Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'System Identity Cryptographic' = 'C:\objaaouur\xguiqebw.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Card Trap SPP Copy IPsec Information Center] 'ImagePath' = 'C:\objaaouur\xguiqebw.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Card Trap SPP Copy IPsec Information Center] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- 'C:\objaaouur\iyjvbeeycy.exe' "c:\objaaouur\xguiqebw.exe"
- 'C:\objaaouur\xguiqebw.exe'
- 'C:\objaaouur\pqch2lsamiq4gsdoh.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\objaaouur\xguiqebw.exe
- C:\objaaouur\iyjvbeeycy.exe
- C:\objaaouur\pqch2lsamiq4gsdoh.exe
- %WINDIR%\objaaouur\rw9iukasgk
- C:\objaaouur\rw9iukasgk
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\objaaouur\iyjvbeeycy.exe
- C:\objaaouur\xguiqebw.exe
Удаляет следующие файлы:
- C:\objaaouur\pqch2lsamiq4gsdoh.exe
- %WINDIR%\objaaouur\rw9iukasgk
Подменяет следующие файлы:
- %WINDIR%\objaaouur\rw9iukasgk
Сетевая активность:
Подключается к:
- 're####erbring.net':80
- 'wo###bring.net':80
- 're####erlisten.net':80
- 'wo###listen.net':80
- 'in####seshout.net':80
- 'fo####demand.net':80
- 'in####selisten.net':80
- 'fo###tshout.net':80
- 'in####sedemand.net':80
- 'wo###demand.net':80
- 'hu####dthird.net':80
- 'jo####ythird.net':80
- 'hu####dobject.net':80
- 'jo####yobject.net':80
- 'hu####dstation.net':80
- 'wo###shout.net':80
- 're####erdemand.net':80
- 'jo####ystation.net':80
- 're####ershout.net':80
- 'fo####listen.net':80
- 'su####demand.net':80
- 'wi####demand.net':80
- 'su###rshout.net':80
- 'wi###nshout.net':80
- 'su####listen.net':80
- 'wi###nbring.net':80
- 'th###shout.net':80
- 'wi####listen.net':80
- 'su###rbring.net':80
- 'ef###tbring.net':80
- 'th####hshout.net':80
- 'ef###tshout.net':80
- 'in####sebring.net':80
- 'fo###tbring.net':80
- 'th####hdemand.net':80
- 'ef####listen.net':80
- 'th####hbring.net':80
- 'ef####demand.net':80
- 'th####hlisten.net':80
TCP:
Запросы HTTP GET:
- http://re####erbring.net/index.php
- http://wo###bring.net/index.php
- http://re####erlisten.net/index.php
- http://wo###listen.net/index.php
- http://in####seshout.net/index.php
- http://fo####demand.net/index.php
- http://in####selisten.net/index.php
- http://fo###tshout.net/index.php
- http://in####sedemand.net/index.php
- http://wo###demand.net/index.php
- http://hu####dthird.net/index.php
- http://jo####ythird.net/index.php
- http://hu####dobject.net/index.php
- http://jo####yobject.net/index.php
- http://hu####dstation.net/index.php
- http://wo###shout.net/index.php
- http://re####erdemand.net/index.php
- http://jo####ystation.net/index.php
- http://re####ershout.net/index.php
- http://fo####listen.net/index.php
- http://su####demand.net/index.php
- http://wi####demand.net/index.php
- http://su###rshout.net/index.php
- http://wi###nshout.net/index.php
- http://su####listen.net/index.php
- http://wi###nbring.net/index.php
- http://th###shout.net/index.php
- http://wi####listen.net/index.php
- http://su###rbring.net/index.php
- http://ef###tbring.net/index.php
- http://th####hshout.net/index.php
- http://ef###tshout.net/index.php
- http://in####sebring.net/index.php
- http://fo###tbring.net/index.php
- http://th####hdemand.net/index.php
- http://ef####listen.net/index.php
- http://th####hbring.net/index.php
- http://ef####demand.net/index.php
- http://th####hlisten.net/index.php
UDP:
- DNS ASK re####erbring.net
- DNS ASK wo###bring.net
- DNS ASK wo###listen.net
- DNS ASK wo###demand.net
- DNS ASK re####erlisten.net
- DNS ASK fo####demand.net
- DNS ASK in####selisten.net
- DNS ASK in####sedemand.net
- DNS ASK in####seshout.net
- DNS ASK fo###tshout.net
- DNS ASK hu####dthird.net
- DNS ASK jo####ythird.net
- DNS ASK jo####yobject.net
- DNS ASK jo#####childhood.net
- DNS ASK hu####dobject.net
- DNS ASK wo###shout.net
- DNS ASK re####erdemand.net
- DNS ASK re####ershout.net
- DNS ASK hu####dstation.net
- DNS ASK jo####ystation.net
- DNS ASK su####demand.net
- DNS ASK wi####demand.net
- DNS ASK wi###nshout.net
- DNS ASK ef###tbring.net
- DNS ASK su###rshout.net
- DNS ASK wi###nbring.net
- DNS ASK th###shout.net
- DNS ASK su###rbring.net
- DNS ASK su####listen.net
- DNS ASK wi####listen.net
- DNS ASK th####hshout.net
- DNS ASK ef###tshout.net
- DNS ASK fo###tbring.net
- DNS ASK fo####listen.net
- DNS ASK in####sebring.net
- DNS ASK ef####listen.net
- DNS ASK th####hbring.net
- DNS ASK th####hlisten.net
- DNS ASK th####hdemand.net
- DNS ASK ef####demand.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
