Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Protected System Brightness iSCSI' = 'C:\amksunv\nloswkxdwm.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Browser Resolution Cache Call Adaptive] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- 'C:\amksunv\kxhzfxn.exe' "c:\amksunv\nloswkxdwm.exe"
- 'C:\amksunv\nloswkxdwm.exe'
- 'C:\amksunv\ffr39vxufrclvb2s.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\amksunv\nloswkxdwm.exe
- C:\amksunv\kxhzfxn.exe
- C:\amksunv\xewjs8ta
- %WINDIR%\amksunv\q1fkzigpd
- C:\amksunv\q1fkzigpd
- C:\amksunv\ffr39vxufrclvb2s.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\amksunv\kxhzfxn.exe
- C:\amksunv\nloswkxdwm.exe
Удаляет следующие файлы:
- C:\amksunv\ffr39vxufrclvb2s.exe
- %WINDIR%\amksunv\q1fkzigpd
Сетевая активность:
Подключается к:
- 'pl####ntheart.net':80
- 'he###battle.net':80
- 'di####ultbattle.net':80
- 'ne#####ryperfect.net':80
- 'pl####ntperfect.net':80
- 'ne####aryheart.net':80
- 'di#####ltperfect.net':80
- 'he###heart.net':80
- 'di####ultheart.net':80
- 'he###mayor.net':80
- 'di####ultmayor.net':80
- 'he####erfect.net':80
- 'pl####ntmayor.net':80
- 're####emayor.net':80
- 'or###mayor.net':80
- 're####eperfect.net':80
- 'le###rheart.net':80
- 're####ebattle.net':80
- 'or###battle.net':80
- 'ne####arybattle.net':80
- 'pl####ntbattle.net':80
- 'ne####arymayor.net':80
- 'or####erfect.net':80
- 're####eheart.net':80
- 'or###heart.net':80
- 'gl###battle.net':80
- 'va####swhite.net':80
- 're####million.net':80
- 'va####smillion.net':80
- 'fo####dheart.net':80
- 'de###eheart.net':80
- 're###nwhite.net':80
- 'va####stoward.net':80
- 'ge###ewhite.net':80
- 'he###white.net':80
- 're####pleasure.net':80
- 'va####spleasure.net':80
- 're####toward.net':80
- 'de####perfect.net':80
- 'gl####erfect.net':80
- 'an####perfect.net':80
- 'gl###heart.net':80
- 'an####battle.net':80
- 'gl###mayor.net':80
- 'an###rmayor.net':80
- 'fo####dmayor.net':80
- 'de###emayor.net':80
- 'fo####dperfect.net':80
- 'an###rheart.net':80
- 'fo####dbattle.net':80
- 'de####battle.net':80
TCP:
Запросы HTTP GET:
- http://pl####ntheart.net/index.php?me########
- http://he###battle.net/index.php?me########
- http://di####ultbattle.net/index.php?me########
- http://ne#####ryperfect.net/index.php?me########
- http://pl####ntperfect.net/index.php?me########
- http://ne####aryheart.net/index.php?me########
- http://di#####ltperfect.net/index.php?me########
- http://he###heart.net/index.php?me########
- http://di####ultheart.net/index.php?me########
- http://he###mayor.net/index.php?me########
- http://di####ultmayor.net/index.php?me########
- http://he####erfect.net/index.php?me########
- http://pl####ntmayor.net/index.php?me########
- http://re####emayor.net/index.php?me########
- http://or###mayor.net/index.php?me########
- http://re####eperfect.net/index.php?me########
- http://le###rheart.net/index.php?me########
- http://re####ebattle.net/index.php?me########
- http://or###battle.net/index.php?me########
- http://ne####arybattle.net/index.php?me########
- http://pl####ntbattle.net/index.php?me########
- http://ne####arymayor.net/index.php?me########
- http://or####erfect.net/index.php?me########
- http://re####eheart.net/index.php?me########
- http://or###heart.net/index.php?me########
- http://gl###battle.net/index.php?me########
- http://va####swhite.net/index.php?me########
- http://re####million.net/index.php?me########
- http://va####smillion.net/index.php?me########
- http://fo####dheart.net/index.php?me########
- http://de###eheart.net/index.php?me########
- http://re###nwhite.net/index.php?me########
- http://va####stoward.net/index.php?me########
- http://ge###ewhite.net/index.php?me########
- http://he###white.net/index.php?me########
- http://re####pleasure.net/index.php?me########
- http://va####spleasure.net/index.php?me########
- http://re####toward.net/index.php?me########
- http://de####perfect.net/index.php?me########
- http://gl####erfect.net/index.php?me########
- http://an####perfect.net/index.php?me########
- http://gl###heart.net/index.php?me########
- http://an####battle.net/index.php?me########
- http://gl###mayor.net/index.php?me########
- http://an###rmayor.net/index.php?me########
- http://fo####dmayor.net/index.php?me########
- http://de###emayor.net/index.php?me########
- http://fo####dperfect.net/index.php?me########
- http://an###rheart.net/index.php?me########
- http://fo####dbattle.net/index.php?me########
- http://de####battle.net/index.php?me########
UDP:
- DNS ASK ne####aryheart.net
- DNS ASK pl####ntheart.net
- DNS ASK he###battle.net
- DNS ASK pl####ntmayor.net
- DNS ASK ne#####ryperfect.net
- DNS ASK pl####ntperfect.net
- DNS ASK di####ultbattle.net
- DNS ASK di#####ltperfect.net
- DNS ASK he###heart.net
- DNS ASK di####ultheart.net
- DNS ASK he###mayor.net
- DNS ASK di####ultmayor.net
- DNS ASK he####erfect.net
- DNS ASK or###battle.net
- DNS ASK re####emayor.net
- DNS ASK or###mayor.net
- DNS ASK he###nheart.net
- DNS ASK le###rheart.net
- DNS ASK re####ebattle.net
- DNS ASK re####eperfect.net
- DNS ASK ne####arybattle.net
- DNS ASK pl####ntbattle.net
- DNS ASK ne####arymayor.net
- DNS ASK or####erfect.net
- DNS ASK re####eheart.net
- DNS ASK or###heart.net
- DNS ASK re###nwhite.net
- DNS ASK va####swhite.net
- DNS ASK re####million.net
- DNS ASK de####perfect.net
- DNS ASK fo####dheart.net
- DNS ASK de###eheart.net
- DNS ASK va####smillion.net
- DNS ASK va####stoward.net
- DNS ASK ge###ewhite.net
- DNS ASK he###white.net
- DNS ASK re####pleasure.net
- DNS ASK va####spleasure.net
- DNS ASK re####toward.net
- DNS ASK an###rmayor.net
- DNS ASK gl####erfect.net
- DNS ASK an####perfect.net
- DNS ASK gl###battle.net
- DNS ASK an####battle.net
- DNS ASK gl###mayor.net
- DNS ASK gl###heart.net
- DNS ASK fo####dmayor.net
- DNS ASK de###emayor.net
- DNS ASK fo####dperfect.net
- DNS ASK an###rheart.net
- DNS ASK fo####dbattle.net
- DNS ASK de####battle.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
