Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'CNG Secure Encryption Detection' = 'C:\kecgqsgqyjgl\megsockfxb.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Office Call Sharing TPM] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- 'C:\kecgqsgqyjgl\yluesmoy.exe' "c:\kecgqsgqyjgl\megsockfxb.exe"
- 'C:\kecgqsgqyjgl\megsockfxb.exe'
- 'C:\kecgqsgqyjgl\nexq836crocplpr0xg.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\kecgqsgqyjgl\megsockfxb.exe
- C:\kecgqsgqyjgl\yluesmoy.exe
- C:\kecgqsgqyjgl\ipoova
- %WINDIR%\kecgqsgqyjgl\fbousblehqy
- C:\kecgqsgqyjgl\fbousblehqy
- C:\kecgqsgqyjgl\nexq836crocplpr0xg.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\kecgqsgqyjgl\yluesmoy.exe
- C:\kecgqsgqyjgl\megsockfxb.exe
Удаляет следующие файлы:
- C:\kecgqsgqyjgl\nexq836crocplpr0xg.exe
- %WINDIR%\kecgqsgqyjgl\fbousblehqy
Сетевая активность:
Подключается к:
- 'cr###mayor.net':80
- 'su####battle.net':80
- 'cr####erfect.net':80
- 'su###rmayor.net':80
- 'wa###heart.net':80
- 'th####tperfect.net':80
- 'cr###battle.net':80
- 'th####theart.net':80
- 'kn###mayor.net':80
- 'be###battle.net':80
- 'kn####erfect.net':80
- 'be###mayor.net':80
- 'cr###heart.net':80
- 'su####perfect.net':80
- 'kn###battle.net':80
- 'su###rheart.net':80
- 'wa####erfect.net':80
- 'wo###battle.net':80
- 'sm###battle.net':80
- 'wo###mayor.net':80
- 'sm###mayor.net':80
- 'pa####erfect.net':80
- 'fi####erfect.net':80
- 'pa###heart.net':80
- 'fi###heart.net':80
- 'th####tbattle.net':80
- 'wa###battle.net':80
- 'th####tmayor.net':80
- 'wa###mayor.net':80
- 'wo####erfect.net':80
- 'sm####erfect.net':80
- 'wo###heart.net':80
- 'sm###heart.net':80
- 'fr###mayor.net':80
- 'ex####encemayor.net':80
- 'fr####erfect.net':80
- 'ex#####nceperfect.net':80
- 'ge####manheart.net':80
- 'al####yheart.net':80
- 'fr###battle.net':80
- 'ex#####ncebattle.net':80
- 'pa####illion.net':80
- 'fi####illion.net':80
- 'pa####leasure.net':80
- 'fi####leasure.net':80
- 'fr###heart.net':80
- 'ex####enceheart.net':80
- 'pa###white.net':80
- 'fi###white.net':80
- 'ge#####anperfect.net':80
- 'me###rmayor.net':80
- 'fo####battle.net':80
- 'me####perfect.net':80
- 'fo###wmayor.net':80
- 'kn###heart.net':80
- 'be####erfect.net':80
- 'me####battle.net':80
- 'be###heart.net':80
- 'al####ymayor.net':80
- 'ge####manbattle.net':80
- 'al####yperfect.net':80
- 'ge####manmayor.net':80
- 'me###rheart.net':80
- 'fo####perfect.net':80
- 'al####ybattle.net':80
- 'fo###wheart.net':80
TCP:
Запросы HTTP GET:
- http://cr###mayor.net/index.php?me########
- http://su####battle.net/index.php?me########
- http://cr####erfect.net/index.php?me########
- http://su###rmayor.net/index.php?me########
- http://wa###heart.net/index.php?me########
- http://th####tperfect.net/index.php?me########
- http://cr###battle.net/index.php?me########
- http://th####theart.net/index.php?me########
- http://kn###mayor.net/index.php?me########
- http://be###battle.net/index.php?me########
- http://kn####erfect.net/index.php?me########
- http://be###mayor.net/index.php?me########
- http://cr###heart.net/index.php?me########
- http://su####perfect.net/index.php?me########
- http://kn###battle.net/index.php?me########
- http://su###rheart.net/index.php?me########
- http://wa####erfect.net/index.php?me########
- http://wo###battle.net/index.php?me########
- http://sm###battle.net/index.php?me########
- http://wo###mayor.net/index.php?me########
- http://sm###mayor.net/index.php?me########
- http://pa####erfect.net/index.php?me########
- http://fi####erfect.net/index.php?me########
- http://pa###heart.net/index.php?me########
- http://fi###heart.net/index.php?me########
- http://th####tbattle.net/index.php?me########
- http://wa###battle.net/index.php?me########
- http://th####tmayor.net/index.php?me########
- http://wa###mayor.net/index.php?me########
- http://wo####erfect.net/index.php?me########
- http://sm####erfect.net/index.php?me########
- http://wo###heart.net/index.php?me########
- http://sm###heart.net/index.php?me########
- http://fr###mayor.net/index.php?me########
- http://ex####encemayor.net/index.php?me########
- http://fr####erfect.net/index.php?me########
- http://ex#####nceperfect.net/index.php?me########
- http://ge####manheart.net/index.php?me########
- http://al####yheart.net/index.php?me########
- http://fr###battle.net/index.php?me########
- http://ex#####ncebattle.net/index.php?me########
- http://pa####illion.net/index.php?me########
- http://fi####illion.net/index.php?me########
- http://pa####leasure.net/index.php?me########
- http://fi####leasure.net/index.php?me########
- http://fr###heart.net/index.php?me########
- http://ex####enceheart.net/index.php?me########
- http://pa###white.net/index.php?me########
- http://fi###white.net/index.php?me########
- http://ge#####anperfect.net/index.php?me########
- http://me###rmayor.net/index.php?me########
- http://fo####battle.net/index.php?me########
- http://me####perfect.net/index.php?me########
- http://fo###wmayor.net/index.php?me########
- http://kn###heart.net/index.php?me########
- http://be####erfect.net/index.php?me########
- http://me####battle.net/index.php?me########
- http://be###heart.net/index.php?me########
- http://al####ymayor.net/index.php?me########
- http://ge####manbattle.net/index.php?me########
- http://al####yperfect.net/index.php?me########
- http://ge####manmayor.net/index.php?me########
- http://me###rheart.net/index.php?me########
- http://fo####perfect.net/index.php?me########
- http://al####ybattle.net/index.php?me########
- http://fo###wheart.net/index.php?me########
UDP:
- DNS ASK su####battle.net
- DNS ASK cr###battle.net
- DNS ASK su###rmayor.net
- DNS ASK cr###mayor.net
- DNS ASK th####tperfect.net
- DNS ASK wa####erfect.net
- DNS ASK th####theart.net
- DNS ASK wa###heart.net
- DNS ASK be###battle.net
- DNS ASK kn###battle.net
- DNS ASK be###mayor.net
- DNS ASK kn###mayor.net
- DNS ASK su####perfect.net
- DNS ASK cr####erfect.net
- DNS ASK su###rheart.net
- DNS ASK cr###heart.net
- DNS ASK th####tmayor.net
- DNS ASK sm###battle.net
- DNS ASK pa###heart.net
- DNS ASK sm###mayor.net
- DNS ASK wo###battle.net
- DNS ASK fi####erfect.net
- DNS ASK pa###mayor.net
- DNS ASK fi###heart.net
- DNS ASK pa####erfect.net
- DNS ASK wa###battle.net
- DNS ASK wo###heart.net
- DNS ASK wa###mayor.net
- DNS ASK th####tbattle.net
- DNS ASK sm####erfect.net
- DNS ASK wo###mayor.net
- DNS ASK sm###heart.net
- DNS ASK wo####erfect.net
- DNS ASK kn####erfect.net
- DNS ASK fr###mayor.net
- DNS ASK ex####encemayor.net
- DNS ASK fr####erfect.net
- DNS ASK ex#####nceperfect.net
- DNS ASK ge####manheart.net
- DNS ASK al####yheart.net
- DNS ASK fr###battle.net
- DNS ASK ex#####ncebattle.net
- DNS ASK pa####illion.net
- DNS ASK fi####illion.net
- DNS ASK pa####leasure.net
- DNS ASK fi####leasure.net
- DNS ASK fr###heart.net
- DNS ASK ex####enceheart.net
- DNS ASK pa###white.net
- DNS ASK fi###white.net
- DNS ASK ge#####anperfect.net
- DNS ASK me###rmayor.net
- DNS ASK fo####battle.net
- DNS ASK me####perfect.net
- DNS ASK fo###wmayor.net
- DNS ASK kn###heart.net
- DNS ASK be####erfect.net
- DNS ASK me####battle.net
- DNS ASK be###heart.net
- DNS ASK al####ymayor.net
- DNS ASK ge####manbattle.net
- DNS ASK al####yperfect.net
- DNS ASK ge####manmayor.net
- DNS ASK me###rheart.net
- DNS ASK fo####perfect.net
- DNS ASK al####ybattle.net
- DNS ASK fo###wheart.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
