Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Drive Visual WebClient Desktop' = 'C:\qnwxrausp\cwdtwdnoko.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Time SNMP Registrar Center PNRP] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- 'C:\qnwxrausp\ylmafpqfxk.exe' "c:\qnwxrausp\cwdtwdnoko.exe"
- 'C:\qnwxrausp\cwdtwdnoko.exe'
- 'C:\qnwxrausp\dmd3g9ijioqwmt9q7e.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\qnwxrausp\cwdtwdnoko.exe
- C:\qnwxrausp\ylmafpqfxk.exe
- C:\qnwxrausp\ibfaeundflsp
- %WINDIR%\qnwxrausp\ohaoyc8yh
- C:\qnwxrausp\ohaoyc8yh
- C:\qnwxrausp\dmd3g9ijioqwmt9q7e.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\qnwxrausp\ylmafpqfxk.exe
- C:\qnwxrausp\cwdtwdnoko.exe
Удаляет следующие файлы:
- C:\qnwxrausp\dmd3g9ijioqwmt9q7e.exe
- %WINDIR%\qnwxrausp\ohaoyc8yh
Сетевая активность:
Подключается к:
- 'ch###mister.net':80
- 'pr####triver.net':80
- 'th###river.net':80
- 'co####emister.net':80
- 'ch####ervice.net':80
- 'co####esuppose.net':80
- 'ch####uppose.net':80
- 'pr####tmister.net':80
- 'th###mister.net':80
- 'cl####rticle.net':80
- 'th####uppose.net':80
- 'pr####tservice.net':80
- 'th####ervice.net':80
- 'pr####tsuppose.net':80
- 'of###river.net':80
- 'al####ervice.net':80
- 'of####ervice.net':80
- 'al###river.net':80
- 'mi####suppose.net':80
- 'tw####mister.net':80
- 'mi####mister.net':80
- 'co####eriver.net':80
- 'ch###river.net':80
- 'co####eservice.net':80
- 'of###mister.net':80
- 'al####uppose.net':80
- 'of####uppose.net':80
- 'al###mister.net':80
- 'th####rticle.net':80
- 'hi####yfifteen.net':80
- 'st####efifteen.net':80
- 'hi####ydried.net':80
- 'st####eangry.net':80
- 'hi####yarticle.net':80
- 'st####earticle.net':80
- 'hi####yangry.net':80
- 'ra###rangry.net':80
- 'mo####gfifteen.net':80
- 'ra####fifteen.net':80
- 'mo####gangry.net':80
- 'st####edried.net':80
- 'mo####garticle.net':80
- 'ra####article.net':80
- 'cl###dried.net':80
- 'th###dried.net':80
- 'we####rarticle.net':80
- 'th####ifteen.net':80
- 'cl###angry.net':80
- 'th###angry.net':80
- 'cl####ifteen.net':80
- 'am####fifteen.net':80
- 'we####rdried.net':80
- 'am###tdried.net':80
- 'we####rfifteen.net':80
- 'am####article.net':80
- 'we####rangry.net':80
- 'am###tangry.net':80
TCP:
Запросы HTTP GET:
- http://ch###mister.net/index.php?me########
- http://pr####triver.net/index.php?me########
- http://th###river.net/index.php?me########
- http://co####emister.net/index.php?me########
- http://ch####ervice.net/index.php?me########
- http://co####esuppose.net/index.php?me########
- http://ch####uppose.net/index.php?me########
- http://pr####tmister.net/index.php?me########
- http://th###mister.net/index.php?me########
- http://cl####rticle.net/index.php?me########
- http://th####uppose.net/index.php?me########
- http://pr####tservice.net/index.php?me########
- http://th####ervice.net/index.php?me########
- http://pr####tsuppose.net/index.php?me########
- http://of###river.net/index.php?me########
- http://al####ervice.net/index.php?me########
- http://of####ervice.net/index.php?me########
- http://al###river.net/index.php?me########
- http://mi####suppose.net/index.php?me########
- http://tw####mister.net/index.php?me########
- http://mi####mister.net/index.php?me########
- http://co####eriver.net/index.php?me########
- http://ch###river.net/index.php?me########
- http://co####eservice.net/index.php?me########
- http://of###mister.net/index.php?me########
- http://al####uppose.net/index.php?me########
- http://of####uppose.net/index.php?me########
- http://al###mister.net/index.php?me########
- http://th####rticle.net/index.php?me########
- http://hi####yfifteen.net/index.php?me########
- http://st####efifteen.net/index.php?me########
- http://hi####ydried.net/index.php?me########
- http://st####eangry.net/index.php?me########
- http://hi####yarticle.net/index.php?me########
- http://st####earticle.net/index.php?me########
- http://hi####yangry.net/index.php?me########
- http://ra###rangry.net/index.php?me########
- http://mo####gfifteen.net/index.php?me########
- http://ra####fifteen.net/index.php?me########
- http://mo####gangry.net/index.php?me########
- http://st####edried.net/index.php?me########
- http://mo####garticle.net/index.php?me########
- http://ra####article.net/index.php?me########
- http://cl###dried.net/index.php?me########
- http://th###dried.net/index.php?me########
- http://we####rarticle.net/index.php?me########
- http://th####ifteen.net/index.php?me########
- http://cl###angry.net/index.php?me########
- http://th###angry.net/index.php?me########
- http://cl####ifteen.net/index.php?me########
- http://am####fifteen.net/index.php?me########
- http://we####rdried.net/index.php?me########
- http://am###tdried.net/index.php?me########
- http://we####rfifteen.net/index.php?me########
- http://am####article.net/index.php?me########
- http://we####rangry.net/index.php?me########
- http://am###tangry.net/index.php?me########
UDP:
- DNS ASK ch###mister.net
- DNS ASK pr####triver.net
- DNS ASK th###river.net
- DNS ASK co####emister.net
- DNS ASK ch####ervice.net
- DNS ASK co####esuppose.net
- DNS ASK ch####uppose.net
- DNS ASK pr####tmister.net
- DNS ASK th###mister.net
- DNS ASK cl####rticle.net
- DNS ASK th####uppose.net
- DNS ASK pr####tservice.net
- DNS ASK th####ervice.net
- DNS ASK pr####tsuppose.net
- DNS ASK co####eservice.net
- DNS ASK al###river.net
- DNS ASK of###river.net
- DNS ASK al####ervice.net
- DNS ASK mi####mister.net
- DNS ASK tw####suppose.net
- DNS ASK mi####suppose.net
- DNS ASK tw####mister.net
- DNS ASK of###mister.net
- DNS ASK co####eriver.net
- DNS ASK ch###river.net
- DNS ASK al###mister.net
- DNS ASK of####ervice.net
- DNS ASK al####uppose.net
- DNS ASK of####uppose.net
- DNS ASK hi####yfifteen.net
- DNS ASK st####efifteen.net
- DNS ASK hi####ydried.net
- DNS ASK st####eangry.net
- DNS ASK hi####yarticle.net
- DNS ASK st####earticle.net
- DNS ASK hi####yangry.net
- DNS ASK ra###rangry.net
- DNS ASK mo####gfifteen.net
- DNS ASK ra####fifteen.net
- DNS ASK mo####gangry.net
- DNS ASK st####edried.net
- DNS ASK mo####garticle.net
- DNS ASK ra####article.net
- DNS ASK am###tdried.net
- DNS ASK th####ifteen.net
- DNS ASK cl###dried.net
- DNS ASK th###dried.net
- DNS ASK cl####ifteen.net
- DNS ASK th####rticle.net
- DNS ASK cl###angry.net
- DNS ASK th###angry.net
- DNS ASK we####rfifteen.net
- DNS ASK am####fifteen.net
- DNS ASK we####rdried.net
- DNS ASK am###tangry.net
- DNS ASK we####rarticle.net
- DNS ASK am####article.net
- DNS ASK we####rangry.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
