Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Layer Reports Remote Performance' = 'C:\eqdlcdlv\xulypfrl.exe'
Вредоносные функции:
Создает и запускает на исполнение:
- 'C:\eqdlcdlv\phzcwknlyraz.exe' "c:\eqdlcdlv\xulypfrl.exe"
- 'C:\eqdlcdlv\xulypfrl.exe'
- 'C:\eqdlcdlv\ye3czwftrtzhmnia.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\eqdlcdlv\xulypfrl.exe
- C:\eqdlcdlv\phzcwknlyraz.exe
- C:\eqdlcdlv\aw1efbd
- %WINDIR%\eqdlcdlv\tkevk4t7zz
- C:\eqdlcdlv\tkevk4t7zz
- C:\eqdlcdlv\ye3czwftrtzhmnia.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\eqdlcdlv\phzcwknlyraz.exe
- C:\eqdlcdlv\xulypfrl.exe
Удаляет следующие файлы:
- C:\eqdlcdlv\ye3czwftrtzhmnia.exe
- %WINDIR%\eqdlcdlv\tkevk4t7zz
Сетевая активность:
Подключается к:
- 'mi####device.net':80
- 'tw####language.net':80
- 'mi####before.net':80
- 'tw####device.net':80
- 'mi####language.net':80
- 'al###before.net':80
- 'of###before.net':80
- 'tw####settle.net':80
- 'mi####settle.net':80
- 'tw####before.net':80
- 'ra####before.net':80
- 'mo####gdevice.net':80
- 'st####esettle.net':80
- 'mo####gbefore.net':80
- 'ra####device.net':80
- 'mo####gsettle.net':80
- 'ra####settle.net':80
- 'mo####glanguage.net':80
- 'ra####language.net':80
- 'al###device.net':80
- 'ch###settle.net':80
- 'pr####tbefore.net':80
- 'ch####anguage.net':80
- 'co####esettle.net':80
- 'th###before.net':80
- 'pr####tlanguage.net':80
- 'th####anguage.net':80
- 'pr####tdevice.net':80
- 'th###device.net':80
- 'co####elanguage.net':80
- 'of####anguage.net':80
- 'al###settle.net':80
- 'of###device.net':80
- 'al####anguage.net':80
- 'of###settle.net':80
- 'co####edevice.net':80
- 'ch###device.net':80
- 'co####ebefore.net':80
- 'ch###before.net':80
TCP:
Запросы HTTP GET:
- http://mi####device.net/index.php?me########
- http://tw####language.net/index.php?me########
- http://mi####before.net/index.php?me########
- http://tw####device.net/index.php?me########
- http://mi####language.net/index.php?me########
- http://al###before.net/index.php?me########
- http://of###before.net/index.php?me########
- http://tw####settle.net/index.php?me########
- http://mi####settle.net/index.php?me########
- http://tw####before.net/index.php?me########
- http://ra####before.net/index.php?me########
- http://mo####gdevice.net/index.php?me########
- http://st####esettle.net/index.php?me########
- http://mo####gbefore.net/index.php?me########
- http://ra####device.net/index.php?me########
- http://mo####gsettle.net/index.php?me########
- http://ra####settle.net/index.php?me########
- http://mo####glanguage.net/index.php?me########
- http://ra####language.net/index.php?me########
- http://al###device.net/index.php?me########
- http://ch###settle.net/index.php?me########
- http://pr####tbefore.net/index.php?me########
- http://ch####anguage.net/index.php?me########
- http://co####esettle.net/index.php?me########
- http://th###before.net/index.php?me########
- http://pr####tlanguage.net/index.php?me########
- http://th####anguage.net/index.php?me########
- http://pr####tdevice.net/index.php?me########
- http://th###device.net/index.php?me########
- http://co####elanguage.net/index.php?me########
- http://of####anguage.net/index.php?me########
- http://al###settle.net/index.php?me########
- http://of###device.net/index.php?me########
- http://al####anguage.net/index.php?me########
- http://of###settle.net/index.php?me########
- http://co####edevice.net/index.php?me########
- http://ch###device.net/index.php?me########
- http://co####ebefore.net/index.php?me########
- http://ch###before.net/index.php?me########
UDP:
- DNS ASK mi####device.net
- DNS ASK tw####language.net
- DNS ASK mi####before.net
- DNS ASK tw####device.net
- DNS ASK mi####language.net
- DNS ASK al###before.net
- DNS ASK of###before.net
- DNS ASK tw####settle.net
- DNS ASK mi####settle.net
- DNS ASK tw####before.net
- DNS ASK ra####before.net
- DNS ASK mo####gdevice.net
- DNS ASK st####esettle.net
- DNS ASK mo####gbefore.net
- DNS ASK ra####device.net
- DNS ASK mo####gsettle.net
- DNS ASK ra####settle.net
- DNS ASK mo####glanguage.net
- DNS ASK ra####language.net
- DNS ASK al###device.net
- DNS ASK ch###settle.net
- DNS ASK pr####tbefore.net
- DNS ASK ch####anguage.net
- DNS ASK co####esettle.net
- DNS ASK th###before.net
- DNS ASK pr####tlanguage.net
- DNS ASK th####anguage.net
- DNS ASK pr####tdevice.net
- DNS ASK th###device.net
- DNS ASK co####elanguage.net
- DNS ASK of####anguage.net
- DNS ASK al###settle.net
- DNS ASK of###device.net
- DNS ASK al####anguage.net
- DNS ASK of###settle.net
- DNS ASK co####edevice.net
- DNS ASK ch###device.net
- DNS ASK co####ebefore.net
- DNS ASK ch###before.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
