Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Presentation COM Services Update' = 'C:\ysqovqxddatj\jincpffpluuq.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\UserMode PnP-X Audio Print Receiver] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- 'C:\ysqovqxddatj\bhzulwebwhi.exe' "c:\ysqovqxddatj\jincpffpluuq.exe"
- 'C:\ysqovqxddatj\jincpffpluuq.exe'
- 'C:\ysqovqxddatj\pk7a3mdkejwicjmvqowt.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\ysqovqxddatj\jincpffpluuq.exe
- C:\ysqovqxddatj\bhzulwebwhi.exe
- C:\ysqovqxddatj\hyglks
- %WINDIR%\ysqovqxddatj\tqy5stofvbek
- C:\ysqovqxddatj\tqy5stofvbek
- C:\ysqovqxddatj\pk7a3mdkejwicjmvqowt.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\ysqovqxddatj\bhzulwebwhi.exe
- C:\ysqovqxddatj\jincpffpluuq.exe
Удаляет следующие файлы:
- C:\ysqovqxddatj\pk7a3mdkejwicjmvqowt.exe
- %WINDIR%\ysqovqxddatj\tqy5stofvbek
Сетевая активность:
Подключается к:
- 'be#####nderstood.net':80
- 'ga####twenty.net':80
- 'ga#####nderstood.net':80
- 'br###chance.net':80
- 'fl###chance.net':80
- 'ga####chance.net':80
- 'be####chance.net':80
- 'be####meeting.net':80
- 'be####twenty.net':80
- 'ga####meeting.net':80
- 'fl####eeting.net':80
- 'se####chance.net':80
- 'qu###chance.net':80
- 'qu####eeting.net':80
- 'qu###twenty.net':80
- 'se####meeting.net':80
- 'fl###twenty.net':80
- 'br####eeting.net':80
- 'br###twenty.net':80
- 'br####nderstood.net':80
- 'fl####nderstood.net':80
- 'tr####nderstood.net':80
- 're####chance.net':80
- 'ca#####understood.net':80
- 'el####icchance.net':80
- 'el####icmeeting.net':80
- 're####meeting.net':80
- 'ca####nmeeting.net':80
- 'la####eeting.net':80
- 'la###twenty.net':80
- 'la####nderstood.net':80
- 'ca####ntwenty.net':80
- 're####twenty.net':80
- 'tr####eeting.net':80
- 'st####meeting.net':80
- 'st####twenty.net':80
- 'st#####nderstood.net':80
- 'tr###twenty.net':80
- 're#####nderstood.net':80
- 'el####ictwenty.net':80
- 'el#####cunderstood.net':80
- 'tr###chance.net':80
- 'st####chance.net':80
TCP:
Запросы HTTP GET:
- http://be#####nderstood.net/index.php?me########
- http://ga####twenty.net/index.php?me########
- http://ga#####nderstood.net/index.php?me########
- http://br###chance.net/index.php?me########
- http://fl###chance.net/index.php?me########
- http://ga####chance.net/index.php?me########
- http://be####chance.net/index.php?me########
- http://be####meeting.net/index.php?me########
- http://be####twenty.net/index.php?me########
- http://ga####meeting.net/index.php?me########
- http://fl####eeting.net/index.php?me########
- http://se####chance.net/index.php?me########
- http://qu###chance.net/index.php?me########
- http://qu####eeting.net/index.php?me########
- http://qu###twenty.net/index.php?me########
- http://se####meeting.net/index.php?me########
- http://fl###twenty.net/index.php?me########
- http://br####eeting.net/index.php?me########
- http://br###twenty.net/index.php?me########
- http://br####nderstood.net/index.php?me########
- http://fl####nderstood.net/index.php?me########
- http://tr####nderstood.net/index.php?me########
- http://re####chance.net/index.php?me########
- http://ca#####understood.net/index.php?me########
- http://el####icchance.net/index.php?me########
- http://el####icmeeting.net/index.php?me########
- http://re####meeting.net/index.php?me########
- http://ca####nmeeting.net/index.php?me########
- http://la####eeting.net/index.php?me########
- http://la###twenty.net/index.php?me########
- http://la####nderstood.net/index.php?me########
- http://ca####ntwenty.net/index.php?me########
- http://re####twenty.net/index.php?me########
- http://tr####eeting.net/index.php?me########
- http://st####meeting.net/index.php?me########
- http://st####twenty.net/index.php?me########
- http://st#####nderstood.net/index.php?me########
- http://tr###twenty.net/index.php?me########
- http://re#####nderstood.net/index.php?me########
- http://el####ictwenty.net/index.php?me########
- http://el#####cunderstood.net/index.php?me########
- http://tr###chance.net/index.php?me########
- http://st####chance.net/index.php?me########
UDP:
- DNS ASK be#####nderstood.net
- DNS ASK ga####twenty.net
- DNS ASK ga#####nderstood.net
- DNS ASK br###chance.net
- DNS ASK fl###chance.net
- DNS ASK ga####chance.net
- DNS ASK be####chance.net
- DNS ASK be####meeting.net
- DNS ASK be####twenty.net
- DNS ASK ga####meeting.net
- DNS ASK fl####eeting.net
- DNS ASK se####chance.net
- DNS ASK qu###chance.net
- DNS ASK qu####eeting.net
- DNS ASK qu###twenty.net
- DNS ASK se####meeting.net
- DNS ASK fl###twenty.net
- DNS ASK br####eeting.net
- DNS ASK br###twenty.net
- DNS ASK br####nderstood.net
- DNS ASK fl####nderstood.net
- DNS ASK tr####nderstood.net
- DNS ASK re####chance.net
- DNS ASK ca#####understood.net
- DNS ASK el####icchance.net
- DNS ASK el####icmeeting.net
- DNS ASK re####meeting.net
- DNS ASK ca####nmeeting.net
- DNS ASK la####eeting.net
- DNS ASK la###twenty.net
- DNS ASK la####nderstood.net
- DNS ASK ca####ntwenty.net
- DNS ASK re####twenty.net
- DNS ASK tr####eeting.net
- DNS ASK st####meeting.net
- DNS ASK st####twenty.net
- DNS ASK st#####nderstood.net
- DNS ASK tr###twenty.net
- DNS ASK re#####nderstood.net
- DNS ASK el####ictwenty.net
- DNS ASK el#####cunderstood.net
- DNS ASK tr###chance.net
- DNS ASK st####chance.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
