Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Server Encrypting Connection Sharing' = 'C:\cmyovjdvfvorc\mhrylvnvymg.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\File DNS Services Shell Video] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- 'C:\cmyovjdvfvorc\flvrffz.exe' "c:\cmyovjdvfvorc\mhrylvnvymg.exe"
- 'C:\cmyovjdvfvorc\mhrylvnvymg.exe'
- 'C:\cmyovjdvfvorc\yeda32diq6mbfj6ugp.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\cmyovjdvfvorc\mhrylvnvymg.exe
- C:\cmyovjdvfvorc\flvrffz.exe
- C:\cmyovjdvfvorc\seuzu6xd
- %WINDIR%\cmyovjdvfvorc\h8swgp6kips
- C:\cmyovjdvfvorc\h8swgp6kips
- C:\cmyovjdvfvorc\yeda32diq6mbfj6ugp.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\cmyovjdvfvorc\flvrffz.exe
- C:\cmyovjdvfvorc\mhrylvnvymg.exe
Удаляет следующие файлы:
- C:\cmyovjdvfvorc\yeda32diq6mbfj6ugp.exe
- %WINDIR%\cmyovjdvfvorc\h8swgp6kips
Сетевая активность:
Подключается к:
- 'hi####ymillion.net':80
- 'st####emillion.net':80
- 'st####ewhite.net':80
- 'am####toward.net':80
- 'hi####ywhite.net':80
- 'st####etoward.net':80
- 'mo####gwhite.net':80
- 'hi####ytoward.net':80
- 'hi####ypleasure.net':80
- 'st####epleasure.net':80
- 'we####rtoward.net':80
- 'th###toward.net':80
- 'we####rwhite.net':80
- 'cl###toward.net':80
- 'cl####leasure.net':80
- 'th####leasure.net':80
- 'we####rpleasure.net':80
- 'am####pleasure.net':80
- 'am####million.net':80
- 'am###twhite.net':80
- 'we####rmillion.net':80
- 'ra###rwhite.net':80
- 'al###white.net':80
- 'of###white.net':80
- 'mi####toward.net':80
- 'mi####pleasure.net':80
- 'tw####toward.net':80
- 'of####leasure.net':80
- 'al###toward.net':80
- 'al####leasure.net':80
- 'al####illion.net':80
- 'of####illion.net':80
- 'tw####pleasure.net':80
- 'ra####pleasure.net':80
- 'mo####gtoward.net':80
- 'mo####gpleasure.net':80
- 'mo####gmillion.net':80
- 'ra####million.net':80
- 'tw####million.net':80
- 'mi####million.net':80
- 'mi###ewhite.net':80
- 'ra####toward.net':80
- 'tw###ewhite.net':80
TCP:
Запросы HTTP GET:
- http://hi####ymillion.net/index.php?me########
- http://st####emillion.net/index.php?me########
- http://st####ewhite.net/index.php?me########
- http://am####toward.net/index.php?me########
- http://hi####ywhite.net/index.php?me########
- http://st####etoward.net/index.php?me########
- http://mo####gwhite.net/index.php?me########
- http://hi####ytoward.net/index.php?me########
- http://hi####ypleasure.net/index.php?me########
- http://st####epleasure.net/index.php?me########
- http://we####rtoward.net/index.php?me########
- http://th###toward.net/index.php?me########
- http://we####rwhite.net/index.php?me########
- http://cl###toward.net/index.php?me########
- http://cl####leasure.net/index.php?me########
- http://th####leasure.net/index.php?me########
- http://we####rpleasure.net/index.php?me########
- http://am####pleasure.net/index.php?me########
- http://am####million.net/index.php?me########
- http://am###twhite.net/index.php?me########
- http://we####rmillion.net/index.php?me########
- http://ra###rwhite.net/index.php?me########
- http://al###white.net/index.php?me########
- http://of###white.net/index.php?me########
- http://mi####toward.net/index.php?me########
- http://mi####pleasure.net/index.php?me########
- http://tw####toward.net/index.php?me########
- http://of####leasure.net/index.php?me########
- http://al###toward.net/index.php?me########
- http://al####leasure.net/index.php?me########
- http://al####illion.net/index.php?me########
- http://of####illion.net/index.php?me########
- http://tw####pleasure.net/index.php?me########
- http://ra####pleasure.net/index.php?me########
- http://mo####gtoward.net/index.php?me########
- http://mo####gpleasure.net/index.php?me########
- http://mo####gmillion.net/index.php?me########
- http://ra####million.net/index.php?me########
- http://tw####million.net/index.php?me########
- http://mi####million.net/index.php?me########
- http://mi###ewhite.net/index.php?me########
- http://ra####toward.net/index.php?me########
- http://tw###ewhite.net/index.php?me########
UDP:
- DNS ASK st####ewhite.net
- DNS ASK hi####ymillion.net
- DNS ASK hi####ywhite.net
- DNS ASK we####rtoward.net
- DNS ASK am####toward.net
- DNS ASK st####emillion.net
- DNS ASK st####etoward.net
- DNS ASK mo####gwhite.net
- DNS ASK hi####ytoward.net
- DNS ASK hi####ypleasure.net
- DNS ASK st####epleasure.net
- DNS ASK cl###toward.net
- DNS ASK th###toward.net
- DNS ASK th####leasure.net
- DNS ASK th####illion.net
- DNS ASK cl####leasure.net
- DNS ASK we####rwhite.net
- DNS ASK we####rpleasure.net
- DNS ASK am####pleasure.net
- DNS ASK am####million.net
- DNS ASK am###twhite.net
- DNS ASK we####rmillion.net
- DNS ASK mi####toward.net
- DNS ASK al###white.net
- DNS ASK tw####toward.net
- DNS ASK tw####pleasure.net
- DNS ASK mi####pleasure.net
- DNS ASK of###white.net
- DNS ASK of####leasure.net
- DNS ASK al###toward.net
- DNS ASK al####leasure.net
- DNS ASK al####illion.net
- DNS ASK of####illion.net
- DNS ASK mo####gpleasure.net
- DNS ASK ra####pleasure.net
- DNS ASK ra####million.net
- DNS ASK ra###rwhite.net
- DNS ASK mo####gmillion.net
- DNS ASK mo####gtoward.net
- DNS ASK tw####million.net
- DNS ASK mi####million.net
- DNS ASK mi###ewhite.net
- DNS ASK ra####toward.net
- DNS ASK tw###ewhite.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
