Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Device Secondary Drive DLL Server Net.Tcp' = 'C:\umgxmzxkjght\jixjwnnavmnh.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Procedure Location Counter] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- 'C:\umgxmzxkjght\lxoorndgr.exe' "c:\umgxmzxkjght\jixjwnnavmnh.exe"
- 'C:\umgxmzxkjght\jixjwnnavmnh.exe'
- 'C:\umgxmzxkjght\i03b9ellgcwkiv.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\umgxmzxkjght\jixjwnnavmnh.exe
- C:\umgxmzxkjght\lxoorndgr.exe
- C:\umgxmzxkjght\t9lfvzxx8dfv
- %WINDIR%\umgxmzxkjght\nechasqnzk
- C:\umgxmzxkjght\nechasqnzk
- C:\umgxmzxkjght\i03b9ellgcwkiv.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\umgxmzxkjght\lxoorndgr.exe
- C:\umgxmzxkjght\jixjwnnavmnh.exe
Удаляет следующие файлы:
- C:\umgxmzxkjght\i03b9ellgcwkiv.exe
- %WINDIR%\umgxmzxkjght\nechasqnzk
Сетевая активность:
Подключается к:
- 'ag####tmeasure.net':80
- 'se###ncarry.net':80
- 'do####easure.net':80
- 'do###dinner.net':80
- 'ag####tdinner.net':80
- 'qu###carry.net':80
- 'qu###apple.net':80
- 'se####father.net':80
- 'se###napple.net':80
- 'se###nbuilt.net':80
- 'qu###built.net':80
- 'ag####tafraid.net':80
- 'ni###afraid.net':80
- 'de####dinner.net':80
- 'de####afraid.net':80
- 'de####circle.net':80
- 'ni###circle.net':80
- 'ni###dinner.net':80
- 'ag####tcircle.net':80
- 'do###afraid.net':80
- 'do###circle.net':80
- 'de####measure.net':80
- 'ni####easure.net':80
- 'qu###father.net':80
- 'be####father.net':80
- 'tr###carry.net':80
- 'ga####father.net':80
- 'ga###rapple.net':80
- 'be###rapple.net':80
- 'st###tcarry.net':80
- 'st###tapple.net':80
- 'tr###father.net':80
- 'tr###apple.net':80
- 'tr###built.net':80
- 'st###tbuilt.net':80
- 'be###rbuilt.net':80
- 'fl###built.net':80
- 'br###apple.net':80
- 'br###built.net':80
- 'br###carry.net':80
- 'fl###carry.net':80
- 'fl###apple.net':80
- 'be###rcarry.net':80
- 'ga###rbuilt.net':80
- 'ga###rcarry.net':80
- 'br###father.net':80
- 'fl###father.net':80
TCP:
Запросы HTTP GET:
- http://ag####tmeasure.net/index.php?me########
- http://se###ncarry.net/index.php?me########
- http://do####easure.net/index.php?me########
- http://do###dinner.net/index.php?me########
- http://ag####tdinner.net/index.php?me########
- http://qu###carry.net/index.php?me########
- http://qu###apple.net/index.php?me########
- http://se####father.net/index.php?me########
- http://se###napple.net/index.php?me########
- http://se###nbuilt.net/index.php?me########
- http://qu###built.net/index.php?me########
- http://ag####tafraid.net/index.php?me########
- http://ni###afraid.net/index.php?me########
- http://de####dinner.net/index.php?me########
- http://de####afraid.net/index.php?me########
- http://de####circle.net/index.php?me########
- http://ni###circle.net/index.php?me########
- http://ni###dinner.net/index.php?me########
- http://ag####tcircle.net/index.php?me########
- http://do###afraid.net/index.php?me########
- http://do###circle.net/index.php?me########
- http://de####measure.net/index.php?me########
- http://ni####easure.net/index.php?me########
- http://qu###father.net/index.php?me########
- http://be####father.net/index.php?me########
- http://tr###carry.net/index.php?me########
- http://ga####father.net/index.php?me########
- http://ga###rapple.net/index.php?me########
- http://be###rapple.net/index.php?me########
- http://st###tcarry.net/index.php?me########
- http://st###tapple.net/index.php?me########
- http://tr###father.net/index.php?me########
- http://tr###apple.net/index.php?me########
- http://tr###built.net/index.php?me########
- http://st###tbuilt.net/index.php?me########
- http://be###rbuilt.net/index.php?me########
- http://fl###built.net/index.php?me########
- http://br###apple.net/index.php?me########
- http://br###built.net/index.php?me########
- http://br###carry.net/index.php?me########
- http://fl###carry.net/index.php?me########
- http://fl###apple.net/index.php?me########
- http://be###rcarry.net/index.php?me########
- http://ga###rbuilt.net/index.php?me########
- http://ga###rcarry.net/index.php?me########
- http://br###father.net/index.php?me########
- http://fl###father.net/index.php?me########
UDP:
- DNS ASK do####easure.net
- DNS ASK ag####tmeasure.net
- DNS ASK se###ncarry.net
- DNS ASK ag####tafraid.net
- DNS ASK do###dinner.net
- DNS ASK ag####tdinner.net
- DNS ASK se###napple.net
- DNS ASK qu###apple.net
- DNS ASK se####father.net
- DNS ASK qu###carry.net
- DNS ASK se###nbuilt.net
- DNS ASK qu###built.net
- DNS ASK de####afraid.net
- DNS ASK ni###afraid.net
- DNS ASK de####dinner.net
- DNS ASK la####easure.net
- DNS ASK de####circle.net
- DNS ASK ni###circle.net
- DNS ASK do###circle.net
- DNS ASK ag####tcircle.net
- DNS ASK do###afraid.net
- DNS ASK ni###dinner.net
- DNS ASK de####measure.net
- DNS ASK ni####easure.net
- DNS ASK ga####father.net
- DNS ASK be####father.net
- DNS ASK tr###carry.net
- DNS ASK be###rbuilt.net
- DNS ASK ga###rapple.net
- DNS ASK be###rapple.net
- DNS ASK tr###apple.net
- DNS ASK st###tapple.net
- DNS ASK tr###father.net
- DNS ASK st###tcarry.net
- DNS ASK tr###built.net
- DNS ASK st###tbuilt.net
- DNS ASK br###built.net
- DNS ASK fl###built.net
- DNS ASK br###apple.net
- DNS ASK qu###father.net
- DNS ASK br###carry.net
- DNS ASK fl###carry.net
- DNS ASK ga###rcarry.net
- DNS ASK be###rcarry.net
- DNS ASK ga###rbuilt.net
- DNS ASK fl###apple.net
- DNS ASK br###father.net
- DNS ASK fl###father.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
