Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Filtering Session Helper Smart' = 'C:\ciogiqgykmolfqz\tfqbsbnygv.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Coordinator Center Acquisition IKE Experience] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- 'C:\ciogiqgykmolfqz\ectddnfwifu.exe' "c:\ciogiqgykmolfqz\tfqbsbnygv.exe"
- 'C:\ciogiqgykmolfqz\tfqbsbnygv.exe'
- 'C:\ciogiqgykmolfqz\tj3evmavjfvozfwl.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\ciogiqgykmolfqz\tfqbsbnygv.exe
- C:\ciogiqgykmolfqz\ectddnfwifu.exe
- C:\ciogiqgykmolfqz\pj9roen2hygh
- %WINDIR%\ciogiqgykmolfqz\klfudd
- C:\ciogiqgykmolfqz\klfudd
- C:\ciogiqgykmolfqz\tj3evmavjfvozfwl.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\ciogiqgykmolfqz\ectddnfwifu.exe
- C:\ciogiqgykmolfqz\tfqbsbnygv.exe
Удаляет следующие файлы:
- C:\ciogiqgykmolfqz\tj3evmavjfvozfwl.exe
- %WINDIR%\ciogiqgykmolfqz\klfudd
Сетевая активность:
Подключается к:
- 'di####ultschool.net':80
- 'gl####herefore.net':80
- 'he###school.net':80
- 'he###while.net':80
- 'di####ultwhile.net':80
- 'an####therefore.net':80
- 'an###rwhile.net':80
- 'gl###school.net':80
- 'gl###while.net':80
- 'gl####uestion.net':80
- 'an####question.net':80
- 'ne####arywhile.net':80
- 'pl####ntwhile.net':80
- 'pl#####tquestion.net':80
- 'pl#####ttherefore.net':80
- 'ne#####ryquestion.net':80
- 'ne####aryschool.net':80
- 'he####uestion.net':80
- 'di#####ltquestion.net':80
- 'di#####lttherefore.net':80
- 'pl####ntschool.net':80
- 'he####herefore.net':80
- 'va####sanger.net':80
- 're###nwheat.net':80
- 're###nanger.net':80
- 're####always.net':80
- 'va####salways.net':80
- 'va####swheat.net':80
- 'he###always.net':80
- 'ge###eanger.net':80
- 'ge####always.net':80
- 'ge####forest.net':80
- 'he###forest.net':80
- 'fo####dquestion.net':80
- 'de####question.net':80
- 'de####therefore.net':80
- 'an####school.net':80
- 'fo#####therefore.net':80
- 'fo####dwhile.net':80
- 're####forest.net':80
- 'va####sforest.net':80
- 'de####school.net':80
- 'de###ewhile.net':80
- 'fo####dschool.net':80
TCP:
Запросы HTTP GET:
- http://di####ultschool.net/index.php?me########
- http://gl####herefore.net/index.php?me########
- http://he###school.net/index.php?me########
- http://he###while.net/index.php?me########
- http://di####ultwhile.net/index.php?me########
- http://an####therefore.net/index.php?me########
- http://an###rwhile.net/index.php?me########
- http://gl###school.net/index.php?me########
- http://gl###while.net/index.php?me########
- http://gl####uestion.net/index.php?me########
- http://an####question.net/index.php?me########
- http://ne####arywhile.net/index.php?me########
- http://pl####ntwhile.net/index.php?me########
- http://pl#####tquestion.net/index.php?me########
- http://pl#####ttherefore.net/index.php?me########
- http://ne#####ryquestion.net/index.php?me########
- http://ne####aryschool.net/index.php?me########
- http://he####uestion.net/index.php?me########
- http://di#####ltquestion.net/index.php?me########
- http://di#####lttherefore.net/index.php?me########
- http://pl####ntschool.net/index.php?me########
- http://he####herefore.net/index.php?me########
- http://va####sanger.net/index.php?me########
- http://re###nwheat.net/index.php?me########
- http://re###nanger.net/index.php?me########
- http://re####always.net/index.php?me########
- http://va####salways.net/index.php?me########
- http://va####swheat.net/index.php?me########
- http://he###always.net/index.php?me########
- http://ge###eanger.net/index.php?me########
- http://ge####always.net/index.php?me########
- http://ge####forest.net/index.php?me########
- http://he###forest.net/index.php?me########
- http://fo####dquestion.net/index.php?me########
- http://de####question.net/index.php?me########
- http://de####therefore.net/index.php?me########
- http://an####school.net/index.php?me########
- http://fo#####therefore.net/index.php?me########
- http://fo####dwhile.net/index.php?me########
- http://re####forest.net/index.php?me########
- http://va####sforest.net/index.php?me########
- http://de####school.net/index.php?me########
- http://de###ewhile.net/index.php?me########
- http://fo####dschool.net/index.php?me########
UDP:
- DNS ASK he###school.net
- DNS ASK di####ultschool.net
- DNS ASK di####ultwhile.net
- DNS ASK di#####ltquestion.net
- DNS ASK he###while.net
- DNS ASK gl####herefore.net
- DNS ASK gl###while.net
- DNS ASK an###rwhile.net
- DNS ASK an####question.net
- DNS ASK an####therefore.net
- DNS ASK gl####uestion.net
- DNS ASK pl#####tquestion.net
- DNS ASK ne####arywhile.net
- DNS ASK ne#####ryquestion.net
- DNS ASK ne#####rytherefore.net
- DNS ASK pl#####ttherefore.net
- DNS ASK pl####ntwhile.net
- DNS ASK di#####lttherefore.net
- DNS ASK he####uestion.net
- DNS ASK he####herefore.net
- DNS ASK ne####aryschool.net
- DNS ASK pl####ntschool.net
- DNS ASK gl###school.net
- DNS ASK va####sanger.net
- DNS ASK re###nwheat.net
- DNS ASK re###nanger.net
- DNS ASK re####always.net
- DNS ASK va####salways.net
- DNS ASK va####swheat.net
- DNS ASK he###always.net
- DNS ASK ge###eanger.net
- DNS ASK ge####always.net
- DNS ASK ge####forest.net
- DNS ASK he###forest.net
- DNS ASK fo####dquestion.net
- DNS ASK de####question.net
- DNS ASK de####therefore.net
- DNS ASK an####school.net
- DNS ASK fo#####therefore.net
- DNS ASK fo####dwhile.net
- DNS ASK re####forest.net
- DNS ASK va####sforest.net
- DNS ASK de####school.net
- DNS ASK de###ewhile.net
- DNS ASK fo####dschool.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
