Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'BitLocker Base Gateway Problem Services' = 'C:\xcemgcehc\ikhmuvasl.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Service Configuration Publication] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- 'C:\xcemgcehc\jdpvijmp.exe' "c:\xcemgcehc\ikhmuvasl.exe"
- 'C:\xcemgcehc\ikhmuvasl.exe'
- 'C:\xcemgcehc\viu49ekyhlwjcqwaj.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\xcemgcehc\ikhmuvasl.exe
- C:\xcemgcehc\jdpvijmp.exe
- C:\xcemgcehc\zbg63n
- %WINDIR%\xcemgcehc\oxnq1fnprz
- C:\xcemgcehc\oxnq1fnprz
- C:\xcemgcehc\viu49ekyhlwjcqwaj.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\xcemgcehc\jdpvijmp.exe
- C:\xcemgcehc\ikhmuvasl.exe
Удаляет следующие файлы:
- C:\xcemgcehc\viu49ekyhlwjcqwaj.exe
- %WINDIR%\xcemgcehc\oxnq1fnprz
Сетевая активность:
Подключается к:
- 'ag####tlikely.net':80
- 'do###likely.net':80
- 'do####lossary.net':80
- 'do###round.net':80
- 'ag####tglossary.net':80
- 'de###eround.net':80
- 'ni####lossary.net':80
- 'ni###round.net':80
- 'ag####tworth.net':80
- 'do###worth.net':80
- 'ag####tround.net':80
- 'se####succeed.net':80
- 'qu####etween.net':80
- 'qu####ucceed.net':80
- 'fl####tudent.net':80
- 'br####tudent.net':80
- 'qu####tudent.net':80
- 'se####student.net':80
- 'se####produce.net':80
- 'se####between.net':80
- 'qu####roduce.net':80
- 'el####icround.net':80
- 're####glossary.net':80
- 're###dround.net':80
- 'la###worth.net':80
- 'ca####nworth.net':80
- 're###dworth.net':80
- 'el####icworth.net':80
- 'el####iclikely.net':80
- 'el#####cglossary.net':80
- 're####likely.net':80
- 'ca####nlikely.net':80
- 'ni###worth.net':80
- 'de###eworth.net':80
- 'de####likely.net':80
- 'de####glossary.net':80
- 'ni###likely.net':80
- 'ca####nglossary.net':80
- 'la###likely.net':80
- 'la####lossary.net':80
- 'la###round.net':80
- 'ca####nround.net':80
- 'br####roduce.net':80
- 'el####icsucceed.net':80
- 're####between.net':80
- 're####succeed.net':80
- 'la####tudent.net':80
- 'ca####nstudent.net':80
- 're####student.net':80
- 'el####icstudent.net':80
- 'el####icproduce.net':80
- 'el####icbetween.net':80
- 're####produce.net':80
- 'ca####nproduce.net':80
- 'ni####tudent.net':80
- 'de####student.net':80
- 'de####produce.net':80
- 'de####between.net':80
- 'ni####roduce.net':80
- 'ca####nbetween.net':80
- 'la####roduce.net':80
- 'la####etween.net':80
- 'la####ucceed.net':80
- 'ca####nsucceed.net':80
- 'be####student.net':80
- 'ga####student.net':80
- 'ga####produce.net':80
- 'ga####between.net':80
- 'be####produce.net':80
- 'br####etween.net':80
- 'fl####roduce.net':80
- 'fl####etween.net':80
- 'fl####ucceed.net':80
- 'br####ucceed.net':80
- 'be####between.net':80
- 'tr####etween.net':80
- 'st####produce.net':80
- 'st####between.net':80
- 'st####succeed.net':80
- 'tr####ucceed.net':80
- 'be####succeed.net':80
- 'ga####succeed.net':80
- 'tr####tudent.net':80
- 'tr####roduce.net':80
- 'st####student.net':80
TCP:
Запросы HTTP GET:
- http://ag####tlikely.net/index.php?me########
- http://do###likely.net/index.php?me########
- http://do####lossary.net/index.php?me########
- http://do###round.net/index.php?me########
- http://ag####tglossary.net/index.php?me########
- http://de###eround.net/index.php?me########
- http://ni####lossary.net/index.php?me########
- http://ni###round.net/index.php?me########
- http://ag####tworth.net/index.php?me########
- http://do###worth.net/index.php?me########
- http://ag####tround.net/index.php?me########
- http://se####succeed.net/index.php?me########
- http://qu####etween.net/index.php?me########
- http://qu####ucceed.net/index.php?me########
- http://fl####tudent.net/index.php?me########
- http://br####tudent.net/index.php?me########
- http://qu####tudent.net/index.php?me########
- http://se####student.net/index.php?me########
- http://se####produce.net/index.php?me########
- http://se####between.net/index.php?me########
- http://qu####roduce.net/index.php?me########
- http://el####icround.net/index.php?me########
- http://re####glossary.net/index.php?me########
- http://re###dround.net/index.php?me########
- http://la###worth.net/index.php?me########
- http://ca####nworth.net/index.php?me########
- http://re###dworth.net/index.php?me########
- http://el####icworth.net/index.php?me########
- http://el####iclikely.net/index.php?me########
- http://el#####cglossary.net/index.php?me########
- http://re####likely.net/index.php?me########
- http://ca####nlikely.net/index.php?me########
- http://ni###worth.net/index.php?me########
- http://de###eworth.net/index.php?me########
- http://de####likely.net/index.php?me########
- http://de####glossary.net/index.php?me########
- http://ni###likely.net/index.php?me########
- http://ca####nglossary.net/index.php?me########
- http://la###likely.net/index.php?me########
- http://la####lossary.net/index.php?me########
- http://la###round.net/index.php?me########
- http://ca####nround.net/index.php?me########
- http://br####roduce.net/index.php?me########
- http://el####icsucceed.net/index.php?me########
- http://re####between.net/index.php?me########
- http://re####succeed.net/index.php?me########
- http://la####tudent.net/index.php?me########
- http://ca####nstudent.net/index.php?me########
- http://re####student.net/index.php?me########
- http://el####icstudent.net/index.php?me########
- http://el####icproduce.net/index.php?me########
- http://el####icbetween.net/index.php?me########
- http://re####produce.net/index.php?me########
- http://ca####nproduce.net/index.php?me########
- http://ni####tudent.net/index.php?me########
- http://de####student.net/index.php?me########
- http://de####produce.net/index.php?me########
- http://de####between.net/index.php?me########
- http://ni####roduce.net/index.php?me########
- http://ca####nbetween.net/index.php?me########
- http://la####roduce.net/index.php?me########
- http://la####etween.net/index.php?me########
- http://la####ucceed.net/index.php?me########
- http://ca####nsucceed.net/index.php?me########
- http://be####student.net/index.php?me########
- http://ga####student.net/index.php?me########
- http://ga####produce.net/index.php?me########
- http://ga####between.net/index.php?me########
- http://be####produce.net/index.php?me########
- http://br####etween.net/index.php?me########
- http://fl####roduce.net/index.php?me########
- http://fl####etween.net/index.php?me########
- http://fl####ucceed.net/index.php?me########
- http://br####ucceed.net/index.php?me########
- http://be####between.net/index.php?me########
- http://tr####etween.net/index.php?me########
- http://st####produce.net/index.php?me########
- http://st####between.net/index.php?me########
- http://st####succeed.net/index.php?me########
- http://tr####ucceed.net/index.php?me########
- http://be####succeed.net/index.php?me########
- http://ga####succeed.net/index.php?me########
- http://tr####tudent.net/index.php?me########
- http://tr####roduce.net/index.php?me########
- http://st####student.net/index.php?me########
UDP:
- DNS ASK ag####tlikely.net
- DNS ASK do###likely.net
- DNS ASK do####lossary.net
- DNS ASK do###round.net
- DNS ASK ag####tglossary.net
- DNS ASK de###eround.net
- DNS ASK ni####lossary.net
- DNS ASK ni###round.net
- DNS ASK ag####tworth.net
- DNS ASK do###worth.net
- DNS ASK ag####tround.net
- DNS ASK se####succeed.net
- DNS ASK qu####etween.net
- DNS ASK qu####ucceed.net
- DNS ASK fl####tudent.net
- DNS ASK br####tudent.net
- DNS ASK qu####tudent.net
- DNS ASK se####student.net
- DNS ASK se####produce.net
- DNS ASK se####between.net
- DNS ASK qu####roduce.net
- DNS ASK el####icround.net
- DNS ASK re####glossary.net
- DNS ASK re###dround.net
- DNS ASK la###worth.net
- DNS ASK ca####nworth.net
- DNS ASK re###dworth.net
- DNS ASK el####icworth.net
- DNS ASK el####iclikely.net
- DNS ASK el#####cglossary.net
- DNS ASK re####likely.net
- DNS ASK ca####nlikely.net
- DNS ASK ni###worth.net
- DNS ASK de###eworth.net
- DNS ASK de####likely.net
- DNS ASK de####glossary.net
- DNS ASK ni###likely.net
- DNS ASK ca####nglossary.net
- DNS ASK la###likely.net
- DNS ASK la####lossary.net
- DNS ASK la###round.net
- DNS ASK ca####nround.net
- DNS ASK br####roduce.net
- DNS ASK el####icsucceed.net
- DNS ASK re####between.net
- DNS ASK re####succeed.net
- DNS ASK la####tudent.net
- DNS ASK ca####nstudent.net
- DNS ASK re####student.net
- DNS ASK el####icstudent.net
- DNS ASK el####icproduce.net
- DNS ASK el####icbetween.net
- DNS ASK re####produce.net
- DNS ASK ca####nproduce.net
- DNS ASK ni####tudent.net
- DNS ASK de####student.net
- DNS ASK de####produce.net
- DNS ASK de####between.net
- DNS ASK ni####roduce.net
- DNS ASK ca####nbetween.net
- DNS ASK la####roduce.net
- DNS ASK la####etween.net
- DNS ASK la####ucceed.net
- DNS ASK ca####nsucceed.net
- DNS ASK be####student.net
- DNS ASK ga####student.net
- DNS ASK ga####produce.net
- DNS ASK ga####between.net
- DNS ASK be####produce.net
- DNS ASK br####etween.net
- DNS ASK fl####roduce.net
- DNS ASK fl####etween.net
- DNS ASK fl####ucceed.net
- DNS ASK br####ucceed.net
- DNS ASK be####between.net
- DNS ASK tr####etween.net
- DNS ASK st####produce.net
- DNS ASK st####between.net
- DNS ASK st####succeed.net
- DNS ASK tr####ucceed.net
- DNS ASK be####succeed.net
- DNS ASK ga####succeed.net
- DNS ASK tr####tudent.net
- DNS ASK tr####roduce.net
- DNS ASK st####student.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
