Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Files Routing Builder Initiator Peer' = 'C:\rjwidvpdloufitw\uuzrrpuruy.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Internet WebClient Event Location] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- 'C:\rjwidvpdloufitw\fvdizjih.exe' "c:\rjwidvpdloufitw\uuzrrpuruy.exe"
- 'C:\rjwidvpdloufitw\uuzrrpuruy.exe'
- 'C:\rjwidvpdloufitw\wmn3dxrfm2j6lpxh.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\rjwidvpdloufitw\uuzrrpuruy.exe
- C:\rjwidvpdloufitw\fvdizjih.exe
- C:\rjwidvpdloufitw\xwslufb6sv5f
- %WINDIR%\rjwidvpdloufitw\qhiisauihu
- C:\rjwidvpdloufitw\qhiisauihu
- C:\rjwidvpdloufitw\wmn3dxrfm2j6lpxh.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\rjwidvpdloufitw\fvdizjih.exe
- C:\rjwidvpdloufitw\uuzrrpuruy.exe
Удаляет следующие файлы:
- C:\rjwidvpdloufitw\wmn3dxrfm2j6lpxh.exe
- %WINDIR%\rjwidvpdloufitw\qhiisauihu
Сетевая активность:
Подключается к:
- 'ge####manplease.net':80
- 'al####ysoldier.net':80
- 'ge#####ansoldier.net':80
- 'al#####condition.net':80
- 'ge#####ancondition.net':80
- 'al####yplease.net':80
- 'fr####ondition.net':80
- 'ex#####nceplease.net':80
- 'fr###please.net':80
- 'al####ynation.net':80
- 'ge####mannation.net':80
- 'ex#####ncecondition.net':80
- 'fo####nation.net':80
- 'kn###nation.net':80
- 'be###nation.net':80
- 'me####condition.net':80
- 'be###please.net':80
- 'kn####oldier.net':80
- 'be####oldier.net':80
- 'me####soldier.net':80
- 'fo####soldier.net':80
- 'me####nation.net':80
- 'fo####condition.net':80
- 'me####please.net':80
- 'fo####please.net':80
- 'sm###brown.net':80
- 'wo###brown.net':80
- 'sm###ready.net':80
- 'wo####aughter.net':80
- 'sm###people.net':80
- 'wo###people.net':80
- 'wa###people.net':80
- 'th####tpeople.net':80
- 'wa###brown.net':80
- 'wo###ready.net':80
- 'wa####aughter.net':80
- 'th####tdaughter.net':80
- 'sm####aughter.net':80
- 'fr###nation.net':80
- 'fi####aughter.net':80
- 'pa####aughter.net':80
- 'ex#####ncesoldier.net':80
- 'fr####oldier.net':80
- 'ex#####ncenation.net':80
- 'pa###brown.net':80
- 'fi###ready.net':80
- 'pa###ready.net':80
- 'fi###people.net':80
- 'pa###people.net':80
- 'fi###brown.net':80
TCP:
Запросы HTTP GET:
- http://ge####manplease.net/index.php?me########
- http://al####ysoldier.net/index.php?me########
- http://ge#####ansoldier.net/index.php?me########
- http://al#####condition.net/index.php?me########
- http://ge#####ancondition.net/index.php?me########
- http://al####yplease.net/index.php?me########
- http://fr####ondition.net/index.php?me########
- http://ex#####nceplease.net/index.php?me########
- http://fr###please.net/index.php?me########
- http://al####ynation.net/index.php?me########
- http://ge####mannation.net/index.php?me########
- http://ex#####ncecondition.net/index.php?me########
- http://fo####nation.net/index.php?me########
- http://kn###nation.net/index.php?me########
- http://be###nation.net/index.php?me########
- http://me####condition.net/index.php?me########
- http://be###please.net/index.php?me########
- http://kn####oldier.net/index.php?me########
- http://be####oldier.net/index.php?me########
- http://me####soldier.net/index.php?me########
- http://fo####soldier.net/index.php?me########
- http://me####nation.net/index.php?me########
- http://fo####condition.net/index.php?me########
- http://me####please.net/index.php?me########
- http://fo####please.net/index.php?me########
- http://sm###brown.net/index.php?me########
- http://wo###brown.net/index.php?me########
- http://sm###ready.net/index.php?me########
- http://wo####aughter.net/index.php?me########
- http://sm###people.net/index.php?me########
- http://wo###people.net/index.php?me########
- http://wa###people.net/index.php?me########
- http://th####tpeople.net/index.php?me########
- http://wa###brown.net/index.php?me########
- http://wo###ready.net/index.php?me########
- http://wa####aughter.net/index.php?me########
- http://th####tdaughter.net/index.php?me########
- http://sm####aughter.net/index.php?me########
- http://fr###nation.net/index.php?me########
- http://fi####aughter.net/index.php?me########
- http://pa####aughter.net/index.php?me########
- http://ex#####ncesoldier.net/index.php?me########
- http://fr####oldier.net/index.php?me########
- http://ex#####ncenation.net/index.php?me########
- http://pa###brown.net/index.php?me########
- http://fi###ready.net/index.php?me########
- http://pa###ready.net/index.php?me########
- http://fi###people.net/index.php?me########
- http://pa###people.net/index.php?me########
- http://fi###brown.net/index.php?me########
UDP:
- DNS ASK ge####manplease.net
- DNS ASK al####ysoldier.net
- DNS ASK ge#####ansoldier.net
- DNS ASK al#####condition.net
- DNS ASK ge#####ancondition.net
- DNS ASK al####yplease.net
- DNS ASK fr####ondition.net
- DNS ASK ex#####nceplease.net
- DNS ASK fr###please.net
- DNS ASK al####ynation.net
- DNS ASK ge####mannation.net
- DNS ASK ex#####ncecondition.net
- DNS ASK fo####nation.net
- DNS ASK kn###nation.net
- DNS ASK be###nation.net
- DNS ASK me####condition.net
- DNS ASK be###please.net
- DNS ASK kn####oldier.net
- DNS ASK be####oldier.net
- DNS ASK me####soldier.net
- DNS ASK fo####soldier.net
- DNS ASK me####nation.net
- DNS ASK fo####condition.net
- DNS ASK me####please.net
- DNS ASK fo####please.net
- DNS ASK sm###brown.net
- DNS ASK wo###brown.net
- DNS ASK sm###ready.net
- DNS ASK wo####aughter.net
- DNS ASK sm###people.net
- DNS ASK wo###people.net
- DNS ASK wa###people.net
- DNS ASK th####tpeople.net
- DNS ASK wa###brown.net
- DNS ASK wo###ready.net
- DNS ASK wa####aughter.net
- DNS ASK th####tdaughter.net
- DNS ASK sm####aughter.net
- DNS ASK fr###nation.net
- DNS ASK fi####aughter.net
- DNS ASK pa####aughter.net
- DNS ASK ex#####ncesoldier.net
- DNS ASK fr####oldier.net
- DNS ASK ex#####ncenation.net
- DNS ASK pa###brown.net
- DNS ASK fi###ready.net
- DNS ASK pa###ready.net
- DNS ASK fi###people.net
- DNS ASK pa###people.net
- DNS ASK fi###brown.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
