Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Window Superfetch Proxy WWAN Scheduler' = 'C:\hcezagcrtp\ngctppu.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\WebClient Connect Topology Visual Assistant] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- 'C:\hcezagcrtp\vecddnre.exe' "c:\hcezagcrtp\ngctppu.exe"
- 'C:\hcezagcrtp\ngctppu.exe'
- 'C:\hcezagcrtp\ac3ashebsvksmrnwy.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\hcezagcrtp\ngctppu.exe
- C:\hcezagcrtp\vecddnre.exe
- C:\hcezagcrtp\fkmfdp
- %WINDIR%\hcezagcrtp\qugslcbeqy
- C:\hcezagcrtp\qugslcbeqy
- C:\hcezagcrtp\ac3ashebsvksmrnwy.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\hcezagcrtp\vecddnre.exe
- C:\hcezagcrtp\ngctppu.exe
Удаляет следующие файлы:
- C:\hcezagcrtp\ac3ashebsvksmrnwy.exe
- %WINDIR%\hcezagcrtp\qugslcbeqy
Сетевая активность:
Подключается к:
- 'th####notice.net':80
- 'fi####notice.net':80
- 'th####indeed.net':80
- 'fi####indeed.net':80
- 'th####length.net':80
- 'wh####rduring.net':80
- 'ri###indeed.net':80
- 'fi####length.net':80
- 'ri###during.net':80
- 'pi####eindeed.net':80
- 'ci####ttenotice.net':80
- 'pi####eduring.net':80
- 'ci####tteindeed.net':80
- 'pi####enotice.net':80
- 'th####during.net':80
- 'fi####during.net':80
- 'ci####ttelength.net':80
- 'pi####elength.net':80
- 'wh####rindeed.net':80
- 'su####length.net':80
- 'ma####eduring.net':80
- 'su####notice.net':80
- 'fo####nlength.net':80
- 'pe####during.net':80
- 'ma####enotice.net':80
- 'pe####notice.net':80
- 'ma####eindeed.net':80
- 'pe####indeed.net':80
- 'ri###length.net':80
- 'wh####rlength.net':80
- 'ri###notice.net':80
- 'wh####rnotice.net':80
- 'fo####nduring.net':80
- 'su####indeed.net':80
- 'fo####nnotice.net':80
- 'su####during.net':80
- 'fo####nindeed.net':80
TCP:
Запросы HTTP GET:
- http://th####notice.net/index.php?me########
- http://fi####notice.net/index.php?me########
- http://th####indeed.net/index.php?me########
- http://fi####indeed.net/index.php?me########
- http://th####length.net/index.php?me########
- http://wh####rduring.net/index.php?me########
- http://ri###indeed.net/index.php?me########
- http://fi####length.net/index.php?me########
- http://ri###during.net/index.php?me########
- http://pi####eindeed.net/index.php?me########
- http://ci####ttenotice.net/index.php?me########
- http://pi####eduring.net/index.php?me########
- http://ci####tteindeed.net/index.php?me########
- http://pi####enotice.net/index.php?me########
- http://th####during.net/index.php?me########
- http://fi####during.net/index.php?me########
- http://ci####ttelength.net/index.php?me########
- http://pi####elength.net/index.php?me########
- http://wh####rindeed.net/index.php?me########
- http://su####length.net/index.php?me########
- http://ma####eduring.net/index.php?me########
- http://su####notice.net/index.php?me########
- http://fo####nlength.net/index.php?me########
- http://pe####during.net/index.php?me########
- http://ma####enotice.net/index.php?me########
- http://pe####notice.net/index.php?me########
- http://ma####eindeed.net/index.php?me########
- http://pe####indeed.net/index.php?me########
- http://ri###length.net/index.php?me########
- http://wh####rlength.net/index.php?me########
- http://ri###notice.net/index.php?me########
- http://wh####rnotice.net/index.php?me########
- http://fo####nduring.net/index.php?me########
- http://su####indeed.net/index.php?me########
- http://fo####nnotice.net/index.php?me########
- http://su####during.net/index.php?me########
- http://fo####nindeed.net/index.php?me########
UDP:
- DNS ASK th####notice.net
- DNS ASK fi####notice.net
- DNS ASK th####indeed.net
- DNS ASK fi####indeed.net
- DNS ASK th####length.net
- DNS ASK wh####rduring.net
- DNS ASK ri###indeed.net
- DNS ASK fi####length.net
- DNS ASK ri###during.net
- DNS ASK fi####during.net
- DNS ASK ci####tteindeed.net
- DNS ASK pi####eindeed.net
- DNS ASK ci####tteduring.net
- DNS ASK pi####eduring.net
- DNS ASK ci####ttenotice.net
- DNS ASK pi####elength.net
- DNS ASK th####during.net
- DNS ASK pi####enotice.net
- DNS ASK ci####ttelength.net
- DNS ASK su####length.net
- DNS ASK ma####eduring.net
- DNS ASK su####notice.net
- DNS ASK fo####nlength.net
- DNS ASK pe####during.net
- DNS ASK ma####enotice.net
- DNS ASK pe####notice.net
- DNS ASK ma####eindeed.net
- DNS ASK pe####indeed.net
- DNS ASK fo####nnotice.net
- DNS ASK wh####rnotice.net
- DNS ASK ri###length.net
- DNS ASK wh####rindeed.net
- DNS ASK ri###notice.net
- DNS ASK wh####rlength.net
- DNS ASK fo####nindeed.net
- DNS ASK su####indeed.net
- DNS ASK fo####nduring.net
- DNS ASK su####during.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
