Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'User Wired COM Power Link-Layer' = 'C:\oosoiqjluze\ddqsixguwpn.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Error Wired Extensible IP Plug] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- 'C:\oosoiqjluze\mkklmdntbii.exe' "c:\oosoiqjluze\ddqsixguwpn.exe"
- 'C:\oosoiqjluze\ddqsixguwpn.exe'
- 'C:\oosoiqjluze\eh3n2resschaz5bbmn.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\oosoiqjluze\ddqsixguwpn.exe
- C:\oosoiqjluze\mkklmdntbii.exe
- C:\oosoiqjluze\my3xjcvwvaz4
- %WINDIR%\oosoiqjluze\ousezylsg3
- C:\oosoiqjluze\ousezylsg3
- C:\oosoiqjluze\eh3n2resschaz5bbmn.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\oosoiqjluze\mkklmdntbii.exe
- C:\oosoiqjluze\ddqsixguwpn.exe
Удаляет следующие файлы:
- C:\oosoiqjluze\eh3n2resschaz5bbmn.exe
- %WINDIR%\oosoiqjluze\ousezylsg3
Сетевая активность:
Подключается к:
- 'ga####eearly.net':80
- 'be####eearly.net':80
- 'be####public.net':80
- 'be###rdress.net':80
- 'ga####public.net':80
- 'st###tdress.net':80
- 'tr###public.net':80
- 'tr###dress.net':80
- 'ga###rcatch.net':80
- 'be###rcatch.net':80
- 'br###public.net':80
- 'fl###public.net':80
- 'fl###dress.net':80
- 'qu###catch.net':80
- 'br###dress.net':80
- 'fl###catch.net':80
- 'ga###rdress.net':80
- 'br###catch.net':80
- 'br###eearly.net':80
- 'fl###eearly.net':80
- 'ca####ndress.net':80
- 'la###dress.net':80
- 're###dcatch.net':80
- 're####eearly.net':80
- 'el####iccatch.net':80
- 'la###eearly.net':80
- 'ca####ncatch.net':80
- 'ca####neearly.net':80
- 'ca####npublic.net':80
- 'la###public.net':80
- 'tr###catch.net':80
- 'st###tcatch.net':80
- 'st####eearly.net':80
- 'st####public.net':80
- 'tr###eearly.net':80
- 're####public.net':80
- 'el####iceearly.net':80
- 'el####icpublic.net':80
- 'el####icdress.net':80
- 're###ddress.net':80
TCP:
Запросы HTTP GET:
- http://ga####eearly.net/index.php?me########
- http://be####eearly.net/index.php?me########
- http://be####public.net/index.php?me########
- http://be###rdress.net/index.php?me########
- http://ga####public.net/index.php?me########
- http://st###tdress.net/index.php?me########
- http://tr###public.net/index.php?me########
- http://tr###dress.net/index.php?me########
- http://ga###rcatch.net/index.php?me########
- http://be###rcatch.net/index.php?me########
- http://br###public.net/index.php?me########
- http://fl###public.net/index.php?me########
- http://fl###dress.net/index.php?me########
- http://qu###catch.net/index.php?me########
- http://br###dress.net/index.php?me########
- http://fl###catch.net/index.php?me########
- http://ga###rdress.net/index.php?me########
- http://br###catch.net/index.php?me########
- http://br###eearly.net/index.php?me########
- http://fl###eearly.net/index.php?me########
- http://ca####ndress.net/index.php?me########
- http://la###dress.net/index.php?me########
- http://re###dcatch.net/index.php?me########
- http://re####eearly.net/index.php?me########
- http://el####iccatch.net/index.php?me########
- http://la###eearly.net/index.php?me########
- http://ca####ncatch.net/index.php?me########
- http://ca####neearly.net/index.php?me########
- http://ca####npublic.net/index.php?me########
- http://la###public.net/index.php?me########
- http://tr###catch.net/index.php?me########
- http://st###tcatch.net/index.php?me########
- http://st####eearly.net/index.php?me########
- http://st####public.net/index.php?me########
- http://tr###eearly.net/index.php?me########
- http://re####public.net/index.php?me########
- http://el####iceearly.net/index.php?me########
- http://el####icpublic.net/index.php?me########
- http://el####icdress.net/index.php?me########
- http://re###ddress.net/index.php?me########
UDP:
- DNS ASK ga####eearly.net
- DNS ASK be####eearly.net
- DNS ASK be####public.net
- DNS ASK be###rdress.net
- DNS ASK ga####public.net
- DNS ASK st###tdress.net
- DNS ASK tr###public.net
- DNS ASK tr###dress.net
- DNS ASK ga###rcatch.net
- DNS ASK be###rcatch.net
- DNS ASK br###public.net
- DNS ASK fl###public.net
- DNS ASK fl###dress.net
- DNS ASK qu###catch.net
- DNS ASK br###dress.net
- DNS ASK fl###catch.net
- DNS ASK ga###rdress.net
- DNS ASK br###catch.net
- DNS ASK br###eearly.net
- DNS ASK fl###eearly.net
- DNS ASK ca####ndress.net
- DNS ASK la###dress.net
- DNS ASK re###dcatch.net
- DNS ASK re####eearly.net
- DNS ASK el####iccatch.net
- DNS ASK la###eearly.net
- DNS ASK ca####ncatch.net
- DNS ASK ca####neearly.net
- DNS ASK ca####npublic.net
- DNS ASK la###public.net
- DNS ASK tr###catch.net
- DNS ASK st###tcatch.net
- DNS ASK st####eearly.net
- DNS ASK st####public.net
- DNS ASK tr###eearly.net
- DNS ASK re####public.net
- DNS ASK el####iceearly.net
- DNS ASK el####icpublic.net
- DNS ASK el####icdress.net
- DNS ASK re###ddress.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
