Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'NGEN Cryptographic Notification Search' = 'C:\rrhelhuqm\rlnmbtiw.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Locator Window Removal Protected Input] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- 'C:\rrhelhuqm\tbkejdobmywh.exe' "c:\rrhelhuqm\rlnmbtiw.exe"
- 'C:\rrhelhuqm\rlnmbtiw.exe'
- 'C:\rrhelhuqm\xmz5k3k1tyammuoqns.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\rrhelhuqm\rlnmbtiw.exe
- C:\rrhelhuqm\tbkejdobmywh.exe
- C:\rrhelhuqm\s7wlb14xdx
- %WINDIR%\rrhelhuqm\bregkp
- C:\rrhelhuqm\bregkp
- C:\rrhelhuqm\xmz5k3k1tyammuoqns.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\rrhelhuqm\tbkejdobmywh.exe
- C:\rrhelhuqm\rlnmbtiw.exe
Удаляет следующие файлы:
- C:\rrhelhuqm\xmz5k3k1tyammuoqns.exe
- %WINDIR%\rrhelhuqm\bregkp
Сетевая активность:
Подключается к:
- 'he###nwhile.net':80
- 'le###rwhile.net':80
- 'le####question.net':80
- 'le####therefore.net':80
- 'he####question.net':80
- 'or####herefore.net':80
- 're####equestion.net':80
- 're#####therefore.net':80
- 'he####school.net':80
- 'le####school.net':80
- 're####school.net':80
- 'va####sschool.net':80
- 'va####swhile.net':80
- 'va####squestion.net':80
- 're###nwhile.net':80
- 'ge####school.net':80
- 'he####therefore.net':80
- 'ge###ewhile.net':80
- 'ge####therefore.net':80
- 'ge####question.net':80
- 'or####uestion.net':80
- 'di#####lttherefore.net':80
- 'he####uestion.net':80
- 'he####herefore.net':80
- 'ne####aryschool.net':80
- 'pl####ntschool.net':80
- 'he###school.net':80
- 'di####ultschool.net':80
- 'di####ultwhile.net':80
- 'di#####ltquestion.net':80
- 'he###while.net':80
- 'or###school.net':80
- 'ne#####rytherefore.net':80
- 're####eschool.net':80
- 're####ewhile.net':80
- 'or###while.net':80
- 'ne####arywhile.net':80
- 'pl####ntwhile.net':80
- 'pl#####tquestion.net':80
- 'pl#####ttherefore.net':80
- 'ne#####ryquestion.net':80
TCP:
Запросы HTTP GET:
- http://he###nwhile.net/index.php?me########
- http://le###rwhile.net/index.php?me########
- http://le####question.net/index.php?me########
- http://le####therefore.net/index.php?me########
- http://he####question.net/index.php?me########
- http://or####herefore.net/index.php?me########
- http://re####equestion.net/index.php?me########
- http://re#####therefore.net/index.php?me########
- http://he####school.net/index.php?me########
- http://le####school.net/index.php?me########
- http://re####school.net/index.php?me########
- http://va####sschool.net/index.php?me########
- http://va####swhile.net/index.php?me########
- http://va####squestion.net/index.php?me########
- http://re###nwhile.net/index.php?me########
- http://ge####school.net/index.php?me########
- http://he####therefore.net/index.php?me########
- http://ge###ewhile.net/index.php?me########
- http://ge####therefore.net/index.php?me########
- http://ge####question.net/index.php?me########
- http://or####uestion.net/index.php?me########
- http://di#####lttherefore.net/index.php?me########
- http://he####uestion.net/index.php?me########
- http://he####herefore.net/index.php?me########
- http://ne####aryschool.net/index.php?me########
- http://pl####ntschool.net/index.php?me########
- http://he###school.net/index.php?me########
- http://di####ultschool.net/index.php?me########
- http://di####ultwhile.net/index.php?me########
- http://di#####ltquestion.net/index.php?me########
- http://he###while.net/index.php?me########
- http://or###school.net/index.php?me########
- http://ne#####rytherefore.net/index.php?me########
- http://re####eschool.net/index.php?me########
- http://re####ewhile.net/index.php?me########
- http://or###while.net/index.php?me########
- http://ne####arywhile.net/index.php?me########
- http://pl####ntwhile.net/index.php?me########
- http://pl#####tquestion.net/index.php?me########
- http://pl#####ttherefore.net/index.php?me########
- http://ne#####ryquestion.net/index.php?me########
UDP:
- DNS ASK he###nwhile.net
- DNS ASK le###rwhile.net
- DNS ASK le####question.net
- DNS ASK le####therefore.net
- DNS ASK he####question.net
- DNS ASK or####herefore.net
- DNS ASK re####equestion.net
- DNS ASK re#####therefore.net
- DNS ASK he####school.net
- DNS ASK le####school.net
- DNS ASK he####therefore.net
- DNS ASK va####swhile.net
- DNS ASK re####school.net
- DNS ASK re###nwhile.net
- DNS ASK re####question.net
- DNS ASK va####squestion.net
- DNS ASK ge###ewhile.net
- DNS ASK ge####school.net
- DNS ASK ge####question.net
- DNS ASK va####sschool.net
- DNS ASK ge####therefore.net
- DNS ASK di#####lttherefore.net
- DNS ASK he####uestion.net
- DNS ASK he####herefore.net
- DNS ASK ne####aryschool.net
- DNS ASK pl####ntschool.net
- DNS ASK he###school.net
- DNS ASK di####ultschool.net
- DNS ASK di####ultwhile.net
- DNS ASK di#####ltquestion.net
- DNS ASK he###while.net
- DNS ASK pl####ntwhile.net
- DNS ASK re####eschool.net
- DNS ASK or###school.net
- DNS ASK or###while.net
- DNS ASK or####uestion.net
- DNS ASK re####ewhile.net
- DNS ASK pl#####tquestion.net
- DNS ASK ne####arywhile.net
- DNS ASK ne#####ryquestion.net
- DNS ASK ne#####rytherefore.net
- DNS ASK pl#####ttherefore.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
