Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Publication Alerts Instrumentation Accounts' = 'C:\vacincoihzt\lldipzvi.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Networking RPC Panel Media Time] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- 'C:\vacincoihzt\vzulhdjdqdwg.exe' "c:\vacincoihzt\lldipzvi.exe"
- 'C:\vacincoihzt\lldipzvi.exe'
- 'C:\vacincoihzt\vnc52n99vdlsryd7.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\vacincoihzt\lldipzvi.exe
- C:\vacincoihzt\vzulhdjdqdwg.exe
- C:\vacincoihzt\byhpum
- %WINDIR%\vacincoihzt\cdi70akcy6
- C:\vacincoihzt\cdi70akcy6
- C:\vacincoihzt\vnc52n99vdlsryd7.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\vacincoihzt\vzulhdjdqdwg.exe
- C:\vacincoihzt\lldipzvi.exe
Удаляет следующие файлы:
- C:\vacincoihzt\vnc52n99vdlsryd7.exe
- %WINDIR%\vacincoihzt\cdi70akcy6
Сетевая активность:
Подключается к:
- 'th####hangry.net':80
- 'ef###tangry.net':80
- 'th####hfifteen.net':80
- 'fo###tdried.net':80
- 'th####harticle.net':80
- 'ef####article.net':80
- 'su####article.net':80
- 'wi####article.net':80
- 'su###rangry.net':80
- 'ef####fifteen.net':80
- 'th####hdried.net':80
- 'ef###tdried.net':80
- 're####erdried.net':80
- 'wo###dried.net':80
- 'in####searticle.net':80
- 'wo###angry.net':80
- 're####erfifteen.net':80
- 'wo####ifteen.net':80
- 'in####sefifteen.net':80
- 'fo####fifteen.net':80
- 'in####sedried.net':80
- 'fo####article.net':80
- 'in####seangry.net':80
- 'fo###tangry.net':80
- 'be###gangry.net':80
- 'ri###nangry.net':80
- 'be####fifteen.net':80
- 'ch###dried.net':80
- 'be####article.net':80
- 'ri####article.net':80
- 'li####article.net':80
- 'de####yarticle.net':80
- 'li###eangry.net':80
- 'ri####fifteen.net':80
- 'be###gdried.net':80
- 'ri###ndried.net':80
- 'su###rdried.net':80
- 'wi###ndried.net':80
- 'th####rticle.net':80
- 'wi###nangry.net':80
- 'su####fifteen.net':80
- 'wi####fifteen.net':80
- 'th####ifteen.net':80
- 'ch####ifteen.net':80
- 'th###dried.net':80
- 'ch####rticle.net':80
- 'th###angry.net':80
- 'ch###angry.net':80
TCP:
Запросы HTTP GET:
- http://th####hangry.net/index.php?me########
- http://ef###tangry.net/index.php?me########
- http://th####hfifteen.net/index.php?me########
- http://fo###tdried.net/index.php?me########
- http://th####harticle.net/index.php?me########
- http://ef####article.net/index.php?me########
- http://su####article.net/index.php?me########
- http://wi####article.net/index.php?me########
- http://su###rangry.net/index.php?me########
- http://ef####fifteen.net/index.php?me########
- http://th####hdried.net/index.php?me########
- http://ef###tdried.net/index.php?me########
- http://re####erdried.net/index.php?me########
- http://wo###dried.net/index.php?me########
- http://in####searticle.net/index.php?me########
- http://wo###angry.net/index.php?me########
- http://re####erfifteen.net/index.php?me########
- http://wo####ifteen.net/index.php?me########
- http://in####sefifteen.net/index.php?me########
- http://fo####fifteen.net/index.php?me########
- http://in####sedried.net/index.php?me########
- http://fo####article.net/index.php?me########
- http://in####seangry.net/index.php?me########
- http://fo###tangry.net/index.php?me########
- http://be###gangry.net/index.php?me########
- http://ri###nangry.net/index.php?me########
- http://be####fifteen.net/index.php?me########
- http://ch###dried.net/index.php?me########
- http://be####article.net/index.php?me########
- http://ri####article.net/index.php?me########
- http://li####article.net/index.php?me########
- http://de####yarticle.net/index.php?me########
- http://li###eangry.net/index.php?me########
- http://ri####fifteen.net/index.php?me########
- http://be###gdried.net/index.php?me########
- http://ri###ndried.net/index.php?me########
- http://su###rdried.net/index.php?me########
- http://wi###ndried.net/index.php?me########
- http://th####rticle.net/index.php?me########
- http://wi###nangry.net/index.php?me########
- http://su####fifteen.net/index.php?me########
- http://wi####fifteen.net/index.php?me########
- http://th####ifteen.net/index.php?me########
- http://ch####ifteen.net/index.php?me########
- http://th###dried.net/index.php?me########
- http://ch####rticle.net/index.php?me########
- http://th###angry.net/index.php?me########
- http://ch###angry.net/index.php?me########
UDP:
- DNS ASK ef####article.net
- DNS ASK th####hangry.net
- DNS ASK ef###tangry.net
- DNS ASK in####sedried.net
- DNS ASK fo###tdried.net
- DNS ASK th####harticle.net
- DNS ASK ef###tdried.net
- DNS ASK su####article.net
- DNS ASK wi####article.net
- DNS ASK th####hfifteen.net
- DNS ASK ef####fifteen.net
- DNS ASK th####hdried.net
- DNS ASK wo####ifteen.net
- DNS ASK re####erdried.net
- DNS ASK wo###dried.net
- DNS ASK re####erangry.net
- DNS ASK wo###angry.net
- DNS ASK re####erfifteen.net
- DNS ASK fo###tangry.net
- DNS ASK in####sefifteen.net
- DNS ASK fo####fifteen.net
- DNS ASK in####searticle.net
- DNS ASK fo####article.net
- DNS ASK in####seangry.net
- DNS ASK su###rangry.net
- DNS ASK be###gangry.net
- DNS ASK ri###nangry.net
- DNS ASK be####fifteen.net
- DNS ASK ch###dried.net
- DNS ASK be####article.net
- DNS ASK ri####article.net
- DNS ASK li####article.net
- DNS ASK de####yarticle.net
- DNS ASK li###eangry.net
- DNS ASK ri####fifteen.net
- DNS ASK be###gdried.net
- DNS ASK ri###ndried.net
- DNS ASK su###rdried.net
- DNS ASK wi###ndried.net
- DNS ASK th####rticle.net
- DNS ASK wi###nangry.net
- DNS ASK su####fifteen.net
- DNS ASK wi####fifteen.net
- DNS ASK th####ifteen.net
- DNS ASK ch####ifteen.net
- DNS ASK th###dried.net
- DNS ASK ch####rticle.net
- DNS ASK th###angry.net
- DNS ASK ch###angry.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
