.php?em###############################
- de####service.net/forum/search.php?em###############################
- de####suppose.net/forum/search.php?em###############################
- de####mister.net/forum/search.php?em###############################
- fo####dmister.net/forum/search.php?em###############################
UDP:
- DNS ASK ne#####ryservice.net
- DNS ASK pl####ntriver.net
- DNS ASK pl####ntservice.net
- DNS ASK pl####ntsuppose.net
- DNS ASK ne#####rysuppose.net
- DNS ASK or####uppose.net
- DNS ASK re####esuppose.net
- DNS ASK re####emister.net
- DNS ASK ne####aryriver.net
- DNS ASK or###mister.net
- DNS ASK he####uppose.net
- DNS ASK di#####ltservice.net
- DNS ASK di#####ltsuppose.net
- DNS ASK di####ultmister.net
- DNS ASK he###mister.net
- DNS ASK pl####ntmister.net
- DNS ASK ne####arymister.net
- DNS ASK he###river.net
- DNS ASK he####ervice.net
- DNS ASK di####ultriver.net
- DNS ASK ge####suppose.net
- DNS ASK ge####service.net
- DNS ASK ge####mister.net
- DNS ASK le###rriver.net
- DNS ASK he###nriver.net
- DNS ASK va####ssuppose.net
- DNS ASK re####suppose.net
- DNS ASK re####mister.net
- DNS ASK ge###eriver.net
- DNS ASK va####smister.net
- DNS ASK re####eriver.net
- DNS ASK le####mister.net
- DNS ASK or###river.net
- DNS ASK or####ervice.net
- DNS ASK re####eservice.net
- DNS ASK le####service.net
- DNS ASK he####service.net
- DNS ASK he####suppose.net
- DNS ASK he####mister.net
- DNS ASK le####suppose.net
- DNS ASK gl###river.net
- DNS ASK he###angry.net
- DNS ASK ge###eangry.net
- DNS ASK ge####fifteen.net
- DNS ASK ge###edried.net
- DNS ASK he####ifteen.net
- DNS ASK re###ndried.net
- DNS ASK va####sfifteen.net
- DNS ASK va####sdried.net
- DNS ASK he####rticle.net
- DNS ASK ge####article.net
- DNS ASK le####fifteen.net
- DNS ASK he####fifteen.net
- DNS ASK he###ndried.net
- DNS ASK re####earticle.net
- DNS ASK le###rdried.net
- DNS ASK he####article.net
- DNS ASK he###dried.net
- DNS ASK le####article.net
- DNS ASK le###rangry.net
- DNS ASK he###nangry.net
- DNS ASK an####mister.net
- DNS ASK gl###mister.net
- DNS ASK fo####driver.net
- DNS ASK fo####dservice.net
- DNS ASK de###eriver.net
- DNS ASK gl####ervice.net
- DNS ASK an###rriver.net
- DNS ASK an####service.net
- DNS ASK an####suppose.net
- DNS ASK gl####uppose.net
- DNS ASK va####sarticle.net
- DNS ASK re####article.net
- DNS ASK re###nangry.net
- DNS ASK re####fifteen.net
- DNS ASK va####sangry.net
- DNS ASK fo####dsuppose.net
- DNS ASK de####service.net
- DNS ASK de####suppose.net
- DNS ASK de####mister.net
- DNS ASK fo####dmister.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'Indicator' WindowName: ''
