Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Internet Diagnostic Redirector' = 'C:\uylkilgattpv\mocbfiwi.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Access Time Auto Auto-Discovery] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- 'C:\uylkilgattpv\wmokhzpqzaal.exe' "c:\uylkilgattpv\mocbfiwi.exe"
- 'C:\uylkilgattpv\mocbfiwi.exe'
- 'C:\uylkilgattpv\ayai3bpwtoqurvohuk5a5.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\uylkilgattpv\mocbfiwi.exe
- C:\uylkilgattpv\wmokhzpqzaal.exe
- C:\uylkilgattpv\vgxrxbkaozn
- %WINDIR%\uylkilgattpv\lngfpzedfhsr
- C:\uylkilgattpv\lngfpzedfhsr
- C:\uylkilgattpv\ayai3bpwtoqurvohuk5a5.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\uylkilgattpv\wmokhzpqzaal.exe
- C:\uylkilgattpv\mocbfiwi.exe
Удаляет следующие файлы:
- C:\uylkilgattpv\ayai3bpwtoqurvohuk5a5.exe
- %WINDIR%\uylkilgattpv\lngfpzedfhsr
Сетевая активность:
Подключается к:
- 'he####needle.net':80
- 'le####enough.net':80
- 'le####needle.net':80
- 'le####nature.net':80
- 'he####nature.net':80
- 'ge####nature.net':80
- 'ge####needle.net':80
- 'he####govern.net':80
- 'he####enough.net':80
- 'le####govern.net':80
- 're####enature.net':80
- 'or###needle.net':80
- 'or###nature.net':80
- 'pl####ntgovern.net':80
- 'ne####arygovern.net':80
- 'or###govern.net':80
- 're####egovern.net':80
- 're####eenough.net':80
- 're####eneedle.net':80
- 'or###enough.net':80
- 'fo####dcover.net':80
- 'de####become.net':80
- 'de###ecover.net':80
- 'de####further.net':80
- 'fo####dfurther.net':80
- 'an####further.net':80
- 'gl####urther.net':80
- 'fo####dcompany.net':80
- 'fo####dbecome.net':80
- 'de####company.net':80
- 're####nature.net':80
- 'va####sneedle.net':80
- 'va####snature.net':80
- 'ge####enough.net':80
- 'ge####govern.net':80
- 'va####sgovern.net':80
- 're####govern.net':80
- 're####enough.net':80
- 're####needle.net':80
- 'va####senough.net':80
- 'ne####aryenough.net':80
- 'de####needle.net':80
- 'fo####dneedle.net':80
- 'fo####dnature.net':80
- 're####complete.net':80
- 'de####nature.net':80
- 'fo####dgovern.net':80
- 'an####nature.net':80
- 'de####govern.net':80
- 'de####enough.net':80
- 'fo####denough.net':80
- 'va####swelcome.net':80
- 're####welcome.net':80
- 'ge####complete.net':80
- 'ge###eproud.net':80
- 'he####omplete.net':80
- 're###nproud.net':80
- 'va####scomplete.net':80
- 'va####sproud.net':80
- 'va####saround.net':80
- 're####around.net':80
- 'di####ultgovern.net':80
- 'he###govern.net':80
- 'he###enough.net':80
- 'he###needle.net':80
- 'di####ultenough.net':80
- 'ne####aryneedle.net':80
- 'pl####ntenough.net':80
- 'pl####ntneedle.net':80
- 'pl####ntnature.net':80
- 'ne####arynature.net':80
- 'an####enough.net':80
- 'gl###enough.net':80
- 'gl###needle.net':80
- 'gl###nature.net':80
- 'an####needle.net':80
- 'he###nature.net':80
- 'di####ultneedle.net':80
- 'di####ultnature.net':80
- 'an####govern.net':80
- 'gl###govern.net':80
TCP:
Запросы HTTP GET:
- http://he####needle.net/index.php?me########
- http://le####enough.net/index.php?me########
- http://le####needle.net/index.php?me########
- http://le####nature.net/index.php?me########
- http://he####nature.net/index.php?me########
- http://ge####nature.net/index.php?me########
- http://ge####needle.net/index.php?me########
- http://he####govern.net/index.php?me########
- http://he####enough.net/index.php?me########
- http://le####govern.net/index.php?me########
- http://re####enature.net/index.php?me########
- http://or###needle.net/index.php?me########
- http://or###nature.net/index.php?me########
- http://pl####ntgovern.net/index.php?me########
- http://ne####arygovern.net/index.php?me########
- http://or###govern.net/index.php?me########
- http://re####egovern.net/index.php?me########
- http://re####eenough.net/index.php?me########
- http://re####eneedle.net/index.php?me########
- http://or###enough.net/index.php?me########
- http://fo####dcover.net/index.php?me########
- http://de####become.net/index.php?me########
- http://de###ecover.net/index.php?me########
- http://de####further.net/index.php?me########
- http://fo####dfurther.net/index.php?me########
- http://an####further.net/index.php?me########
- http://gl####urther.net/index.php?me########
- http://fo####dcompany.net/index.php?me########
- http://fo####dbecome.net/index.php?me########
- http://de####company.net/index.php?me########
- http://re####nature.net/index.php?me########
- http://va####sneedle.net/index.php?me########
- http://va####snature.net/index.php?me########
- http://ge####enough.net/index.php?me########
- http://ge####govern.net/index.php?me########
- http://va####sgovern.net/index.php?me########
- http://re####govern.net/index.php?me########
- http://re####enough.net/index.php?me########
- http://re####needle.net/index.php?me########
- http://va####senough.net/index.php?me########
- http://ne####aryenough.net/index.php?me########
- http://de####needle.net/index.php?me########
- http://fo####dneedle.net/index.php?me########
- http://fo####dnature.net/index.php?me########
- http://re####complete.net/index.php?me########
- http://de####nature.net/index.php?me########
- http://fo####dgovern.net/index.php?me########
- http://an####nature.net/index.php?me########
- http://de####govern.net/index.php?me########
- http://de####enough.net/index.php?me########
- http://fo####denough.net/index.php?me########
- http://va####swelcome.net/index.php?me########
- http://re####welcome.net/index.php?me########
- http://ge####complete.net/index.php?me########
- http://ge###eproud.net/index.php?me########
- http://he####omplete.net/index.php?me########
- http://re###nproud.net/index.php?me########
- http://va####scomplete.net/index.php?me########
- http://va####sproud.net/index.php?me########
- http://va####saround.net/index.php?me########
- http://re####around.net/index.php?me########
- http://di####ultgovern.net/index.php?me########
- http://he###govern.net/index.php?me########
- http://he###enough.net/index.php?me########
- http://he###needle.net/index.php?me########
- http://di####ultenough.net/index.php?me########
- http://ne####aryneedle.net/index.php?me########
- http://pl####ntenough.net/index.php?me########
- http://pl####ntneedle.net/index.php?me########
- http://pl####ntnature.net/index.php?me########
- http://ne####arynature.net/index.php?me########
- http://an####enough.net/index.php?me########
- http://gl###enough.net/index.php?me########
- http://gl###needle.net/index.php?me########
- http://gl###nature.net/index.php?me########
- http://an####needle.net/index.php?me########
- http://he###nature.net/index.php?me########
- http://di####ultneedle.net/index.php?me########
- http://di####ultnature.net/index.php?me########
- http://an####govern.net/index.php?me########
- http://gl###govern.net/index.php?me########
UDP:
- DNS ASK he####needle.net
- DNS ASK le####enough.net
- DNS ASK le####needle.net
- DNS ASK le####nature.net
- DNS ASK he####nature.net
- DNS ASK ge####nature.net
- DNS ASK ge####needle.net
- DNS ASK he####govern.net
- DNS ASK he####enough.net
- DNS ASK le####govern.net
- DNS ASK re####enature.net
- DNS ASK or###needle.net
- DNS ASK or###nature.net
- DNS ASK pl####ntgovern.net
- DNS ASK ne####arygovern.net
- DNS ASK or###govern.net
- DNS ASK re####egovern.net
- DNS ASK re####eenough.net
- DNS ASK re####eneedle.net
- DNS ASK or###enough.net
- DNS ASK fo####dcover.net
- DNS ASK de####become.net
- DNS ASK de###ecover.net
- DNS ASK de####further.net
- DNS ASK fo####dfurther.net
- DNS ASK an####further.net
- DNS ASK gl####urther.net
- DNS ASK fo####dcompany.net
- DNS ASK fo####dbecome.net
- DNS ASK de####company.net
- DNS ASK re####nature.net
- DNS ASK va####sneedle.net
- DNS ASK va####snature.net
- DNS ASK ge####enough.net
- DNS ASK ge####govern.net
- DNS ASK va####sgovern.net
- DNS ASK re####govern.net
- DNS ASK re####enough.net
- DNS ASK re####needle.net
- DNS ASK va####senough.net
- DNS ASK ne####aryenough.net
- DNS ASK de####needle.net
- DNS ASK fo####dneedle.net
- DNS ASK fo####dnature.net
- DNS ASK re####complete.net
- DNS ASK de####nature.net
- DNS ASK fo####dgovern.net
- DNS ASK an####nature.net
- DNS ASK de####govern.net
- DNS ASK de####enough.net
- DNS ASK fo####denough.net
- DNS ASK va####swelcome.net
- DNS ASK re####welcome.net
- DNS ASK ge####complete.net
- DNS ASK ge###eproud.net
- DNS ASK he####omplete.net
- DNS ASK re###nproud.net
- DNS ASK va####scomplete.net
- DNS ASK va####sproud.net
- DNS ASK va####saround.net
- DNS ASK re####around.net
- DNS ASK di####ultgovern.net
- DNS ASK he###govern.net
- DNS ASK he###enough.net
- DNS ASK he###needle.net
- DNS ASK di####ultenough.net
- DNS ASK ne####aryneedle.net
- DNS ASK pl####ntenough.net
- DNS ASK pl####ntneedle.net
- DNS ASK pl####ntnature.net
- DNS ASK ne####arynature.net
- DNS ASK an####enough.net
- DNS ASK gl###enough.net
- DNS ASK gl###needle.net
- DNS ASK gl###nature.net
- DNS ASK an####needle.net
- DNS ASK he###nature.net
- DNS ASK di####ultneedle.net
- DNS ASK di####ultnature.net
- DNS ASK an####govern.net
- DNS ASK gl###govern.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
