Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Shadow User-mode Event Microsoft Access' = 'C:\arihptkxqr\wplopvd.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Experience DNS IP Center Firewall Agent] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- 'C:\arihptkxqr\fmwntwpff.exe' "c:\arihptkxqr\wplopvd.exe"
- 'C:\arihptkxqr\wplopvd.exe'
- 'C:\arihptkxqr\ds6394kat7is936fe.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\arihptkxqr\wplopvd.exe
- C:\arihptkxqr\fmwntwpff.exe
- C:\arihptkxqr\p1ipxmrnfhvl
- %WINDIR%\arihptkxqr\ohkebl
- C:\arihptkxqr\ohkebl
- C:\arihptkxqr\ds6394kat7is936fe.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\arihptkxqr\fmwntwpff.exe
- C:\arihptkxqr\wplopvd.exe
Удаляет следующие файлы:
- C:\arihptkxqr\ds6394kat7is936fe.exe
- %WINDIR%\arihptkxqr\ohkebl
Сетевая активность:
Подключается к:
- 'ch#####ectricity.net':80
- 'co####etrain.net':80
- 'co#####electricity.net':80
- 'co####edelight.net':80
- 'ch####elight.net':80
- 'pr####tdelight.net':80
- 'th####elight.net':80
- 'ch###borrow.net':80
- 'ch###train.net':80
- 'co####eborrow.net':80
- 'of####elight.net':80
- 'al#####ectricity.net':80
- 'al####elight.net':80
- 'tw####borrow.net':80
- 'mi####borrow.net':80
- 'al###borrow.net':80
- 'of###borrow.net':80
- 'of###train.net':80
- 'of#####ectricity.net':80
- 'al###train.net':80
- 'pr#####electricity.net':80
- 'we#####understood.net':80
- 'am#####nderstood.net':80
- 'th###chance.net':80
- 'th####eeting.net':80
- 'cl###chance.net':80
- 'am####meeting.net':80
- 'we####rchance.net':80
- 'we####rmeeting.net':80
- 'we####rtwenty.net':80
- 'am####twenty.net':80
- 'pr####tborrow.net':80
- 'th###borrow.net':80
- 'th###train.net':80
- 'th#####ectricity.net':80
- 'pr####ttrain.net':80
- 'th###twenty.net':80
- 'cl####eeting.net':80
- 'cl###twenty.net':80
- 'cl####nderstood.net':80
- 'th####nderstood.net':80
TCP:
Запросы HTTP GET:
- http://ch#####ectricity.net/index.php
- http://co####etrain.net/index.php
- http://co#####electricity.net/index.php
- http://co####edelight.net/index.php
- http://ch####elight.net/index.php
- http://pr####tdelight.net/index.php
- http://th####elight.net/index.php
- http://ch###borrow.net/index.php
- http://ch###train.net/index.php
- http://co####eborrow.net/index.php
- http://of####elight.net/index.php
- http://al#####ectricity.net/index.php
- http://al####elight.net/index.php
- http://tw####borrow.net/index.php
- http://mi####borrow.net/index.php
- http://al###borrow.net/index.php
- http://of###borrow.net/index.php
- http://of###train.net/index.php
- http://of#####ectricity.net/index.php
- http://al###train.net/index.php
- http://pr#####electricity.net/index.php
- http://we#####understood.net/index.php
- http://am#####nderstood.net/index.php
- http://th###chance.net/index.php
- http://th####eeting.net/index.php
- http://cl###chance.net/index.php
- http://am####meeting.net/index.php
- http://we####rchance.net/index.php
- http://we####rmeeting.net/index.php
- http://we####rtwenty.net/index.php
- http://am####twenty.net/index.php
- http://pr####tborrow.net/index.php
- http://th###borrow.net/index.php
- http://th###train.net/index.php
- http://th#####ectricity.net/index.php
- http://pr####ttrain.net/index.php
- http://th###twenty.net/index.php
- http://cl####eeting.net/index.php
- http://cl###twenty.net/index.php
- http://cl####nderstood.net/index.php
- http://th####nderstood.net/index.php
UDP:
- DNS ASK ch#####ectricity.net
- DNS ASK co####etrain.net
- DNS ASK co#####electricity.net
- DNS ASK co####edelight.net
- DNS ASK ch####elight.net
- DNS ASK pr####tdelight.net
- DNS ASK th####elight.net
- DNS ASK ch###borrow.net
- DNS ASK ch###train.net
- DNS ASK co####eborrow.net
- DNS ASK of###borrow.net
- DNS ASK al####elight.net
- DNS ASK of####elight.net
- DNS ASK mi####borrow.net
- DNS ASK mi###etrain.net
- DNS ASK tw####borrow.net
- DNS ASK of###train.net
- DNS ASK al###borrow.net
- DNS ASK al###train.net
- DNS ASK al#####ectricity.net
- DNS ASK of#####ectricity.net
- DNS ASK we#####understood.net
- DNS ASK am#####nderstood.net
- DNS ASK th###chance.net
- DNS ASK th####eeting.net
- DNS ASK cl###chance.net
- DNS ASK am####meeting.net
- DNS ASK we####rchance.net
- DNS ASK we####rmeeting.net
- DNS ASK we####rtwenty.net
- DNS ASK am####twenty.net
- DNS ASK cl####eeting.net
- DNS ASK th###train.net
- DNS ASK pr####tborrow.net
- DNS ASK pr####ttrain.net
- DNS ASK pr#####electricity.net
- DNS ASK th#####ectricity.net
- DNS ASK cl###twenty.net
- DNS ASK th###twenty.net
- DNS ASK th####nderstood.net
- DNS ASK th###borrow.net
- DNS ASK cl####nderstood.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
