Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Yfotegacteokl' = '<Полный путь к вирусу>'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Yfotegacteokl' = '<Полный путь к вирусу>'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Yfotegacteokl' = '"<Полный путь к вирусу>"'
- [<HKLM>\SYSTEM\ControlSet001\Control\Session Manager\SubSystems] 'Windows' = ''
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Yfotegacteokl' = '"<Полный путь к вирусу>"'
Вредоносные функции:
Внедряет код в
следующие системные процессы:
- %WINDIR%\Explorer.EXE
Завершает или пытается завершить
следующие системные процессы:
- <SYSTEM32>\ctfmon.exe
Изменения в файловой системе:
Создает следующие файлы:
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\607AF16A6457FE0D61E02D0C[1].htm
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\0DD530D578307B6B7D87A86A[1].htm
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\DB93DE461CD724AB1960F7AA[1].htm
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\CE96974445C7B2DB407061DA[1].htm
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\94032CE48B97ADED8E207EEC[1].htm
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\07EA6B05D7F253F6D24580F7[1].htm
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\6EF0161F7FF20A977A45D996[1].htm
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\928139CFB4CAF66CB17D256D[1].htm
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\F5DD156A5B5A7E435EEDAD42[1].htm
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\4CF41E4A5020E4EF559737EE[1].htm
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\52DC91884852A3154DE57014[1].htm
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\5F54A89A78DC8C737D6B5F72[1].htm
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\E7C3312639F6706F3C41A36E[1].htm
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\6DF70054E8695CA8EDDE8FA9[1].htm
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\A663CEADF477D61DF1C0051C[1].htm
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\25F51493EB4E5BDBEEF988DA[1].htm
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\3768FAE0FC131A86F9A4C987[1].htm
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\eac63387ef71e086e5e80111[1]
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\012421D3ECFA9B5FE94D485E[1].htm
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\D4BF8C28E7743DD3E2C3EED2[1].htm
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\609ECD9716E135221356E623[1].htm
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\D303617C247EBF0021C96C01[1].htm
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\1FD8ECECD0B6CA22D5011923[1].htm
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\81D4A2ACAF951B1DAA22C81C[1].htm
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\5D5D77B58FDE0FCE8A69DCCF[1].htm
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\E6CA104AFE76BFC4FBC16CC5[1].htm
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\F8D0B29BB4B42050B103F351[1].htm
Удаляет следующие файлы:
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\607AF16A6457FE0D61E02D0C[1].htm
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\0DD530D578307B6B7D87A86A[1].htm
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\DB93DE461CD724AB1960F7AA[1].htm
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\CE96974445C7B2DB407061DA[1].htm
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\94032CE48B97ADED8E207EEC[1].htm
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\07EA6B05D7F253F6D24580F7[1].htm
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\6EF0161F7FF20A977A45D996[1].htm
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\928139CFB4CAF66CB17D256D[1].htm
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\F5DD156A5B5A7E435EEDAD42[1].htm
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\4CF41E4A5020E4EF559737EE[1].htm
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\52DC91884852A3154DE57014[1].htm
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\5F54A89A78DC8C737D6B5F72[1].htm
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\E7C3312639F6706F3C41A36E[1].htm
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\25F51493EB4E5BDBEEF988DA[1].htm
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\3768FAE0FC131A86F9A4C987[1].htm
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\609ECD9716E135221356E623[1].htm
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\012421D3ECFA9B5FE94D485E[1].htm
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\D4BF8C28E7743DD3E2C3EED2[1].htm
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\A663CEADF477D61DF1C0051C[1].htm
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\5D5D77B58FDE0FCE8A69DCCF[1].htm
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\1FD8ECECD0B6CA22D5011923[1].htm
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\81D4A2ACAF951B1DAA22C81C[1].htm
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\6DF70054E8695CA8EDDE8FA9[1].htm
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\E6CA104AFE76BFC4FBC16CC5[1].htm
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\F8D0B29BB4B42050B103F351[1].htm
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\D303617C247EBF0021C96C01[1].htm
Сетевая активность:
Подключается к:
- '74.##5.232.51':80
- 'll#####figurasdg.com':80
- 'localhost':1037
TCP:
Запросы HTTP GET:
- 74.##5.232.51/
- ll#####figurasdg.com/b/eve/eac63387ef71e086e5e80111
UDP:
- DNS ASK www.google.com
- DNS ASK ll#####figurasdg.com
Другое:
Ищет следующие окна:
- ClassName: 'MS_WebcheckMonitor' WindowName: '(null)'
- ClassName: 'MS_AutodialMonitor' WindowName: '(null)'
- ClassName: 'Indicator' WindowName: '(null)'
