Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Intelligent Profile PNRP Play' = '%APPDATA%\kwnsvhzvwcrmvm\ugaodvqsuuug.exe'
Вредоносные функции:
Создает и запускает на исполнение:
- '%APPDATA%\kwnsvhzvwcrmvm\jnfycylakbfb.exe' "%APPDATA%\kwnsvhzvwcrmvm\ugaodvqsuuug.exe"
- '%APPDATA%\kwnsvhzvwcrmvm\ugaodvqsuuug.exe'
Запускает на исполнение:
- '<SYSTEM32>\wbem\wmiadap.exe' /R /T
Изменения в файловой системе:
Создает следующие файлы:
- %APPDATA%\kwnsvhzvwcrmvm\ugaodvqsuuug.ii1
- %APPDATA%\kwnsvhzvwcrmvm\jnfycylakbfb.exe
- %APPDATA%\kwnsvhzvwcrmvm\ugaodvqsuuug.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- %APPDATA%\kwnsvhzvwcrmvm\jnfycylakbfb.exe
- %APPDATA%\kwnsvhzvwcrmvm\ugaodvqsuuug.exe
Удаляет следующие файлы:
- <SYSTEM32>\PerfStringBackup.TMP
- <SYSTEM32>\wbem\Performance\WmiApRpl.ini
Сетевая активность:
Подключается к:
- 'th####ifference.net':80
- 'pr####tcharge.net':80
- 'th###every.net':80
- 'pr#####difference.net':80
- 'th###charge.net':80
- 'cl####owever.net':80
- 'th####owever.net':80
- 'pr####tsingle.net':80
- 'th###single.net':80
- 'co#####difference.net':80
- 'ch####ifference.net':80
- 'co####eevery.net':80
- 'ch###every.net':80
- 'co####echarge.net':80
- 'ch###single.net':80
- 'pr####tevery.net':80
- 'ch###charge.net':80
- 'co####esingle.net':80
- 'cl###period.net':80
- 'we####rchoose.net':80
- 'am####choose.net':80
- 'we####ralthough.net':80
- 'am####although.net':80
- 'hi####yhowever.net':80
- 'st####eperiod.net':80
- 'hi####yalthough.net':80
- 'st####ehowever.net':80
- 'hi####yperiod.net':80
- 'th####lthough.net':80
- 'cl###choose.net':80
- 'th###period.net':80
- 'cl####lthough.net':80
- 'th###choose.net':80
- 'we####rperiod.net':80
- 'am####period.net':80
- 'we####rhowever.net':80
- 'am####however.net':80
TCP:
Запросы HTTP GET:
- th####ifference.net/forum/search.php?em######################################
- pr####tcharge.net/forum/search.php?em######################################
- th###every.net/forum/search.php?em######################################
- pr#####difference.net/forum/search.php?em######################################
- th###charge.net/forum/search.php?em######################################
- cl####owever.net/forum/search.php?em######################################
- th####owever.net/forum/search.php?em######################################
- pr####tsingle.net/forum/search.php?em######################################
- th###single.net/forum/search.php?em######################################
- co#####difference.net/forum/search.php?em######################################
- ch####ifference.net/forum/search.php?em######################################
- co####eevery.net/forum/search.php?em######################################
- ch###every.net/forum/search.php?em######################################
- co####echarge.net/forum/search.php?em######################################
- ch###single.net/forum/search.php?em######################################
- pr####tevery.net/forum/search.php?em######################################
- ch###charge.net/forum/search.php?em######################################
- co####esingle.net/forum/search.php?em######################################
- cl###period.net/forum/search.php?em######################################
- we####rchoose.net/forum/search.php?em######################################
- am####choose.net/forum/search.php?em######################################
- we####ralthough.net/forum/search.php?em######################################
- am####although.net/forum/search.php?em######################################
- hi####yhowever.net/forum/search.php?em######################################
- st####eperiod.net/forum/search.php?em######################################
- hi####yalthough.net/forum/search.php?em######################################
- st####ehowever.net/forum/search.php?em######################################
- hi####yperiod.net/forum/search.php?em######################################
- th####lthough.net/forum/search.php?em######################################
- cl###choose.net/forum/search.php?em######################################
- th###period.net/forum/search.php?em######################################
- cl####lthough.net/forum/search.php?em######################################
- th###choose.net/forum/search.php?em######################################
- we####rperiod.net/forum/search.php?em######################################
- am####period.net/forum/search.php?em######################################
- we####rhowever.net/forum/search.php?em######################################
- am####however.net/forum/search.php?em######################################
UDP:
- DNS ASK th####ifference.net
- DNS ASK pr####tcharge.net
- DNS ASK th###every.net
- DNS ASK pr#####difference.net
- DNS ASK th###charge.net
- DNS ASK cl####owever.net
- DNS ASK th####owever.net
- DNS ASK pr####tsingle.net
- DNS ASK th###single.net
- DNS ASK pr####tevery.net
- DNS ASK ch###every.net
- DNS ASK co#####difference.net
- DNS ASK of###single.net
- DNS ASK co####eevery.net
- DNS ASK ch####ifference.net
- DNS ASK co####esingle.net
- DNS ASK ch###single.net
- DNS ASK co####echarge.net
- DNS ASK ch###charge.net
- DNS ASK we####rchoose.net
- DNS ASK am####choose.net
- DNS ASK we####ralthough.net
- DNS ASK am####although.net
- DNS ASK hi####yhowever.net
- DNS ASK st####eperiod.net
- DNS ASK hi####yalthough.net
- DNS ASK st####ehowever.net
- DNS ASK hi####yperiod.net
- DNS ASK am####period.net
- DNS ASK cl####lthough.net
- DNS ASK th####lthough.net
- DNS ASK cl###period.net
- DNS ASK th###period.net
- DNS ASK cl###choose.net
- DNS ASK am####however.net
- DNS ASK we####rperiod.net
- DNS ASK th###choose.net
- DNS ASK we####rhowever.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'Indicator' WindowName: ''
