Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Class Group Brightness Office Controls' = 'C:\bjpqtatklaf\aqpjbhslqsc.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Framework Device Class COM] 'ImagePath' = 'C:\bjpqtatklaf\aqpjbhslqsc.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Framework Device Class COM] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- 'C:\bjpqtatklaf\pqurgbg.exe' "c:\bjpqtatklaf\aqpjbhslqsc.exe"
- 'C:\bjpqtatklaf\aqpjbhslqsc.exe'
- 'C:\bjpqtatklaf\nael2tljcvgmduh1x.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\bjpqtatklaf\aqpjbhslqsc.exe
- C:\bjpqtatklaf\pqurgbg.exe
- C:\bjpqtatklaf\nael2tljcvgmduh1x.exe
- %WINDIR%\bjpqtatklaf\zlennx9ceo2
- C:\bjpqtatklaf\zlennx9ceo2
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\bjpqtatklaf\pqurgbg.exe
- C:\bjpqtatklaf\aqpjbhslqsc.exe
Удаляет следующие файлы:
- C:\bjpqtatklaf\nael2tljcvgmduh1x.exe
- %WINDIR%\bjpqtatklaf\zlennx9ceo2
Подменяет следующие файлы:
- %WINDIR%\bjpqtatklaf\zlennx9ceo2
Сетевая активность:
Подключается к:
- 'se####lstream.net':80
- 'pr####lydivide.net':80
- 'sw###divide.net':80
- 'ma####alnothing.net':80
- 'se####lnothing.net':80
- 'ma####alstream.net':80
- 'sw####othing.net':80
- 'pr####lystream.net':80
- 'sw###stream.net':80
- 'pr####lybottle.net':80
- 'sw###bottle.net':80
- 'pr####lynothing.net':80
- 'se####business.net':80
- 'la####nother.net':80
- 'se####another.net':80
- 'la###appear.net':80
- 'se####appear.net':80
- 'la####usiness.net':80
- 'se####ldivide.net':80
- 'ma####albottle.net':80
- 'se####lbottle.net':80
- 'la###manner.net':80
- 'se####manner.net':80
- 'ma####aldivide.net':80
- 'le###divide.net':80
- 'wi####nothing.net':80
- 'pe####snothing.net':80
- 'wi####stream.net':80
- 'pe####sdivide.net':80
- 'wi####bottle.net':80
- 'pe####sbottle.net':80
- 'po####lebottle.net':80
- 'mo####inbottle.net':80
- 'po####lenothing.net':80
- 'pe####sstream.net':80
- 'po####ledivide.net':80
- 'mo####individe.net':80
- 'le####othing.net':80
- 'fi####nothing.net':80
- 'le###stream.net':80
- 'fi####divide.net':80
- 'le###bottle.net':80
- 'fi####bottle.net':80
- 'su####tnothing.net':80
- 'su####tstream.net':80
- 'wi####divide.net':80
- 'fi####stream.net':80
- 'su####tdivide.net':80
- 'su####tbottle.net':80
TCP:
Запросы HTTP GET:
- http://se####lstream.net/index.php
- http://pr####lydivide.net/index.php
- http://sw###divide.net/index.php
- http://ma####alnothing.net/index.php
- http://se####lnothing.net/index.php
- http://ma####alstream.net/index.php
- http://sw####othing.net/index.php
- http://pr####lystream.net/index.php
- http://sw###stream.net/index.php
- http://pr####lybottle.net/index.php
- http://sw###bottle.net/index.php
- http://pr####lynothing.net/index.php
- http://se####business.net/index.php
- http://la####nother.net/index.php
- http://se####another.net/index.php
- http://la###appear.net/index.php
- http://se####appear.net/index.php
- http://la####usiness.net/index.php
- http://se####ldivide.net/index.php
- http://ma####albottle.net/index.php
- http://se####lbottle.net/index.php
- http://la###manner.net/index.php
- http://se####manner.net/index.php
- http://ma####aldivide.net/index.php
- http://le###divide.net/index.php
- http://wi####nothing.net/index.php
- http://pe####snothing.net/index.php
- http://wi####stream.net/index.php
- http://pe####sdivide.net/index.php
- http://wi####bottle.net/index.php
- http://pe####sbottle.net/index.php
- http://po####lebottle.net/index.php
- http://mo####inbottle.net/index.php
- http://po####lenothing.net/index.php
- http://pe####sstream.net/index.php
- http://po####ledivide.net/index.php
- http://mo####individe.net/index.php
- http://le####othing.net/index.php
- http://fi####nothing.net/index.php
- http://le###stream.net/index.php
- http://fi####divide.net/index.php
- http://le###bottle.net/index.php
- http://fi####bottle.net/index.php
- http://su####tnothing.net/index.php
- http://su####tstream.net/index.php
- http://wi####divide.net/index.php
- http://fi####stream.net/index.php
- http://su####tdivide.net/index.php
- http://su####tbottle.net/index.php
UDP:
- DNS ASK se####lstream.net
- DNS ASK pr####lydivide.net
- DNS ASK sw###divide.net
- DNS ASK ma####alnothing.net
- DNS ASK se####lnothing.net
- DNS ASK ma####alstream.net
- DNS ASK sw####othing.net
- DNS ASK pr####lystream.net
- DNS ASK sw###stream.net
- DNS ASK pr####lybottle.net
- DNS ASK sw###bottle.net
- DNS ASK pr####lynothing.net
- DNS ASK se####lbottle.net
- DNS ASK la####usiness.net
- DNS ASK se####business.net
- DNS ASK la####nother.net
- DNS ASK si####manner.net
- DNS ASK la###appear.net
- DNS ASK se####appear.net
- DNS ASK ma####aldivide.net
- DNS ASK se####ldivide.net
- DNS ASK ma####albottle.net
- DNS ASK se####another.net
- DNS ASK la###manner.net
- DNS ASK se####manner.net
- DNS ASK wi####nothing.net
- DNS ASK pe####snothing.net
- DNS ASK wi####stream.net
- DNS ASK pe####sdivide.net
- DNS ASK wi####bottle.net
- DNS ASK pe####sbottle.net
- DNS ASK po####lebottle.net
- DNS ASK mo####inbottle.net
- DNS ASK po####lenothing.net
- DNS ASK pe####sstream.net
- DNS ASK po####ledivide.net
- DNS ASK mo####individe.net
- DNS ASK wi####divide.net
- DNS ASK fi####bottle.net
- DNS ASK le####othing.net
- DNS ASK fi####nothing.net
- DNS ASK le###divide.net
- DNS ASK fi####divide.net
- DNS ASK le###bottle.net
- DNS ASK su####tbottle.net
- DNS ASK su####tnothing.net
- DNS ASK su####tstream.net
- DNS ASK le###stream.net
- DNS ASK fi####stream.net
- DNS ASK su####tdivide.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
