Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'shell' = 'explorer.exe,%APPDATA%\skype.dat'
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe'
Внедряет код в
следующие системные процессы:
- <SYSTEM32>\svchost.exe
Изменения в файловой системе:
Создает следующие файлы:
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\zvyx-pajhel-uqfp-lgfm-facddn-ukqzxvfymramsu-jppq-xxonxlzvezzmarmp-qrsi-osit-qrksxotfptna-qugbyq-[1].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\tsor-qpnh-llnwam-rdrc-wkqs-kfpfclcemx-frxomv-arcu-cbpzhjmpioru-bfuxcqitvqihznwpbahezr-bakkqrlm[1].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\rczrxqehat-rzprxtpfwgoepv-nwmr-hcpy-nndrdk-bcipxj-uystgbfrmvjgkf-vqdi-pbyk-kbpaaw-fvnbvaplprpi[1].html
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\ytmxykvqsrznyjbqclkfqnyngali-gnfqakzajkrkll-fcrt-xynnkgriykjvarpqatouriuobfjunenqnh-qsqs-[1].html
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\xsdknqza-jpfc-gtdhko-jppmdwuocblz-ezty-zakkzhwkuayttsqkqtjgalxx-zaru-onez-fpouegcbyv-wbce-lmdn[1].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\cbkydf-tmys-glga-jzsdtwrnzvgaysorfqou-ukfanlowawxs-jhcn-jgeg-ehrgrczhdgqnou-fzsd-nnpq-uapyosgk[1].html
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\nh-llnw-amrdmynsoefr-tyyviq-fqfqxywpjtmsftcjpf-tfygrpstpvbi-yqehjk-quih-lasp-qtnw-qrsp-tsqpcrpb[1].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\eyvibfiqfzcj-ynsp-ldpb-fpqu-drfc-rolzyb-htpm-vnju-cjyb-juat-cesh-nmamvp-tiio-kodirqqtgtvy-oxyq-uakd[1].php
- %APPDATA%\skype.dat
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\oahjyqyb-tisddn-xosy-jliiykzoykvn-fyclnaqjladwdh-yeoysd-qral-nefzxftwmrdgqsxj-ytcnxignohzh-cr[1].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\sp-gbnnrp-faau-xfjwrotimrsuouzv-tiofyvsrlx-frph-nagl-jwua-zrrgfy-jujhfzyxti-ndrc-usofvy-ksjgxfak[1].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\zh-rubtoahjyqybtirtcelmmy-akat-quhe-xsrn-jlshwp-syqznq-gdexus-xfft-igyx-zacn-vnsnosnfna-neye-akxf-[1].php
Сетевая активность:
Подключается к:
- 'cl#####ats.dns-dns.com':80
- 'pu####countmovs.in':80
- 'fr#####teurssporting.us':80
TCP:
Запросы HTTP GET:
- pu####countmovs.in/community/zvyx-pajhel-uqfp-lgfm-facddn-ukqzxvfymramsu-jppq-xxonxlzvezzmarmp-qrsi-osit-qrksxotfptna-qugbyq-.php
- fr#####teurssporting.us/community/tsor-qpnh-llnwam-rdrc-wkqs-kfpfclcemx-frxomv-arcu-cbpzhjmpioru-bfuxcqitvqihznwpbahezr-bakkqrlm.php
- cl#####ats.dns-dns.com/forums/cbkydf-tmys-glga-jzsdtwrnzvgaysorfqou-ukfanlowawxs-jhcn-jgeg-ehrgrczhdgqnou-fzsd-nnpq-uapyosgk.html
- pu####countmovs.in/forums/ytmxykvqsrznyjbqclkfqnyngali-gnfqakzajkrkll-fcrt-xynnkgriykjvarpqatouriuobfjunenqnh-qsqs-.html
- fr#####teurssporting.us/forum/xsdknqza-jpfc-gtdhko-jppmdwuocblz-ezty-zakkzhwkuayttsqkqtjgalxx-zaru-onez-fpouegcbyv-wbce-lmdn.php
- cl#####ats.dns-dns.com/forums/rczrxqehat-rzprxtpfwgoepv-nwmr-hcpy-nndrdk-bcipxj-uystgbfrmvjgkf-vqdi-pbyk-kbpaaw-fvnbvaplprpi.html
- pu####countmovs.in/forum/nh-llnw-amrdmynsoefr-tyyviq-fqfqxywpjtmsftcjpf-tfygrpstpvbi-yqehjk-quih-lasp-qtnw-qrsp-tsqpcrpb.php
- fr#####teurssporting.us/community/eyvibfiqfzcj-ynsp-ldpb-fpqu-drfc-rolzyb-htpm-vnju-cjyb-juat-cesh-nmamvp-tiio-kodirqqtgtvy-oxyq-uakd.php
- cl#####ats.dns-dns.com/forum/zh-rubtoahjyqybtirtcelmmy-akat-quhe-xsrn-jlshwp-syqznq-gdexus-xfft-igyx-zacn-vnsnosnfna-neye-akxf-.php
- pu####countmovs.in/forum/oahjyqyb-tisddn-xosy-jliiykzoykvn-fyclnaqjladwdh-yeoysd-qral-nefzxftwmrdgqsxj-ytcnxignohzh-cr.php
- fr#####teurssporting.us/community/sp-gbnnrp-faau-xfjwrotimrsuouzv-tiofyvsrlx-frph-nagl-jwua-zrrgfy-jujhfzyxti-ndrc-usofvy-ksjgxfak.php
UDP:
- DNS ASK cl#####ats.dns-dns.com
- DNS ASK pu####countmovs.in
- DNS ASK fr#####teurssporting.us
