Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Net.Tcp Scheduler Manager Protection Controls' = '<LS_APPDATA>\drvmcoayiidqtn\eiljvocf.exe'
Вредоносные функции:
Создает и запускает на исполнение:
- '<LS_APPDATA>\drvmcoayiidqtn\smegmkqcbxd.exe' "<LS_APPDATA>\drvmcoayiidqtn\eiljvocf.exe"
- '<LS_APPDATA>\drvmcoayiidqtn\eiljvocf.exe'
Изменения в файловой системе:
Создает следующие файлы:
- <LS_APPDATA>\drvmcoayiidqtn\eiljvocf.bymv
- <LS_APPDATA>\drvmcoayiidqtn\smegmkqcbxd.exe
- <LS_APPDATA>\drvmcoayiidqtn\eiljvocf.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- <LS_APPDATA>\drvmcoayiidqtn\smegmkqcbxd.exe
- <LS_APPDATA>\drvmcoayiidqtn\eiljvocf.exe
Сетевая активность:
Подключается к:
- 'be####stranger.net':80
- 'ri####stranger.net':80
- 'ri####goodbye.net':80
- 'ri####fortieth.net':80
- 'be####goodbye.net':80
- 'be####advance.net':80
- 'li####goodbye.net':80
- 'de####ygoodbye.net':80
- 'de####yfortieth.net':80
- 'ri####advance.net':80
- 'li####fortieth.net':80
- 'be####fortieth.net':80
- 'th####ortieth.net':80
- 'ch####ortieth.net':80
- 'wi####advance.net':80
- 'wi####stranger.net':80
- 'su####advance.net':80
- 'th####oodbye.net':80
- 'th####dvance.net':80
- 'ch####dvance.net':80
- 'ch####tranger.net':80
- 'ch####oodbye.net':80
- 'th####tranger.net':80
- 'li####stranger.net':80
- 're####erminute.net':80
- 'wo###minute.net':80
- 'wo####pecial.net':80
- 'wo###corner.net':80
- 're####erspecial.net':80
- 're####erflower.net':80
- 'in####sespecial.net':80
- 'fo####special.net':80
- 'fo####corner.net':80
- 'wo###flower.net':80
- 'in####secorner.net':80
- 're####ercorner.net':80
- 'hu####dfortieth.net':80
- 'jo####yfortieth.net':80
- 'de####yadvance.net':80
- 'de####ystranger.net':80
- 'li####advance.net':80
- 'hu####dgoodbye.net':80
- 'hu####dadvance.net':80
- 'jo####yadvance.net':80
- 'jo####ystranger.net':80
- 'jo####ygoodbye.net':80
- 'hu####dstranger.net':80
TCP:
Запросы HTTP GET:
- http://be####stranger.net/forum/search.php?em###############################
- http://ri####stranger.net/forum/search.php?em###############################
- http://ri####goodbye.net/forum/search.php?em###############################
- http://ri####fortieth.net/forum/search.php?em###############################
- http://be####goodbye.net/forum/search.php?em###############################
- http://be####advance.net/forum/search.php?em###############################
- http://li####goodbye.net/forum/search.php?em###############################
- http://de####ygoodbye.net/forum/search.php?em###############################
- http://de####yfortieth.net/forum/search.php?em###############################
- http://ri####advance.net/forum/search.php?em###############################
- http://li####fortieth.net/forum/search.php?em###############################
- http://be####fortieth.net/forum/search.php?em###############################
- http://th####ortieth.net/forum/search.php?em###############################
- http://ch####ortieth.net/forum/search.php?em###############################
- http://wi####advance.net/forum/search.php?em###############################
- http://wi####stranger.net/forum/search.php?em###############################
- http://su####advance.net/forum/search.php?em###############################
- http://th####oodbye.net/forum/search.php?em###############################
- http://th####dvance.net/forum/search.php?em###############################
- http://ch####dvance.net/forum/search.php?em###############################
- http://ch####tranger.net/forum/search.php?em###############################
- http://ch####oodbye.net/forum/search.php?em###############################
- http://th####tranger.net/forum/search.php?em###############################
- http://li####stranger.net/forum/search.php?em###############################
- http://re####erminute.net/forum/search.php?em###############################
- http://wo###minute.net/forum/search.php?em###############################
- http://wo####pecial.net/forum/search.php?em###############################
- http://wo###corner.net/forum/search.php?em###############################
- http://re####erspecial.net/forum/search.php?em###############################
- http://re####erflower.net/forum/search.php?em###############################
- http://in####sespecial.net/forum/search.php?em###############################
- http://fo####special.net/forum/search.php?em###############################
- http://fo####corner.net/forum/search.php?em###############################
- http://wo###flower.net/forum/search.php?em###############################
- http://in####secorner.net/forum/search.php?em###############################
- http://re####ercorner.net/forum/search.php?em###############################
- http://hu####dfortieth.net/forum/search.php?em###############################
- http://jo####yfortieth.net/forum/search.php?em###############################
- http://de####yadvance.net/forum/search.php?em###############################
- http://de####ystranger.net/forum/search.php?em###############################
- http://li####advance.net/forum/search.php?em###############################
- http://hu####dgoodbye.net/forum/search.php?em###############################
- http://hu####dadvance.net/forum/search.php?em###############################
- http://jo####yadvance.net/forum/search.php?em###############################
- http://jo####ystranger.net/forum/search.php?em###############################
- http://jo####ygoodbye.net/forum/search.php?em###############################
- http://hu####dstranger.net/forum/search.php?em###############################
UDP:
- DNS ASK ri####goodbye.net
- DNS ASK be####stranger.net
- DNS ASK ri####stranger.net
- DNS ASK be####fortieth.net
- DNS ASK ri####fortieth.net
- DNS ASK be####goodbye.net
- DNS ASK de####yfortieth.net
- DNS ASK li####goodbye.net
- DNS ASK de####ygoodbye.net
- DNS ASK be####advance.net
- DNS ASK ri####advance.net
- DNS ASK li####fortieth.net
- DNS ASK wi####advance.net
- DNS ASK th####ortieth.net
- DNS ASK ch####ortieth.net
- DNS ASK su####stranger.net
- DNS ASK wi####stranger.net
- DNS ASK su####advance.net
- DNS ASK ch####tranger.net
- DNS ASK th####dvance.net
- DNS ASK ch####dvance.net
- DNS ASK th####oodbye.net
- DNS ASK ch####oodbye.net
- DNS ASK th####tranger.net
- DNS ASK wo####pecial.net
- DNS ASK re####erminute.net
- DNS ASK wo###minute.net
- DNS ASK re####ercorner.net
- DNS ASK wo###corner.net
- DNS ASK re####erspecial.net
- DNS ASK fo####corner.net
- DNS ASK in####sespecial.net
- DNS ASK fo####special.net
- DNS ASK re####erflower.net
- DNS ASK wo###flower.net
- DNS ASK in####secorner.net
- DNS ASK de####yadvance.net
- DNS ASK hu####dfortieth.net
- DNS ASK jo####yfortieth.net
- DNS ASK li####stranger.net
- DNS ASK de####ystranger.net
- DNS ASK li####advance.net
- DNS ASK jo####ystranger.net
- DNS ASK hu####dadvance.net
- DNS ASK jo####yadvance.net
- DNS ASK hu####dgoodbye.net
- DNS ASK jo####ygoodbye.net
- DNS ASK hu####dstranger.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'Indicator' WindowName: ''
