Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'shell' = 'explorer.exe,%APPDATA%\skype.dat'
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe'
Внедряет код в
следующие системные процессы:
- <SYSTEM32>\svchost.exe
Изменения в файловой системе:
Создает следующие файлы:
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\zajpfcgt-dhxsdknqcndmkfixbfpivacolgvqqjjh-cozvlaxvuscugn_amalwg-osxosdytor-cdofytduxtyjwb[1].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bi-hckk-rqsh-gscdnbtetu-shgbixgjdnfz-bwfq-dmjp-uoostsfasdvyosnbspxcuszvjxxqduxpdunw-nhxl-yvca-[1].html
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\rubtoa-hjyq-ybtisdpidwpf-sizjnq-ltyx-xtru-uxjx-fzab-ukonkb-vyrzgt-ynpb_bwwb_vtvn_cnwf_xxrt-usli-paop-[1].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\fvsudu-cala-jutf-ofvrmv-biqrofioddvnmrarfvfmgxbqrnxfzaysoy-akrq-syqrphxynwmrifacbfbtliowyh[1].html
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\cqpiqjteit-qukqcbphnnpbvtpauump-yvnmjtceqtptxxlauaxibcnsnebhtygobt-kkrz-qntfxcshznwkhjcg-[1].html
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\nw-amrd-myns-oeex-jlip-mvybwbkqsykg-dmyxmponkdfc-kypb-yvcornppow-nlft-jtop-ioux-ebopqnjxaratuqgo[1].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\pljv-zvyxpa-jheluqzrwg-rivlpvqnoawfmvua-mruunlcqjpzrcgvpuufmuuitebvl_xigxcosyltpbsdyjzvyk[1].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\oyxioyxioyxioyxijkdgyetirgkbej-jvgacbtmejxi-oyixfp-msnd-egltgltiliytznceksdmrzbiaumrysjp[1].html
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\lipbuxmpfmgnltblkgpriq-kfca_witydf-uurovqpirtvpltdrdkowtejgqz-hcstlitsrn_vaig-nnro-sidavnnw[1].html
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\zvyxpajheluq-fplg-fmfacddnukqzxvfy-mramsujppq_xxon_xlzvhe-myjt-kyqr-amsnqtqrksxotfptna-qugbyq-[1].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\jp-fcgt_dhxsdknqzadm-uqxjpbgozvgjzr_ehpz-auli-codgkdzasdnopfoe-gjliphougtbteh_uytmyb-zawi-pfwk-[1].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\jhel-uqfplgsncexc-twltbhpfzhnq-ejtwihnwux_ximp-bikg-oxce_vabc_xfxopy-spcqdn-gopy-dkqrticdtextfa-[1].html
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\pbuxmpfmgnltblcrvlxlbiowpytwgacleg-vnsrzayvrojwcnxj-pfpzrgsrpirkoyoutmqndnjhqncbjzts-dn[1].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\owpvpzturnndgk-jkti-noihkd-vqprhcxxpi-bcuaxypvtw-ofdh_ofqzvy-oaro-ifce-vpkfos-vlrggbouplalltbl[1].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ldwk-clal-bcgo-cnpm-ofnd-kkdmfafczrsh-nmux_jlwi-alfrcjhedidaqjlxgtgluxxo-dhfzrn-iqkowg-ezkqkqwf[1].html
- %APPDATA%\skype.ini
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\gjyvxvakuakbegnl-nhonjx-qjpt-spihcbducdnlpbqsxigsgbdwysacvyxyixsy-lgko_dnfc-osjthtllkd_onph_[1].html
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\clalbcgo-cnpm-ezeaxv-dujt-ldukdi-lmtw_usdn_lmxcaceynlrgliukwkppldrk_coqs-qpxqfpksqsnh-prmx_xxjv[1].html
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\fyab-diiiyeohif-ejzoebgnjtft-rukgegouxqra-rnjh-nbigxlmpqk-pvprce-wffr-eyelgnsyonxonllmrghc_mx[1].php
- %APPDATA%\skype.dat
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\zmfr-qsra-fyab-diii_xxshzr-twxpowrkpaxpac-rndfzorqauxtytts_zofv_zasu_shspsuosdwjhruybrtne-kgbq-[1].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\ipnadwwipq-neytmxjlltganeytkfwirigkqjquuu-pquqhtelmytezaowonqzitfyarnojt-ysna_kbjk_osfy_da[1].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\fplgsn_cexc_zjddon-nenn-xxpm_jwyqgb-pans_lxiipp-nmlg-ysva-nawb-akrcnqdrdm-itix_jlexrk-mxzofckgdice[1].html
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\hckk-rqsh-gscd-nbvp-nsbcauamvpyvxvkgzodhifzodr_znrp_wfqtihrigajuat-laexllgjjh-rcgn-viybgtqkko[1].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\yn-spgbnnrpfaauxfndegxfsy-nwlmbhehzokgjwlawggx-rznwmswkfqmxgk-nmak-ebvr-ejlmpfviyteb_bqpq-xo[1].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ukwg-rglzli-pbuxmp-btznnafvgtexqkcb-nlhtykvkxx_kdxypp-dhpqcuystyaltm-abte-oupfvrpriozoxxoxne[1].html
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\ph-acuyqckfou-gjyvrqjwftpv-usfy_twtm_blouyv-duykrtbwzakf_ehwi-caus-opda-nltm_lljvtuxyxfam-yepbex-[1].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\pfxyaw-rkowpvpztu-mxkb-pbxs-jlrkva-nnra_myvi-ixyq-dfukfpdmqsihpz_ynrz_ykeg-srzm-rtrpuqzjpfxibali[1].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\hjyqybtisddnxo-cqpb-tuye_yxspxo-yvwp-nwwguornhckscuehnwsncumrwgmrms-ddph-acpbrtmyvafappnlxf-[1].php
Сетевая активность:
Подключается к:
- 'au####y0.xxuz.com':80
- 'su####odelstomp.biz':80
- 'ri#####ickcoast.info':80
TCP:
Запросы HTTP GET:
- au####y0.xxuz.com/mpgs/zajpfcgt-dhxsdknqcndmkfixbfpivacolgvqqjjh-cozvlaxvuscugn_amalwg-osxosdytor-cdofytduxtyjwb.php
- ri#####ickcoast.info/contact/bi-hckk-rqsh-gscdnbtetu-shgbixgjdnfz-bwfq-dmjp-uoostsfasdvyosnbspxcuszvjxxqduxpdunw-nhxl-yvca-.html
- su####odelstomp.biz/forum/rubtoa-hjyq-ybtisdpidwpf-sizjnq-ltyx-xtru-uxjx-fzab-ukonkb-vyrzgt-ynpb_bwwb_vtvn_cnwf_xxrt-usli-paop-.php
- au####y0.xxuz.com/forum/nw-amrd-myns-oeex-jlip-mvybwbkqsykg-dmyxmponkdfc-kypb-yvcornppow-nlft-jtop-ioux-ebopqnjxaratuqgo.php
- ri#####ickcoast.info/forum/pljv-zvyxpa-jheluqzrwg-rivlpvqnoawfmvua-mruunlcqjpzrcgvpuufmuuitebvl_xigxcosyltpbsdyjzvyk.php
- su####odelstomp.biz/users/fvsudu-cala-jutf-ofvrmv-biqrofioddvnmrarfvfmgxbqrnxfzaysoy-akrq-syqrphxynwmrifacbfbtliowyh.html
- au####y0.xxuz.com/users/jhel-uqfplgsncexc-twltbhpfzhnq-ejtwihnwux_ximp-bikg-oxce_vabc_xfxopy-spcqdn-gopy-dkqrticdtextfa-.html
- ri#####ickcoast.info/users/oyxioyxioyxioyxijkdgyetirgkbej-jvgacbtmejxi-oyixfp-msnd-egltgltiliytznceksdmrzbiaumrysjp.html
- su####odelstomp.biz/users/lipbuxmpfmgnltblkgpriq-kfca_witydf-uurovqpirtvpltdrdkowtejgqz-hcstlitsrn_vaig-nnro-sidavnnw.html
- au####y0.xxuz.com/mpgs/zvyxpajheluq-fplg-fmfacddnukqzxvfy-mramsujppq_xxon_xlzvhe-myjt-kyqr-amsnqtqrksxotfptna-qugbyq-.php
- ri#####ickcoast.info/forum/pbuxmpfmgnltblcrvlxlbiowpytwgacleg-vnsrzayvrojwcnxj-pfpzrgsrpirkoyoutmqndnjhqncbjzts-dn.php
- su####odelstomp.biz/mpgs/owpvpzturnndgk-jkti-noihkd-vqprhcxxpi-bcuaxypvtw-ofdh_ofqzvy-oaro-ifce-vpkfos-vlrggbouplalltbl.php
- au####y0.xxuz.com/forum/jp-fcgt_dhxsdknqzadm-uqxjpbgozvgjzr_ehpz-auli-codgkdzasdnopfoe-gjliphougtbteh_uytmyb-zawi-pfwk-.php
- su####odelstomp.biz/contact/cqpiqjteit-qukqcbphnnpbvtpauump-yvnmjtceqtptxxlauaxibcnsnebhtygobt-kkrz-qntfxcshznwkhjcg-.html
- ri#####ickcoast.info/contact/gjyvxvakuakbegnl-nhonjx-qjpt-spihcbducdnlpbqsxigsgbdwysacvyxyixsy-lgko_dnfc-osjthtllkd_onph_.html
- su####odelstomp.biz/users/clalbcgo-cnpm-ezeaxv-dujt-ldukdi-lmtw_usdn_lmxcaceynlrgliukwkppldrk_coqs-qpxqfpksqsnh-prmx_xxjv.html
- au####y0.xxuz.com/mpgs/ph-acuyqckfou-gjyvrqjwftpv-usfy_twtm_blouyv-duykrtbwzakf_ehwi-caus-opda-nltm_lljvtuxyxfam-yepbex-.php
- ri#####ickcoast.info/mpgs/zmfr-qsra-fyab-diii_xxshzr-twxpowrkpaxpac-rndfzorqauxtytts_zofv_zasu_shspsuosdwjhruybrtne-kgbq-.php
- su####odelstomp.biz/mpgs/ipnadwwipq-neytmxjlltganeytkfwirigkqjquuu-pquqhtelmytezaowonqzitfyarnojt-ysna_kbjk_osfy_da.php
- au####y0.xxuz.com/mpgs/fyab-diiiyeohif-ejzoebgnjtft-rukgegouxqra-rnjh-nbigxlmpqk-pvprce-wffr-eyelgnsyonxonllmrghc_mx.php
- ri#####ickcoast.info/forum/pfxyaw-rkowpvpztu-mxkb-pbxs-jlrkva-nnra_myvi-ixyq-dfukfpdmqsihpz_ynrz_ykeg-srzm-rtrpuqzjpfxibali.php
- su####odelstomp.biz/mpgs/hckk-rqsh-gscd-nbvp-nsbcauamvpyvxvkgzodhifzodr_znrp_wfqtihrigajuat-laexllgjjh-rcgn-viybgtqkko.php
- au####y0.xxuz.com/forum/yn-spgbnnrpfaauxfndegxfsy-nwlmbhehzokgjwlawggx-rznwmswkfqmxgk-nmak-ebvr-ejlmpfviyteb_bqpq-xo.php
- ri#####ickcoast.info/users/ldwk-clal-bcgo-cnpm-ofnd-kkdmfafczrsh-nmux_jlwi-alfrcjhedidaqjlxgtgluxxo-dhfzrn-iqkowg-ezkqkqwf.html
- su####odelstomp.biz/mpgs/hjyqybtisddnxo-cqpb-tuye_yxspxo-yvwp-nwwguornhckscuehnwsncumrwgmrms-ddph-acpbrtmyvafappnlxf-.php
- au####y0.xxuz.com/contact/ukwg-rglzli-pbuxmp-btznnafvgtexqkcb-nlhtykvkxx_kdxypp-dhpqcuystyaltm-abte-oupfvrpriozoxxoxne.html
- ri#####ickcoast.info/contact/fplgsn_cexc_zjddon-nenn-xxpm_jwyqgb-pans_lxiipp-nmlg-ysva-nawb-akrcnqdrdm-itix_jlexrk-mxzofckgdice.html
UDP:
- DNS ASK au####y0.xxuz.com
- DNS ASK su####odelstomp.biz
- DNS ASK ri#####ickcoast.info
