Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'shell' = 'explorer.exe,%APPDATA%\skype.dat'
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe'
Внедряет код в
следующие системные процессы:
- <SYSTEM32>\svchost.exe
Изменения в файловой системе:
Создает следующие файлы:
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\tmysglgajz-qrpfxyfmbqbafywpnn-dnfv-ejmscrzoxfwksyvi-frtssucjwg-jhpvsnnnipwpmx-ynytmr-jtsn-bh[1].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\igyhvaxl-syftxplxlzndrgxxuyjzdkvlpfpm-btsuatldhj-pajklagdqcdgaklt-labw-yearouabdhldcbuqix[1].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\qukqcbkydftmysglih-plnnxxftzvor-piceamfcbiakuxxsdift-qcyv-uqgl-mvxqdmrctfgo-xyitwgehzvprpf-[1].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\jpfcgtdhxsdknqzadmuqxjpbgo-zvgjzrehpzaulicodgkdzasdynqrux-gjli-tfeh-srbt-ehuy-tmybzawipfwk[1].html
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\kfougjyv-xvak-uakb-fcfppr-lzwfvqcozm-radm-kyvlbifzxllxdm-bqat-zvppxygjjxsu-jlhj-pzglfpzhdkkbdk[1].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\sddnxocqpi-qjteitrcrnxl-gjkk-ukebrapaye-twmr-pfmpiflgzntwyj-tfjx-gxyk-akvyms-cbdwrn-colljh-juts[1].html
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\frqsrafy-abdiiiyelljhbc-gkgk-yesndumsakpiuonqlxykkqsyrdro-ezaufm-tmcn-gkcl-nwej-bqyh-zmpvrpyv[1].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\herovnvyvlcuopvkdgrzbq-drksbwlxftndsiva-pqxxlmehjwht-xjsn-xjsd-pfnm-rzxf-xpnl-jxgnnn-shixal-mx[1].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\exjlbw-ipna-dwwipq-cejl-jvrixfzjynwpptnndmmxwkuaxscgostmfc-ipys-aucb-rzhcacvkoaxqpyppqnnn-bh[1].html
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\xfjwbheyvibfiq-fzfyxcykmrdk-znddnb-wgdhkknqnd-gxdi-ifltab-pybtxo-awuoygrnndlica-qpzogdgjlaqz[1].html
- %APPDATA%\skype.dat
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\pydrrc-zrxq-ehat-rznm-oatw-gkuooscnjwhjsndnqk-aufqezifcaoarnxjjkbagovkvkwidmrdpvyhpflgro-or[1].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\msqtusqzukwgrglz-jvdfcoxidujx-ynppftegfc-rgjlacihmxkqpf-iqbq-pyip-vrsnrkfqphxp-dhat-tsti-abgo[1].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\pi-qjte-itqu-kqcbkynwcbrdglsumyfyauargnauygacgtfqyh-kkpf-xyuurixpjuzj-suon-ownq-xcbt-xqyb-uxpb[1].html
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\rzprxtgxtyebms-qtgsjt-qrus-gljpdgmpnddmnqruzaix-roqsqjcezhrd-dmfmqklipbpyyk-eawkda-stft-ukqj-[1].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\fa-auxfjw-bhey-vibfxfwgxlvqfmih-bfceihhcuyqk-jkfptyalheaw-vtabfqxsbwbh-rprc-dalzopgdqzaljguo[1].php
Сетевая активность:
Подключается к:
- 'au###.dns-dns.com':80
- 'ty#######tyouseeiswhatyouget.in':80
- 'bi####phyrate.us':80
TCP:
Запросы HTTP GET:
- ty#######tyouseeiswhatyouget.in/tgp/igyhvaxl-syftxplxlzndrgxxuyjzdkvlpfpm-btsuatldhj-pajklagdqcdgaklt-labw-yearouabdhldcbuqix.php
- bi####phyrate.us/o/tmysglgajz-qrpfxyfmbqbafywpnn-dnfv-ejmscrzoxfwksyvi-frtssucjwg-jhpvsnnnipwpmx-ynytmr-jtsn-bh.php
- au###.dns-dns.com/post/jpfcgtdhxsdknqzadmuqxjpbgo-zvgjzrehpzaulicodgkdzasdynqrux-gjli-tfeh-srbt-ehuy-tmybzawipfwk.html
- au###.dns-dns.com/tgp/frqsrafy-abdiiiyelljhbc-gkgk-yesndumsakpiuonqlxykkqsyrdro-ezaufm-tmcn-gkcl-nwej-bqyh-zmpvrpyv.php
- au###.dns-dns.com/post/sddnxocqpi-qjteitrcrnxl-gjkk-ukebrapaye-twmr-pfmpiflgzntwyj-tfjx-gxyk-akvyms-cbdwrn-colljh-juts.html
- ty#######tyouseeiswhatyouget.in/o/kfougjyv-xvak-uakb-fcfppr-lzwfvqcozm-radm-kyvlbifzxllxdm-bqat-zvppxygjjxsu-jlhj-pzglfpzhdkkbdk.php
- bi####phyrate.us/o/herovnvyvlcuopvkdgrzbq-drksbwlxftndsiva-pqxxlmehjwht-xjsn-xjsd-pfnm-rzxf-xpnl-jxgnnn-shixal-mx.php
- ty#######tyouseeiswhatyouget.in/o/qukqcbkydftmysglih-plnnxxftzvor-piceamfcbiakuxxsdift-qcyv-uqgl-mvxqdmrctfgo-xyitwgehzvprpf-.php
- au###.dns-dns.com/questions/xfjwbheyvibfiq-fzfyxcykmrdk-znddnb-wgdhkknqnd-gxdi-ifltab-pybtxo-awuoygrnndlica-qpzogdgjlaqz.html
- ty#######tyouseeiswhatyouget.in/questions/exjlbw-ipna-dwwipq-cejl-jvrixfzjynwpptnndmmxwkuaxscgostmfc-ipys-aucb-rzhcacvkoaxqpyppqnnn-bh.html
- bi####phyrate.us/o/pydrrc-zrxq-ehat-rznm-oatw-gkuooscnjwhjsndnqk-aufqezifcaoarnxjjkbagovkvkwidmrdpvyhpflgro-or.php
- bi####phyrate.us/tgp/rzprxtgxtyebms-qtgsjt-qrus-gljpdgmpnddmnqruzaix-roqsqjcezhrd-dmfmqklipbpyyk-eawkda-stft-ukqj-.php
- bi####phyrate.us/questions/pi-qjte-itqu-kqcbkynwcbrdglsumyfyauargnauygacgtfqyh-kkpf-xyuurixpjuzj-suon-ownq-xcbt-xqyb-uxpb.html
- au###.dns-dns.com/o/msqtusqzukwgrglz-jvdfcoxidujx-ynppftegfc-rgjlacihmxkqpf-iqbq-pyip-vrsnrkfqphxp-dhat-tsti-abgo.php
- ty#######tyouseeiswhatyouget.in/tgp/fa-auxfjw-bhey-vibfxfwgxlvqfmih-bfceihhcuyqk-jkfptyalheaw-vtabfqxsbwbh-rprc-dalzopgdqzaljguo.php
UDP:
- DNS ASK au###.dns-dns.com
- DNS ASK ty#######tyouseeiswhatyouget.in
- DNS ASK bi####phyrate.us
Другое:
Ищет следующие окна:
- ClassName: '0' WindowName: '0'
- ClassName: '' WindowName: ''
