Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Initiator Location Health Framework Video' = 'C:\tuhrfzgjgl\oehfbefvqfs.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Portable Port NetBIOS Bluetooth Layer] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- 'C:\tuhrfzgjgl\cuaytxmmspdv.exe' "c:\tuhrfzgjgl\oehfbefvqfs.exe"
- 'C:\tuhrfzgjgl\oehfbefvqfs.exe'
- 'C:\tuhrfzgjgl\umi2omqo8xxtp9as7wz.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\tuhrfzgjgl\oehfbefvqfs.exe
- C:\tuhrfzgjgl\cuaytxmmspdv.exe
- C:\tuhrfzgjgl\dd2tsq
- %WINDIR%\tuhrfzgjgl\dclptd
- C:\tuhrfzgjgl\dclptd
- C:\tuhrfzgjgl\umi2omqo8xxtp9as7wz.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\tuhrfzgjgl\cuaytxmmspdv.exe
- C:\tuhrfzgjgl\oehfbefvqfs.exe
Удаляет следующие файлы:
- C:\tuhrfzgjgl\umi2omqo8xxtp9as7wz.exe
- %WINDIR%\tuhrfzgjgl\dclptd
Сетевая активность:
Подключается к:
- 'fa####further.net':80
- 'ch####enfurther.net':80
- 'ch####encover.net':80
- 'ch####enbecome.net':80
- 'fa###ycover.net':80
- 'pi####ebecome.net':80
- 'ci####ttecover.net':80
- 'ci####ttebecome.net':80
- 'ci#####tecompany.net':80
- 'pi####ecompany.net':80
- 'en####hcover.net':80
- 'ei###rcover.net':80
- 'ei####become.net':80
- 'ei####company.net':80
- 'en####hbecome.net':80
- 'ch####encompany.net':80
- 'fa####become.net':80
- 'fa####company.net':80
- 'en####hfurther.net':80
- 'ei####further.net':80
- 'ri###become.net':80
- 'wh####rbecome.net':80
- 'wh####rcompany.net':80
- 'fi####further.net':80
- 'ri####ompany.net':80
- 'wh####rfurther.net':80
- 'fo####ncompany.net':80
- 'ri####urther.net':80
- 'ri###cover.net':80
- 'wh####rcover.net':80
- 'th####company.net':80
- 'fi####company.net':80
- 'pi####efurther.net':80
- 'pi####ecover.net':80
- 'ci#####tefurther.net':80
- 'fi###ecover.net':80
- 'th####further.net':80
- 'th###hcover.net':80
- 'th####become.net':80
- 'fi####become.net':80
TCP:
Запросы HTTP GET:
- http://fa####further.net/index.php?me########
- http://ch####enfurther.net/index.php?me########
- http://ch####encover.net/index.php?me########
- http://ch####enbecome.net/index.php?me########
- http://fa###ycover.net/index.php?me########
- http://pi####ebecome.net/index.php?me########
- http://ci####ttecover.net/index.php?me########
- http://ci####ttebecome.net/index.php?me########
- http://ci#####tecompany.net/index.php?me########
- http://pi####ecompany.net/index.php?me########
- http://en####hcover.net/index.php?me########
- http://ei###rcover.net/index.php?me########
- http://ei####become.net/index.php?me########
- http://ei####company.net/index.php?me########
- http://en####hbecome.net/index.php?me########
- http://ch####encompany.net/index.php?me########
- http://fa####become.net/index.php?me########
- http://fa####company.net/index.php?me########
- http://en####hfurther.net/index.php?me########
- http://ei####further.net/index.php?me########
- http://ri###become.net/index.php?me########
- http://wh####rbecome.net/index.php?me########
- http://wh####rcompany.net/index.php?me########
- http://fi####further.net/index.php?me########
- http://ri####ompany.net/index.php?me########
- http://wh####rfurther.net/index.php?me########
- http://fo####ncompany.net/index.php?me########
- http://ri####urther.net/index.php?me########
- http://ri###cover.net/index.php?me########
- http://wh####rcover.net/index.php?me########
- http://th####company.net/index.php?me########
- http://fi####company.net/index.php?me########
- http://pi####efurther.net/index.php?me########
- http://pi####ecover.net/index.php?me########
- http://ci#####tefurther.net/index.php?me########
- http://fi###ecover.net/index.php?me########
- http://th####further.net/index.php?me########
- http://th###hcover.net/index.php?me########
- http://th####become.net/index.php?me########
- http://fi####become.net/index.php?me########
UDP:
- DNS ASK ch####encover.net
- DNS ASK fa####further.net
- DNS ASK fa###ycover.net
- DNS ASK fa####become.net
- DNS ASK ch####enbecome.net
- DNS ASK ci####ttebecome.net
- DNS ASK pi####ebecome.net
- DNS ASK pi####ecompany.net
- DNS ASK ch####enfurther.net
- DNS ASK ci#####tecompany.net
- DNS ASK ei####become.net
- DNS ASK en####hcover.net
- DNS ASK en####hbecome.net
- DNS ASK en####hcompany.net
- DNS ASK ei####company.net
- DNS ASK fa####company.net
- DNS ASK ch####encompany.net
- DNS ASK ei####further.net
- DNS ASK ei###rcover.net
- DNS ASK en####hfurther.net
- DNS ASK ci####ttecover.net
- DNS ASK ri###become.net
- DNS ASK wh####rbecome.net
- DNS ASK wh####rcompany.net
- DNS ASK fi####further.net
- DNS ASK ri####ompany.net
- DNS ASK wh####rfurther.net
- DNS ASK fo####ncompany.net
- DNS ASK ri####urther.net
- DNS ASK ri###cover.net
- DNS ASK wh####rcover.net
- DNS ASK th####company.net
- DNS ASK fi####company.net
- DNS ASK pi####efurther.net
- DNS ASK pi####ecover.net
- DNS ASK ci#####tefurther.net
- DNS ASK fi###ecover.net
- DNS ASK th####further.net
- DNS ASK th###hcover.net
- DNS ASK th####become.net
- DNS ASK fi####become.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
