Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Device UserMode Reporting Process Discovery' = 'C:\unezetqbrybzy\vjxypwnq.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Protected Class Microsoft TP] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- 'C:\unezetqbrybzy\dxmbfzg.exe' "c:\unezetqbrybzy\vjxypwnq.exe"
- 'C:\unezetqbrybzy\vjxypwnq.exe'
- 'C:\unezetqbrybzy\kt1mo2qbhjrzbqvdx2sq.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\unezetqbrybzy\vjxypwnq.exe
- C:\unezetqbrybzy\dxmbfzg.exe
- C:\unezetqbrybzy\kpmioh1bc2
- %WINDIR%\unezetqbrybzy\rqh4gjz
- C:\unezetqbrybzy\rqh4gjz
- C:\unezetqbrybzy\kt1mo2qbhjrzbqvdx2sq.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\unezetqbrybzy\dxmbfzg.exe
- C:\unezetqbrybzy\vjxypwnq.exe
Удаляет следующие файлы:
- C:\unezetqbrybzy\kt1mo2qbhjrzbqvdx2sq.exe
- %WINDIR%\unezetqbrybzy\rqh4gjz
Сетевая активность:
Подключается к:
- 'jo####ypartial.net':80
- 'hu####dpartial.net':80
- 'hu####dstrike.net':80
- 'hu####dposition.net':80
- 'jo####ystrike.net':80
- 'li####position.net':80
- 'de####ystrike.net':80
- 'de####yposition.net':80
- 'de####ynumber.net':80
- 'li####number.net':80
- 'wo#####ectricity.net':80
- 're#####relectricity.net':80
- 're####ertrain.net':80
- 're####erborrow.net':80
- 'wo###train.net':80
- 'hu####dnumber.net':80
- 'jo####yposition.net':80
- 'jo####ynumber.net':80
- 'wo####elight.net':80
- 're####erdelight.net':80
- 'ch####osition.net':80
- 'th####osition.net':80
- 'th###number.net':80
- 'be####partial.net':80
- 'ch###number.net':80
- 'th####artial.net':80
- 'wi####number.net':80
- 'ch####artial.net':80
- 'ch###strike.net':80
- 'th###strike.net':80
- 'ri####number.net':80
- 'be####number.net':80
- 'li####partial.net':80
- 'li####strike.net':80
- 'de####ypartial.net':80
- 'be####strike.net':80
- 'ri####partial.net':80
- 'ri####strike.net':80
- 'ri####position.net':80
- 'be####position.net':80
- 'wo###borrow.net':80
- 'th#####ectricity.net':80
- 'ch####elight.net':80
- 'ch#####ectricity.net':80
- 'ch###train.net':80
- 'th###train.net':80
- 'wi###ntrain.net':80
- 'su###rtrain.net':80
- 'su####borrow.net':80
- 'th####elight.net':80
- 'wi####borrow.net':80
- 'be###gtrain.net':80
- 'ri#####lectricity.net':80
- 'ri###ntrain.net':80
- 'ri####borrow.net':80
- 'be####borrow.net':80
- 'ch###borrow.net':80
- 'th###borrow.net':80
- 'be####delight.net':80
- 'be#####lectricity.net':80
- 'ri####delight.net':80
- 'in####seborrow.net':80
- 'fo###ttrain.net':80
- 'fo####borrow.net':80
- 'ef####delight.net':80
- 'th####hdelight.net':80
- 'fo####delight.net':80
- 'in####sedelight.net':80
- 'in#####eelectricity.net':80
- 'in####setrain.net':80
- 'fo#####lectricity.net':80
- 'su####delight.net':80
- 'ef####borrow.net':80
- 'wi####delight.net':80
- 'wi#####lectricity.net':80
- 'su#####lectricity.net':80
- 'ef#####lectricity.net':80
- 'th#####electricity.net':80
- 'th####htrain.net':80
- 'th####hborrow.net':80
- 'ef###ttrain.net':80
TCP:
Запросы HTTP GET:
- http://jo####ypartial.net/index.php?me########
- http://hu####dpartial.net/index.php?me########
- http://hu####dstrike.net/index.php?me########
- http://hu####dposition.net/index.php?me########
- http://jo####ystrike.net/index.php?me########
- http://li####position.net/index.php?me########
- http://de####ystrike.net/index.php?me########
- http://de####yposition.net/index.php?me########
- http://de####ynumber.net/index.php?me########
- http://li####number.net/index.php?me########
- http://wo#####ectricity.net/index.php?me########
- http://re#####relectricity.net/index.php?me########
- http://re####ertrain.net/index.php?me########
- http://re####erborrow.net/index.php?me########
- http://wo###train.net/index.php?me########
- http://hu####dnumber.net/index.php?me########
- http://jo####yposition.net/index.php?me########
- http://jo####ynumber.net/index.php?me########
- http://wo####elight.net/index.php?me########
- http://re####erdelight.net/index.php?me########
- http://ch####osition.net/index.php?me########
- http://th####osition.net/index.php?me########
- http://th###number.net/index.php?me########
- http://be####partial.net/index.php?me########
- http://ch###number.net/index.php?me########
- http://th####artial.net/index.php?me########
- http://wi####number.net/index.php?me########
- http://ch####artial.net/index.php?me########
- http://ch###strike.net/index.php?me########
- http://th###strike.net/index.php?me########
- http://ri####number.net/index.php?me########
- http://be####number.net/index.php?me########
- http://li####partial.net/index.php?me########
- http://li####strike.net/index.php?me########
- http://de####ypartial.net/index.php?me########
- http://be####strike.net/index.php?me########
- http://ri####partial.net/index.php?me########
- http://ri####strike.net/index.php?me########
- http://ri####position.net/index.php?me########
- http://be####position.net/index.php?me########
- http://wo###borrow.net/index.php?me########
- http://th#####ectricity.net/index.php?me########
- http://ch####elight.net/index.php?me########
- http://ch#####ectricity.net/index.php?me########
- http://ch###train.net/index.php?me########
- http://th###train.net/index.php?me########
- http://wi###ntrain.net/index.php?me########
- http://su###rtrain.net/index.php?me########
- http://su####borrow.net/index.php?me########
- http://th####elight.net/index.php?me########
- http://wi####borrow.net/index.php?me########
- http://be###gtrain.net/index.php?me########
- http://ri#####lectricity.net/index.php?me########
- http://ri###ntrain.net/index.php?me########
- http://ri####borrow.net/index.php?me########
- http://be####borrow.net/index.php?me########
- http://ch###borrow.net/index.php?me########
- http://th###borrow.net/index.php?me########
- http://be####delight.net/index.php?me########
- http://be#####lectricity.net/index.php?me########
- http://ri####delight.net/index.php?me########
- http://in####seborrow.net/index.php?me########
- http://fo###ttrain.net/index.php?me########
- http://fo####borrow.net/index.php?me########
- http://ef####delight.net/index.php?me########
- http://th####hdelight.net/index.php?me########
- http://fo####delight.net/index.php?me########
- http://in####sedelight.net/index.php?me########
- http://in#####eelectricity.net/index.php?me########
- http://in####setrain.net/index.php?me########
- http://fo#####lectricity.net/index.php?me########
- http://su####delight.net/index.php?me########
- http://ef####borrow.net/index.php?me########
- http://wi####delight.net/index.php?me########
- http://wi#####lectricity.net/index.php?me########
- http://su#####lectricity.net/index.php?me########
- http://ef#####lectricity.net/index.php?me########
- http://th#####electricity.net/index.php?me########
- http://th####htrain.net/index.php?me########
- http://th####hborrow.net/index.php?me########
- http://ef###ttrain.net/index.php?me########
UDP:
- DNS ASK jo####ypartial.net
- DNS ASK hu####dpartial.net
- DNS ASK hu####dstrike.net
- DNS ASK hu####dposition.net
- DNS ASK jo####ystrike.net
- DNS ASK li####position.net
- DNS ASK de####ystrike.net
- DNS ASK de####yposition.net
- DNS ASK de####ynumber.net
- DNS ASK li####number.net
- DNS ASK wo#####ectricity.net
- DNS ASK re#####relectricity.net
- DNS ASK re####ertrain.net
- DNS ASK re####erborrow.net
- DNS ASK wo###train.net
- DNS ASK hu####dnumber.net
- DNS ASK jo####yposition.net
- DNS ASK jo####ynumber.net
- DNS ASK wo####elight.net
- DNS ASK re####erdelight.net
- DNS ASK li####strike.net
- DNS ASK th####osition.net
- DNS ASK ch###strike.net
- DNS ASK ch####osition.net
- DNS ASK ch###number.net
- DNS ASK th###number.net
- DNS ASK wi####number.net
- DNS ASK su####number.net
- DNS ASK th####artial.net
- DNS ASK th###strike.net
- DNS ASK ch####artial.net
- DNS ASK be####number.net
- DNS ASK ri####position.net
- DNS ASK ri####number.net
- DNS ASK de####ypartial.net
- DNS ASK li####partial.net
- DNS ASK ri####partial.net
- DNS ASK be####partial.net
- DNS ASK be####strike.net
- DNS ASK be####position.net
- DNS ASK ri####strike.net
- DNS ASK th#####ectricity.net
- DNS ASK ch####elight.net
- DNS ASK ch#####ectricity.net
- DNS ASK ch###train.net
- DNS ASK th###train.net
- DNS ASK wi###ntrain.net
- DNS ASK su###rtrain.net
- DNS ASK su####borrow.net
- DNS ASK th####elight.net
- DNS ASK wi####borrow.net
- DNS ASK be###gtrain.net
- DNS ASK ri#####lectricity.net
- DNS ASK ri###ntrain.net
- DNS ASK ri####borrow.net
- DNS ASK be####borrow.net
- DNS ASK ch###borrow.net
- DNS ASK th###borrow.net
- DNS ASK be####delight.net
- DNS ASK be#####lectricity.net
- DNS ASK ri####delight.net
- DNS ASK wi#####lectricity.net
- DNS ASK fo###ttrain.net
- DNS ASK in####setrain.net
- DNS ASK in####seborrow.net
- DNS ASK th####hdelight.net
- DNS ASK fo####borrow.net
- DNS ASK in####sedelight.net
- DNS ASK wo###borrow.net
- DNS ASK fo####delight.net
- DNS ASK fo#####lectricity.net
- DNS ASK in#####eelectricity.net
- DNS ASK ef####borrow.net
- DNS ASK th####hborrow.net
- DNS ASK su####delight.net
- DNS ASK su#####lectricity.net
- DNS ASK wi####delight.net
- DNS ASK th#####electricity.net
- DNS ASK ef####delight.net
- DNS ASK ef#####lectricity.net
- DNS ASK ef###ttrain.net
- DNS ASK th####htrain.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
