Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Certificate Center DCOM Builder' = 'C:\ayamdvfdgevjkoy\dftomijelyy.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Tunneling Isolation Mapper] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- 'C:\ayamdvfdgevjkoy\brknkwz.exe' "c:\ayamdvfdgevjkoy\dftomijelyy.exe"
- 'C:\ayamdvfdgevjkoy\dftomijelyy.exe'
- 'C:\ayamdvfdgevjkoy\mi36ohwefouqzepw.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\ayamdvfdgevjkoy\dftomijelyy.exe
- C:\ayamdvfdgevjkoy\brknkwz.exe
- C:\ayamdvfdgevjkoy\vwcvxzu
- %WINDIR%\ayamdvfdgevjkoy\o5woq8f
- C:\ayamdvfdgevjkoy\o5woq8f
- C:\ayamdvfdgevjkoy\mi36ohwefouqzepw.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\ayamdvfdgevjkoy\brknkwz.exe
- C:\ayamdvfdgevjkoy\dftomijelyy.exe
Удаляет следующие файлы:
- C:\ayamdvfdgevjkoy\mi36ohwefouqzepw.exe
- %WINDIR%\ayamdvfdgevjkoy\o5woq8f
Сетевая активность:
Подключается к:
- 'su####texcept.net':80
- 'wi###wwhose.net':80
- 'pe####swhose.net':80
- 'wi###rwhose.net':80
- 'su####tbicycle.net':80
- 'su####tbridge.net':80
- 'wi####bicycle.net':80
- 'wi####except.net':80
- 'pe####sexcept.net':80
- 'po####lewhose.net':80
- 'pe####sbicycle.net':80
- 'wi####bridge.net':80
- 'pe####sbridge.net':80
- 'su####twhose.net':80
- 'pr####lyexcept.net':80
- 'sw###except.net':80
- 'le###whose.net':80
- 'sw####icycle.net':80
- 'pr####lybridge.net':80
- 'sw###bridge.net':80
- 'fi###hwhose.net':80
- 'fi####bridge.net':80
- 'le###except.net':80
- 'fi####except.net':80
- 'le####icycle.net':80
- 'fi####bicycle.net':80
- 'le###bridge.net':80
- 'mo####inwhose.net':80
- 'se####bicycle.net':80
- 'la###bridge.net':80
- 'se####bridge.net':80
- 'la###whose.net':80
- 'se###awhose.net':80
- 'la####icycle.net':80
- 'la###except.net':80
- 'ma####alboard.net':80
- 'se####lboard.net':80
- 'ma####alladder.net':80
- 'se####except.net':80
- 'ma####alenter.net':80
- 'se####lenter.net':80
- 'si####except.net':80
- 'mo####inbridge.net':80
- 'po####leexcept.net':80
- 'mo####inexcept.net':80
- 'po####lebicycle.net':80
- 'mo####inbicycle.net':80
- 'po####lebridge.net':80
- 'mo###rwhose.net':80
- 'mo####bridge.net':80
- 'si####bridge.net':80
- 'mo####except.net':80
- 'si###ewhose.net':80
- 'mo####bicycle.net':80
- 'si####bicycle.net':80
TCP:
Запросы HTTP GET:
- http://su####texcept.net/index.php?me########
- http://wi###wwhose.net/index.php?me########
- http://pe####swhose.net/index.php?me########
- http://wi###rwhose.net/index.php?me########
- http://su####tbicycle.net/index.php?me########
- http://su####tbridge.net/index.php?me########
- http://wi####bicycle.net/index.php?me########
- http://wi####except.net/index.php?me########
- http://pe####sexcept.net/index.php?me########
- http://po####lewhose.net/index.php?me########
- http://pe####sbicycle.net/index.php?me########
- http://wi####bridge.net/index.php?me########
- http://pe####sbridge.net/index.php?me########
- http://su####twhose.net/index.php?me########
- http://pr####lyexcept.net/index.php?me########
- http://sw###except.net/index.php?me########
- http://le###whose.net/index.php?me########
- http://sw####icycle.net/index.php?me########
- http://pr####lybridge.net/index.php?me########
- http://sw###bridge.net/index.php?me########
- http://fi###hwhose.net/index.php?me########
- http://fi####bridge.net/index.php?me########
- http://le###except.net/index.php?me########
- http://fi####except.net/index.php?me########
- http://le####icycle.net/index.php?me########
- http://fi####bicycle.net/index.php?me########
- http://le###bridge.net/index.php?me########
- http://mo####inwhose.net/index.php?me########
- http://se####bicycle.net/index.php?me########
- http://la###bridge.net/index.php?me########
- http://se####bridge.net/index.php?me########
- http://la###whose.net/index.php?me########
- http://se###awhose.net/index.php?me########
- http://la####icycle.net/index.php?me########
- http://la###except.net/index.php?me########
- http://ma####alboard.net/index.php?me########
- http://se####lboard.net/index.php?me########
- http://ma####alladder.net/index.php?me########
- http://se####except.net/index.php?me########
- http://ma####alenter.net/index.php?me########
- http://se####lenter.net/index.php?me########
- http://si####except.net/index.php?me########
- http://mo####inbridge.net/index.php?me########
- http://po####leexcept.net/index.php?me########
- http://mo####inexcept.net/index.php?me########
- http://po####lebicycle.net/index.php?me########
- http://mo####inbicycle.net/index.php?me########
- http://po####lebridge.net/index.php?me########
- http://mo###rwhose.net/index.php?me########
- http://mo####bridge.net/index.php?me########
- http://si####bridge.net/index.php?me########
- http://mo####except.net/index.php?me########
- http://si###ewhose.net/index.php?me########
- http://mo####bicycle.net/index.php?me########
- http://si####bicycle.net/index.php?me########
UDP:
- DNS ASK su####texcept.net
- DNS ASK wi###wwhose.net
- DNS ASK pe####swhose.net
- DNS ASK su####tbridge.net
- DNS ASK su####twhose.net
- DNS ASK wi###rwhose.net
- DNS ASK su####tbicycle.net
- DNS ASK wi####except.net
- DNS ASK pe####sexcept.net
- DNS ASK po####lewhose.net
- DNS ASK pe####sbridge.net
- DNS ASK wi####bicycle.net
- DNS ASK pe####sbicycle.net
- DNS ASK wi####bridge.net
- DNS ASK pr####lyexcept.net
- DNS ASK sw###except.net
- DNS ASK le###whose.net
- DNS ASK sw###bridge.net
- DNS ASK pr####lybicycle.net
- DNS ASK sw####icycle.net
- DNS ASK pr####lybridge.net
- DNS ASK fi####bridge.net
- DNS ASK le###except.net
- DNS ASK fi####except.net
- DNS ASK le###bridge.net
- DNS ASK fi###hwhose.net
- DNS ASK le####icycle.net
- DNS ASK fi####bicycle.net
- DNS ASK se####bicycle.net
- DNS ASK la###bridge.net
- DNS ASK se####bridge.net
- DNS ASK la####icycle.net
- DNS ASK si####except.net
- DNS ASK la###whose.net
- DNS ASK se###awhose.net
- DNS ASK ma####alboard.net
- DNS ASK se####lboard.net
- DNS ASK ma####alladder.net
- DNS ASK se####lenter.net
- DNS ASK la###except.net
- DNS ASK se####except.net
- DNS ASK ma####alenter.net
- DNS ASK mo####inbridge.net
- DNS ASK po####leexcept.net
- DNS ASK mo####inexcept.net
- DNS ASK po####lebridge.net
- DNS ASK mo####inwhose.net
- DNS ASK po####lebicycle.net
- DNS ASK mo####inbicycle.net
- DNS ASK mo####bridge.net
- DNS ASK si####bridge.net
- DNS ASK mo####except.net
- DNS ASK si####bicycle.net
- DNS ASK mo###rwhose.net
- DNS ASK si###ewhose.net
- DNS ASK mo####bicycle.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
