Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Auto-Discovery Biometric Quality' = 'C:\xvhoqdvavcm\rglpibigj.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Launcher Protection Visual Source Offline] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- 'C:\xvhoqdvavcm\wsnhmdrcbpke.exe' "c:\xvhoqdvavcm\rglpibigj.exe"
- 'C:\xvhoqdvavcm\rglpibigj.exe'
- 'C:\xvhoqdvavcm\ca1a2n2qvbmlgpo5i.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\xvhoqdvavcm\rglpibigj.exe
- C:\xvhoqdvavcm\wsnhmdrcbpke.exe
- C:\xvhoqdvavcm\cgxcf0p
- %WINDIR%\xvhoqdvavcm\vbafyx5lu
- C:\xvhoqdvavcm\vbafyx5lu
- C:\xvhoqdvavcm\ca1a2n2qvbmlgpo5i.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\xvhoqdvavcm\wsnhmdrcbpke.exe
- C:\xvhoqdvavcm\rglpibigj.exe
Удаляет следующие файлы:
- C:\xvhoqdvavcm\ca1a2n2qvbmlgpo5i.exe
- %WINDIR%\xvhoqdvavcm\vbafyx5lu
Сетевая активность:
Подключается к:
- 'co####ematter.net':80
- 'ch###spent.net':80
- 'ch###matter.net':80
- 'th####ontrol.net':80
- 'pr####tcontrol.net':80
- 'ch####ontrol.net':80
- 'co####econtrol.net':80
- 'co####etogether.net':80
- 'co####espent.net':80
- 'ch####ogether.net':80
- 'se###nevery.net':80
- 'th###matter.net':80
- 'qu###every.net':80
- 'qu####ifference.net':80
- 'se#####ifference.net':80
- 'th####ogether.net':80
- 'pr####ttogether.net':80
- 'pr####tspent.net':80
- 'pr####tmatter.net':80
- 'th###spent.net':80
- 'tw####together.net':80
- 'mi####control.net':80
- 'mi####together.net':80
- 'mi###espent.net':80
- 'tw###espent.net':80
- 'ra###rspent.net':80
- 'mo####gspent.net':80
- 'mo####gmatter.net':80
- 'tw####control.net':80
- 'ra####matter.net':80
- 'al###spent.net':80
- 'of####ogether.net':80
- 'of###spent.net':80
- 'of###matter.net':80
- 'al###matter.net':80
- 'mi####matter.net':80
- 'tw####matter.net':80
- 'al####ontrol.net':80
- 'al####ogether.net':80
- 'of####ontrol.net':80
- 'se####charge.net':80
- 'st####single.net':80
- 'tr###single.net':80
- 'el####icevery.net':80
- 'el#####cdifference.net':80
- 're###devery.net':80
- 'tr####ifference.net':80
- 'st###tevery.net':80
- 'st#####ifference.net':80
- 'st####charge.net':80
- 'tr###charge.net':80
- 'la###every.net':80
- 'ca####nevery.net':80
- 'ca#####difference.net':80
- 'ca####ncharge.net':80
- 'la####ifference.net':80
- 'el####iccharge.net':80
- 're#####ifference.net':80
- 're####charge.net':80
- 're####single.net':80
- 'el####icsingle.net':80
- 'fl####ifference.net':80
- 'br####ifference.net':80
- 'br###charge.net':80
- 'br###single.net':80
- 'fl###charge.net':80
- 'se####single.net':80
- 'qu###charge.net':80
- 'qu###single.net':80
- 'fl###every.net':80
- 'br###every.net':80
- 'be####charge.net':80
- 'ga####charge.net':80
- 'ga####single.net':80
- 'tr###every.net':80
- 'be####single.net':80
- 'ga###revery.net':80
- 'fl###single.net':80
- 'be###revery.net':80
- 'be#####ifference.net':80
- 'ga#####ifference.net':80
TCP:
Запросы HTTP GET:
- http://co####ematter.net/index.php?me########
- http://ch###spent.net/index.php?me########
- http://ch###matter.net/index.php?me########
- http://th####ontrol.net/index.php?me########
- http://pr####tcontrol.net/index.php?me########
- http://ch####ontrol.net/index.php?me########
- http://co####econtrol.net/index.php?me########
- http://co####etogether.net/index.php?me########
- http://co####espent.net/index.php?me########
- http://ch####ogether.net/index.php?me########
- http://se###nevery.net/index.php?me########
- http://th###matter.net/index.php?me########
- http://qu###every.net/index.php?me########
- http://qu####ifference.net/index.php?me########
- http://se#####ifference.net/index.php?me########
- http://th####ogether.net/index.php?me########
- http://pr####ttogether.net/index.php?me########
- http://pr####tspent.net/index.php?me########
- http://pr####tmatter.net/index.php?me########
- http://th###spent.net/index.php?me########
- http://tw####together.net/index.php?me########
- http://mi####control.net/index.php?me########
- http://mi####together.net/index.php?me########
- http://mi###espent.net/index.php?me########
- http://tw###espent.net/index.php?me########
- http://ra###rspent.net/index.php?me########
- http://mo####gspent.net/index.php?me########
- http://mo####gmatter.net/index.php?me########
- http://tw####control.net/index.php?me########
- http://ra####matter.net/index.php?me########
- http://al###spent.net/index.php?me########
- http://of####ogether.net/index.php?me########
- http://of###spent.net/index.php?me########
- http://of###matter.net/index.php?me########
- http://al###matter.net/index.php?me########
- http://mi####matter.net/index.php?me########
- http://tw####matter.net/index.php?me########
- http://al####ontrol.net/index.php?me########
- http://al####ogether.net/index.php?me########
- http://of####ontrol.net/index.php?me########
- http://se####charge.net/index.php?me########
- http://st####single.net/index.php?me########
- http://tr###single.net/index.php?me########
- http://el####icevery.net/index.php?me########
- http://el#####cdifference.net/index.php?me########
- http://re###devery.net/index.php?me########
- http://tr####ifference.net/index.php?me########
- http://st###tevery.net/index.php?me########
- http://st#####ifference.net/index.php?me########
- http://st####charge.net/index.php?me########
- http://tr###charge.net/index.php?me########
- http://la###every.net/index.php?me########
- http://ca####nevery.net/index.php?me########
- http://ca#####difference.net/index.php?me########
- http://ca####ncharge.net/index.php?me########
- http://la####ifference.net/index.php?me########
- http://el####iccharge.net/index.php?me########
- http://re#####ifference.net/index.php?me########
- http://re####charge.net/index.php?me########
- http://re####single.net/index.php?me########
- http://el####icsingle.net/index.php?me########
- http://fl####ifference.net/index.php?me########
- http://br####ifference.net/index.php?me########
- http://br###charge.net/index.php?me########
- http://br###single.net/index.php?me########
- http://fl###charge.net/index.php?me########
- http://se####single.net/index.php?me########
- http://qu###charge.net/index.php?me########
- http://qu###single.net/index.php?me########
- http://fl###every.net/index.php?me########
- http://br###every.net/index.php?me########
- http://be####charge.net/index.php?me########
- http://ga####charge.net/index.php?me########
- http://ga####single.net/index.php?me########
- http://tr###every.net/index.php?me########
- http://be####single.net/index.php?me########
- http://ga###revery.net/index.php?me########
- http://fl###single.net/index.php?me########
- http://be###revery.net/index.php?me########
- http://be#####ifference.net/index.php?me########
- http://ga#####ifference.net/index.php?me########
UDP:
- DNS ASK co####ematter.net
- DNS ASK ch###spent.net
- DNS ASK ch###matter.net
- DNS ASK th####ontrol.net
- DNS ASK pr####tcontrol.net
- DNS ASK ch####ontrol.net
- DNS ASK co####econtrol.net
- DNS ASK co####etogether.net
- DNS ASK co####espent.net
- DNS ASK ch####ogether.net
- DNS ASK se###nevery.net
- DNS ASK th###matter.net
- DNS ASK qu###every.net
- DNS ASK qu####ifference.net
- DNS ASK se#####ifference.net
- DNS ASK th####ogether.net
- DNS ASK pr####ttogether.net
- DNS ASK pr####tspent.net
- DNS ASK pr####tmatter.net
- DNS ASK th###spent.net
- DNS ASK of###matter.net
- DNS ASK mi####control.net
- DNS ASK tw####control.net
- DNS ASK tw####together.net
- DNS ASK tw###espent.net
- DNS ASK mi####together.net
- DNS ASK mo####gspent.net
- DNS ASK ra####together.net
- DNS ASK ra###rspent.net
- DNS ASK ra####matter.net
- DNS ASK mo####gmatter.net
- DNS ASK of####ogether.net
- DNS ASK al####ogether.net
- DNS ASK al###spent.net
- DNS ASK al###matter.net
- DNS ASK of###spent.net
- DNS ASK tw####matter.net
- DNS ASK mi###espent.net
- DNS ASK mi####matter.net
- DNS ASK of####ontrol.net
- DNS ASK al####ontrol.net
- DNS ASK st####single.net
- DNS ASK tr###single.net
- DNS ASK el####icevery.net
- DNS ASK el#####cdifference.net
- DNS ASK re###devery.net
- DNS ASK tr####ifference.net
- DNS ASK st###tevery.net
- DNS ASK st#####ifference.net
- DNS ASK st####charge.net
- DNS ASK tr###charge.net
- DNS ASK la###every.net
- DNS ASK ca####nevery.net
- DNS ASK ca#####difference.net
- DNS ASK ca####ncharge.net
- DNS ASK la####ifference.net
- DNS ASK el####iccharge.net
- DNS ASK re#####ifference.net
- DNS ASK re####charge.net
- DNS ASK re####single.net
- DNS ASK el####icsingle.net
- DNS ASK tr###every.net
- DNS ASK br####ifference.net
- DNS ASK fl###every.net
- DNS ASK fl####ifference.net
- DNS ASK fl###charge.net
- DNS ASK br###charge.net
- DNS ASK qu###charge.net
- DNS ASK se####charge.net
- DNS ASK se####single.net
- DNS ASK br###every.net
- DNS ASK qu###single.net
- DNS ASK ga####charge.net
- DNS ASK be#####ifference.net
- DNS ASK be####charge.net
- DNS ASK be####single.net
- DNS ASK ga####single.net
- DNS ASK fl###single.net
- DNS ASK br###single.net
- DNS ASK ga###revery.net
- DNS ASK ga#####ifference.net
- DNS ASK be###revery.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
