Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Classes\PROTOCOLS\Handler\file] 'CLSID' = '{79eac9e7-baf9-11ce-8c82-00aa004ba90b}'
- [<HKLM>\SOFTWARE\Classes\PROTOCOLS\Handler\local] 'CLSID' = '{79eac9e7-baf9-11ce-8c82-00aa004ba90b}'
- [<HKLM>\SOFTWARE\Classes\PROTOCOLS\Handler\https] 'CLSID' = '{79eac9e5-baf9-11ce-8c82-00aa004ba90b}'
- [<HKLM>\SOFTWARE\Classes\PROTOCOLS\Handler\mk] 'CLSID' = '{79eac9e6-baf9-11ce-8c82-00aa004ba90b}'
- [<HKLM>\SOFTWARE\Classes\PROTOCOLS\Filter\lzdhtml] 'CLSID' = '{8f6b0360-b80d-11d0-a9b3-006097942311}'
- [<HKLM>\SOFTWARE\Classes\PROTOCOLS\Filter\Class Install Handler] 'CLSID' = '{32B533BB-EDAE-11d0-BD5A-00AA00B92AF1}'
- [<HKLM>\SOFTWARE\Classes\PROTOCOLS\Handler\cdl] 'CLSID' = '{3dd53d40-7b8b-11D0-b013-00aa0059ce02}'
- [<HKLM>\SOFTWARE\Classes\PROTOCOLS\Filter\deflate] 'CLSID' = '{8f6b0360-b80d-11d0-a9b3-006097942311}'
- [<HKLM>\SOFTWARE\Classes\PROTOCOLS\Filter\gzip] 'CLSID' = '{8f6b0360-b80d-11d0-a9b3-006097942311}'
- [<HKLM>\SOFTWARE\Classes\PROTOCOLS\Handler\gopher] 'CLSID' = '{79eac9e4-baf9-11ce-8c82-00aa004ba90b}'
- [<HKLM>\SOFTWARE\Classes\PROTOCOLS\Handler\vbscript] 'CLSID' = '{3050F3B2-98B5-11CF-BB82-00AA00BDCE0B}'
- [<HKLM>\SOFTWARE\Classes\PROTOCOLS\Handler\about] 'CLSID' = '{3050F406-98B5-11CF-BB82-00AA00BDCE0B}'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'mgdmx.exe' = '%TEMP%\mgdmx.exe'
- [<HKLM>\SOFTWARE\Classes\PROTOCOLS\Handler\javascript] 'CLSID' = '{3050F3B2-98B5-11CF-BB82-00AA00BDCE0B}'
- [<HKLM>\SOFTWARE\Classes\PROTOCOLS\Handler\res] 'CLSID' = '{3050F3BC-98B5-11CF-BB82-00AA00BDCE0B}'
- [<HKLM>\SOFTWARE\Classes\PROTOCOLS\Handler\http] 'CLSID' = '{79eac9e2-baf9-11ce-8c82-00aa004ba90b}'
- [<HKLM>\SOFTWARE\Classes\PROTOCOLS\Handler\ftp] 'CLSID' = '{79eac9e3-baf9-11ce-8c82-00aa004ba90b}'
- [<HKLM>\SOFTWARE\Classes\PROTOCOLS\Handler\mailto] 'CLSID' = '{3050f3DA-98B5-11CF-BB82-00AA00BDCE0B}'
- [<HKLM>\SOFTWARE\Classes\PROTOCOLS\Handler\sysimage] 'CLSID' = '{76E67A63-06E9-11D2-A840-006008059382}'
Вредоносные функции:
Создает и запускает на исполнение:
- '%TEMP%\svchost.exe' <Имя вируса>.exe
Запускает на исполнение:
- '<SYSTEM32>\regsvr32.exe' Mshtml.dll /s
- '<SYSTEM32>\regsvr32.exe' Urlmon.dll /s
- '<SYSTEM32>\regsvr32.exe' browseui.dll /s
- '<SYSTEM32>\regsvr32.exe' Actxprxy.dll /s
- '<SYSTEM32>\cmd.exe' /c ""%WINDIR%\winsock.bat" "
- '<SYSTEM32>\regsvr32.exe' Shdocvw.dll /s
- '<SYSTEM32>\regsvr32.exe' Oleaut32.dll /s
Завершает или пытается завершить
следующие пользовательские процессы:
- dnf.exe
Изменения в файловой системе:
Создает следующие файлы:
- %WINDIR%2\ХЪ2.bmp
- %WINDIR%2\ХЪ1.bmp
- %WINDIR%2\ХЪ3.bmp
- %WINDIR%2\ХэіЈИЎПы.bmp
- %WINDIR%2\ХЪ4.bmp
- %WINDIR%2\СйЦ¤°ґПВ.bmp
- %WINDIR%2\КЦ»ъБоЕЖ2.bmp
- %WINDIR%2\СйЦ¤µгИј.bmp
- %WINDIR%2\СйЦ¤ХэіЈ.bmp
- %WINDIR%2\СйЦ¤Вл.bmp
- %WINDIR%2\ХэФЪµЗВј.bmp
- %WINDIR%2\¶ЇМ¬6.bmp
- %WINDIR%2\¶ЇМ¬5.bmp
- %TEMP%\RGI2.tmp
- %TEMP%\RGI4.tmp
- %TEMP%\RGI3.tmp
- %WINDIR%2\¶ЇМ¬1.bmp
- %WINDIR%2\НјЖ¬Цч1.bmp
- %WINDIR%2\¶ЇМ¬2.bmp
- %WINDIR%2\¶ЇМ¬4.bmp
- %WINDIR%2\¶ЇМ¬3.bmp
- %WINDIR%2\КЦ»ъБоЕЖ1.bmp
- %WINDIR%2\QQБоЕЖ2.bmp
- %WINDIR%2\QQБоЕЖ1.bmp
- %WINDIR%2\°ґПВИЎПы.bmp
- %WINDIR%2\µЗВј2.bmp
- %WINDIR%2\µЗВј1.bmp
- %WINDIR%\winsock.bat
- %TEMP%\svchost.exe
- %TEMP%\RGI1.tmp
- %WINDIR%2\Т»јьСйЦ¤.bmp
- %WINDIR%2\QQ°ІИ«ЦРРД.bmp
- %WINDIR%2\µЗВј3.bmp
- %WINDIR%2\И·ИПµгИј.bmp
- %WINDIR%2\И·ИП°ґПВ.bmp
- %WINDIR%2\И·ИПХэіЈ.bmp
- %WINDIR%2\КЦ»ъ¶МРЕ2.bmp
- %WINDIR%2\КЦ»ъ¶МРЕ1.bmp
- %WINDIR%2\µгИјИЎПы.bmp
- %WINDIR%2\µЧНјНёГч.bmp
- %WINDIR%2\ЅбКш.bmp
- %WINDIR%2\ДЪНјЖ¬.bmp
- %WINDIR%2\ГЬВлґнОу.bmp
Удаляет следующие файлы:
- %TEMP%\RGI3.tmp
- %TEMP%\RGI4.tmp
- %TEMP%\RGI1.tmp
- %TEMP%\RGI2.tmp
Самоперемещается:
- из <Полный путь к вирусу> в %TEMP%\mgdmx.exe
Сетевая активность:
Подключается к:
- '11#.#0.189.76':999
- '12#.#25.114.144':80
TCP:
Запросы HTTP GET:
- 12#.#25.114.144/album/s%3D900%3Bq%3D90/sign=a4812aab542c11dfdad1b323531c13ed/8cb1cb13495409231b0c8e369158d109b3de4915.jpg
- 12#.#25.114.144/album/s%3D1600%3Bq%3D90/sign=33668a1ed3160924d825a61de4370e8b/3b87e950352ac65c95a38b3bf8f2b21192138ad0.jpg
- 12#.#25.114.144/album/s%3D1600%3Bq%3D90/sign=e40b2e7b708da9774a2f822d8061c368/d4628535e5dde7113e74aebea4efce1b9c1661d0.jpg
- 12#.#25.114.144/album/s%3D1600%3Bq%3D90/sign=4688ab8881025aafd7327acdcbdd9015/b3b7d0a20cf431ad5c74ae714836acaf2fdd98d0.jpg
- 12#.#25.114.144/album/s%3D1600%3Bq%3D90/sign=942b53acb01c8701d2b6b6e0174fa55e/b58f8c5494eef01f8071f58de3fe9925bc317d15.jpg
- 12#.#25.114.144/album/s%3D1600%3Bq%3D90/sign=9fe4d75c41a7d933bba8e0759d7bea62/64380cd7912397dd3113754c5a82b2b7d0a28714.jpg
- 12#.#25.114.144/album/s%3D1600%3Bq%3D90/sign=d4f61569718b4710ca2ff9caf3fef88c/6a63f6246b600c33e9133380194c510fd9f9a114.jpg
- 12#.#25.114.144/album/s%3D1600%3Bq%3D90/sign=182fe16ab01bb0518b24b72e064ae1c5/e61190ef76c6a7ef7f43456efefaaf51f3de6615.jpg
- 12#.#25.114.144/album/s%3D1600%3Bq%3D90/sign=cd180920cfbf6c81f33728ee8c0e8a44/a8ec8a13632762d0a69949f7a3ec08fa503dc6d7.jpg
- 12#.#25.114.144/album/s%3D1600%3Bq%3D90/sign=9eabddf784d6277fed12363e18082441/f11f3a292df5e0fe808fc04d5f6034a85fdf72e2.jpg
- 12#.#25.114.144/album/s%3D1600%3Bq%3D90/sign=2dee7e7478f40ad111e4c3e5671c2aae/574e9258d109b3debb17ad24cfbf6c81810a4cd5.jpg
- 12#.#25.114.144/album/s%3D1600%3Bq%3D90/sign=48802d73daf9d72a1364141be41a1345/d788d43f8794a4c22fd2ae670df41bd5ac6e398c.jpg
- 12#.#25.114.144/album/s%3D1600%3Bq%3D90/sign=494c8eaf542c11dfdad1bb25531759a1/9d82d158ccbf6c81ab9f65a4bf3eb13532fa40d5.jpg
- 12#.#25.114.144/album/s%3D1600%3Bq%3D90/sign=51cd7f337bf0f736dcfe48073a658868/adaf2edda3cc7cd977b97d953a01213fb90e91e2.jpg
- 12#.#25.114.144/album/s%3D1000%3Bq%3D90/sign=fd4570abfe1f4134e437017e152faebb/58ee3d6d55fbb2fb184db55a4c4a20a44623dc10.jpg
- 12#.#25.114.144/album/s%3D1000%3Bq%3D90/sign=efaf482a9b22720e7fcee6fa4bfb3137/c83d70cf3bc79f3d1e840978b9a1cd11728b2915.jpg
- 12#.#25.114.144/album/s%3D1600%3Bq%3D90/sign=201d1ea5f1d3572c62e298daba235856/b2de9c82d158ccbf464dfc761ad8bc3eb035418c.jpg
- 12#.#25.114.144/album/s%3D1600%3Bq%3D90/sign=569fad48b1b7d0a27fc9009bfbdf4d78/83025aafa40f4bfb00465fae004f78f0f63618b2.jpg
- 12#.#25.114.144/album/s%3D1600%3Bq%3D90/sign=1754eeabd639b60049ce0bb1d9600e5b/38dbb6fd5266d0160bbe7360942bd40734fa35d6.jpg
- 12#.#25.114.144/album/s%3D1600%3Bq%3D90/sign=0f165f79a28b87d65442af1937381349/95eef01f3a292df55cf4415dbf315c6034a87347.jpg
- 12#.#25.114.144/album/s%3D1600%3Bq%3D90/sign=4dce6f3d40a98226bcc12f21bab28270/b90e7bec54e736d18924614098504fc2d5626947.jpg
- 12#.#25.114.144/album/s%3D1600%3Bq%3D90/sign=1b3091423adbb6fd215be12039149069/d439b6003af33a87a3ba25a3c55c10385243b5b7.jpg
- 12#.#25.114.144/album/s%3D1600%3Bq%3D90/sign=7028aa760ff3d7ca08f63b70c22f8578/3ac79f3df8dcd10052ab1569718b4710b9122f47.jpg
- 12#.#25.114.144/album/s%3D1600%3Bq%3D90/sign=f46920a4d200baa1be2c43bd77208263/0b46f21fbe096b639d70b3180f338744ebf8ac09.jpg
- 12#.#25.114.144/album/s%3D1600%3Bq%3D90/sign=21c4bb1d2c2eb938e86d7ef4e552be44/8b82b9014a90f60306ae24bb3a12b31bb051ed34.jpg
- 12#.#25.114.144/album/s%3D1600%3Bq%3D90/sign=8ca4f6a5a0cc7cd9fe2d30df09311a4e/aec379310a55b319cbcf6f3d40a98226cffc1747.jpg
- 12#.#25.114.144/album/s%3D1600%3Bq%3D90/sign=4a3910edd243ad4ba22e42c6b23261de/96dda144ad34598221bd08da0ff431adcbef8447.jpg
- 12#.#25.114.144/album/s%3D1600%3Bq%3D90/sign=02c1e1a3b5fd5266a32b38129b28ac5a/b7003af33a87e950b6201e2413385343fbf2b447.jpg
- 12#.#25.114.144/album/s%3D1600%3Bq%3D90/sign=0632607678ec54e745ec1e188908a021/8326cffc1e178a829e0c92e8f503738da977e842.jpg
- 12#.#25.114.144/album/s%3D1600%3Bq%3D90/sign=a07312f866380cd7e21ea6eb91749645/43a7d933c895d143bd46096b70f082025aaf0741.jpg
- 12#.#25.114.144/album/s%3D1600%3Bq%3D90/sign=e5355d4de6dde711e3d247f097dff56a/3812b31bb051f819b64fee02d9b44aed2e73e714.jpg
- 12#.#25.114.144/album/s%3D1600%3Bq%3D90/sign=7eeaeea92c2eb938e86d7ef4e552be44/8b82b9014a90f6035980710f3a12b31bb051ed42.jpg
- 12#.#25.114.144/album/s%3D1600%3Bq%3D90/sign=b30de28b3987e9504617f76a20086832/d1160924ab18972bd10aed82e5cd7b899e510a41.jpg
- 12#.#25.114.144/album/s%3D1600%3Bq%3D90/sign=fc6f83cdcaea15ce45eee40f86300182/dcc451da81cb39db49a98a1ed3160924ab183009.jpg
- 12#.#25.114.144/album/s%3D1600%3Bq%3D90/sign=73103380194c510faac4e61c50691e5c/fd039245d688d43f73c07cba7e1ed21b0ef43b09.jpg
- 12#.#25.114.144/album/s%3D1600%3Bq%3D90/sign=d2eed2808518367aa9897bdb1e43b0a5/a6efce1b9d16fdfacdeed947b78f8c5495ee7b9c.jpg
- 12#.#25.114.144/album/s%3D1600%3Bq%3D90/sign=f917456efefaaf5180e385b9bc64af9f/4bed2e738bd4b31cb00d79f384d6277f9e2ff841.jpg
UDP:
- DNS ASK c.#####otos.baidu.com
- DNS ASK e.#####otos.baidu.com
- DNS ASK b.#####otos.baidu.com
- DNS ASK h.#####otos.baidu.com
- DNS ASK f.#####otos.baidu.com
- DNS ASK a.#####otos.baidu.com
- DNS ASK g.#####otos.baidu.com
- DNS ASK d.#####otos.baidu.com
Другое:
Ищет следующие окна:
- ClassName: 'Indicator' WindowName: ''
