Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Reporting Machine Mapper Services TP Panel' = 'C:\pgacuaaqioou\nxldwypv.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Link-Layer AutoConnect Group Application] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- 'C:\pgacuaaqioou\zfzyviqjyncc.exe' "c:\pgacuaaqioou\nxldwypv.exe"
- 'C:\pgacuaaqioou\nxldwypv.exe'
- 'C:\pgacuaaqioou\py4v3e60wdapfr77k.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\pgacuaaqioou\nxldwypv.exe
- C:\pgacuaaqioou\zfzyviqjyncc.exe
- C:\pgacuaaqioou\gufhrma
- %WINDIR%\pgacuaaqioou\oosefqfxe
- C:\pgacuaaqioou\oosefqfxe
- C:\pgacuaaqioou\py4v3e60wdapfr77k.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\pgacuaaqioou\zfzyviqjyncc.exe
- C:\pgacuaaqioou\nxldwypv.exe
Удаляет следующие файлы:
- C:\pgacuaaqioou\py4v3e60wdapfr77k.exe
- %WINDIR%\pgacuaaqioou\oosefqfxe
Сетевая активность:
Подключается к:
- 'th###behind.net':80
- 'pr####tbehind.net':80
- 'pr####tbroad.net':80
- 'pr#####understand.net':80
- 'th###broad.net':80
- 'co#####understand.net':80
- 'ch###broad.net':80
- 'ch####nderstand.net':80
- 'th###butter.net':80
- 'pr####tbutter.net':80
- 'th####nderstand.net':80
- 'se###nspeak.net':80
- 'qu###niece.net':80
- 'qu###speak.net':80
- 'fl###oclock.net':80
- 'br###oclock.net':80
- 'qu###oclock.net':80
- 'se####oclock.net':80
- 'se###nwrite.net':80
- 'se###nniece.net':80
- 'qu###write.net':80
- 'tw#####nderstand.net':80
- 'mi###ebroad.net':80
- 'mi#####nderstand.net':80
- 'of###butter.net':80
- 'al###butter.net':80
- 'mi####butter.net':80
- 'tw####butter.net':80
- 'tw####behind.net':80
- 'tw###ebroad.net':80
- 'mi####behind.net':80
- 'al###behind.net':80
- 'ch###butter.net':80
- 'co####ebutter.net':80
- 'co####ebehind.net':80
- 'co####ebroad.net':80
- 'ch###behind.net':80
- 'al###broad.net':80
- 'of###behind.net':80
- 'of###broad.net':80
- 'of####nderstand.net':80
- 'al####nderstand.net':80
- 'br###write.net':80
- 'el####icspeak.net':80
- 're###dniece.net':80
- 're###dspeak.net':80
- 'la###oclock.net':80
- 'ca####noclock.net':80
- 're####oclock.net':80
- 'el####icoclock.net':80
- 'el####icwrite.net':80
- 'el####icniece.net':80
- 're###dwrite.net':80
- 'ca####nwrite.net':80
- 'ni###oclock.net':80
- 'de####oclock.net':80
- 'de###ewrite.net':80
- 'de###eniece.net':80
- 'ni###write.net':80
- 'ca####nniece.net':80
- 'la###write.net':80
- 'la###niece.net':80
- 'la###speak.net':80
- 'ca####nspeak.net':80
- 'be####oclock.net':80
- 'ga####oclock.net':80
- 'ga###rwrite.net':80
- 'ga###rniece.net':80
- 'be###rwrite.net':80
- 'br###niece.net':80
- 'fl###write.net':80
- 'fl###niece.net':80
- 'fl###speak.net':80
- 'br###speak.net':80
- 'be###rniece.net':80
- 'tr###niece.net':80
- 'st###twrite.net':80
- 'st###tniece.net':80
- 'st###tspeak.net':80
- 'tr###speak.net':80
- 'be###rspeak.net':80
- 'ga###rspeak.net':80
- 'tr###oclock.net':80
- 'tr###write.net':80
- 'st####oclock.net':80
TCP:
Запросы HTTP GET:
- http://th###behind.net/index.php?me########
- http://pr####tbehind.net/index.php?me########
- http://pr####tbroad.net/index.php?me########
- http://pr#####understand.net/index.php?me########
- http://th###broad.net/index.php?me########
- http://co#####understand.net/index.php?me########
- http://ch###broad.net/index.php?me########
- http://ch####nderstand.net/index.php?me########
- http://th###butter.net/index.php?me########
- http://pr####tbutter.net/index.php?me########
- http://th####nderstand.net/index.php?me########
- http://se###nspeak.net/index.php?me########
- http://qu###niece.net/index.php?me########
- http://qu###speak.net/index.php?me########
- http://fl###oclock.net/index.php?me########
- http://br###oclock.net/index.php?me########
- http://qu###oclock.net/index.php?me########
- http://se####oclock.net/index.php?me########
- http://se###nwrite.net/index.php?me########
- http://se###nniece.net/index.php?me########
- http://qu###write.net/index.php?me########
- http://tw#####nderstand.net/index.php?me########
- http://mi###ebroad.net/index.php?me########
- http://mi#####nderstand.net/index.php?me########
- http://of###butter.net/index.php?me########
- http://al###butter.net/index.php?me########
- http://mi####butter.net/index.php?me########
- http://tw####butter.net/index.php?me########
- http://tw####behind.net/index.php?me########
- http://tw###ebroad.net/index.php?me########
- http://mi####behind.net/index.php?me########
- http://al###behind.net/index.php?me########
- http://ch###butter.net/index.php?me########
- http://co####ebutter.net/index.php?me########
- http://co####ebehind.net/index.php?me########
- http://co####ebroad.net/index.php?me########
- http://ch###behind.net/index.php?me########
- http://al###broad.net/index.php?me########
- http://of###behind.net/index.php?me########
- http://of###broad.net/index.php?me########
- http://of####nderstand.net/index.php?me########
- http://al####nderstand.net/index.php?me########
- http://br###write.net/index.php?me########
- http://el####icspeak.net/index.php?me########
- http://re###dniece.net/index.php?me########
- http://re###dspeak.net/index.php?me########
- http://la###oclock.net/index.php?me########
- http://ca####noclock.net/index.php?me########
- http://re####oclock.net/index.php?me########
- http://el####icoclock.net/index.php?me########
- http://el####icwrite.net/index.php?me########
- http://el####icniece.net/index.php?me########
- http://re###dwrite.net/index.php?me########
- http://ca####nwrite.net/index.php?me########
- http://ni###oclock.net/index.php?me########
- http://de####oclock.net/index.php?me########
- http://de###ewrite.net/index.php?me########
- http://de###eniece.net/index.php?me########
- http://ni###write.net/index.php?me########
- http://ca####nniece.net/index.php?me########
- http://la###write.net/index.php?me########
- http://la###niece.net/index.php?me########
- http://la###speak.net/index.php?me########
- http://ca####nspeak.net/index.php?me########
- http://be####oclock.net/index.php?me########
- http://ga####oclock.net/index.php?me########
- http://ga###rwrite.net/index.php?me########
- http://ga###rniece.net/index.php?me########
- http://be###rwrite.net/index.php?me########
- http://br###niece.net/index.php?me########
- http://fl###write.net/index.php?me########
- http://fl###niece.net/index.php?me########
- http://fl###speak.net/index.php?me########
- http://br###speak.net/index.php?me########
- http://be###rniece.net/index.php?me########
- http://tr###niece.net/index.php?me########
- http://st###twrite.net/index.php?me########
- http://st###tniece.net/index.php?me########
- http://st###tspeak.net/index.php?me########
- http://tr###speak.net/index.php?me########
- http://be###rspeak.net/index.php?me########
- http://ga###rspeak.net/index.php?me########
- http://tr###oclock.net/index.php?me########
- http://tr###write.net/index.php?me########
- http://st####oclock.net/index.php?me########
UDP:
- DNS ASK th###behind.net
- DNS ASK pr####tbehind.net
- DNS ASK pr####tbroad.net
- DNS ASK pr#####understand.net
- DNS ASK th###broad.net
- DNS ASK co#####understand.net
- DNS ASK ch###broad.net
- DNS ASK ch####nderstand.net
- DNS ASK th###butter.net
- DNS ASK pr####tbutter.net
- DNS ASK th####nderstand.net
- DNS ASK se###nspeak.net
- DNS ASK qu###niece.net
- DNS ASK qu###speak.net
- DNS ASK fl###oclock.net
- DNS ASK br###oclock.net
- DNS ASK qu###oclock.net
- DNS ASK se####oclock.net
- DNS ASK se###nwrite.net
- DNS ASK se###nniece.net
- DNS ASK qu###write.net
- DNS ASK tw#####nderstand.net
- DNS ASK mi###ebroad.net
- DNS ASK mi#####nderstand.net
- DNS ASK of###butter.net
- DNS ASK al###butter.net
- DNS ASK mi####butter.net
- DNS ASK tw####butter.net
- DNS ASK tw####behind.net
- DNS ASK tw###ebroad.net
- DNS ASK mi####behind.net
- DNS ASK al###behind.net
- DNS ASK ch###butter.net
- DNS ASK co####ebutter.net
- DNS ASK co####ebehind.net
- DNS ASK co####ebroad.net
- DNS ASK ch###behind.net
- DNS ASK al###broad.net
- DNS ASK of###behind.net
- DNS ASK of###broad.net
- DNS ASK of####nderstand.net
- DNS ASK al####nderstand.net
- DNS ASK br###write.net
- DNS ASK el####icspeak.net
- DNS ASK re###dniece.net
- DNS ASK re###dspeak.net
- DNS ASK la###oclock.net
- DNS ASK ca####noclock.net
- DNS ASK re####oclock.net
- DNS ASK el####icoclock.net
- DNS ASK el####icwrite.net
- DNS ASK el####icniece.net
- DNS ASK re###dwrite.net
- DNS ASK ca####nwrite.net
- DNS ASK ni###oclock.net
- DNS ASK de####oclock.net
- DNS ASK de###ewrite.net
- DNS ASK de###eniece.net
- DNS ASK ni###write.net
- DNS ASK ca####nniece.net
- DNS ASK la###write.net
- DNS ASK la###niece.net
- DNS ASK la###speak.net
- DNS ASK ca####nspeak.net
- DNS ASK be####oclock.net
- DNS ASK ga####oclock.net
- DNS ASK ga###rwrite.net
- DNS ASK ga###rniece.net
- DNS ASK be###rwrite.net
- DNS ASK br###niece.net
- DNS ASK fl###write.net
- DNS ASK fl###niece.net
- DNS ASK fl###speak.net
- DNS ASK br###speak.net
- DNS ASK be###rniece.net
- DNS ASK tr###niece.net
- DNS ASK st###twrite.net
- DNS ASK st###tniece.net
- DNS ASK st###tspeak.net
- DNS ASK tr###speak.net
- DNS ASK be###rspeak.net
- DNS ASK ga###rspeak.net
- DNS ASK tr###oclock.net
- DNS ASK tr###write.net
- DNS ASK st####oclock.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
