Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Computer AutoConfig Internet' = '%APPDATA%\jzheegwcyplqrf\jsbtwdgfypm.exe'
Вредоносные функции:
Создает и запускает на исполнение:
- '%APPDATA%\jzheegwcyplqrf\ntbbywcw.exe' "%APPDATA%\jzheegwcyplqrf\jsbtwdgfypm.exe"
- '%APPDATA%\jzheegwcyplqrf\jsbtwdgfypm.exe'
Изменения в файловой системе:
Создает следующие файлы:
- %APPDATA%\jzheegwcyplqrf\jsbtwdgfypm.yetlo
- %APPDATA%\jzheegwcyplqrf\ntbbywcw.exe
- %APPDATA%\jzheegwcyplqrf\jsbtwdgfypm.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- %APPDATA%\jzheegwcyplqrf\ntbbywcw.exe
- %APPDATA%\jzheegwcyplqrf\jsbtwdgfypm.exe
Сетевая активность:
Подключается к:
- 'ri####bright.net':80
- 'be####explain.net':80
- 'be####bright.net':80
- 'be####inside.net':80
- 'ri####inside.net':80
- 'ri####explain.net':80
- 'de####yinside.net':80
- 'li####bright.net':80
- 'li####inside.net':80
- 'be####instead.net':80
- 'ri####instead.net':80
- 'th###inside.net':80
- 'ch###inside.net':80
- 'wi####instead.net':80
- 'wi####explain.net':80
- 'su####instead.net':80
- 'th###bright.net':80
- 'th####nstead.net':80
- 'ch####nstead.net':80
- 'ch####xplain.net':80
- 'ch###bright.net':80
- 'th####xplain.net':80
- 'de####ybright.net':80
- 're#####rbusiness.net':80
- 'wo####usiness.net':80
- 'wo###appear.net':80
- 'jo####yinstead.net':80
- 're####erappear.net':80
- 're####eranother.net':80
- 'in####seappear.net':80
- 'fo####appear.net':80
- 'wo###manner.net':80
- 'wo####nother.net':80
- 're####ermanner.net':80
- 'de####yinstead.net':80
- 'hu####dinside.net':80
- 'li####instead.net':80
- 'li####explain.net':80
- 'de####yexplain.net':80
- 'jo####yinside.net':80
- 'jo####yexplain.net':80
- 'hu####dinstead.net':80
- 'hu####dexplain.net':80
- 'hu####dbright.net':80
- 'jo####ybright.net':80
TCP:
Запросы HTTP GET:
- http://ri####bright.net/forum/search.php?em###################################
- http://be####explain.net/forum/search.php?em###################################
- http://be####bright.net/forum/search.php?em###################################
- http://be####inside.net/forum/search.php?em###################################
- http://ri####inside.net/forum/search.php?em###################################
- http://ri####explain.net/forum/search.php?em###################################
- http://de####yinside.net/forum/search.php?em###################################
- http://li####bright.net/forum/search.php?em###################################
- http://li####inside.net/forum/search.php?em###################################
- http://be####instead.net/forum/search.php?em###################################
- http://ri####instead.net/forum/search.php?em###################################
- http://th###inside.net/forum/search.php?em###################################
- http://ch###inside.net/forum/search.php?em###################################
- http://wi####instead.net/forum/search.php?em###################################
- http://wi####explain.net/forum/search.php?em###################################
- http://su####instead.net/forum/search.php?em###################################
- http://th###bright.net/forum/search.php?em###################################
- http://th####nstead.net/forum/search.php?em###################################
- http://ch####nstead.net/forum/search.php?em###################################
- http://ch####xplain.net/forum/search.php?em###################################
- http://ch###bright.net/forum/search.php?em###################################
- http://th####xplain.net/forum/search.php?em###################################
- http://de####ybright.net/forum/search.php?em###################################
- http://re#####rbusiness.net/forum/search.php?em###################################
- http://wo####usiness.net/forum/search.php?em###################################
- http://wo###appear.net/forum/search.php?em###################################
- http://jo####yinstead.net/forum/search.php?em###################################
- http://re####erappear.net/forum/search.php?em###################################
- http://re####eranother.net/forum/search.php?em###################################
- http://in####seappear.net/forum/search.php?em###################################
- http://fo####appear.net/forum/search.php?em###################################
- http://wo###manner.net/forum/search.php?em###################################
- http://wo####nother.net/forum/search.php?em###################################
- http://re####ermanner.net/forum/search.php?em###################################
- http://de####yinstead.net/forum/search.php?em###################################
- http://hu####dinside.net/forum/search.php?em###################################
- http://li####instead.net/forum/search.php?em###################################
- http://li####explain.net/forum/search.php?em###################################
- http://de####yexplain.net/forum/search.php?em###################################
- http://jo####yinside.net/forum/search.php?em###################################
- http://jo####yexplain.net/forum/search.php?em###################################
- http://hu####dinstead.net/forum/search.php?em###################################
- http://hu####dexplain.net/forum/search.php?em###################################
- http://hu####dbright.net/forum/search.php?em###################################
- http://jo####ybright.net/forum/search.php?em###################################
UDP:
- DNS ASK ri####bright.net
- DNS ASK be####explain.net
- DNS ASK be####bright.net
- DNS ASK be####inside.net
- DNS ASK ri####inside.net
- DNS ASK ri####explain.net
- DNS ASK de####yinside.net
- DNS ASK li####bright.net
- DNS ASK li####inside.net
- DNS ASK be####instead.net
- DNS ASK ri####instead.net
- DNS ASK ch####nstead.net
- DNS ASK wi####instead.net
- DNS ASK th###inside.net
- DNS ASK su####instead.net
- DNS ASK su####explain.net
- DNS ASK wi####explain.net
- DNS ASK ch###inside.net
- DNS ASK ch####xplain.net
- DNS ASK th####nstead.net
- DNS ASK th####xplain.net
- DNS ASK th###bright.net
- DNS ASK ch###bright.net
- DNS ASK re#####rbusiness.net
- DNS ASK wo####usiness.net
- DNS ASK wo###appear.net
- DNS ASK jo####yinstead.net
- DNS ASK re####erappear.net
- DNS ASK re####eranother.net
- DNS ASK in####seappear.net
- DNS ASK fo####appear.net
- DNS ASK wo###manner.net
- DNS ASK wo####nother.net
- DNS ASK re####ermanner.net
- DNS ASK hu####dinstead.net
- DNS ASK li####instead.net
- DNS ASK de####yinstead.net
- DNS ASK de####yexplain.net
- DNS ASK de####ybright.net
- DNS ASK li####explain.net
- DNS ASK hu####dinside.net
- DNS ASK hu####dexplain.net
- DNS ASK jo####yexplain.net
- DNS ASK jo####ybright.net
- DNS ASK jo####yinside.net
- DNS ASK hu####dbright.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'Indicator' WindowName: ''
