Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'wins' = '"%TEMP%\RarSFX0\TryNOD.exe" -tray'
- [<HKLM>\SOFTWARE\Classes\wins\shell\open\command] '' = '"%TEMP%\RarSFX0\TryNOD.exe" "%1"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'TryNOD' = '%TEMP%\RarSFX0\TryNOD.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'TryNOD' = '%TEMP%\RarSFX0\TryNOD.exe'
Вредоносные функции:
Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%TEMP%\RarSFX0\TryNOD.exe' = '%TEMP%\RarSFX0\TryNOD.exe:*:Enabled:wins'
Создает и запускает на исполнение:
- '%TEMP%\TryNOD32.exe'
- '%TEMP%\RarSFX0\TryNOD.exe'
- '%TEMP%\·sјWёк®Ж§Ё\o.exe'
- '%TEMP%\d.exe'
Запускает на исполнение:
- '<SYSTEM32>\wscript.exe' "%TEMP%\RarSFX0\TryNOD.vbs"
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\RarSFX0\Conf\Addresses.cfg
- %TEMP%\RarSFX0\TryNOD.vbs
- %TEMP%\RarSFX0\foxyinstalled.dll
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\trynod32[1]
- %TEMP%\RarSFX0\LinkMaker.dll
- %TEMP%\FP2.tmp
- %TEMP%\·sјWёк®Ж§Ё\o.exe
- %TEMP%\d.exe
- %TEMP%\RarSFX0\TryNOD.exe
- %TEMP%\TryNOD32.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- %TEMP%\RarSFX0\foxyinstalled.dll
- %TEMP%\RarSFX0\LinkMaker.dll
- %TEMP%\RarSFX0\Conf\Addresses.cfg
- %TEMP%\RarSFX0\TryNOD.exe
- %TEMP%\RarSFX0\TryNOD.vbs
Удаляет следующие файлы:
- %TEMP%\RarSFX0\TryNOD.exe
- %TEMP%\RarSFX0\LinkMaker.dll
- %TEMP%\RarSFX0\foxyinstalled.dll
Сетевая активность:
Подключается к:
- '22#.#29.92.142':18258
- '1.###.223.11':6585
- '11#.#55.15.143':4534
- '1.###.166.62':4389
- '11#.#3.14.81':3319
- '12#.#02.187.85':6979
- '12#.#02.131.88':17323
- '11#.#2.118.161':8752
- 'gw#.#blinx.com':2108
- '11#.#0.149.214':21026
- '11#.#46.50.207':21819
- '11#.#7.147.173':15153
- '61.##.197.33':21819
- '22#.#42.140.133':20082
- '1.###.127.27':8540
- '22#.#67.239.216':16848
- '36.##9.76.183':12017
- '11#.#55.220.108':5350
- '11#.#70.156.52':20927
- '14.##8.197.131':5944
- '22#.#42.226.191':17102
- '11#.#42.156.197':15468
- '11#.#3.216.17':3001
- '58.##6.119.39':18335
- '1.###.136.248':16216
- 'www.tr###d32.com':80
- 'localhost':1039
- '36.##9.175.56':9890
- 'localhost':1044
- '1.###.176.150':14539
- '12#.#2.53.227':7008
- '22#.#36.235.65':19289
- '20#.#98.235.209':6031
- '42.#.131.66':23901
- '59.##9.183.180':9824
- '21#.#5.149.130':9523
- '1.###.107.134':4262
- 'tw.####on.iblinx.com':2107
- 'up####.iblinx.com':2106
TCP:
Запросы HTTP GET:
- www.tr###d32.com/
UDP:
- DNS ASK ku##er.com
- DNS ASK gw#.#blinx.com
- DNS ASK tw.####on.iblinx.com
- DNS ASK www.tr###d32.com
- DNS ASK up####.iblinx.com
- '12#.#40.185.46':9849
- '1.##1.57.37':4999
- '59.##2.156.206':6713
- '58.##5.91.227':22739
- '61.##6.153.250':2691
- '11#.#0.176.22':24745
- '61.##4.12.89':10531
- '18#.#78.254.162':8906
- '12#.#30.148.8':10885
- '59.##4.20.209':5347
- '11#.#8.240.202':8135
- '21#.#6.95.215':15224
- '22#.#32.55.122':22203
- '11#.#7.201.191':19560
- '18#.#3.57.179':15963
- '1.##.232.246':18724
- '11#.#46.50.207':21819
- '59.##9.189.18':12687
- '59.##8.113.145':2873
- '18#.#10.38.172':2873
- '21#.#02.212.102':5990
- '12#.#28.43.152':10212
- '61.##.24.100':8479
- '21#.#5.247.103':18638
- '1.###.118.138':14940
- '36.##8.133.58':3816
- '1.##.12.36':11839
- '11#.#51.90.176':18241
- '11#.#7.211.160':7477
- '14.##9.9.156':8598
- '42.#.53.195':2946
- '11#.#43.39.4':7572
- '11#.#47.64.116':10561
- '11#.#42.106.252':9374
- '1.###.235.134':3164
- '11#.#70.219.237':3209
- '22#.#67.44.101':9987
- '61.##7.237.99':7234
- '12#.#41.34.89':9461
- '11#.#2.118.161':8752
- '22#.#29.92.142':18258
- '42.#8.44.93':5109
- '11#.#55.19.176':2637
- '1.###.127.27':8540
- '1.###.234.72':8124
- '36.##1.215.233':16303
- '1.##5.4.105':8816
- '42.##.141.150':7327
- '22#.#29.81.36':9533
- '1.###.192.240':4721
- '1.###.229.179':22590
- '12#.#02.54.81':1050
- '11#.#55.15.143':4534
- '11#.#54.112.120':17440
- '1.###.133.16':4560
- '11#.#40.36.200':18078
- '11#.#52.151.142':55557
- '14.##6.162.44':21819
- '14.##8.197.131':5944
- '42.#.168.217':4437
- '61.##1.154.2':15729
- '61.##.162.134':17436
- '21#.#73.48.36':2787
- '11#.#53.125.95':16075
- '1.##.4.135':4369
- '16#.#0.124.103':7804
- '42.#.131.66':23901
- '11#.#0.218.184':12222
- '11#.#3.14.81':3319
- '11#.#67.21.205':5074
- '11#.#4.100.198':2943
- '11#.#5.46.199':11026
- '11#.#18.148.63':11801
- '59.##9.223.126':16237
- '1.###.176.150':14539
- '11#.#1.52.211':7846
- '11#.#70.70.10':8627
- '61.#8.52.91':11975
- '22#.#67.239.216':16848
- '61.##.197.33':21819
- '11#.#7.147.173':15153
- '59.##7.195.182':7504
- '11#.#3.51.61':20807
- '36.##9.76.183':12017
- '11#.#63.200.94':23303
- '11#.#50.191.147':10723
- '12#.#24.5.102':2573
- '61.##3.0.111':9390
- '59.##9.183.180':9824
- '36.##9.188.82':7221
- '14#.#13.49.10':12847
- '11#.#7.172.108':11744
- '12#.#21.204.195':23561
- '12#.#04.129.221':19438
- '36.##9.166.98':4784
- '11#.#70.77.11':4296
- '11#.#4.20.203':14520
- '11#.#55.152.177':11581
- '11#.#70.156.52':20927
- '61.##7.203.200':22711
- '11#.#54.120.208':11849
- '12#.#2.53.227':7008
- '21#.#0.143.163':19271
- '11#.#4.174.206':8625
- '1.##4.2.72':9360
- '11#.#2.174.66':3875
- '1.###.22.176':21888
- '1.##.169.66':21819
- '11#.#19.8.169':24138
- '11#.#51.196.210':11191
- '11#.#47.213.236':9725
- '61.##1.27.34':19445
- '61.##1.99.231':5394
- '59.##6.107.122':8618
- '12#.#02.57.193':10743
- '12#.#95.109.46':4374
- '1.###.186.197':10631
- '1.###.18.165':4060
- '61.##.50.127':4022
- '12#.#95.123.193':8468
- '22#.#42.226.26':7333
- '1.###.211.130':20541
- '11#.#8.136.229':14058
- '18#.#78.166.206':21819
- '22#.#42.140.133':20082
- '22#.#41.129.34':15421
- '20#.#19.143.47':21819
- '36.##1.93.248':11975
- '11#.#55.220.108':5350
- 'localhost':1061
- 'localhost':1060
- '23#.#55.255.250':1900
- '21#.#66.197.241':10326
- '12#.#30.3.229':8184
- '11#.#49.70.33':21819
- '1.###.223.11':6585
- '11#.#53.80.99':6058
- '11#.#60.44.213':4130
- '1.###.205.140':3653
- '22#.#37.160.253':17473
- '12#.#18.32.181':3295
- '11#.#41.244.69':3164
- '21#.#4.228.88':19837
- '11#.#48.137.89':2798
- '69.##2.97.104':19036
- '12#.#44.135.35':3515
- '1.###.247.42':19252
- '1.###.81.206':22038
- '61.##1.17.30':5603
- '12#.#.67.200':24589
- '1.###.128.206':16501
- '21#.#64.204.131':8658
- '11#.#4.173.217':9327
- '11#.#40.22.84':24063
- '12#.#44.150.152':21821
- '36.##4.90.90':5418
- '1.##.223.158':21819
- '11#.#52.169.231':17600
- '12#.#30.173.14':9715
- '11#.#0.149.214':21026
- '20#.#98.235.209':6031
- '17#.#81.142.164':4444
- '11#.#4.119.141':8700
- '18#.#18.110.121':10399
- '12#.#02.187.85':6979
- '21#.#87.31.22':23519
- '11#.#31.82.33':22904
- '11#.#05.206.75':6665
- '12#.#.231.181':17983
- '22#.#36.235.65':19289
- '1.###.212.60':12347
- '1.###.159.57':4020
- '42.#.172.15':11649
- '11#.#8.52.196':19097
- '11#.#46.85.212':2838
- '27.#47.3.87':14771
- '12#.#02.131.88':17323
- '12#.#6.58.238':9969
- '1.###.224.49':5809
- '12#.#44.16.7':14606
- '21#.#64.89.107':20719
- '12#.#03.157.196':5732
- '21#.#6.62.200':8054
- '11#.#47.106.229':21819
- '11#.#43.181.36':13062
- '11#.#4.117.140':15222
- '11#.#7.147.101':13822
- '1.###.166.62':4389
- '22#.#42.129.181':11327
- '42.#.110.15':16005
- '12#.#10.158.156':5291
- '61.##1.0.241':11785
- '21#.#8.97.121':4990
- '11#.#8.156.229':9070
- '12#.#40.46.244':17219
- '21#.#.162.225':2873
Другое:
Ищет следующие окна:
- ClassName: 'MS_AutodialMonitor' WindowName: '(null)'
- ClassName: 'MS_WebcheckMonitor' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'EDIT' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'Indicator' WindowName: '(null)'
