Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Source Internet Video Certificate AutoConfig' = 'C:\egoycgvqdxtpo\mqcnhwn.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Netlogon VC List NetBIOS Smart] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- 'C:\egoycgvqdxtpo\kgqanmwtblf.exe' "c:\egoycgvqdxtpo\mqcnhwn.exe"
- 'C:\egoycgvqdxtpo\mqcnhwn.exe'
- 'C:\egoycgvqdxtpo\kdwvh3vqdnclghwpzibng.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\egoycgvqdxtpo\mqcnhwn.exe
- C:\egoycgvqdxtpo\kgqanmwtblf.exe
- C:\egoycgvqdxtpo\s7zoahm
- %WINDIR%\egoycgvqdxtpo\zlwdfcyy5
- C:\egoycgvqdxtpo\zlwdfcyy5
- C:\egoycgvqdxtpo\kdwvh3vqdnclghwpzibng.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\egoycgvqdxtpo\kgqanmwtblf.exe
- C:\egoycgvqdxtpo\mqcnhwn.exe
Удаляет следующие файлы:
- C:\egoycgvqdxtpo\kdwvh3vqdnclghwpzibng.exe
- %WINDIR%\egoycgvqdxtpo\zlwdfcyy5
Сетевая активность:
Подключается к:
- 'th###divide.net':80
- 'pr####tbottle.net':80
- 'pr####tdivide.net':80
- 'co####estream.net':80
- 'ch###stream.net':80
- 'th###bottle.net':80
- 'th###stream.net':80
- 'cl###women.net':80
- 'pr####tstream.net':80
- 'pr####tnothing.net':80
- 'th####othing.net':80
- 'ch####othing.net':80
- 'of####othing.net':80
- 'al###stream.net':80
- 'al####othing.net':80
- 'al###bottle.net':80
- 'of###bottle.net':80
- 'of###stream.net':80
- 'ch###bottle.net':80
- 'co####enothing.net':80
- 'co####ebottle.net':80
- 'co####edivide.net':80
- 'ch###divide.net':80
- 'hi####ywomen.net':80
- 'st####ewomen.net':80
- 'am###tclean.net':80
- 'am###tpaint.net':80
- 'we####rclean.net':80
- 'hi####ycourse.net':80
- 'hi####yclean.net':80
- 'st####eclean.net':80
- 'st####epaint.net':80
- 'st####ecourse.net':80
- 'hi####ypaint.net':80
- 'we####rpaint.net':80
- 'cl###paint.net':80
- 'th###paint.net':80
- 'th###course.net':80
- 'th###women.net':80
- 'cl###course.net':80
- 'cl###clean.net':80
- 'we####rcourse.net':80
- 'am####course.net':80
- 'am###twomen.net':80
- 'th###clean.net':80
- 'we####rwomen.net':80
TCP:
Запросы HTTP GET:
- http://th###divide.net/index.php?me########
- http://pr####tbottle.net/index.php?me########
- http://pr####tdivide.net/index.php?me########
- http://co####estream.net/index.php?me########
- http://ch###stream.net/index.php?me########
- http://th###bottle.net/index.php?me########
- http://th###stream.net/index.php?me########
- http://cl###women.net/index.php?me########
- http://pr####tstream.net/index.php?me########
- http://pr####tnothing.net/index.php?me########
- http://th####othing.net/index.php?me########
- http://ch####othing.net/index.php?me########
- http://of####othing.net/index.php?me########
- http://al###stream.net/index.php?me########
- http://al####othing.net/index.php?me########
- http://al###bottle.net/index.php?me########
- http://of###bottle.net/index.php?me########
- http://of###stream.net/index.php?me########
- http://ch###bottle.net/index.php?me########
- http://co####enothing.net/index.php?me########
- http://co####ebottle.net/index.php?me########
- http://co####edivide.net/index.php?me########
- http://ch###divide.net/index.php?me########
- http://hi####ywomen.net/index.php?me########
- http://st####ewomen.net/index.php?me########
- http://am###tclean.net/index.php?me########
- http://am###tpaint.net/index.php?me########
- http://we####rclean.net/index.php?me########
- http://hi####ycourse.net/index.php?me########
- http://hi####yclean.net/index.php?me########
- http://st####eclean.net/index.php?me########
- http://st####epaint.net/index.php?me########
- http://st####ecourse.net/index.php?me########
- http://hi####ypaint.net/index.php?me########
- http://we####rpaint.net/index.php?me########
- http://cl###paint.net/index.php?me########
- http://th###paint.net/index.php?me########
- http://th###course.net/index.php?me########
- http://th###women.net/index.php?me########
- http://cl###course.net/index.php?me########
- http://cl###clean.net/index.php?me########
- http://we####rcourse.net/index.php?me########
- http://am####course.net/index.php?me########
- http://am###twomen.net/index.php?me########
- http://th###clean.net/index.php?me########
- http://we####rwomen.net/index.php?me########
UDP:
- DNS ASK pr####tdivide.net
- DNS ASK th###divide.net
- DNS ASK ch###stream.net
- DNS ASK ch####othing.net
- DNS ASK co####estream.net
- DNS ASK pr####tbottle.net
- DNS ASK pr####tstream.net
- DNS ASK th###stream.net
- DNS ASK th####othing.net
- DNS ASK th###bottle.net
- DNS ASK pr####tnothing.net
- DNS ASK co####enothing.net
- DNS ASK al####othing.net
- DNS ASK of####othing.net
- DNS ASK of###bottle.net
- DNS ASK of###divide.net
- DNS ASK al###bottle.net
- DNS ASK al###stream.net
- DNS ASK co####ebottle.net
- DNS ASK ch###bottle.net
- DNS ASK ch###divide.net
- DNS ASK of###stream.net
- DNS ASK co####edivide.net
- DNS ASK cl###women.net
- DNS ASK hi####ywomen.net
- DNS ASK st####ewomen.net
- DNS ASK am###tclean.net
- DNS ASK am###tpaint.net
- DNS ASK we####rclean.net
- DNS ASK hi####ycourse.net
- DNS ASK hi####yclean.net
- DNS ASK st####eclean.net
- DNS ASK st####epaint.net
- DNS ASK st####ecourse.net
- DNS ASK hi####ypaint.net
- DNS ASK we####rpaint.net
- DNS ASK cl###paint.net
- DNS ASK th###paint.net
- DNS ASK th###course.net
- DNS ASK th###women.net
- DNS ASK cl###course.net
- DNS ASK cl###clean.net
- DNS ASK we####rcourse.net
- DNS ASK am####course.net
- DNS ASK am###twomen.net
- DNS ASK th###clean.net
- DNS ASK we####rwomen.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
