Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'PC Instrumentation Source' = 'C:\sdgqyhiaoullbxs\sdreajzrzq.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Framework SPP Function Store Installer Class] 'ImagePath' = 'C:\sdgqyhiaoullbxs\sdreajzrzq.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Framework SPP Function Store Installer Class] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- 'C:\sdgqyhiaoullbxs\xgpzlvlftecr.exe' "c:\sdgqyhiaoullbxs\sdreajzrzq.exe"
- 'C:\sdgqyhiaoullbxs\sdreajzrzq.exe'
- 'C:\sdgqyhiaoullbxs\aql3qjbdpos4curj.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\sdgqyhiaoullbxs\sdreajzrzq.exe
- C:\sdgqyhiaoullbxs\xgpzlvlftecr.exe
- C:\sdgqyhiaoullbxs\aql3qjbdpos4curj.exe
- %WINDIR%\sdgqyhiaoullbxs\cuysp4uj
- C:\sdgqyhiaoullbxs\cuysp4uj
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\sdgqyhiaoullbxs\xgpzlvlftecr.exe
- C:\sdgqyhiaoullbxs\sdreajzrzq.exe
Удаляет следующие файлы:
- C:\sdgqyhiaoullbxs\aql3qjbdpos4curj.exe
- %WINDIR%\sdgqyhiaoullbxs\cuysp4uj
Подменяет следующие файлы:
- %WINDIR%\sdgqyhiaoullbxs\cuysp4uj
Сетевая активность:
Подключается к:
- 'ch####enbetween.net':80
- 'fa####succeed.net':80
- 'fa####between.net':80
- 'fa####produce.net':80
- 'ch####enproduce.net':80
- 'ch####ensucceed.net':80
- 'pi####eproduce.net':80
- 'ci#####tebetween.net':80
- 'ci#####teproduce.net':80
- 'ci#####testudent.net':80
- 'pi####estudent.net':80
- 'en####hproduce.net':80
- 'ei####produce.net':80
- 'ei####student.net':80
- 'ex###tround.net':80
- 'en####hstudent.net':80
- 'en####hbetween.net':80
- 'fa####student.net':80
- 'ch####enstudent.net':80
- 'ei####succeed.net':80
- 'ei####between.net':80
- 'en####hsucceed.net':80
- 'wh####rproduce.net':80
- 'ri####etween.net':80
- 'ri####roduce.net':80
- 'ri####tudent.net':80
- 'wh####rstudent.net':80
- 'wh####rbetween.net':80
- 'su####student.net':80
- 'fo####nproduce.net':80
- 'fo####nstudent.net':80
- 'ri####ucceed.net':80
- 'wh####rsucceed.net':80
- 'th####student.net':80
- 'fi####student.net':80
- 'pi####esucceed.net':80
- 'pi####ebetween.net':80
- 'ci#####tesucceed.net':80
- 'th####produce.net':80
- 'th####succeed.net':80
- 'fi####succeed.net':80
- 'fi####between.net':80
- 'fi####produce.net':80
- 'th####between.net':80
TCP:
Запросы HTTP GET:
- http://ch####enbetween.net/index.php
- http://fa####succeed.net/index.php
- http://fa####between.net/index.php
- http://fa####produce.net/index.php
- http://ch####enproduce.net/index.php
- http://ch####ensucceed.net/index.php
- http://pi####eproduce.net/index.php
- http://ci#####tebetween.net/index.php
- http://ci#####teproduce.net/index.php
- http://ci#####testudent.net/index.php
- http://pi####estudent.net/index.php
- http://en####hproduce.net/index.php
- http://ei####produce.net/index.php
- http://ei####student.net/index.php
- http://ex###tround.net/index.php
- http://en####hstudent.net/index.php
- http://en####hbetween.net/index.php
- http://fa####student.net/index.php
- http://ch####enstudent.net/index.php
- http://ei####succeed.net/index.php
- http://ei####between.net/index.php
- http://en####hsucceed.net/index.php
- http://wh####rproduce.net/index.php
- http://ri####etween.net/index.php
- http://ri####roduce.net/index.php
- http://ri####tudent.net/index.php
- http://wh####rstudent.net/index.php
- http://wh####rbetween.net/index.php
- http://su####student.net/index.php
- http://fo####nproduce.net/index.php
- http://fo####nstudent.net/index.php
- http://ri####ucceed.net/index.php
- http://wh####rsucceed.net/index.php
- http://th####student.net/index.php
- http://fi####student.net/index.php
- http://pi####esucceed.net/index.php
- http://pi####ebetween.net/index.php
- http://ci#####tesucceed.net/index.php
- http://th####produce.net/index.php
- http://th####succeed.net/index.php
- http://fi####succeed.net/index.php
- http://fi####between.net/index.php
- http://fi####produce.net/index.php
- http://th####between.net/index.php
UDP:
- DNS ASK fa####between.net
- DNS ASK ch####enbetween.net
- DNS ASK ch####enproduce.net
- DNS ASK ch####enstudent.net
- DNS ASK fa####produce.net
- DNS ASK fa####succeed.net
- DNS ASK ci#####teproduce.net
- DNS ASK pi####eproduce.net
- DNS ASK pi####estudent.net
- DNS ASK ch####ensucceed.net
- DNS ASK ci#####testudent.net
- DNS ASK ei####student.net
- DNS ASK en####hproduce.net
- DNS ASK en####hstudent.net
- DNS ASK be####eround.net
- DNS ASK ex###tround.net
- DNS ASK ei####produce.net
- DNS ASK ei####succeed.net
- DNS ASK fa####student.net
- DNS ASK en####hsucceed.net
- DNS ASK en####hbetween.net
- DNS ASK ei####between.net
- DNS ASK ci#####tebetween.net
- DNS ASK wh####rproduce.net
- DNS ASK ri####etween.net
- DNS ASK ri####roduce.net
- DNS ASK ri####tudent.net
- DNS ASK wh####rstudent.net
- DNS ASK wh####rbetween.net
- DNS ASK su####student.net
- DNS ASK fo####nproduce.net
- DNS ASK fo####nstudent.net
- DNS ASK ri####ucceed.net
- DNS ASK wh####rsucceed.net
- DNS ASK th####student.net
- DNS ASK fi####student.net
- DNS ASK pi####esucceed.net
- DNS ASK pi####ebetween.net
- DNS ASK ci#####tesucceed.net
- DNS ASK th####produce.net
- DNS ASK th####succeed.net
- DNS ASK fi####succeed.net
- DNS ASK fi####between.net
- DNS ASK fi####produce.net
- DNS ASK th####between.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
