Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Link Health Portable Identity' = 'C:\owclwpnhtnfwzl\grhjrtyao.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Center Propagation Spooler Peer Call] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- 'C:\owclwpnhtnfwzl\hxvmvgq.exe' "c:\owclwpnhtnfwzl\grhjrtyao.exe"
- 'C:\owclwpnhtnfwzl\grhjrtyao.exe'
- 'C:\owclwpnhtnfwzl\amals2opra8bdtqmsxja.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\owclwpnhtnfwzl\grhjrtyao.exe
- C:\owclwpnhtnfwzl\hxvmvgq.exe
- C:\owclwpnhtnfwzl\mbcxs4cc
- %WINDIR%\owclwpnhtnfwzl\d0oo73
- C:\owclwpnhtnfwzl\d0oo73
- C:\owclwpnhtnfwzl\amals2opra8bdtqmsxja.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\owclwpnhtnfwzl\hxvmvgq.exe
- C:\owclwpnhtnfwzl\grhjrtyao.exe
Удаляет следующие файлы:
- C:\owclwpnhtnfwzl\amals2opra8bdtqmsxja.exe
- %WINDIR%\owclwpnhtnfwzl\d0oo73
Сетевая активность:
Подключается к:
- 'mo####gwonder.net':80
- 'ra####wonder.net':80
- 'mo####gmaster.net':80
- 'ra####discover.net':80
- 'hi####ycontinue.net':80
- 'st####econtinue.net':80
- 'mo####gdiscover.net':80
- 'mi####discover.net':80
- 'tw####wonder.net':80
- 'mi####wonder.net':80
- 'tw####discover.net':80
- 'ra####master.net':80
- 'mo####gcontinue.net':80
- 'ra####continue.net':80
- 'st####emaster.net':80
- 'am####wonder.net':80
- 'we####rmaster.net':80
- 'am####master.net':80
- 'we####rwonder.net':80
- 'cl####ontinue.net':80
- 'we####rdiscover.net':80
- 'am####discover.net':80
- 'hi####ywonder.net':80
- 'st####ewonder.net':80
- 'hi####ymaster.net':80
- 'st####ediscover.net':80
- 'we####rcontinue.net':80
- 'am####continue.net':80
- 'hi####ydiscover.net':80
- 'tw####master.net':80
- 'pr####tdiscover.net':80
- 'th####iscover.net':80
- 'pr####twonder.net':80
- 'ch####ontinue.net':80
- 'co####emaster.net':80
- 'ch###master.net':80
- 'co####econtinue.net':80
- 'th####ontinue.net':80
- 'cl###caught.net':80
- 'th###caught.net':80
- 'pr####tcontinue.net':80
- 'th###wonder.net':80
- 'pr####tmaster.net':80
- 'th###master.net':80
- 'ch###wonder.net':80
- 'of####iscover.net':80
- 'al###wonder.net':80
- 'of###wonder.net':80
- 'al####iscover.net':80
- 'mi####master.net':80
- 'tw####continue.net':80
- 'mi####continue.net':80
- 'co####ediscover.net':80
- 'ch####iscover.net':80
- 'co####ewonder.net':80
- 'of####ontinue.net':80
- 'al###master.net':80
- 'of###master.net':80
- 'al####ontinue.net':80
TCP:
Запросы HTTP GET:
- http://mo####gwonder.net/index.php?me########
- http://ra####wonder.net/index.php?me########
- http://mo####gmaster.net/index.php?me########
- http://ra####discover.net/index.php?me########
- http://hi####ycontinue.net/index.php?me########
- http://st####econtinue.net/index.php?me########
- http://mo####gdiscover.net/index.php?me########
- http://mi####discover.net/index.php?me########
- http://tw####wonder.net/index.php?me########
- http://mi####wonder.net/index.php?me########
- http://tw####discover.net/index.php?me########
- http://ra####master.net/index.php?me########
- http://mo####gcontinue.net/index.php?me########
- http://ra####continue.net/index.php?me########
- http://st####emaster.net/index.php?me########
- http://am####wonder.net/index.php?me########
- http://we####rmaster.net/index.php?me########
- http://am####master.net/index.php?me########
- http://we####rwonder.net/index.php?me########
- http://cl####ontinue.net/index.php?me########
- http://we####rdiscover.net/index.php?me########
- http://am####discover.net/index.php?me########
- http://hi####ywonder.net/index.php?me########
- http://st####ewonder.net/index.php?me########
- http://hi####ymaster.net/index.php?me########
- http://st####ediscover.net/index.php?me########
- http://we####rcontinue.net/index.php?me########
- http://am####continue.net/index.php?me########
- http://hi####ydiscover.net/index.php?me########
- http://tw####master.net/index.php?me########
- http://pr####tdiscover.net/index.php?me########
- http://th####iscover.net/index.php?me########
- http://pr####twonder.net/index.php?me########
- http://ch####ontinue.net/index.php?me########
- http://co####emaster.net/index.php?me########
- http://ch###master.net/index.php?me########
- http://co####econtinue.net/index.php?me########
- http://th####ontinue.net/index.php?me########
- http://cl###caught.net/index.php?me########
- http://th###caught.net/index.php?me########
- http://pr####tcontinue.net/index.php?me########
- http://th###wonder.net/index.php?me########
- http://pr####tmaster.net/index.php?me########
- http://th###master.net/index.php?me########
- http://ch###wonder.net/index.php?me########
- http://of####iscover.net/index.php?me########
- http://al###wonder.net/index.php?me########
- http://of###wonder.net/index.php?me########
- http://al####iscover.net/index.php?me########
- http://mi####master.net/index.php?me########
- http://tw####continue.net/index.php?me########
- http://mi####continue.net/index.php?me########
- http://co####ediscover.net/index.php?me########
- http://ch####iscover.net/index.php?me########
- http://co####ewonder.net/index.php?me########
- http://of####ontinue.net/index.php?me########
- http://al###master.net/index.php?me########
- http://of###master.net/index.php?me########
- http://al####ontinue.net/index.php?me########
UDP:
- DNS ASK mo####gwonder.net
- DNS ASK ra####wonder.net
- DNS ASK mo####gmaster.net
- DNS ASK ra####discover.net
- DNS ASK hi####ycontinue.net
- DNS ASK st####econtinue.net
- DNS ASK mo####gdiscover.net
- DNS ASK mi####discover.net
- DNS ASK tw####wonder.net
- DNS ASK mi####wonder.net
- DNS ASK tw####discover.net
- DNS ASK ra####master.net
- DNS ASK mo####gcontinue.net
- DNS ASK ra####continue.net
- DNS ASK st####emaster.net
- DNS ASK am####wonder.net
- DNS ASK we####rmaster.net
- DNS ASK am####master.net
- DNS ASK we####rwonder.net
- DNS ASK cl####ontinue.net
- DNS ASK we####rdiscover.net
- DNS ASK am####discover.net
- DNS ASK hi####ywonder.net
- DNS ASK st####ewonder.net
- DNS ASK hi####ymaster.net
- DNS ASK st####ediscover.net
- DNS ASK we####rcontinue.net
- DNS ASK am####continue.net
- DNS ASK hi####ydiscover.net
- DNS ASK tw####master.net
- DNS ASK pr####tdiscover.net
- DNS ASK th####iscover.net
- DNS ASK pr####twonder.net
- DNS ASK ch####ontinue.net
- DNS ASK co####emaster.net
- DNS ASK ch###master.net
- DNS ASK co####econtinue.net
- DNS ASK th####ontinue.net
- DNS ASK cl###caught.net
- DNS ASK th###caught.net
- DNS ASK pr####tcontinue.net
- DNS ASK th###wonder.net
- DNS ASK pr####tmaster.net
- DNS ASK th###master.net
- DNS ASK ch###wonder.net
- DNS ASK of####iscover.net
- DNS ASK al###wonder.net
- DNS ASK of###wonder.net
- DNS ASK al####iscover.net
- DNS ASK mi####master.net
- DNS ASK tw####continue.net
- DNS ASK mi####continue.net
- DNS ASK co####ediscover.net
- DNS ASK ch####iscover.net
- DNS ASK co####ewonder.net
- DNS ASK of####ontinue.net
- DNS ASK al###master.net
- DNS ASK of###master.net
- DNS ASK al####ontinue.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
