Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'System Registry Update Interactive Log' = 'C:\xcmxjpwik\zvhwqvalknou.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\TP Drive Call Collector IP Themes] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- 'C:\xcmxjpwik\srdswkjfys.exe' "c:\xcmxjpwik\zvhwqvalknou.exe"
- 'C:\xcmxjpwik\zvhwqvalknou.exe'
- 'C:\xcmxjpwik\gdzfc3gzkmctvobh0rv.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\xcmxjpwik\zvhwqvalknou.exe
- C:\xcmxjpwik\srdswkjfys.exe
- C:\xcmxjpwik\bujxxwafi
- %WINDIR%\xcmxjpwik\siqnie
- C:\xcmxjpwik\siqnie
- C:\xcmxjpwik\gdzfc3gzkmctvobh0rv.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\xcmxjpwik\srdswkjfys.exe
- C:\xcmxjpwik\zvhwqvalknou.exe
Удаляет следующие файлы:
- C:\xcmxjpwik\gdzfc3gzkmctvobh0rv.exe
- %WINDIR%\xcmxjpwik\siqnie
Сетевая активность:
Подключается к:
- 'su#####nderstand.net':80
- 'wi#####nderstand.net':80
- 'wi###nbroad.net':80
- 'wi####behind.net':80
- 'su###rbroad.net':80
- 'ch###behind.net':80
- 'th###broad.net':80
- 'th###behind.net':80
- 'th###butter.net':80
- 'ch###butter.net':80
- 'su####behind.net':80
- 'ef####behind.net':80
- 'th####hbroad.net':80
- 'th####hbehind.net':80
- 'th####hbutter.net':80
- 'ef####butter.net':80
- 'su####butter.net':80
- 'wi####butter.net':80
- 'ef#####nderstand.net':80
- 'ef###tbroad.net':80
- 'th#####understand.net':80
- 'ch###broad.net':80
- 'li###ebroad.net':80
- 'de####ybroad.net':80
- 'de####ybehind.net':80
- 'de####ybutter.net':80
- 'li####behind.net':80
- 'jo####ybutter.net':80
- 'hu####dbehind.net':80
- 'hu####dbutter.net':80
- 'li#####nderstand.net':80
- 'de#####understand.net':80
- 'li####butter.net':80
- 'ri####butter.net':80
- 'be####behind.net':80
- 'be####butter.net':80
- 'th####nderstand.net':80
- 'ch####nderstand.net':80
- 'be#####nderstand.net':80
- 'ri#####nderstand.net':80
- 'ri###nbroad.net':80
- 'ri####behind.net':80
- 'be###gbroad.net':80
TCP:
Запросы HTTP GET:
- http://su#####nderstand.net/index.php?me########
- http://wi#####nderstand.net/index.php?me########
- http://wi###nbroad.net/index.php?me########
- http://wi####behind.net/index.php?me########
- http://su###rbroad.net/index.php?me########
- http://ch###behind.net/index.php?me########
- http://th###broad.net/index.php?me########
- http://th###behind.net/index.php?me########
- http://th###butter.net/index.php?me########
- http://ch###butter.net/index.php?me########
- http://su####behind.net/index.php?me########
- http://ef####behind.net/index.php?me########
- http://th####hbroad.net/index.php?me########
- http://th####hbehind.net/index.php?me########
- http://th####hbutter.net/index.php?me########
- http://ef####butter.net/index.php?me########
- http://su####butter.net/index.php?me########
- http://wi####butter.net/index.php?me########
- http://ef#####nderstand.net/index.php?me########
- http://ef###tbroad.net/index.php?me########
- http://th#####understand.net/index.php?me########
- http://ch###broad.net/index.php?me########
- http://li###ebroad.net/index.php?me########
- http://de####ybroad.net/index.php?me########
- http://de####ybehind.net/index.php?me########
- http://de####ybutter.net/index.php?me########
- http://li####behind.net/index.php?me########
- http://jo####ybutter.net/index.php?me########
- http://hu####dbehind.net/index.php?me########
- http://hu####dbutter.net/index.php?me########
- http://li#####nderstand.net/index.php?me########
- http://de#####understand.net/index.php?me########
- http://li####butter.net/index.php?me########
- http://ri####butter.net/index.php?me########
- http://be####behind.net/index.php?me########
- http://be####butter.net/index.php?me########
- http://th####nderstand.net/index.php?me########
- http://ch####nderstand.net/index.php?me########
- http://be#####nderstand.net/index.php?me########
- http://ri#####nderstand.net/index.php?me########
- http://ri###nbroad.net/index.php?me########
- http://ri####behind.net/index.php?me########
- http://be###gbroad.net/index.php?me########
UDP:
- DNS ASK su#####nderstand.net
- DNS ASK wi#####nderstand.net
- DNS ASK wi###nbroad.net
- DNS ASK wi####behind.net
- DNS ASK su###rbroad.net
- DNS ASK ch###behind.net
- DNS ASK th###broad.net
- DNS ASK th###behind.net
- DNS ASK th###butter.net
- DNS ASK ch###butter.net
- DNS ASK su####behind.net
- DNS ASK ef####behind.net
- DNS ASK th####hbroad.net
- DNS ASK th####hbehind.net
- DNS ASK th####hbutter.net
- DNS ASK ef####butter.net
- DNS ASK su####butter.net
- DNS ASK wi####butter.net
- DNS ASK ef#####nderstand.net
- DNS ASK ef###tbroad.net
- DNS ASK th#####understand.net
- DNS ASK ch###broad.net
- DNS ASK li###ebroad.net
- DNS ASK de####ybroad.net
- DNS ASK de####ybehind.net
- DNS ASK de####ybutter.net
- DNS ASK li####behind.net
- DNS ASK jo####ybutter.net
- DNS ASK hu####dbehind.net
- DNS ASK hu####dbutter.net
- DNS ASK li#####nderstand.net
- DNS ASK de#####understand.net
- DNS ASK li####butter.net
- DNS ASK ri####butter.net
- DNS ASK be####behind.net
- DNS ASK be####butter.net
- DNS ASK th####nderstand.net
- DNS ASK ch####nderstand.net
- DNS ASK be#####nderstand.net
- DNS ASK ri#####nderstand.net
- DNS ASK ri###nbroad.net
- DNS ASK ri####behind.net
- DNS ASK be###gbroad.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
