Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'BranchCache Services Call SSDP' = '<LS_APPDATA>\rykcmwrxclic\sidxlpz.exe'
Вредоносные функции:
Создает и запускает на исполнение:
- '<LS_APPDATA>\rykcmwrxclic\azrxvrs.exe' "<LS_APPDATA>\rykcmwrxclic\sidxlpz.exe"
- '<LS_APPDATA>\rykcmwrxclic\sidxlpz.exe'
Изменения в файловой системе:
Создает следующие файлы:
- <LS_APPDATA>\rykcmwrxclic\sidxlpz.d18k
- <LS_APPDATA>\rykcmwrxclic\azrxvrs.exe
- <LS_APPDATA>\rykcmwrxclic\sidxlpz.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- <LS_APPDATA>\rykcmwrxclic\azrxvrs.exe
- <LS_APPDATA>\rykcmwrxclic\sidxlpz.exe
Сетевая активность:
Подключается к:
- 'de###eshake.net':80
- 'pr####eshare.net':80
- 'de####happen.net':80
- 'pr####eshake.net':80
- 'st####thhappen.net':80
- 'st####thshake.net':80
- 'de###eshare.net':80
- 'st####thnearly.net':80
- 're###tshake.net':80
- 'br###nshare.net':80
- 're####happen.net':80
- 'br###nshake.net':80
- 'de####nearly.net':80
- 'pr####ehappen.net':80
- 're###tshare.net':80
- 'pr####enearly.net':80
- 'ev####gsucceed.net':80
- 'bu####ngbetween.net':80
- 'ou####estudent.net':80
- 'bu####ngsucceed.net':80
- 'ev####gproduce.net':80
- 'bu####ngstudent.net':80
- 'ev####gbetween.net':80
- 'bu####ngproduce.net':80
- 'ou####esucceed.net':80
- 'mo####ntbetween.net':80
- 'st####thshare.net':80
- 'mo####ntsucceed.net':80
- 'ou####eproduce.net':80
- 'mo####ntstudent.net':80
- 'ou####ebetween.net':80
- 'mo####ntproduce.net':80
- 'br####happen.net':80
- 'st###happen.net':80
- 'mi###happen.net':80
- 'st###nearly.net':80
- 'mi###nearly.net':80
- 'st###share.net':80
- 'mi###share.net':80
- 'st###shake.net':80
- 'mi###shake.net':80
- 'bu####nghappen.net':80
- 'ev####ghappen.net':80
- 'bu####ngnearly.net':80
- 'ev####gnearly.net':80
- 'bu####ngshare.net':80
- 'ev####gshare.net':80
- 'bu####ngshake.net':80
- 'ev####gshake.net':80
- 'fe###wshake.net':80
- 'do###eshake.net':80
- 'fe####nearly.net':80
- 'fe####happen.net':80
- 'br####nearly.net':80
- 're####nearly.net':80
- 'fe###wshare.net':80
- 'do###eshare.net':80
- 'do####happen.net':80
- 'pr####happen.net':80
- 'do####nearly.net':80
- 'pr####nearly.net':80
- 'do###rshare.net':80
- 'pr###yshare.net':80
- 'do###rshake.net':80
- 'pr###yshake.net':80
TCP:
Запросы HTTP GET:
- http://de###eshake.net/forum/search.php?em###############################
- http://pr####eshare.net/forum/search.php?em###############################
- http://de####happen.net/forum/search.php?em###############################
- http://pr####eshake.net/forum/search.php?em###############################
- http://st####thhappen.net/forum/search.php?em###############################
- http://st####thshake.net/forum/search.php?em###############################
- http://de###eshare.net/forum/search.php?em###############################
- http://st####thnearly.net/forum/search.php?em###############################
- http://re###tshake.net/forum/search.php?em###############################
- http://br###nshare.net/forum/search.php?em###############################
- http://re####happen.net/forum/search.php?em###############################
- http://br###nshake.net/forum/search.php?em###############################
- http://de####nearly.net/forum/search.php?em###############################
- http://pr####ehappen.net/forum/search.php?em###############################
- http://re###tshare.net/forum/search.php?em###############################
- http://pr####enearly.net/forum/search.php?em###############################
- http://ev####gsucceed.net/forum/search.php?em###############################
- http://bu####ngbetween.net/forum/search.php?em###############################
- http://ou####estudent.net/forum/search.php?em###############################
- http://bu####ngsucceed.net/forum/search.php?em###############################
- http://ev####gproduce.net/forum/search.php?em###############################
- http://bu####ngstudent.net/forum/search.php?em###############################
- http://ev####gbetween.net/forum/search.php?em###############################
- http://bu####ngproduce.net/forum/search.php?em###############################
- http://ou####esucceed.net/forum/search.php?em###############################
- http://mo####ntbetween.net/forum/search.php?em###############################
- http://st####thshare.net/forum/search.php?em###############################
- http://mo####ntsucceed.net/forum/search.php?em###############################
- http://ou####eproduce.net/forum/search.php?em###############################
- http://mo####ntstudent.net/forum/search.php?em###############################
- http://ou####ebetween.net/forum/search.php?em###############################
- http://mo####ntproduce.net/forum/search.php?em###############################
- http://br####happen.net/forum/search.php?em###############################
- http://st###happen.net/forum/search.php?em###############################
- http://mi###happen.net/forum/search.php?em###############################
- http://st###nearly.net/forum/search.php?em###############################
- http://mi###nearly.net/forum/search.php?em###############################
- http://st###share.net/forum/search.php?em###############################
- http://mi###share.net/forum/search.php?em###############################
- http://st###shake.net/forum/search.php?em###############################
- http://mi###shake.net/forum/search.php?em###############################
- http://bu####nghappen.net/forum/search.php?em###############################
- http://ev####ghappen.net/forum/search.php?em###############################
- http://bu####ngnearly.net/forum/search.php?em###############################
- http://ev####gnearly.net/forum/search.php?em###############################
- http://bu####ngshare.net/forum/search.php?em###############################
- http://ev####gshare.net/forum/search.php?em###############################
- http://bu####ngshake.net/forum/search.php?em###############################
- http://ev####gshake.net/forum/search.php?em###############################
- http://fe###wshake.net/forum/search.php?em###############################
- http://do###eshake.net/forum/search.php?em###############################
- http://fe####nearly.net/forum/search.php?em###############################
- http://fe####happen.net/forum/search.php?em###############################
- http://br####nearly.net/forum/search.php?em###############################
- http://re####nearly.net/forum/search.php?em###############################
- http://fe###wshare.net/forum/search.php?em###############################
- http://do###eshare.net/forum/search.php?em###############################
- http://do####happen.net/forum/search.php?em###############################
- http://pr####happen.net/forum/search.php?em###############################
- http://do####nearly.net/forum/search.php?em###############################
- http://pr####nearly.net/forum/search.php?em###############################
- http://do###rshare.net/forum/search.php?em###############################
- http://pr###yshare.net/forum/search.php?em###############################
- http://do###rshake.net/forum/search.php?em###############################
- http://pr###yshake.net/forum/search.php?em###############################
UDP:
- DNS ASK de###eshake.net
- DNS ASK pr####eshare.net
- DNS ASK de####happen.net
- DNS ASK pr####eshake.net
- DNS ASK st####thhappen.net
- DNS ASK st####thshake.net
- DNS ASK de###eshare.net
- DNS ASK st####thnearly.net
- DNS ASK re###tshake.net
- DNS ASK br###nshare.net
- DNS ASK re####happen.net
- DNS ASK br###nshake.net
- DNS ASK de####nearly.net
- DNS ASK pr####ehappen.net
- DNS ASK re###tshare.net
- DNS ASK pr####enearly.net
- DNS ASK ev####gsucceed.net
- DNS ASK bu####ngbetween.net
- DNS ASK ou####estudent.net
- DNS ASK bu####ngsucceed.net
- DNS ASK ev####gproduce.net
- DNS ASK bu####ngstudent.net
- DNS ASK ev####gbetween.net
- DNS ASK bu####ngproduce.net
- DNS ASK ou####esucceed.net
- DNS ASK mo####ntbetween.net
- DNS ASK st####thshare.net
- DNS ASK mo####ntsucceed.net
- DNS ASK ou####eproduce.net
- DNS ASK mo####ntstudent.net
- DNS ASK ou####ebetween.net
- DNS ASK mo####ntproduce.net
- DNS ASK br####happen.net
- DNS ASK st###happen.net
- DNS ASK mi###happen.net
- DNS ASK st###nearly.net
- DNS ASK mi###nearly.net
- DNS ASK st###share.net
- DNS ASK mi###share.net
- DNS ASK st###shake.net
- DNS ASK mi###shake.net
- DNS ASK bu####nghappen.net
- DNS ASK ev####ghappen.net
- DNS ASK bu####ngnearly.net
- DNS ASK ev####gnearly.net
- DNS ASK bu####ngshare.net
- DNS ASK ev####gshare.net
- DNS ASK bu####ngshake.net
- DNS ASK ev####gshake.net
- DNS ASK fe###wshake.net
- DNS ASK do###eshake.net
- DNS ASK fe####nearly.net
- DNS ASK fe####happen.net
- DNS ASK br####nearly.net
- DNS ASK re####nearly.net
- DNS ASK fe###wshare.net
- DNS ASK do###eshare.net
- DNS ASK do####happen.net
- DNS ASK pr####happen.net
- DNS ASK do####nearly.net
- DNS ASK pr####nearly.net
- DNS ASK do###rshare.net
- DNS ASK pr###yshare.net
- DNS ASK do###rshake.net
- DNS ASK pr###yshake.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'Indicator' WindowName: ''
