Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'NGEN Office Tablet Certificate Ordering' = 'C:\tamgceznorzyl\lcsxxst.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Compatibility Interactive Biometric Name] 'ImagePath' = 'C:\tamgceznorzyl\lcsxxst.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Compatibility Interactive Biometric Name] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- 'C:\tamgceznorzyl\gorjieouemzy.exe' "c:\tamgceznorzyl\lcsxxst.exe"
- 'C:\tamgceznorzyl\lcsxxst.exe'
- 'C:\tamgceznorzyl\yvh320xqvjyzcpi.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\tamgceznorzyl\lcsxxst.exe
- C:\tamgceznorzyl\gorjieouemzy.exe
- C:\tamgceznorzyl\yvh320xqvjyzcpi.exe
- %WINDIR%\tamgceznorzyl\yqvrhbcr
- C:\tamgceznorzyl\yqvrhbcr
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\tamgceznorzyl\gorjieouemzy.exe
- C:\tamgceznorzyl\lcsxxst.exe
Удаляет следующие файлы:
- C:\tamgceznorzyl\yvh320xqvjyzcpi.exe
- %WINDIR%\tamgceznorzyl\yqvrhbcr
Подменяет следующие файлы:
- %WINDIR%\tamgceznorzyl\yqvrhbcr
Сетевая активность:
Подключается к:
- 'de####realize.net':80
- 'fo####ddollar.net':80
- 'de####dollar.net':80
- 'fo####drealize.net':80
- 'an####written.net':80
- 'gl###shore.net':80
- 'an###rshore.net':80
- 're####erfinger.net':80
- 'wo###finger.net':80
- 're#####rshoulder.net':80
- 'de###eshore.net':80
- 'fo####dwritten.net':80
- 'de####written.net':80
- 'fo####dshore.net':80
- 'di####ultdollar.net':80
- 'he####ritten.net':80
- 'di#####ltwritten.net':80
- 'he###dollar.net':80
- 'pl####ntshore.net':80
- 'he####ealize.net':80
- 'di#####ltrealize.net':80
- 'gl###dollar.net':80
- 'an####dollar.net':80
- 'gl####ritten.net':80
- 'an####realize.net':80
- 'he###shore.net':80
- 'di####ultshore.net':80
- 'gl####ealize.net':80
- 'ef###tabove.net':80
- 'th####huntil.net':80
- 'ef###tuntil.net':80
- 'th####habove.net':80
- 'ef####finger.net':80
- 'th####hshoulder.net':80
- 'ef####shoulder.net':80
- 'su###rabove.net':80
- 'wi###nabove.net':80
- 'su###runtil.net':80
- 'wi####shoulder.net':80
- 'su####finger.net':80
- 'wi####finger.net':80
- 'su####shoulder.net':80
- 'wo###until.net':80
- 'in####sefinger.net':80
- 'fo####finger.net':80
- 're####eruntil.net':80
- 'wo####houlder.net':80
- 're####erabove.net':80
- 'wo###above.net':80
- 'in####seuntil.net':80
- 'fo###tuntil.net':80
- 'th####hfinger.net':80
- 'fo###tabove.net':80
- 'in#####eshoulder.net':80
- 'fo####shoulder.net':80
- 'in####seabove.net':80
TCP:
Запросы HTTP GET:
- http://de####realize.net/index.php
- http://fo####ddollar.net/index.php
- http://de####dollar.net/index.php
- http://fo####drealize.net/index.php
- http://an####written.net/index.php
- http://gl###shore.net/index.php
- http://an###rshore.net/index.php
- http://re####erfinger.net/index.php
- http://wo###finger.net/index.php
- http://re#####rshoulder.net/index.php
- http://de###eshore.net/index.php
- http://fo####dwritten.net/index.php
- http://de####written.net/index.php
- http://fo####dshore.net/index.php
- http://di####ultdollar.net/index.php
- http://he####ritten.net/index.php
- http://di#####ltwritten.net/index.php
- http://he###dollar.net/index.php
- http://pl####ntshore.net/index.php
- http://he####ealize.net/index.php
- http://di#####ltrealize.net/index.php
- http://gl###dollar.net/index.php
- http://an####dollar.net/index.php
- http://gl####ritten.net/index.php
- http://an####realize.net/index.php
- http://he###shore.net/index.php
- http://di####ultshore.net/index.php
- http://gl####ealize.net/index.php
- http://ef###tabove.net/index.php
- http://th####huntil.net/index.php
- http://ef###tuntil.net/index.php
- http://th####habove.net/index.php
- http://ef####finger.net/index.php
- http://th####hshoulder.net/index.php
- http://ef####shoulder.net/index.php
- http://su###rabove.net/index.php
- http://wi###nabove.net/index.php
- http://su###runtil.net/index.php
- http://wi####shoulder.net/index.php
- http://su####finger.net/index.php
- http://wi####finger.net/index.php
- http://su####shoulder.net/index.php
- http://wo###until.net/index.php
- http://in####sefinger.net/index.php
- http://fo####finger.net/index.php
- http://re####eruntil.net/index.php
- http://wo####houlder.net/index.php
- http://re####erabove.net/index.php
- http://wo###above.net/index.php
- http://in####seuntil.net/index.php
- http://fo###tuntil.net/index.php
- http://th####hfinger.net/index.php
- http://fo###tabove.net/index.php
- http://in#####eshoulder.net/index.php
- http://fo####shoulder.net/index.php
- http://in####seabove.net/index.php
UDP:
- DNS ASK fo####drealize.net
- DNS ASK de####realize.net
- DNS ASK fo####ddollar.net
- DNS ASK an###rshore.net
- DNS ASK gl####ritten.net
- DNS ASK an####written.net
- DNS ASK gl###shore.net
- DNS ASK de###eshore.net
- DNS ASK re####erfinger.net
- DNS ASK wo###finger.net
- DNS ASK fo####dshore.net
- DNS ASK de####dollar.net
- DNS ASK fo####dwritten.net
- DNS ASK de####written.net
- DNS ASK he###dollar.net
- DNS ASK di####ultdollar.net
- DNS ASK he####ritten.net
- DNS ASK di#####ltrealize.net
- DNS ASK ne####aryshore.net
- DNS ASK pl####ntshore.net
- DNS ASK he####ealize.net
- DNS ASK an####realize.net
- DNS ASK gl###dollar.net
- DNS ASK an####dollar.net
- DNS ASK gl####ealize.net
- DNS ASK di#####ltwritten.net
- DNS ASK he###shore.net
- DNS ASK di####ultshore.net
- DNS ASK re#####rshoulder.net
- DNS ASK ef###tabove.net
- DNS ASK th####huntil.net
- DNS ASK ef###tuntil.net
- DNS ASK th####habove.net
- DNS ASK ef####finger.net
- DNS ASK th####hshoulder.net
- DNS ASK ef####shoulder.net
- DNS ASK su###rabove.net
- DNS ASK wi###nabove.net
- DNS ASK su###runtil.net
- DNS ASK wi####shoulder.net
- DNS ASK su####finger.net
- DNS ASK wi####finger.net
- DNS ASK su####shoulder.net
- DNS ASK wo###until.net
- DNS ASK in####sefinger.net
- DNS ASK fo####finger.net
- DNS ASK re####eruntil.net
- DNS ASK wo####houlder.net
- DNS ASK re####erabove.net
- DNS ASK wo###above.net
- DNS ASK in####seuntil.net
- DNS ASK fo###tuntil.net
- DNS ASK th####hfinger.net
- DNS ASK fo###tabove.net
- DNS ASK in#####eshoulder.net
- DNS ASK fo####shoulder.net
- DNS ASK in####seabove.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
