Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Windows Security Center' = '%TEMP%\4027da6e1051d70aa38c110c3d90e663\f7cbe066368693669931.exe'
Вредоносные функции:
Создает и запускает на исполнение:
- '%TEMP%\4027da6e1051d70aa38c110c3d90e663\f7cbe066368693669931.exe'
Изменения в файловой системе:
Создает следующие файлы:
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\wp-test[5].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\wp-test[5].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\wp-test[6].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\wp-test[5].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\wp-test[4].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\wp-test[4].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\wp-test[5].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\wp-test[6].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\wp-test[7].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\wp-test[7].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\wp-test[8].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\wp-test[7].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\wp-test[6].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\wp-test[6].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\wp-test[7].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\wp-test[1].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\wp-test[2].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\wp-test[2].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\wp-test[1].php
- %TEMP%\4027da6e1051d70aa38c110c3d90e663\f7cbe066368693669931.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\wp-test[1].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\wp-test[1].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\wp-test[2].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\wp-test[3].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\wp-test[4].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\wp-test[4].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\wp-test[3].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\wp-test[2].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\wp-test[3].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\wp-test[3].php
Самоудаляется.
Сетевая активность:
Подключается к:
- 'th#####teneffect.com':80
- 'pu#####thepedals.com':80
- 'ra###run.com':80
- 'ba###nimtb.com':80
- 'ma###tusa.com':80
- 'jo###rehab.com':80
- 'of###emap.com':80
- 'fa####nistando.com':80
- 'ma##jc.net':80
- 'fu####lilly.c??m':80
- 'es#####oseuropeus.com':80
- 'wh####olarpower.com':80
- 'hs##t.org':80
- 'te#####rtstraining.com':80
- 'pr###postur.com':80
- 'pi####planta.com':80
- 'ho####llandwise.org':80
- 'ba###oflove.org':80
- 'wo###scourt.ca':80
- 'et#####gie-occitane.fr':80
- 'fo#####fie-slubne.org':80
- 'pl####aestate.it':80
- 'qn###teway.com':80
- 'jo###onese.com':80
- 'an####ajoiner.com':80
- 'th#####innocence.com':80
- 'ma####infame.com':80
- 'tr####tmiami.com':80
- 'fa####ticfins.com':80
TCP:
Запросы HTTP GET:
- th#####teneffect.com/
- ba###nimtb.com/wp-includes/wp-test.php
- ba###nimtb.com/
- th#####teneffect.com/wp-includes/wp-test.php
- ra###run.com/
- pu#####thepedals.com/wp-includes/wp-test.php
- pu#####thepedals.com/
- ma###tusa.com/wp-includes/wp-test.php
- ma###tusa.com/
- pr###postur.com/wp-includes/wp-test.php
- jo###rehab.com/
- of###emap.com/wp-includes/wp-test.php
- of###emap.com/
- jo###rehab.com/wp-includes/wp-test.php
- ra###run.com/wp-includes/wp-test.php
- fa####nistando.com/wp-includes/wp-test.php
- fa####nistando.com/
- es#####oseuropeus.com/wp-includes/wp-test.php
- ma##jc.net/
- fu####lilly.c??m/wp-includes/wp-test.php
- fu####lilly.c??m/
- ma##jc.net/wp-includes/wp-test.php
- hs##t.org/
- wh####olarpower.com/wp-includes/wp-test.php
- wh####olarpower.com/
- hs##t.org/wp-includes/wp-test.php
- es#####oseuropeus.com/
- te#####rtstraining.com/wp-includes/wp-test.php
- te#####rtstraining.com/
- pi####planta.com/wp-includes/wp-test.php
- pi####planta.com/
- wo###scourt.ca/wp-includes/wp-test.php
- ho####llandwise.org/
- ba###oflove.org/wp-includes/wp-test.php
- ba###oflove.org/
- ho####llandwise.org/wp-includes/wp-test.php
- fo#####fie-slubne.org/
- et#####gie-occitane.fr/wp-includes/wp-test.php
- et#####gie-occitane.fr/
- fo#####fie-slubne.org/wp-includes/wp-test.php
- wo###scourt.ca/
- pl####aestate.it/wp-includes/wp-test.php
- pl####aestate.it/
- ma####infame.com/
- jo###onese.com/
- qn###teway.com/wp-includes/wp-test.php
- qn###teway.com/
- jo###onese.com/wp-includes/wp-test.php
- pr###postur.com/
- an####ajoiner.com/wp-includes/wp-test.php
- an####ajoiner.com/
- tr####tmiami.com/wp-includes/wp-test.php
- tr####tmiami.com/
- ma####infame.com/wp-includes/wp-test.php
- fa####ticfins.com/
- th#####innocence.com/wp-includes/wp-test.php
- th#####innocence.com/
- fa####ticfins.com/wp-includes/wp-test.php
UDP:
- DNS ASK th#####teneffect.com
- DNS ASK pu#####thepedals.com
- DNS ASK ra###run.com
- DNS ASK ba###nimtb.com
- DNS ASK ma###tusa.com
- DNS ASK jo###rehab.com
- DNS ASK of###emap.com
- DNS ASK fa####nistando.com
- DNS ASK ma##jc.net
- DNS ASK fu####lilly.cьm
- DNS ASK es#####oseuropeus.com
- DNS ASK wh####olarpower.com
- DNS ASK hs##t.org
- DNS ASK te#####rtstraining.com
- DNS ASK pr###postur.com
- DNS ASK pi####planta.com
- DNS ASK ho####llandwise.org
- DNS ASK ba###oflove.org
- DNS ASK wo###scourt.ca
- DNS ASK et#####gie-occitane.fr
- DNS ASK fo#####fie-slubne.org
- DNS ASK pl####aestate.it
- DNS ASK qn###teway.com
- DNS ASK jo###onese.com
- DNS ASK an####ajoiner.com
- DNS ASK th#####innocence.com
- DNS ASK ma####infame.com
- DNS ASK tr####tmiami.com
- DNS ASK fa####ticfins.com
Другое:
Ищет следующие окна:
- ClassName: 'Indicator' WindowName: '(null)'
