Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Video Discovery Gateway Scheduler' = 'C:\qzwiaqvtqdhykm\ntahnhgeoal.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Auto-Discovery Name PnP-X Support HomeGroup] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- 'C:\qzwiaqvtqdhykm\pxjokljtsozw.exe' "c:\qzwiaqvtqdhykm\ntahnhgeoal.exe"
- 'C:\qzwiaqvtqdhykm\ntahnhgeoal.exe'
- 'C:\qzwiaqvtqdhykm\dsp3bh7kihhspaw7.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\qzwiaqvtqdhykm\ntahnhgeoal.exe
- C:\qzwiaqvtqdhykm\pxjokljtsozw.exe
- C:\qzwiaqvtqdhykm\xyimtrnzc
- %WINDIR%\qzwiaqvtqdhykm\ymmvzcd
- C:\qzwiaqvtqdhykm\ymmvzcd
- C:\qzwiaqvtqdhykm\dsp3bh7kihhspaw7.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\qzwiaqvtqdhykm\pxjokljtsozw.exe
- C:\qzwiaqvtqdhykm\ntahnhgeoal.exe
Удаляет следующие файлы:
- C:\qzwiaqvtqdhykm\dsp3bh7kihhspaw7.exe
- %WINDIR%\qzwiaqvtqdhykm\ymmvzcd
Сетевая активность:
Подключается к:
- 'pe####sborrow.net':80
- 'po####ledelight.net':80
- 'mo####indelight.net':80
- 'wi###wtrain.net':80
- 'pe####strain.net':80
- 'wi####borrow.net':80
- 'mo####intrain.net':80
- 'po####leborrow.net':80
- 'mo####inborrow.net':80
- 'po#####eelectricity.net':80
- 'mo#####nelectricity.net':80
- 'po####letrain.net':80
- 'pe#####electricity.net':80
- 'fi####borrow.net':80
- 'su####tdelight.net':80
- 'su#####electricity.net':80
- 'le###train.net':80
- 'fi###htrain.net':80
- 'le###borrow.net':80
- 'wi####delight.net':80
- 'pe####sdelight.net':80
- 'wi#####lectricity.net':80
- 'su####ttrain.net':80
- 'wi###rtrain.net':80
- 'su####tborrow.net':80
- 'ma#####lunderstood.net':80
- 'se#####understood.net':80
- 'ma####altwenty.net':80
- 'se###atrain.net':80
- 'la###borrow.net':80
- 'se####borrow.net':80
- 'ma####alchance.net':80
- 'se####lchance.net':80
- 'pr#####yunderstood.net':80
- 'se####ltwenty.net':80
- 'ma####almeeting.net':80
- 'se####lmeeting.net':80
- 'la###train.net':80
- 'si#####lectricity.net':80
- 'mo###rtrain.net':80
- 'si###etrain.net':80
- 'mo####delight.net':80
- 'si####delight.net':80
- 'mo#####lectricity.net':80
- 'se####delight.net':80
- 'la#####ectricity.net':80
- 'se#####lectricity.net':80
- 'mo####borrow.net':80
- 'si####borrow.net':80
- 'la####elight.net':80
TCP:
Запросы HTTP GET:
- http://pe####sborrow.net/index.php?me########
- http://po####ledelight.net/index.php?me########
- http://mo####indelight.net/index.php?me########
- http://wi###wtrain.net/index.php?me########
- http://pe####strain.net/index.php?me########
- http://wi####borrow.net/index.php?me########
- http://mo####intrain.net/index.php?me########
- http://po####leborrow.net/index.php?me########
- http://mo####inborrow.net/index.php?me########
- http://po#####eelectricity.net/index.php?me########
- http://mo#####nelectricity.net/index.php?me########
- http://po####letrain.net/index.php?me########
- http://pe#####electricity.net/index.php?me########
- http://fi####borrow.net/index.php?me########
- http://su####tdelight.net/index.php?me########
- http://su#####electricity.net/index.php?me########
- http://le###train.net/index.php?me########
- http://fi###htrain.net/index.php?me########
- http://le###borrow.net/index.php?me########
- http://wi####delight.net/index.php?me########
- http://pe####sdelight.net/index.php?me########
- http://wi#####lectricity.net/index.php?me########
- http://su####ttrain.net/index.php?me########
- http://wi###rtrain.net/index.php?me########
- http://su####tborrow.net/index.php?me########
- http://ma#####lunderstood.net/index.php?me########
- http://se#####understood.net/index.php?me########
- http://ma####altwenty.net/index.php?me########
- http://se###atrain.net/index.php?me########
- http://la###borrow.net/index.php?me########
- http://se####borrow.net/index.php?me########
- http://ma####alchance.net/index.php?me########
- http://se####lchance.net/index.php?me########
- http://pr#####yunderstood.net/index.php?me########
- http://se####ltwenty.net/index.php?me########
- http://ma####almeeting.net/index.php?me########
- http://se####lmeeting.net/index.php?me########
- http://la###train.net/index.php?me########
- http://si#####lectricity.net/index.php?me########
- http://mo###rtrain.net/index.php?me########
- http://si###etrain.net/index.php?me########
- http://mo####delight.net/index.php?me########
- http://si####delight.net/index.php?me########
- http://mo#####lectricity.net/index.php?me########
- http://se####delight.net/index.php?me########
- http://la#####ectricity.net/index.php?me########
- http://se#####lectricity.net/index.php?me########
- http://mo####borrow.net/index.php?me########
- http://si####borrow.net/index.php?me########
- http://la####elight.net/index.php?me########
UDP:
- DNS ASK wi####borrow.net
- DNS ASK pe####sborrow.net
- DNS ASK po####ledelight.net
- DNS ASK pe#####electricity.net
- DNS ASK wi###wtrain.net
- DNS ASK pe####strain.net
- DNS ASK po####letrain.net
- DNS ASK mo####intrain.net
- DNS ASK po####leborrow.net
- DNS ASK mo####indelight.net
- DNS ASK po#####eelectricity.net
- DNS ASK mo#####nelectricity.net
- DNS ASK wi#####lectricity.net
- DNS ASK le###borrow.net
- DNS ASK fi####borrow.net
- DNS ASK su####tdelight.net
- DNS ASK fi#####lectricity.net
- DNS ASK le###train.net
- DNS ASK fi###htrain.net
- DNS ASK su####tborrow.net
- DNS ASK wi####delight.net
- DNS ASK pe####sdelight.net
- DNS ASK su#####electricity.net
- DNS ASK su####ttrain.net
- DNS ASK wi###rtrain.net
- DNS ASK mo####inborrow.net
- DNS ASK ma#####lunderstood.net
- DNS ASK se#####understood.net
- DNS ASK ma####altwenty.net
- DNS ASK se###atrain.net
- DNS ASK la###borrow.net
- DNS ASK se####borrow.net
- DNS ASK ma####alchance.net
- DNS ASK se####lchance.net
- DNS ASK pr#####yunderstood.net
- DNS ASK se####ltwenty.net
- DNS ASK ma####almeeting.net
- DNS ASK se####lmeeting.net
- DNS ASK la###train.net
- DNS ASK si#####lectricity.net
- DNS ASK mo###rtrain.net
- DNS ASK si###etrain.net
- DNS ASK mo####delight.net
- DNS ASK si####delight.net
- DNS ASK mo#####lectricity.net
- DNS ASK se####delight.net
- DNS ASK la#####ectricity.net
- DNS ASK se#####lectricity.net
- DNS ASK mo####borrow.net
- DNS ASK si####borrow.net
- DNS ASK la####elight.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
