Техническая информация
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\find.exe' /C /I "s12.sfgame.cz" <DRIVERS>\etc\hosts
- '<SYSTEM32>\find.exe' /C /I "s11.sfgame.cz" <DRIVERS>\etc\hosts
- '<SYSTEM32>\find.exe' /C /I "s10.sfgame.cz" <DRIVERS>\etc\hosts
- '<SYSTEM32>\find.exe' /C /I "s13.sfgame.cz" <DRIVERS>\etc\hosts
- '<SYSTEM32>\find.exe' /C /I "s16.sfgame.cz" <DRIVERS>\etc\hosts
- '<SYSTEM32>\find.exe' /C /I "s15.sfgame.cz" <DRIVERS>\etc\hosts
- '<SYSTEM32>\find.exe' /C /I "s14.sfgame.cz" <DRIVERS>\etc\hosts
- '<SYSTEM32>\find.exe' /C /I "s9.sfgame.cz" <DRIVERS>\etc\hosts
- '<SYSTEM32>\find.exe' /C /I "s4.sfgame.cz" <DRIVERS>\etc\hosts
- '<SYSTEM32>\find.exe' /C /I "s3.sfgame.cz" <DRIVERS>\etc\hosts
- '<SYSTEM32>\find.exe' /C /I "s2.sfgame.cz" <DRIVERS>\etc\hosts
- '<SYSTEM32>\find.exe' /C /I "s5.sfgame.cz" <DRIVERS>\etc\hosts
- '<SYSTEM32>\find.exe' /C /I "s8.sfgame.cz" <DRIVERS>\etc\hosts
- '<SYSTEM32>\find.exe' /C /I "s7.sfgame.cz" <DRIVERS>\etc\hosts
- '<SYSTEM32>\find.exe' /C /I "s6.sfgame.cz" <DRIVERS>\etc\hosts
- '<SYSTEM32>\find.exe' /C /I "s17.sfgame.cz" <DRIVERS>\etc\hosts
- '<SYSTEM32>\find.exe' /C /I "*.*" <DRIVERS>\etc\hosts
- '<SYSTEM32>\find.exe' /C /I "twitter.com" <DRIVERS>\etc\hosts
- '<SYSTEM32>\find.exe' /C /I "ulozto.cz" <DRIVERS>\etc\hosts
- '<SYSTEM32>\attrib.exe' +r <DRIVERS>\etc\hosts
- '<SYSTEM32>\taskkill.exe' /f /im chrome.exe
- '<SYSTEM32>\taskkill.exe' /f /im explorer.exe
- '<SYSTEM32>\taskkill.exe' /f /im Skype.exe
- '<SYSTEM32>\find.exe' /C /I "s25.sfgame.cz" <DRIVERS>\etc\hosts
- '<SYSTEM32>\find.exe' /C /I "s20.sfgame.cz" <DRIVERS>\etc\hosts
- '<SYSTEM32>\find.exe' /C /I "s19.sfgame.cz" <DRIVERS>\etc\hosts
- '<SYSTEM32>\find.exe' /C /I "s18.sfgame.cz" <DRIVERS>\etc\hosts
- '<SYSTEM32>\find.exe' /C /I "s21.sfgame.cz" <DRIVERS>\etc\hosts
- '<SYSTEM32>\find.exe' /C /I "s24.sfgame.cz" <DRIVERS>\etc\hosts
- '<SYSTEM32>\find.exe' /C /I "s23.sfgame.cz" <DRIVERS>\etc\hosts
- '<SYSTEM32>\find.exe' /C /I "s22.sfgame.cz" <DRIVERS>\etc\hosts
- '<SYSTEM32>\find.exe' /C /I "s1.sfgame.cz" <DRIVERS>\etc\hosts
- '<SYSTEM32>\find.exe' /C /I "kaspersky.com" <DRIVERS>\etc\hosts
- '<SYSTEM32>\find.exe' /C /I "avg.com" <DRIVERS>\etc\hosts
- '<SYSTEM32>\find.exe' /C /I "gmail.com" <DRIVERS>\etc\hosts
- '<SYSTEM32>\find.exe' /C /I "eset.com" <DRIVERS>\etc\hosts
- '<SYSTEM32>\find.exe' /C /I "viry.cz" <DRIVERS>\etc\hosts
- '<SYSTEM32>\find.exe' /C /I "uloz.to" <DRIVERS>\etc\hosts
- '<SYSTEM32>\find.exe' /C /I "surfright.nl" <DRIVERS>\etc\hosts
- '<SYSTEM32>\find.exe' /C /I "avast.com" <DRIVERS>\etc\hosts
- '<SYSTEM32>\find.exe' /C /I "google.cz" <DRIVERS>\etc\hosts
- '<SYSTEM32>\attrib.exe' -r <DRIVERS>\etc\hosts
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\1.tmp\eeewew.bat""
- '<SYSTEM32>\find.exe' /C /I "youtube.com" <DRIVERS>\etc\hosts
- '<SYSTEM32>\find.exe' /C /I "malwarebytes.org" <DRIVERS>\etc\hosts
- '<SYSTEM32>\find.exe' /C /I "seznam.cz" <DRIVERS>\etc\hosts
- '<SYSTEM32>\find.exe' /C /I "facebook.com" <DRIVERS>\etc\hosts
- '<SYSTEM32>\find.exe' /C /I "norton.com" <DRIVERS>\etc\hosts
- '<SYSTEM32>\find.exe' /C /I "pornuj.cz" <DRIVERS>\etc\hosts
- '<SYSTEM32>\find.exe' /C /I "redtube.com" <DRIVERS>\etc\hosts
- '<SYSTEM32>\find.exe' /C /I "wikipedia.org" <DRIVERS>\etc\hosts
- '<SYSTEM32>\find.exe' /C /I "youporn.com" <DRIVERS>\etc\hosts
- '<SYSTEM32>\find.exe' /C /I "sfgame.cz" <DRIVERS>\etc\hosts
- '<SYSTEM32>\find.exe' /C /I "stream.cz" <DRIVERS>\etc\hosts
- '<SYSTEM32>\find.exe' /C /I "brazzers.com" <DRIVERS>\etc\hosts
- '<SYSTEM32>\find.exe' /C /I "avira.com" <DRIVERS>\etc\hosts
- '<SYSTEM32>\find.exe' /C /I "iobit.com" <DRIVERS>\etc\hosts
- '<SYSTEM32>\find.exe' /C /I "slunecnice.cz" <DRIVERS>\etc\hosts
- '<SYSTEM32>\find.exe' /C /I "stahuj.centrum.cz" <DRIVERS>\etc\hosts
- '<SYSTEM32>\find.exe' /C /I "filehippo.com" <DRIVERS>\etc\hosts
- '<SYSTEM32>\find.exe' /C /I "bleepingcomputer.com" <DRIVERS>\etc\hosts
- '<SYSTEM32>\find.exe' /C /I "softonic.com" <DRIVERS>\etc\hosts
- '<SYSTEM32>\find.exe' /C /I "download.cnet.com" <DRIVERS>\etc\hosts
Завершает или пытается завершить
следующие системные процессы:
- %WINDIR%\Explorer.EXE
следующие пользовательские процессы:
- chrome.exe
- skype.exe
Изменения в файловой системе:
Создает следующие файлы:
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\nobrain[1]
- %TEMP%\1.tmp\eeewew.bat
Изменяет файл HOSTS.
Сетевая активность:
Подключается к:
- 'www.no##ain.dk':80
- 'www.na####al.homo.com':80
- 'localhost':1038
TCP:
Запросы HTTP GET:
- www.no##ain.dk/
UDP:
- DNS ASK www.no##ain.dk
- DNS ASK www.na####al.homo.com
Другое:
Ищет следующие окна:
- ClassName: 'MS_AutodialMonitor' WindowName: '(null)'
- ClassName: 'MS_WebcheckMonitor' WindowName: '(null)'
- ClassName: '(null)' WindowName: '(null)'
- ClassName: '' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'IEFrame' WindowName: '(null)'
