Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Secure Fax VC Server IKE Removal Time' = 'C:\eksyxhrnsqo\adzqdwdd.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Adaptive Encrypting Name Performance Files] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- 'C:\eksyxhrnsqo\ylzmsigr.exe' "c:\eksyxhrnsqo\adzqdwdd.exe"
- 'C:\eksyxhrnsqo\adzqdwdd.exe'
- 'C:\eksyxhrnsqo\s8z2o8ev7febhqhjf.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\eksyxhrnsqo\adzqdwdd.exe
- C:\eksyxhrnsqo\ylzmsigr.exe
- C:\eksyxhrnsqo\kbwwwfiym
- %WINDIR%\eksyxhrnsqo\ot9gdymk1
- C:\eksyxhrnsqo\ot9gdymk1
- C:\eksyxhrnsqo\s8z2o8ev7febhqhjf.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\eksyxhrnsqo\ylzmsigr.exe
- C:\eksyxhrnsqo\adzqdwdd.exe
Удаляет следующие файлы:
- C:\eksyxhrnsqo\s8z2o8ev7febhqhjf.exe
- %WINDIR%\eksyxhrnsqo\ot9gdymk1
Сетевая активность:
Подключается к:
- 'di#####ltunderstand.net':80
- 'gl###butter.net':80
- 'he####nderstand.net':80
- 'he###broad.net':80
- 'di####ultbroad.net':80
- 'an####butter.net':80
- 'an###rbroad.net':80
- 'gl####nderstand.net':80
- 'gl###broad.net':80
- 'gl###behind.net':80
- 'an####behind.net':80
- 'di####ultbehind.net':80
- 'pl####ntbehind.net':80
- 'ne####arybroad.net':80
- 'ne####arybehind.net':80
- 'ne####arybutter.net':80
- 'pl####ntbutter.net':80
- 'pl####ntbroad.net':80
- 'di####ultbutter.net':80
- 'he###behind.net':80
- 'he###butter.net':80
- 'ne#####ryunderstand.net':80
- 'pl#####tunderstand.net':80
- 'an#####nderstand.net':80
- 'wo###speak.net':80
- 'in####seoclock.net':80
- 're####erspeak.net':80
- 're####erniece.net':80
- 'wo###niece.net':80
- 'fo####oclock.net':80
- 'fo###tniece.net':80
- 'in####sespeak.net':80
- 'in####seniece.net':80
- 'in####sewrite.net':80
- 'fo###twrite.net':80
- 'wo###write.net':80
- 'de####behind.net':80
- 'fo####dbroad.net':80
- 'fo####dbehind.net':80
- 'fo####dbutter.net':80
- 'de####butter.net':80
- 'de###ebroad.net':80
- 'wo###oclock.net':80
- 're####erwrite.net':80
- 're####eroclock.net':80
- 'fo#####understand.net':80
- 'de#####nderstand.net':80
TCP:
Запросы HTTP GET:
- http://di#####ltunderstand.net/index.php
- http://gl###butter.net/index.php
- http://he####nderstand.net/index.php
- http://he###broad.net/index.php
- http://di####ultbroad.net/index.php
- http://an####butter.net/index.php
- http://an###rbroad.net/index.php
- http://gl####nderstand.net/index.php
- http://gl###broad.net/index.php
- http://gl###behind.net/index.php
- http://an####behind.net/index.php
- http://di####ultbehind.net/index.php
- http://pl####ntbehind.net/index.php
- http://ne####arybroad.net/index.php
- http://ne####arybehind.net/index.php
- http://ne####arybutter.net/index.php
- http://pl####ntbutter.net/index.php
- http://pl####ntbroad.net/index.php
- http://di####ultbutter.net/index.php
- http://he###behind.net/index.php
- http://he###butter.net/index.php
- http://ne#####ryunderstand.net/index.php
- http://pl#####tunderstand.net/index.php
- http://an#####nderstand.net/index.php
- http://wo###speak.net/index.php
- http://in####seoclock.net/index.php
- http://re####erspeak.net/index.php
- http://re####erniece.net/index.php
- http://wo###niece.net/index.php
- http://fo####oclock.net/index.php
- http://fo###tniece.net/index.php
- http://in####sespeak.net/index.php
- http://in####seniece.net/index.php
- http://in####sewrite.net/index.php
- http://fo###twrite.net/index.php
- http://wo###write.net/index.php
- http://de####behind.net/index.php
- http://fo####dbroad.net/index.php
- http://fo####dbehind.net/index.php
- http://fo####dbutter.net/index.php
- http://de####butter.net/index.php
- http://de###ebroad.net/index.php
- http://wo###oclock.net/index.php
- http://re####erwrite.net/index.php
- http://re####eroclock.net/index.php
- http://fo#####understand.net/index.php
- http://de#####nderstand.net/index.php
UDP:
- DNS ASK he####nderstand.net
- DNS ASK di#####ltunderstand.net
- DNS ASK gl###butter.net
- DNS ASK di####ultbehind.net
- DNS ASK he###broad.net
- DNS ASK di####ultbroad.net
- DNS ASK gl###broad.net
- DNS ASK an###rbroad.net
- DNS ASK gl####nderstand.net
- DNS ASK an####butter.net
- DNS ASK gl###behind.net
- DNS ASK an####behind.net
- DNS ASK ne####arybehind.net
- DNS ASK pl####ntbehind.net
- DNS ASK ne####arybroad.net
- DNS ASK or####nderstand.net
- DNS ASK ne####arybutter.net
- DNS ASK pl####ntbutter.net
- DNS ASK he###butter.net
- DNS ASK di####ultbutter.net
- DNS ASK he###behind.net
- DNS ASK pl####ntbroad.net
- DNS ASK ne#####ryunderstand.net
- DNS ASK pl#####tunderstand.net
- DNS ASK re####erspeak.net
- DNS ASK wo###speak.net
- DNS ASK in####seoclock.net
- DNS ASK wo###write.net
- DNS ASK re####erniece.net
- DNS ASK wo###niece.net
- DNS ASK in####seniece.net
- DNS ASK fo###tniece.net
- DNS ASK in####sespeak.net
- DNS ASK fo####oclock.net
- DNS ASK in####sewrite.net
- DNS ASK fo###twrite.net
- DNS ASK fo####dbehind.net
- DNS ASK de####behind.net
- DNS ASK fo####dbroad.net
- DNS ASK an#####nderstand.net
- DNS ASK fo####dbutter.net
- DNS ASK de####butter.net
- DNS ASK re####eroclock.net
- DNS ASK wo###oclock.net
- DNS ASK re####erwrite.net
- DNS ASK de###ebroad.net
- DNS ASK fo#####understand.net
- DNS ASK de#####nderstand.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
