Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'BranchCache Superfetch Discovery' = 'C:\uvpwvjftkzdlq\xfdxinhvgf.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\CNG Receiver SSDP Filtering] 'ImagePath' = 'C:\uvpwvjftkzdlq\xfdxinhvgf.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\CNG Receiver SSDP Filtering] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- 'C:\uvpwvjftkzdlq\mxzikifx.exe' "c:\uvpwvjftkzdlq\xfdxinhvgf.exe"
- 'C:\uvpwvjftkzdlq\xfdxinhvgf.exe'
- 'C:\uvpwvjftkzdlq\or342qsybaagviyvfc.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\uvpwvjftkzdlq\xfdxinhvgf.exe
- C:\uvpwvjftkzdlq\mxzikifx.exe
- C:\uvpwvjftkzdlq\or342qsybaagviyvfc.exe
- %WINDIR%\uvpwvjftkzdlq\udwnme0axemp
- C:\uvpwvjftkzdlq\udwnme0axemp
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\uvpwvjftkzdlq\mxzikifx.exe
- C:\uvpwvjftkzdlq\xfdxinhvgf.exe
Удаляет следующие файлы:
- C:\uvpwvjftkzdlq\or342qsybaagviyvfc.exe
- %WINDIR%\uvpwvjftkzdlq\udwnme0axemp
Подменяет следующие файлы:
- %WINDIR%\uvpwvjftkzdlq\udwnme0axemp
Сетевая активность:
Подключается к:
- 'po####leexplain.net':80
- 'mo####inexplain.net':80
- 'mo####inbright.net':80
- 'mo####ininside.net':80
- 'po####lebright.net':80
- 'si####inside.net':80
- 'mo####bright.net':80
- 'mo####inside.net':80
- 'po####leinstead.net':80
- 'mo####ininstead.net':80
- 'po####leinside.net':80
- 'pe####sinside.net':80
- 'wi####bright.net':80
- 'wi####inside.net':80
- 'su####texplain.net':80
- 'su####tinstead.net':80
- 'wi####instead.net':80
- 'pe####sinstead.net':80
- 'pe####sexplain.net':80
- 'pe####sbright.net':80
- 'wi####explain.net':80
- 'si####bright.net':80
- 'ma#####lbusiness.net':80
- 'se####lbusiness.net':80
- 'se####lappear.net':80
- 'se####instead.net':80
- 'ma####alappear.net':80
- 'se####lmanner.net':80
- 'pr####lyappear.net':80
- 'ma####almanner.net':80
- 'ma####alanother.net':80
- 'se####lanother.net':80
- 'la####nstead.net':80
- 'si####instead.net':80
- 'la###inside.net':80
- 'mo####instead.net':80
- 'mo####explain.net':80
- 'si####explain.net':80
- 'la####xplain.net':80
- 'se####explain.net':80
- 'se####bright.net':80
- 'se####inside.net':80
- 'la###bright.net':80
TCP:
Запросы HTTP GET:
- http://po####leexplain.net/index.php
- http://mo####inexplain.net/index.php
- http://mo####inbright.net/index.php
- http://mo####ininside.net/index.php
- http://po####lebright.net/index.php
- http://si####inside.net/index.php
- http://mo####bright.net/index.php
- http://mo####inside.net/index.php
- http://po####leinstead.net/index.php
- http://mo####ininstead.net/index.php
- http://po####leinside.net/index.php
- http://pe####sinside.net/index.php
- http://wi####bright.net/index.php
- http://wi####inside.net/index.php
- http://su####texplain.net/index.php
- http://su####tinstead.net/index.php
- http://wi####instead.net/index.php
- http://pe####sinstead.net/index.php
- http://pe####sexplain.net/index.php
- http://pe####sbright.net/index.php
- http://wi####explain.net/index.php
- http://si####bright.net/index.php
- http://ma#####lbusiness.net/index.php
- http://se####lbusiness.net/index.php
- http://se####lappear.net/index.php
- http://se####instead.net/index.php
- http://ma####alappear.net/index.php
- http://se####lmanner.net/index.php
- http://pr####lyappear.net/index.php
- http://ma####almanner.net/index.php
- http://ma####alanother.net/index.php
- http://se####lanother.net/index.php
- http://la####nstead.net/index.php
- http://si####instead.net/index.php
- http://la###inside.net/index.php
- http://mo####instead.net/index.php
- http://mo####explain.net/index.php
- http://si####explain.net/index.php
- http://la####xplain.net/index.php
- http://se####explain.net/index.php
- http://se####bright.net/index.php
- http://se####inside.net/index.php
- http://la###bright.net/index.php
UDP:
- DNS ASK po####leexplain.net
- DNS ASK mo####inexplain.net
- DNS ASK mo####inbright.net
- DNS ASK mo####ininside.net
- DNS ASK po####lebright.net
- DNS ASK si####inside.net
- DNS ASK mo####bright.net
- DNS ASK mo####inside.net
- DNS ASK po####leinstead.net
- DNS ASK mo####ininstead.net
- DNS ASK po####leinside.net
- DNS ASK pe####sinside.net
- DNS ASK wi####bright.net
- DNS ASK wi####inside.net
- DNS ASK su####texplain.net
- DNS ASK su####tinstead.net
- DNS ASK wi####instead.net
- DNS ASK pe####sinstead.net
- DNS ASK pe####sexplain.net
- DNS ASK pe####sbright.net
- DNS ASK wi####explain.net
- DNS ASK si####bright.net
- DNS ASK ma#####lbusiness.net
- DNS ASK se####lbusiness.net
- DNS ASK se####lappear.net
- DNS ASK se####instead.net
- DNS ASK ma####alappear.net
- DNS ASK se####lmanner.net
- DNS ASK pr####lyappear.net
- DNS ASK ma####almanner.net
- DNS ASK ma####alanother.net
- DNS ASK se####lanother.net
- DNS ASK la####nstead.net
- DNS ASK si####instead.net
- DNS ASK la###inside.net
- DNS ASK mo####instead.net
- DNS ASK mo####explain.net
- DNS ASK si####explain.net
- DNS ASK la####xplain.net
- DNS ASK se####explain.net
- DNS ASK se####bright.net
- DNS ASK se####inside.net
- DNS ASK la###bright.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
