Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Defragmenter Locator AutoConnect Server DCOM' = 'C:\noiqfyxkzmfeq\ueeyvmsvzc.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Event Counter Process Log Protected DCOM] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- 'C:\noiqfyxkzmfeq\indgmhprs.exe' "c:\noiqfyxkzmfeq\ueeyvmsvzc.exe"
- 'C:\noiqfyxkzmfeq\ueeyvmsvzc.exe'
- 'C:\noiqfyxkzmfeq\fxg3340zt9lmgsfu5tv.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\noiqfyxkzmfeq\ueeyvmsvzc.exe
- C:\noiqfyxkzmfeq\indgmhprs.exe
- C:\noiqfyxkzmfeq\cjrq4bhi
- %WINDIR%\noiqfyxkzmfeq\fcov8m14hb
- C:\noiqfyxkzmfeq\fcov8m14hb
- C:\noiqfyxkzmfeq\fxg3340zt9lmgsfu5tv.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\noiqfyxkzmfeq\indgmhprs.exe
- C:\noiqfyxkzmfeq\ueeyvmsvzc.exe
Удаляет следующие файлы:
- C:\noiqfyxkzmfeq\fxg3340zt9lmgsfu5tv.exe
- %WINDIR%\noiqfyxkzmfeq\fcov8m14hb
Сетевая активность:
Подключается к:
- 'tw####battle.net':80
- 'mi####battle.net':80
- 'tw###emayor.net':80
- 'ra###rheart.net':80
- 'mo####gperfect.net':80
- 'ra####perfect.net':80
- 'mo####gheart.net':80
- 'mi###emayor.net':80
- 'al###battle.net':80
- 'of###battle.net':80
- 'al###mayor.net':80
- 'mi###eheart.net':80
- 'tw####perfect.net':80
- 'mi####perfect.net':80
- 'tw###eheart.net':80
- 'ra###rmayor.net':80
- 'hi####ybattle.net':80
- 'st####ebattle.net':80
- 'hi####ymayor.net':80
- 'am###theart.net':80
- 'we####rperfect.net':80
- 'am####perfect.net':80
- 'we####rheart.net':80
- 'st####emayor.net':80
- 'mo####gbattle.net':80
- 'ra####battle.net':80
- 'mo####gmayor.net':80
- 'st####eheart.net':80
- 'hi####yperfect.net':80
- 'st####eperfect.net':80
- 'hi####yheart.net':80
- 'th###heart.net':80
- 'cl###white.net':80
- 'th###white.net':80
- 'pr####theart.net':80
- 'th###mayor.net':80
- 'pr####tperfect.net':80
- 'th####erfect.net':80
- 'cl####illion.net':80
- 'th###toward.net':80
- 'we####rwhite.net':80
- 'am###twhite.net':80
- 'cl###toward.net':80
- 'th####illion.net':80
- 'cl####leasure.net':80
- 'th####leasure.net':80
- 'pr####tmayor.net':80
- 'of###heart.net':80
- 'co####ebattle.net':80
- 'ch###battle.net':80
- 'al###heart.net':80
- 'of###mayor.net':80
- 'al####erfect.net':80
- 'of####erfect.net':80
- 'co####emayor.net':80
- 'ch###heart.net':80
- 'pr####tbattle.net':80
- 'th###battle.net':80
- 'co####eheart.net':80
- 'ch###mayor.net':80
- 'co####eperfect.net':80
- 'ch####erfect.net':80
TCP:
Запросы HTTP GET:
- http://tw####battle.net/index.php?me########
- http://mi####battle.net/index.php?me########
- http://tw###emayor.net/index.php?me########
- http://ra###rheart.net/index.php?me########
- http://mo####gperfect.net/index.php?me########
- http://ra####perfect.net/index.php?me########
- http://mo####gheart.net/index.php?me########
- http://mi###emayor.net/index.php?me########
- http://al###battle.net/index.php?me########
- http://of###battle.net/index.php?me########
- http://al###mayor.net/index.php?me########
- http://mi###eheart.net/index.php?me########
- http://tw####perfect.net/index.php?me########
- http://mi####perfect.net/index.php?me########
- http://tw###eheart.net/index.php?me########
- http://ra###rmayor.net/index.php?me########
- http://hi####ybattle.net/index.php?me########
- http://st####ebattle.net/index.php?me########
- http://hi####ymayor.net/index.php?me########
- http://am###theart.net/index.php?me########
- http://we####rperfect.net/index.php?me########
- http://am####perfect.net/index.php?me########
- http://we####rheart.net/index.php?me########
- http://st####emayor.net/index.php?me########
- http://mo####gbattle.net/index.php?me########
- http://ra####battle.net/index.php?me########
- http://mo####gmayor.net/index.php?me########
- http://st####eheart.net/index.php?me########
- http://hi####yperfect.net/index.php?me########
- http://st####eperfect.net/index.php?me########
- http://hi####yheart.net/index.php?me########
- http://th###heart.net/index.php?me########
- http://cl###white.net/index.php?me########
- http://th###white.net/index.php?me########
- http://pr####theart.net/index.php?me########
- http://th###mayor.net/index.php?me########
- http://pr####tperfect.net/index.php?me########
- http://th####erfect.net/index.php?me########
- http://cl####illion.net/index.php?me########
- http://th###toward.net/index.php?me########
- http://we####rwhite.net/index.php?me########
- http://am###twhite.net/index.php?me########
- http://cl###toward.net/index.php?me########
- http://th####illion.net/index.php?me########
- http://cl####leasure.net/index.php?me########
- http://th####leasure.net/index.php?me########
- http://pr####tmayor.net/index.php?me########
- http://of###heart.net/index.php?me########
- http://co####ebattle.net/index.php?me########
- http://ch###battle.net/index.php?me########
- http://al###heart.net/index.php?me########
- http://of###mayor.net/index.php?me########
- http://al####erfect.net/index.php?me########
- http://of####erfect.net/index.php?me########
- http://co####emayor.net/index.php?me########
- http://ch###heart.net/index.php?me########
- http://pr####tbattle.net/index.php?me########
- http://th###battle.net/index.php?me########
- http://co####eheart.net/index.php?me########
- http://ch###mayor.net/index.php?me########
- http://co####eperfect.net/index.php?me########
- http://ch####erfect.net/index.php?me########
UDP:
- DNS ASK ra###rheart.net
- DNS ASK tw####battle.net
- DNS ASK mi####battle.net
- DNS ASK mo####gheart.net
- DNS ASK ra###rmayor.net
- DNS ASK mo####gperfect.net
- DNS ASK ra####perfect.net
- DNS ASK tw###emayor.net
- DNS ASK mi###eheart.net
- DNS ASK al###battle.net
- DNS ASK of###battle.net
- DNS ASK tw###eheart.net
- DNS ASK mi###emayor.net
- DNS ASK tw####perfect.net
- DNS ASK mi####perfect.net
- DNS ASK mo####gmayor.net
- DNS ASK am###theart.net
- DNS ASK hi####ybattle.net
- DNS ASK st####ebattle.net
- DNS ASK we####rheart.net
- DNS ASK am###tmayor.net
- DNS ASK we####rperfect.net
- DNS ASK am####perfect.net
- DNS ASK hi####ymayor.net
- DNS ASK st####eheart.net
- DNS ASK mo####gbattle.net
- DNS ASK ra####battle.net
- DNS ASK hi####yheart.net
- DNS ASK st####emayor.net
- DNS ASK hi####yperfect.net
- DNS ASK st####eperfect.net
- DNS ASK al###mayor.net
- DNS ASK th###heart.net
- DNS ASK cl###white.net
- DNS ASK th###white.net
- DNS ASK pr####theart.net
- DNS ASK th###mayor.net
- DNS ASK pr####tperfect.net
- DNS ASK th####erfect.net
- DNS ASK cl####illion.net
- DNS ASK th###toward.net
- DNS ASK we####rwhite.net
- DNS ASK am###twhite.net
- DNS ASK cl###toward.net
- DNS ASK th####illion.net
- DNS ASK cl####leasure.net
- DNS ASK th####leasure.net
- DNS ASK pr####tmayor.net
- DNS ASK of###heart.net
- DNS ASK co####ebattle.net
- DNS ASK ch###battle.net
- DNS ASK al###heart.net
- DNS ASK of###mayor.net
- DNS ASK al####erfect.net
- DNS ASK of####erfect.net
- DNS ASK co####emayor.net
- DNS ASK ch###heart.net
- DNS ASK pr####tbattle.net
- DNS ASK th###battle.net
- DNS ASK co####eheart.net
- DNS ASK ch###mayor.net
- DNS ASK co####eperfect.net
- DNS ASK ch####erfect.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
