Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hijackthis.exe] 'Debugger' = 'nrmhzd_.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spybotsd.exe] 'Debugger' = 'rchzjn_.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\housecalllauncher.exe] 'Debugger' = 'rnrnkp_.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe] 'Debugger' = 'dttezf_.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Flash Update Client' = '%CommonProgramFiles%\Flash Update Client.{2227A280-3AEA-1069-A2DE-08002B30309D}\ifbxqllff.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] 'Flash Update Client' = '%CommonProgramFiles%\Flash Update Client.{2227A280-3AEA-1069-A2DE-08002B30309D}\ifbxqllff.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Flash Update Client' = '%CommonProgramFiles%\Flash Update Client.{2227A280-3AEA-1069-A2DE-08002B30309D}\ifbxqllff.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\SSDPSRV] 'Start' = '00000002'
Вредоносные функции:
Для затруднения выявления своего присутствия в системе
блокирует отображение:
- скрытых файлов
Создает и запускает на исполнение:
- '%CommonProgramFiles%\Flash Update Client.{2227A280-3AEA-1069-A2DE-08002B30309D}\ifbxqllff.exe'
Запускает на исполнение:
- '%WINDIR%\explorer.exe'
- '<SYSTEM32>\wuauclt.exe'
Внедряет код в
следующие системные процессы:
- <SYSTEM32>\cmd.exe
- <SYSTEM32>\wbem\wmiprvse.exe
- <SYSTEM32>\cscript.exe
- <SYSTEM32>\wuauclt.exe
- %WINDIR%\Explorer.EXE
- <SYSTEM32>\ctfmon.exe
большое количество пользовательских процессов.
Завершает или пытается завершить
большое количество пользовательских процессов.
Ищет ветки реестра, отвечающие за хранение паролей сторонними программами:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FTP Commander]
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FTP Commander Deluxe]
- [<HKCU>\Software\FTPWare\CoreFTP\Sites]
- [<HKCU>\Software\Martin Prikryl\WinSCP 2\Sessions]
Изменяет следующие настройки браузера Windows Internet Explorer:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '2500' = '00000003'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '2500' = '00000003'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '2500' = '00000003'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2500' = '00000003'
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Flash Update Client.{2227A280-3AEA-1069-A2DE-08002B30309D}\ifbxqllff.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- %CommonProgramFiles%\Flash Update Client.{2227A280-3AEA-1069-A2DE-08002B30309D}\ifbxqllff.exe
Сетевая активность:
UDP:
- DNS ASK we######ngprotection.info
Другое:
Ищет следующие окна:
- ClassName: 'xyzivwxy' WindowName: 'meqkkome'
- ClassName: 'yyyyyyyy' WindowName: 'eeeeeeee'
- ClassName: 'xdnftxdn' WindowName: 'mewokmew'
- ClassName: 'cyuskqcy' WindowName: 'qeaomeqe'
- ClassName: 'fwzebsvw' WindowName: 'ooqmwoko'
- ClassName: 'bthththt' WindowName: 'wkakakak'
- ClassName: 'uuuuuuuu' WindowName: 'aaaaaaaa'
- ClassName: 'txblnzjf' WindowName: 'kmwewqoo'
- ClassName: 'mmmmmmmm' WindowName: 'qqqqqqqq'
- ClassName: 'rlbbbbbb' WindowName: 'mewwwwww'
- ClassName: 'tglydqva' WindowName: 'kkeeeekw'
- ClassName: 'vjzrptnh' WindowName: 'koqmqkwa'
- ClassName: 'zbrltxfz' WindowName: 'qwmekmoq'
- ClassName: 'Proxy Desktop' WindowName: '(null)'
- ClassName: 'zhxndltb' WindowName: 'qamweekw'
- ClassName: 'oooooooo' WindowName: 'wwwwwwww'
- ClassName: 'znznznzn' WindowName: 'qwqwqwqw'
- ClassName: 'dtphxtph' WindowName: 'ekqamkqa'
- ClassName: 'dgdgdgdg' WindowName: 'ekekekek'
- ClassName: 'rrrrrrrr' WindowName: 'mmmmmmmm'
- ClassName: 'podkzydk' WindowName: 'qwemqeem'
- ClassName: 'zrfjnbbb' WindowName: 'qmoowwww'
- ClassName: 'buzexkpc' WindowName: 'waqmmmqq'
- ClassName: 'jdxztnpr' WindowName: 'oemqkwqm'
- ClassName: 'llllllll' WindowName: 'eeeeeeee'
- ClassName: 'dgpmdgpm' WindowName: 'ekqqekqq'
- ClassName: 'nbvlvlvl' WindowName: 'wwkekeke'
- ClassName: 'hhhhhhhh' WindowName: 'aaaaaaaa'
- ClassName: 'ueayueay' WindowName: 'amweamwe'
- ClassName: 'zzzzzzzz' WindowName: 'qqqqqqqq'
- ClassName: 'pkjgfcxi' WindowName: 'qmokoqmk'
- ClassName: 'rltdhpnh' WindowName: 'mekeaqwa'
- ClassName: 'rqpotkxw' WindowName: 'meqwkmmo'
- ClassName: 'jovuzovu' WindowName: 'owkaqwka'
- ClassName: 'rpvbzxdb' WindowName: 'mqkwqmew'
- ClassName: 'qmeuuuuu' WindowName: 'eqmaaaaa'
- ClassName: 'zolixmjy' WindowName: 'qwekmqoe'
- ClassName: 'gggggggg' WindowName: 'kkkkkkkk'
- ClassName: 'xfrnphfr' WindowName: 'momwqaom'
- ClassName: 'hnzvrbph' WindowName: 'awqkmwqa'
- ClassName: 'pppppppp' WindowName: 'qqqqqqqq'
- ClassName: 'vibapwtk' WindowName: 'kkwwqokm'
- ClassName: 'jhjhjhjh' WindowName: 'oaoaoaoa'
- ClassName: 'Indicator' WindowName: '(null)'
- ClassName: 'vvvvvvvv' WindowName: 'kkkkkkkk'
- ClassName: 'ffffffff' WindowName: 'oooooooo'
- ClassName: 'tttttttt' WindowName: 'kkkkkkkk'
- ClassName: 'yiqgeiqg' WindowName: 'ekekmkek'
- ClassName: 'hcbyxmru' WindowName: 'aqwemqma'
- ClassName: 'bbbbbbbb' WindowName: 'wwwwwwww'
- ClassName: 'xhxhxhxh' WindowName: 'mamamama'
- ClassName: 'drvlllll' WindowName: 'emkeeeee'
- ClassName: 'euowwwww' WindowName: 'mawooooo'
- ClassName: 'tqdutqdu' WindowName: 'keeakeea'
- ClassName: 'bohgvcry' WindowName: 'wwakkqme'
- ClassName: 'blrblrbl' WindowName: 'wemwemwe'
- ClassName: 'vcfuhida' WindowName: 'kqoaakew'
- ClassName: 'dfbxdfbx' WindowName: 'eowmeowm'
- ClassName: 'uwekuwek' WindowName: 'aommaomm'
- ClassName: 'qqqqqqqq' WindowName: 'eeeeeeee'
- ClassName: 'nmbgvwrq' WindowName: 'wqwkkome'
- ClassName: 'bgtgtgtg' WindowName: 'wkkkkkkk'
- ClassName: 'amamamam' WindowName: 'wqwqwqwq'
- ClassName: 'dddddddd' WindowName: 'eeeeeeee'
- ClassName: 'byjuxitw' WindowName: 'weoamkko'
- ClassName: 'kkkkkkkk' WindowName: 'mmmmmmmm'
