Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Player Drive Program Intelligent' = 'C:\frerrbsahk\fsgfqhvrb.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Presentation Procedure Launcher] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- 'C:\frerrbsahk\tawhidyovjas.exe' "c:\frerrbsahk\fsgfqhvrb.exe"
- 'C:\frerrbsahk\fsgfqhvrb.exe'
- 'C:\frerrbsahk\sgqc3udcemrtkhrwdlf.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\frerrbsahk\fsgfqhvrb.exe
- C:\frerrbsahk\tawhidyovjas.exe
- C:\frerrbsahk\opyptj9fsq
- %WINDIR%\frerrbsahk\wjzbsbxixlp
- C:\frerrbsahk\wjzbsbxixlp
- C:\frerrbsahk\sgqc3udcemrtkhrwdlf.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\frerrbsahk\tawhidyovjas.exe
- C:\frerrbsahk\fsgfqhvrb.exe
Удаляет следующие файлы:
- C:\frerrbsahk\sgqc3udcemrtkhrwdlf.exe
- %WINDIR%\frerrbsahk\wjzbsbxixlp
Сетевая активность:
Подключается к:
- 'ga####famous.net':80
- 'be####famous.net':80
- 'be###rpower.net':80
- 'be####country.net':80
- 'ga###rpower.net':80
- 'ga####century.net':80
- 'tr###power.net':80
- 'st###tpower.net':80
- 'st####country.net':80
- 'be####century.net':80
- 'tr####ountry.net':80
- 'fl####ountry.net':80
- 'br###power.net':80
- 'br####ountry.net':80
- 'se####century.net':80
- 'qu####entury.net':80
- 'fl###power.net':80
- 'fl####entury.net':80
- 'ga####country.net':80
- 'br####entury.net':80
- 'br###famous.net':80
- 'fl###famous.net':80
- 'ca####npower.net':80
- 'la###power.net':80
- 'la####ountry.net':80
- 're####century.net':80
- 'ca####ncountry.net':80
- 'ca####nfamous.net':80
- 'de####country.net':80
- 'ni####ountry.net':80
- 'la####entury.net':80
- 'la###famous.net':80
- 'ca####ncentury.net':80
- 'st####century.net':80
- 'el####iccountry.net':80
- 'tr####entury.net':80
- 'tr###famous.net':80
- 'st####famous.net':80
- 're####country.net':80
- 're####famous.net':80
- 'el####iccentury.net':80
- 'el####icfamous.net':80
- 'el####icpower.net':80
- 're###dpower.net':80
TCP:
Запросы HTTP GET:
- http://ga####famous.net/index.php?me########
- http://be####famous.net/index.php?me########
- http://be###rpower.net/index.php?me########
- http://be####country.net/index.php?me########
- http://ga###rpower.net/index.php?me########
- http://ga####century.net/index.php?me########
- http://tr###power.net/index.php?me########
- http://st###tpower.net/index.php?me########
- http://st####country.net/index.php?me########
- http://be####century.net/index.php?me########
- http://tr####ountry.net/index.php?me########
- http://fl####ountry.net/index.php?me########
- http://br###power.net/index.php?me########
- http://br####ountry.net/index.php?me########
- http://se####century.net/index.php?me########
- http://qu####entury.net/index.php?me########
- http://fl###power.net/index.php?me########
- http://fl####entury.net/index.php?me########
- http://ga####country.net/index.php?me########
- http://br####entury.net/index.php?me########
- http://br###famous.net/index.php?me########
- http://fl###famous.net/index.php?me########
- http://ca####npower.net/index.php?me########
- http://la###power.net/index.php?me########
- http://la####ountry.net/index.php?me########
- http://re####century.net/index.php?me########
- http://ca####ncountry.net/index.php?me########
- http://ca####nfamous.net/index.php?me########
- http://de####country.net/index.php?me########
- http://ni####ountry.net/index.php?me########
- http://la####entury.net/index.php?me########
- http://la###famous.net/index.php?me########
- http://ca####ncentury.net/index.php?me########
- http://st####century.net/index.php?me########
- http://el####iccountry.net/index.php?me########
- http://tr####entury.net/index.php?me########
- http://tr###famous.net/index.php?me########
- http://st####famous.net/index.php?me########
- http://re####country.net/index.php?me########
- http://re####famous.net/index.php?me########
- http://el####iccentury.net/index.php?me########
- http://el####icfamous.net/index.php?me########
- http://el####icpower.net/index.php?me########
- http://re###dpower.net/index.php?me########
UDP:
- DNS ASK be###rpower.net
- DNS ASK ga####famous.net
- DNS ASK ga###rpower.net
- DNS ASK ga####country.net
- DNS ASK be####country.net
- DNS ASK be####famous.net
- DNS ASK st####country.net
- DNS ASK tr###power.net
- DNS ASK tr####ountry.net
- DNS ASK ga####century.net
- DNS ASK be####century.net
- DNS ASK br####ountry.net
- DNS ASK fl####ountry.net
- DNS ASK qu####entury.net
- DNS ASK qu###famous.net
- DNS ASK se####century.net
- DNS ASK br###power.net
- DNS ASK br####entury.net
- DNS ASK fl####entury.net
- DNS ASK fl###famous.net
- DNS ASK fl###power.net
- DNS ASK br###famous.net
- DNS ASK st###tpower.net
- DNS ASK ca####npower.net
- DNS ASK la###power.net
- DNS ASK la####ountry.net
- DNS ASK re####century.net
- DNS ASK ca####ncountry.net
- DNS ASK ca####nfamous.net
- DNS ASK de####country.net
- DNS ASK ni####ountry.net
- DNS ASK la####entury.net
- DNS ASK la###famous.net
- DNS ASK ca####ncentury.net
- DNS ASK st####century.net
- DNS ASK el####iccountry.net
- DNS ASK tr####entury.net
- DNS ASK tr###famous.net
- DNS ASK st####famous.net
- DNS ASK re####country.net
- DNS ASK re####famous.net
- DNS ASK el####iccentury.net
- DNS ASK el####icfamous.net
- DNS ASK el####icpower.net
- DNS ASK re###dpower.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
