Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Program Host Drive Security Quality Bus' = 'C:\uxpbcedy\eanrrwf.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Power File Resource Debugger Logon] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- 'C:\uxpbcedy\awircekmst.exe' "c:\uxpbcedy\eanrrwf.exe"
- 'C:\uxpbcedy\eanrrwf.exe'
- 'C:\uxpbcedy\i4132hfbwuuc2co.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\uxpbcedy\eanrrwf.exe
- C:\uxpbcedy\awircekmst.exe
- C:\uxpbcedy\wr6sirm
- %WINDIR%\uxpbcedy\zzvgkpdtlzs
- C:\uxpbcedy\zzvgkpdtlzs
- C:\uxpbcedy\i4132hfbwuuc2co.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\uxpbcedy\awircekmst.exe
- C:\uxpbcedy\eanrrwf.exe
Удаляет следующие файлы:
- C:\uxpbcedy\i4132hfbwuuc2co.exe
- %WINDIR%\uxpbcedy\zzvgkpdtlzs
Сетевая активность:
Подключается к:
- 'wo###bottom.net':80
- 'sm####orever.net':80
- 'wo####orever.net':80
- 'sm###bottom.net':80
- 'pa###being.net':80
- 'fi###beyond.net':80
- 'pa###beyond.net':80
- 'sm###being.net':80
- 'th####tbottom.net':80
- 'wa####orever.net':80
- 'th####tforever.net':80
- 'wa###bottom.net':80
- 'wo###being.net':80
- 'sm###beyond.net':80
- 'wo###beyond.net':80
- 'fi###being.net':80
- 'fr###corner.net':80
- 'ex#####ncespecial.net':80
- 'fr####pecial.net':80
- 'ex#####ncecorner.net':80
- 'ge####manminute.net':80
- 'al####yflower.net':80
- 'ge####manflower.net':80
- 'ex#####nceminute.net':80
- 'pa###bottom.net':80
- 'fi####orever.net':80
- 'pa####orever.net':80
- 'fi###bottom.net':80
- 'fr###minute.net':80
- 'ex#####nceflower.net':80
- 'fr###flower.net':80
- 'wa###being.net':80
- 'fo####bottom.net':80
- 'me####forever.net':80
- 'fo####forever.net':80
- 'me####bottom.net':80
- 'be###being.net':80
- 'kn###beyond.net':80
- 'be###beyond.net':80
- 'me###rbeing.net':80
- 'ge####manbottom.net':80
- 'al####yforever.net':80
- 'ge#####anforever.net':80
- 'al####ybottom.net':80
- 'fo###wbeing.net':80
- 'me####beyond.net':80
- 'fo####beyond.net':80
- 'kn###being.net':80
- 'su####bottom.net':80
- 'cr####orever.net':80
- 'su####forever.net':80
- 'cr###bottom.net':80
- 'th####tbeing.net':80
- 'wa###beyond.net':80
- 'th####tbeyond.net':80
- 'cr###being.net':80
- 'be###bottom.net':80
- 'kn####orever.net':80
- 'be####orever.net':80
- 'kn###bottom.net':80
- 'su###rbeing.net':80
- 'cr###beyond.net':80
- 'su####beyond.net':80
TCP:
Запросы HTTP GET:
- http://wo###bottom.net/index.php?me########
- http://sm####orever.net/index.php?me########
- http://wo####orever.net/index.php?me########
- http://sm###bottom.net/index.php?me########
- http://pa###being.net/index.php?me########
- http://fi###beyond.net/index.php?me########
- http://pa###beyond.net/index.php?me########
- http://sm###being.net/index.php?me########
- http://th####tbottom.net/index.php?me########
- http://wa####orever.net/index.php?me########
- http://th####tforever.net/index.php?me########
- http://wa###bottom.net/index.php?me########
- http://wo###being.net/index.php?me########
- http://sm###beyond.net/index.php?me########
- http://wo###beyond.net/index.php?me########
- http://fi###being.net/index.php?me########
- http://fr###corner.net/index.php?me########
- http://ex#####ncespecial.net/index.php?me########
- http://fr####pecial.net/index.php?me########
- http://ex#####ncecorner.net/index.php?me########
- http://ge####manminute.net/index.php?me########
- http://al####yflower.net/index.php?me########
- http://ge####manflower.net/index.php?me########
- http://ex#####nceminute.net/index.php?me########
- http://pa###bottom.net/index.php?me########
- http://fi####orever.net/index.php?me########
- http://pa####orever.net/index.php?me########
- http://fi###bottom.net/index.php?me########
- http://fr###minute.net/index.php?me########
- http://ex#####nceflower.net/index.php?me########
- http://fr###flower.net/index.php?me########
- http://wa###being.net/index.php?me########
- http://fo####bottom.net/index.php?me########
- http://me####forever.net/index.php?me########
- http://fo####forever.net/index.php?me########
- http://me####bottom.net/index.php?me########
- http://be###being.net/index.php?me########
- http://kn###beyond.net/index.php?me########
- http://be###beyond.net/index.php?me########
- http://me###rbeing.net/index.php?me########
- http://ge####manbottom.net/index.php?me########
- http://al####yforever.net/index.php?me########
- http://ge#####anforever.net/index.php?me########
- http://al####ybottom.net/index.php?me########
- http://fo###wbeing.net/index.php?me########
- http://me####beyond.net/index.php?me########
- http://fo####beyond.net/index.php?me########
- http://kn###being.net/index.php?me########
- http://su####bottom.net/index.php?me########
- http://cr####orever.net/index.php?me########
- http://su####forever.net/index.php?me########
- http://cr###bottom.net/index.php?me########
- http://th####tbeing.net/index.php?me########
- http://wa###beyond.net/index.php?me########
- http://th####tbeyond.net/index.php?me########
- http://cr###being.net/index.php?me########
- http://be###bottom.net/index.php?me########
- http://kn####orever.net/index.php?me########
- http://be####orever.net/index.php?me########
- http://kn###bottom.net/index.php?me########
- http://su###rbeing.net/index.php?me########
- http://cr###beyond.net/index.php?me########
- http://su####beyond.net/index.php?me########
UDP:
- DNS ASK wo###bottom.net
- DNS ASK sm###bottom.net
- DNS ASK wo####orever.net
- DNS ASK sm####orever.net
- DNS ASK pa###being.net
- DNS ASK fi###being.net
- DNS ASK pa###beyond.net
- DNS ASK fi###beyond.net
- DNS ASK th####tbottom.net
- DNS ASK wa###bottom.net
- DNS ASK th####tforever.net
- DNS ASK wa####orever.net
- DNS ASK wo###being.net
- DNS ASK sm###being.net
- DNS ASK wo###beyond.net
- DNS ASK sm###beyond.net
- DNS ASK fr###corner.net
- DNS ASK ex#####ncecorner.net
- DNS ASK fr####pecial.net
- DNS ASK ex#####ncespecial.net
- DNS ASK ge####manminute.net
- DNS ASK al####yminute.net
- DNS ASK ge####manflower.net
- DNS ASK al####yflower.net
- DNS ASK pa###bottom.net
- DNS ASK fi###bottom.net
- DNS ASK pa####orever.net
- DNS ASK fi####orever.net
- DNS ASK fr###minute.net
- DNS ASK ex#####nceminute.net
- DNS ASK fr###flower.net
- DNS ASK ex#####nceflower.net
- DNS ASK fo####bottom.net
- DNS ASK me####bottom.net
- DNS ASK fo####forever.net
- DNS ASK me####forever.net
- DNS ASK be###being.net
- DNS ASK kn###being.net
- DNS ASK be###beyond.net
- DNS ASK kn###beyond.net
- DNS ASK ge####manbottom.net
- DNS ASK al####ybottom.net
- DNS ASK ge#####anforever.net
- DNS ASK al####yforever.net
- DNS ASK fo###wbeing.net
- DNS ASK me###rbeing.net
- DNS ASK fo####beyond.net
- DNS ASK me####beyond.net
- DNS ASK su####bottom.net
- DNS ASK cr###bottom.net
- DNS ASK su####forever.net
- DNS ASK cr####orever.net
- DNS ASK th####tbeing.net
- DNS ASK wa###being.net
- DNS ASK th####tbeyond.net
- DNS ASK wa###beyond.net
- DNS ASK be###bottom.net
- DNS ASK kn###bottom.net
- DNS ASK be####orever.net
- DNS ASK kn####orever.net
- DNS ASK su###rbeing.net
- DNS ASK cr###being.net
- DNS ASK su####beyond.net
- DNS ASK cr###beyond.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
