Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'System Biometric WLAN Encrypting Agent' = 'C:\yckhdfuzsuxya\smcrkhhd.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Auto Counter Interface Presentation] 'ImagePath' = 'C:\yckhdfuzsuxya\smcrkhhd.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Auto Counter Interface Presentation] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- 'C:\yckhdfuzsuxya\bmugjckc.exe' "c:\yckhdfuzsuxya\smcrkhhd.exe"
- 'C:\yckhdfuzsuxya\smcrkhhd.exe'
- 'C:\yckhdfuzsuxya\pc533ejwqbexjfbkc.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\yckhdfuzsuxya\smcrkhhd.exe
- C:\yckhdfuzsuxya\bmugjckc.exe
- C:\yckhdfuzsuxya\aeqeetzynx
- %WINDIR%\yckhdfuzsuxya\ujqlp52uoc5p
- C:\yckhdfuzsuxya\ujqlp52uoc5p
- C:\yckhdfuzsuxya\pc533ejwqbexjfbkc.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\yckhdfuzsuxya\bmugjckc.exe
- C:\yckhdfuzsuxya\smcrkhhd.exe
Удаляет следующие файлы:
- C:\yckhdfuzsuxya\pc533ejwqbexjfbkc.exe
- %WINDIR%\yckhdfuzsuxya\ujqlp52uoc5p
Подменяет следующие файлы:
- %WINDIR%\yckhdfuzsuxya\ujqlp52uoc5p
Сетевая активность:
Подключается к:
- 'en####hmethod.net':80
- 'ei####method.net':80
- 'fa####brought.net':80
- 'ei####direct.net':80
- 'en####haction.net':80
- 'ei####action.net':80
- 'fa####action.net':80
- 'ch####enaction.net':80
- 'fa####method.net':80
- 'ch####enbrought.net':80
- 'fa####direct.net':80
- 'ch####endirect.net':80
- 'be####ewrite.net':80
- 'ex###twrite.net':80
- 'be####eniece.net':80
- 'pe###nspeak.net':80
- 'be####eoclock.net':80
- 'ex####oclock.net':80
- 'en####hbrought.net':80
- 'ei####brought.net':80
- 'en####hdirect.net':80
- 'ex###tniece.net':80
- 'be####espeak.net':80
- 'ex###tspeak.net':80
- 'ch####enmethod.net':80
- 'fi####method.net':80
- 'ri####rought.net':80
- 'wh####rbrought.net':80
- 'th####action.net':80
- 'fi####action.net':80
- 'th####method.net':80
- 'wh####raction.net':80
- 'ri###method.net':80
- 'wh####rmethod.net':80
- 'ri###direct.net':80
- 'wh####rdirect.net':80
- 'ri###action.net':80
- 'pi####edirect.net':80
- 'ci####tteaction.net':80
- 'pi####eaction.net':80
- 'ci#####tebrought.net':80
- 'pi####ebrought.net':80
- 'ci####ttedirect.net':80
- 'fi####brought.net':80
- 'th####direct.net':80
- 'fi####direct.net':80
- 'ci####ttemethod.net':80
- 'pi####emethod.net':80
- 'th####brought.net':80
TCP:
Запросы HTTP GET:
- http://en####hmethod.net/index.php?me########
- http://ei####method.net/index.php?me########
- http://fa####brought.net/index.php?me########
- http://ei####direct.net/index.php?me########
- http://en####haction.net/index.php?me########
- http://ei####action.net/index.php?me########
- http://fa####action.net/index.php?me########
- http://ch####enaction.net/index.php?me########
- http://fa####method.net/index.php?me########
- http://ch####enbrought.net/index.php?me########
- http://fa####direct.net/index.php?me########
- http://ch####endirect.net/index.php?me########
- http://be####ewrite.net/index.php?me########
- http://ex###twrite.net/index.php?me########
- http://be####eniece.net/index.php?me########
- http://pe###nspeak.net/index.php?me########
- http://be####eoclock.net/index.php?me########
- http://ex####oclock.net/index.php?me########
- http://en####hbrought.net/index.php?me########
- http://ei####brought.net/index.php?me########
- http://en####hdirect.net/index.php?me########
- http://ex###tniece.net/index.php?me########
- http://be####espeak.net/index.php?me########
- http://ex###tspeak.net/index.php?me########
- http://ch####enmethod.net/index.php?me########
- http://fi####method.net/index.php?me########
- http://ri####rought.net/index.php?me########
- http://wh####rbrought.net/index.php?me########
- http://th####action.net/index.php?me########
- http://fi####action.net/index.php?me########
- http://th####method.net/index.php?me########
- http://wh####raction.net/index.php?me########
- http://ri###method.net/index.php?me########
- http://wh####rmethod.net/index.php?me########
- http://ri###direct.net/index.php?me########
- http://wh####rdirect.net/index.php?me########
- http://ri###action.net/index.php?me########
- http://pi####edirect.net/index.php?me########
- http://ci####tteaction.net/index.php?me########
- http://pi####eaction.net/index.php?me########
- http://ci#####tebrought.net/index.php?me########
- http://pi####ebrought.net/index.php?me########
- http://ci####ttedirect.net/index.php?me########
- http://fi####brought.net/index.php?me########
- http://th####direct.net/index.php?me########
- http://fi####direct.net/index.php?me########
- http://ci####ttemethod.net/index.php?me########
- http://pi####emethod.net/index.php?me########
- http://th####brought.net/index.php?me########
UDP:
- DNS ASK en####hmethod.net
- DNS ASK ei####method.net
- DNS ASK fa####brought.net
- DNS ASK ei####direct.net
- DNS ASK en####haction.net
- DNS ASK ei####action.net
- DNS ASK fa####action.net
- DNS ASK ch####enaction.net
- DNS ASK fa####method.net
- DNS ASK ch####enbrought.net
- DNS ASK fa####direct.net
- DNS ASK ch####endirect.net
- DNS ASK en####hdirect.net
- DNS ASK ex####oclock.net
- DNS ASK be####ewrite.net
- DNS ASK ex###twrite.net
- DNS ASK ma####espeak.net
- DNS ASK pe###nspeak.net
- DNS ASK be####eoclock.net
- DNS ASK ex###tspeak.net
- DNS ASK en####hbrought.net
- DNS ASK ei####brought.net
- DNS ASK be####eniece.net
- DNS ASK ex###tniece.net
- DNS ASK be####espeak.net
- DNS ASK fi####method.net
- DNS ASK ri####rought.net
- DNS ASK wh####rbrought.net
- DNS ASK th####action.net
- DNS ASK fi####action.net
- DNS ASK th####method.net
- DNS ASK wh####raction.net
- DNS ASK ri###method.net
- DNS ASK wh####rmethod.net
- DNS ASK ri###direct.net
- DNS ASK wh####rdirect.net
- DNS ASK ri###action.net
- DNS ASK fi####direct.net
- DNS ASK ci####ttedirect.net
- DNS ASK pi####edirect.net
- DNS ASK ci####tteaction.net
- DNS ASK ch####enmethod.net
- DNS ASK ci#####tebrought.net
- DNS ASK pi####ebrought.net
- DNS ASK th####brought.net
- DNS ASK fi####brought.net
- DNS ASK th####direct.net
- DNS ASK pi####eaction.net
- DNS ASK ci####ttemethod.net
- DNS ASK pi####emethod.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
