Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Health Management Initiator' = 'C:\zdgsdhtcg\zsdrpytbshvi.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Launcher Grouping Panel Defragmenter System] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- 'C:\zdgsdhtcg\exybrbfvb.exe' "c:\zdgsdhtcg\zsdrpytbshvi.exe"
- 'C:\zdgsdhtcg\zsdrpytbshvi.exe'
- 'C:\zdgsdhtcg\dqm2oo1hkwkqkltzn.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\zdgsdhtcg\zsdrpytbshvi.exe
- C:\zdgsdhtcg\exybrbfvb.exe
- C:\zdgsdhtcg\bdicvostna
- %WINDIR%\zdgsdhtcg\yvlqrs
- C:\zdgsdhtcg\yvlqrs
- C:\zdgsdhtcg\dqm2oo1hkwkqkltzn.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\zdgsdhtcg\exybrbfvb.exe
- C:\zdgsdhtcg\zsdrpytbshvi.exe
Удаляет следующие файлы:
- C:\zdgsdhtcg\dqm2oo1hkwkqkltzn.exe
- %WINDIR%\zdgsdhtcg\yvlqrs
Сетевая активность:
Подключается к:
- 'pr####evalley.net':80
- 'de####sister.net':80
- 'pr####esister.net':80
- 'de####valley.net':80
- 'st####thsilver.net':80
- 'de###elabor.net':80
- 'pr####elabor.net':80
- 'de####silver.net':80
- 'br####valley.net':80
- 're####sister.net':80
- 'br####sister.net':80
- 're####valley.net':80
- 'pr####esilver.net':80
- 're###tlabor.net':80
- 'br###nlabor.net':80
- 'st####thsister.net':80
- 'bu####ngbring.net':80
- 'ou####eshout.net':80
- 'mo####ntshout.net':80
- 'ev####gbring.net':80
- 'bu####ngdemand.net':80
- 'ev####glisten.net':80
- 'bu####nglisten.net':80
- 'ou####edemand.net':80
- 'mo####ntbring.net':80
- 'st####thlabor.net':80
- 'st####thvalley.net':80
- 'ou####ebring.net':80
- 'mo####ntdemand.net':80
- 'ou####elisten.net':80
- 'mo####ntlisten.net':80
- 're####silver.net':80
- 'mi###silver.net':80
- 'st###silver.net':80
- 'ev####glabor.net':80
- 'st###sister.net':80
- 'mi###valley.net':80
- 'st###valley.net':80
- 'mi###sister.net':80
- 'bu####nglabor.net':80
- 'ev####gsilver.net':80
- 'bu####ngsilver.net':80
- 'ou####elabor.net':80
- 'bu####ngsister.net':80
- 'ev####gvalley.net':80
- 'bu####ngvalley.net':80
- 'ev####gsister.net':80
- 'st###labor.net':80
- 'fe####sister.net':80
- 'fe####silver.net':80
- 'pr###ylabor.net':80
- 'fe####valley.net':80
- 'br####silver.net':80
- 'do###elabor.net':80
- 'fe###wlabor.net':80
- 'do###rlabor.net':80
- 'pr####silver.net':80
- 'do####silver.net':80
- 'mi###labor.net':80
- 'do####sister.net':80
- 'pr####valley.net':80
- 'do####valley.net':80
- 'pr####sister.net':80
TCP:
Запросы HTTP GET:
- http://pr####evalley.net/index.php?me########
- http://de####sister.net/index.php?me########
- http://pr####esister.net/index.php?me########
- http://de####valley.net/index.php?me########
- http://st####thsilver.net/index.php?me########
- http://de###elabor.net/index.php?me########
- http://pr####elabor.net/index.php?me########
- http://de####silver.net/index.php?me########
- http://br####valley.net/index.php?me########
- http://re####sister.net/index.php?me########
- http://br####sister.net/index.php?me########
- http://re####valley.net/index.php?me########
- http://pr####esilver.net/index.php?me########
- http://re###tlabor.net/index.php?me########
- http://br###nlabor.net/index.php?me########
- http://st####thsister.net/index.php?me########
- http://bu####ngbring.net/index.php?me########
- http://ou####eshout.net/index.php?me########
- http://mo####ntshout.net/index.php?me########
- http://ev####gbring.net/index.php?me########
- http://bu####ngdemand.net/index.php?me########
- http://ev####glisten.net/index.php?me########
- http://bu####nglisten.net/index.php?me########
- http://ou####edemand.net/index.php?me########
- http://mo####ntbring.net/index.php?me########
- http://st####thlabor.net/index.php?me########
- http://st####thvalley.net/index.php?me########
- http://ou####ebring.net/index.php?me########
- http://mo####ntdemand.net/index.php?me########
- http://ou####elisten.net/index.php?me########
- http://mo####ntlisten.net/index.php?me########
- http://re####silver.net/index.php?me########
- http://mi###silver.net/index.php?me########
- http://st###silver.net/index.php?me########
- http://ev####glabor.net/index.php?me########
- http://st###sister.net/index.php?me########
- http://mi###valley.net/index.php?me########
- http://st###valley.net/index.php?me########
- http://mi###sister.net/index.php?me########
- http://bu####nglabor.net/index.php?me########
- http://ev####gsilver.net/index.php?me########
- http://bu####ngsilver.net/index.php?me########
- http://ou####elabor.net/index.php?me########
- http://bu####ngsister.net/index.php?me########
- http://ev####gvalley.net/index.php?me########
- http://bu####ngvalley.net/index.php?me########
- http://ev####gsister.net/index.php?me########
- http://st###labor.net/index.php?me########
- http://fe####sister.net/index.php?me########
- http://fe####silver.net/index.php?me########
- http://pr###ylabor.net/index.php?me########
- http://fe####valley.net/index.php?me########
- http://br####silver.net/index.php?me########
- http://do###elabor.net/index.php?me########
- http://fe###wlabor.net/index.php?me########
- http://do###rlabor.net/index.php?me########
- http://pr####silver.net/index.php?me########
- http://do####silver.net/index.php?me########
- http://mi###labor.net/index.php?me########
- http://do####sister.net/index.php?me########
- http://pr####valley.net/index.php?me########
- http://do####valley.net/index.php?me########
- http://pr####sister.net/index.php?me########
UDP:
- DNS ASK pr####evalley.net
- DNS ASK de####valley.net
- DNS ASK pr####esister.net
- DNS ASK de####sister.net
- DNS ASK st####thsilver.net
- DNS ASK st####thsister.net
- DNS ASK pr####elabor.net
- DNS ASK de###elabor.net
- DNS ASK br####valley.net
- DNS ASK re####valley.net
- DNS ASK br####sister.net
- DNS ASK re####sister.net
- DNS ASK pr####esilver.net
- DNS ASK de####silver.net
- DNS ASK br###nlabor.net
- DNS ASK re###tlabor.net
- DNS ASK bu####ngbring.net
- DNS ASK ev####gbring.net
- DNS ASK mo####ntshout.net
- DNS ASK ou####eshout.net
- DNS ASK bu####ngdemand.net
- DNS ASK ev####gdemand.net
- DNS ASK bu####nglisten.net
- DNS ASK ev####glisten.net
- DNS ASK mo####ntbring.net
- DNS ASK ou####ebring.net
- DNS ASK st####thvalley.net
- DNS ASK st####thlabor.net
- DNS ASK mo####ntdemand.net
- DNS ASK ou####edemand.net
- DNS ASK mo####ntlisten.net
- DNS ASK ou####elisten.net
- DNS ASK mi###silver.net
- DNS ASK st###sister.net
- DNS ASK ev####glabor.net
- DNS ASK st###silver.net
- DNS ASK mi###valley.net
- DNS ASK st###labor.net
- DNS ASK mi###sister.net
- DNS ASK st###valley.net
- DNS ASK ev####gsilver.net
- DNS ASK bu####ngsister.net
- DNS ASK ou####elabor.net
- DNS ASK bu####ngsilver.net
- DNS ASK ev####gvalley.net
- DNS ASK bu####nglabor.net
- DNS ASK ev####gsister.net
- DNS ASK bu####ngvalley.net
- DNS ASK fe####sister.net
- DNS ASK fe####valley.net
- DNS ASK pr###ylabor.net
- DNS ASK fe####silver.net
- DNS ASK br####silver.net
- DNS ASK re####silver.net
- DNS ASK fe###wlabor.net
- DNS ASK do###elabor.net
- DNS ASK pr####silver.net
- DNS ASK do####sister.net
- DNS ASK mi###labor.net
- DNS ASK do####silver.net
- DNS ASK pr####valley.net
- DNS ASK do###rlabor.net
- DNS ASK pr####sister.net
- DNS ASK do####valley.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
