Техническая информация
Для обеспечения автозапуска и распространения
Устанавливает следующие настройки сервисов
- [HKLM\SYSTEM\CurrentControlSet\Services\Performance Accounts Media Modules] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\Performance Accounts Media Modules] 'ImagePath' = 'C:\rxegannqdqbkp\daecfanh.exe'
Создает следующие сервисы
- 'Performance Accounts Media Modules' C:\rxegannqdqbkp\daecfanh.exe
Вредоносные функции
Завершает или пытается завершить
следующие системные процессы:
- <SYSTEM32>\dwm.exe
Изменения в файловой системе
Создает следующие файлы
- %WINDIR%\rxegannqdqbkp\zmivxv
- C:\rxegannqdqbkp\zmivxv
- C:\rxegannqdqbkp\hvcgfjlcsdbbkmuan1uw.exe
- C:\rxegannqdqbkp\daecfanh.exe
- C:\rxegannqdqbkp\dikyxtk.exe
Присваивает атрибут 'скрытый' для следующих файлов
- C:\rxegannqdqbkp\daecfanh.exe
- C:\rxegannqdqbkp\dikyxtk.exe
Удаляет файлы, которые сам же создал
- %WINDIR%\rxegannqdqbkp\zmivxv
- C:\rxegannqdqbkp\hvcgfjlcsdbbkmuan1uw.exe
Подменяет следующие файлы
- %WINDIR%\rxegannqdqbkp\zmivxv
Сетевая активность
Подключается к
- 'sw###third.net':80
- 'ma####althird.net':80
- 'ma####alobject.net':80
- 'si###espace.net':80
- 'mo####inspace.net':80
- 'po####letravel.net':80
- 'ma####alspace.net':80
- 'bu####ngduring.net':80
- 'st###length.net':80
- 'st####eneral.net':80
TCP
Запросы HTTP GET
- http://sw###third.net/index.php
- http://ma####althird.net/index.php
- http://ma####alobject.net/index.php
- http://si###espace.net/index.php
- http://mo####inspace.net/index.php
- http://po####letravel.net/index.php
- http://ma####alspace.net/index.php
- http://bu####ngduring.net/index.php
- http://st###length.net/index.php
- http://st####eneral.net/index.php
UDP
- DNS ASK fi####object.net
- DNS ASK le###object.net
- DNS ASK fi####childhood.net
- DNS ASK le####hildhood.net
- DNS ASK sw####tation.net
- DNS ASK pr####lystation.net
- DNS ASK sw###third.net
- DNS ASK pr####lythird.net
- DNS ASK sw###object.net
- DNS ASK pr####lyobject.net
- DNS ASK sw####hildhood.net
- DNS ASK pr#####ychildhood.net
- DNS ASK se####lstation.net
- DNS ASK ma####alstation.net
- DNS ASK se####lthird.net
- DNS ASK ma####althird.net
- DNS ASK se####lobject.net
- DNS ASK ma####alobject.net
- DNS ASK se#####childhood.net
- DNS ASK ma#####lchildhood.net
- DNS ASK se###aspace.net
- DNS ASK la###space.net
- DNS ASK se####travel.net
- DNS ASK la###travel.net
- DNS ASK se####yellow.net
- DNS ASK la###yellow.net
- DNS ASK se###aclose.net
- DNS ASK la###close.net
- DNS ASK si###espace.net
- DNS ASK mo###rspace.net
- DNS ASK si####travel.net
- DNS ASK mo####travel.net
- DNS ASK si####yellow.net
- DNS ASK mo####yellow.net
- DNS ASK si###eclose.net
- DNS ASK mo###rclose.net
- DNS ASK mo####inspace.net
- DNS ASK po####lespace.net
- DNS ASK mo####intravel.net
- DNS ASK po####letravel.net
- DNS ASK mo####inyellow.net
- DNS ASK po####leyellow.net
- DNS ASK mo####inclose.net
- DNS ASK po####leclose.net
- DNS ASK pe####sspace.net
- DNS ASK wi###wspace.net
- DNS ASK pe####stravel.net
- DNS ASK wi####travel.net
- DNS ASK pe####syellow.net
- DNS ASK wi####yellow.net
- DNS ASK pe####sclose.net
- DNS ASK wi###wclose.net
- DNS ASK wi###rspace.net
- DNS ASK su####tspace.net
- DNS ASK su####ttravel.net
- DNS ASK su####tyellow.net
- DNS ASK wi###rclose.net
- DNS ASK su####tclose.net
- DNS ASK fi###hspace.net
- DNS ASK le###space.net
- DNS ASK fi####travel.net
- DNS ASK le###travel.net
- DNS ASK fi####yellow.net
- DNS ASK le###yellow.net
- DNS ASK fi###hclose.net
- DNS ASK le###close.net
- DNS ASK sw###space.net
- DNS ASK pr####lyspace.net
- DNS ASK sw###travel.net
- DNS ASK pr####lytravel.net
- DNS ASK sw###yellow.net
- DNS ASK pr####lyyellow.net
- DNS ASK sw###close.net
- DNS ASK pr####lyclose.net
- DNS ASK se####lspace.net
- DNS ASK ma####alspace.net
- DNS ASK se####ltravel.net
- DNS ASK ma####altravel.net
- DNS ASK se####lyellow.net
- DNS ASK ma####alyellow.net
- DNS ASK se####lclose.net
- DNS ASK ma####alclose.net
- DNS ASK mo####ntlength.net
- DNS ASK ou####elength.net
- DNS ASK mo####ntnotice.net
- DNS ASK ou####enotice.net
- DNS ASK mo####ntindeed.net
- DNS ASK ou####eindeed.net
- DNS ASK mo####ntduring.net
- DNS ASK ou####eduring.net
- DNS ASK bu####nglength.net
- DNS ASK ev####glength.net
- DNS ASK bu####ngnotice.net
- DNS ASK ev####gnotice.net
- DNS ASK bu####ngindeed.net
- DNS ASK ev####gindeed.net
- DNS ASK bu####ngduring.net
- DNS ASK ev####gduring.net
- DNS ASK st###length.net
- DNS ASK mi###length.net
- DNS ASK st###notice.net
- DNS ASK mi###notice.net
- DNS ASK st###indeed.net
- DNS ASK mi###indeed.net
- DNS ASK st###during.net
- DNS ASK mi###during.net
- DNS ASK do####length.net
- DNS ASK pr####length.net
- DNS ASK do####notice.net
- DNS ASK pr####notice.net
- DNS ASK do####indeed.net
- DNS ASK pr####indeed.net
- DNS ASK do####during.net
- DNS ASK pr####during.net
- DNS ASK fe####length.net
- DNS ASK fe####notice.net
- DNS ASK fe####indeed.net
- DNS ASK fe####during.net
- DNS ASK br####length.net
- DNS ASK re####length.net
- DNS ASK br####notice.net
- DNS ASK re####notice.net
- DNS ASK br####indeed.net
- DNS ASK re####indeed.net
- DNS ASK br####during.net
- DNS ASK re####during.net
- DNS ASK pr####elength.net
- DNS ASK de####length.net
- DNS ASK pr####enotice.net
- DNS ASK de####notice.net
- DNS ASK pr####eindeed.net
- DNS ASK de####indeed.net
- DNS ASK pr####eduring.net
- DNS ASK de####during.net
- DNS ASK st####thlength.net
- DNS ASK st####thnotice.net
- DNS ASK st####thindeed.net
- DNS ASK st####thduring.net
- DNS ASK mo####ntclear.net
- DNS ASK ou####eclear.net
- DNS ASK mo####ntgeneral.net
- DNS ASK ou####egeneral.net
- DNS ASK mo####ntinclude.net
- DNS ASK ou####einclude.net
- DNS ASK mo####ntnorth.net
- DNS ASK ou####enorth.net
- DNS ASK bu####ngclear.net
- DNS ASK ev####gclear.net
- DNS ASK bu####nggeneral.net
- DNS ASK ev####ggeneral.net
- DNS ASK bu####nginclude.net
- DNS ASK ev####ginclude.net
- DNS ASK bu####ngnorth.net
- DNS ASK ev####gnorth.net
- DNS ASK st###clear.net
- DNS ASK mi###clear.net
- DNS ASK st####eneral.net
- DNS ASK mi####eneral.net
- DNS ASK st####nclude.net
- DNS ASK mi####nclude.net
Другое
Создает и запускает на исполнение
- 'C:\rxegannqdqbkp\hvcgfjlcsdbbkmuan1uw.exe'
- 'C:\rxegannqdqbkp\daecfanh.exe'
- 'C:\rxegannqdqbkp\dikyxtk.exe' "c:\rxegannqdqbkp\daecfanh.exe"
Запускает на исполнение
- '<SYSTEM32>\dwm.exe'
