Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Debugger NGEN Compatibility Source Engine' = 'C:\gmhpvirbtvbfwh\curvwdfr.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Config Keying Health Connections] 'ImagePath' = 'C:\gmhpvirbtvbfwh\curvwdfr.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Config Keying Health Connections] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- 'C:\gmhpvirbtvbfwh\emdcvyr.exe' "c:\gmhpvirbtvbfwh\curvwdfr.exe"
- 'C:\gmhpvirbtvbfwh\curvwdfr.exe'
- 'C:\gmhpvirbtvbfwh\uok2g1pzpgu2wrebvo.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\gmhpvirbtvbfwh\curvwdfr.exe
- C:\gmhpvirbtvbfwh\emdcvyr.exe
- C:\gmhpvirbtvbfwh\ccnbxudbelnp
- %WINDIR%\gmhpvirbtvbfwh\kmzsinl
- C:\gmhpvirbtvbfwh\kmzsinl
- C:\gmhpvirbtvbfwh\uok2g1pzpgu2wrebvo.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\gmhpvirbtvbfwh\emdcvyr.exe
- C:\gmhpvirbtvbfwh\curvwdfr.exe
Удаляет следующие файлы:
- C:\gmhpvirbtvbfwh\uok2g1pzpgu2wrebvo.exe
- %WINDIR%\gmhpvirbtvbfwh\kmzsinl
Подменяет следующие файлы:
- %WINDIR%\gmhpvirbtvbfwh\kmzsinl
Сетевая активность:
Подключается к:
- 'co####ecover.net':80
- 'ch###become.net':80
- 'ch###cover.net':80
- 'ch####urther.net':80
- 'co####efurther.net':80
- 'of####urther.net':80
- 'al####urther.net':80
- 'co####ecompany.net':80
- 'co####ebecome.net':80
- 'ch####ompany.net':80
- 'pr####tcompany.net':80
- 'th####urther.net':80
- 'pr####tfurther.net':80
- 'cl###govern.net':80
- 'cl###enough.net':80
- 'th###govern.net':80
- 'pr####tbecome.net':80
- 'th####ompany.net':80
- 'th###become.net':80
- 'th###cover.net':80
- 'pr####tcover.net':80
- 'ra####further.net':80
- 'mo####gfurther.net':80
- 'tw####company.net':80
- 'tw####become.net':80
- 'mi####company.net':80
- 'mo####gbecome.net':80
- 'ra####company.net':80
- 'ra####become.net':80
- 'ra###rcover.net':80
- 'mo####gcover.net':80
- 'mi####become.net':80
- 'al###become.net':80
- 'of####ompany.net':80
- 'of###become.net':80
- 'of###cover.net':80
- 'al###cover.net':80
- 'mi###ecover.net':80
- 'tw###ecover.net':80
- 'tw####further.net':80
- 'al####ompany.net':80
- 'mi####further.net':80
- 'th###enough.net':80
- 'ra####nature.net':80
- 'mo####gnature.net':80
- 'tw####govern.net':80
- 'tw####enough.net':80
- 'mi####govern.net':80
- 'mo####genough.net':80
- 'ra####govern.net':80
- 'ra####enough.net':80
- 'ra####needle.net':80
- 'mo####gneedle.net':80
- 'mi####enough.net':80
- 'al###enough.net':80
- 'of###govern.net':80
- 'of###enough.net':80
- 'of###needle.net':80
- 'al###needle.net':80
- 'mi####needle.net':80
- 'tw####needle.net':80
- 'tw####nature.net':80
- 'al###govern.net':80
- 'mi####nature.net':80
- 'we####renough.net':80
- 'am####govern.net':80
- 'am####enough.net':80
- 'am####needle.net':80
- 'we####rneedle.net':80
- 'th###needle.net':80
- 'cl###needle.net':80
- 'cl###nature.net':80
- 'we####rgovern.net':80
- 'th###nature.net':80
- 'we####rnature.net':80
- 'st####eneedle.net':80
- 'hi####yneedle.net':80
- 'hi####ynature.net':80
- 'mo####ggovern.net':80
- 'st####enature.net':80
- 'hi####ygovern.net':80
- 'am####nature.net':80
- 'st####egovern.net':80
- 'st####eenough.net':80
- 'hi####yenough.net':80
TCP:
Запросы HTTP GET:
- http://co####ecover.net/index.php?me########
- http://ch###become.net/index.php?me########
- http://ch###cover.net/index.php?me########
- http://ch####urther.net/index.php?me########
- http://co####efurther.net/index.php?me########
- http://of####urther.net/index.php?me########
- http://al####urther.net/index.php?me########
- http://co####ecompany.net/index.php?me########
- http://co####ebecome.net/index.php?me########
- http://ch####ompany.net/index.php?me########
- http://pr####tcompany.net/index.php?me########
- http://th####urther.net/index.php?me########
- http://pr####tfurther.net/index.php?me########
- http://cl###govern.net/index.php?me########
- http://cl###enough.net/index.php?me########
- http://th###govern.net/index.php?me########
- http://pr####tbecome.net/index.php?me########
- http://th####ompany.net/index.php?me########
- http://th###become.net/index.php?me########
- http://th###cover.net/index.php?me########
- http://pr####tcover.net/index.php?me########
- http://ra####further.net/index.php?me########
- http://mo####gfurther.net/index.php?me########
- http://tw####company.net/index.php?me########
- http://tw####become.net/index.php?me########
- http://mi####company.net/index.php?me########
- http://mo####gbecome.net/index.php?me########
- http://ra####company.net/index.php?me########
- http://ra####become.net/index.php?me########
- http://ra###rcover.net/index.php?me########
- http://mo####gcover.net/index.php?me########
- http://mi####become.net/index.php?me########
- http://al###become.net/index.php?me########
- http://of####ompany.net/index.php?me########
- http://of###become.net/index.php?me########
- http://of###cover.net/index.php?me########
- http://al###cover.net/index.php?me########
- http://mi###ecover.net/index.php?me########
- http://tw###ecover.net/index.php?me########
- http://tw####further.net/index.php?me########
- http://al####ompany.net/index.php?me########
- http://mi####further.net/index.php?me########
- http://th###enough.net/index.php?me########
- http://ra####nature.net/index.php?me########
- http://mo####gnature.net/index.php?me########
- http://tw####govern.net/index.php?me########
- http://tw####enough.net/index.php?me########
- http://mi####govern.net/index.php?me########
- http://mo####genough.net/index.php?me########
- http://ra####govern.net/index.php?me########
- http://ra####enough.net/index.php?me########
- http://ra####needle.net/index.php?me########
- http://mo####gneedle.net/index.php?me########
- http://mi####enough.net/index.php?me########
- http://al###enough.net/index.php?me########
- http://of###govern.net/index.php?me########
- http://of###enough.net/index.php?me########
- http://of###needle.net/index.php?me########
- http://al###needle.net/index.php?me########
- http://mi####needle.net/index.php?me########
- http://tw####needle.net/index.php?me########
- http://tw####nature.net/index.php?me########
- http://al###govern.net/index.php?me########
- http://mi####nature.net/index.php?me########
- http://we####renough.net/index.php?me########
- http://am####govern.net/index.php?me########
- http://am####enough.net/index.php?me########
- http://am####needle.net/index.php?me########
- http://we####rneedle.net/index.php?me########
- http://th###needle.net/index.php?me########
- http://cl###needle.net/index.php?me########
- http://cl###nature.net/index.php?me########
- http://we####rgovern.net/index.php?me########
- http://th###nature.net/index.php?me########
- http://we####rnature.net/index.php?me########
- http://st####eneedle.net/index.php?me########
- http://hi####yneedle.net/index.php?me########
- http://hi####ynature.net/index.php?me########
- http://mo####ggovern.net/index.php?me########
- http://st####enature.net/index.php?me########
- http://hi####ygovern.net/index.php?me########
- http://am####nature.net/index.php?me########
- http://st####egovern.net/index.php?me########
- http://st####eenough.net/index.php?me########
- http://hi####yenough.net/index.php?me########
UDP:
- DNS ASK co####ecover.net
- DNS ASK ch###become.net
- DNS ASK ch###cover.net
- DNS ASK ch####urther.net
- DNS ASK co####efurther.net
- DNS ASK of####urther.net
- DNS ASK al####urther.net
- DNS ASK co####ecompany.net
- DNS ASK co####ebecome.net
- DNS ASK ch####ompany.net
- DNS ASK pr####tcompany.net
- DNS ASK th####urther.net
- DNS ASK pr####tfurther.net
- DNS ASK cl###govern.net
- DNS ASK cl###enough.net
- DNS ASK th###govern.net
- DNS ASK pr####tbecome.net
- DNS ASK th####ompany.net
- DNS ASK th###become.net
- DNS ASK th###cover.net
- DNS ASK pr####tcover.net
- DNS ASK ra####further.net
- DNS ASK mo####gfurther.net
- DNS ASK tw####company.net
- DNS ASK tw####become.net
- DNS ASK mi####company.net
- DNS ASK mo####gbecome.net
- DNS ASK ra####company.net
- DNS ASK ra####become.net
- DNS ASK ra###rcover.net
- DNS ASK mo####gcover.net
- DNS ASK mi####become.net
- DNS ASK al###become.net
- DNS ASK of####ompany.net
- DNS ASK of###become.net
- DNS ASK of###cover.net
- DNS ASK al###cover.net
- DNS ASK mi###ecover.net
- DNS ASK tw###ecover.net
- DNS ASK tw####further.net
- DNS ASK al####ompany.net
- DNS ASK mi####further.net
- DNS ASK th###enough.net
- DNS ASK ra####nature.net
- DNS ASK mo####gnature.net
- DNS ASK tw####govern.net
- DNS ASK tw####enough.net
- DNS ASK mi####govern.net
- DNS ASK mo####genough.net
- DNS ASK ra####govern.net
- DNS ASK ra####enough.net
- DNS ASK ra####needle.net
- DNS ASK mo####gneedle.net
- DNS ASK mi####enough.net
- DNS ASK al###enough.net
- DNS ASK of###govern.net
- DNS ASK of###enough.net
- DNS ASK of###needle.net
- DNS ASK al###needle.net
- DNS ASK mi####needle.net
- DNS ASK tw####needle.net
- DNS ASK tw####nature.net
- DNS ASK al###govern.net
- DNS ASK mi####nature.net
- DNS ASK we####renough.net
- DNS ASK am####govern.net
- DNS ASK am####enough.net
- DNS ASK am####needle.net
- DNS ASK we####rneedle.net
- DNS ASK th###needle.net
- DNS ASK cl###needle.net
- DNS ASK cl###nature.net
- DNS ASK we####rgovern.net
- DNS ASK th###nature.net
- DNS ASK we####rnature.net
- DNS ASK st####eneedle.net
- DNS ASK hi####yneedle.net
- DNS ASK hi####ynature.net
- DNS ASK mo####ggovern.net
- DNS ASK st####enature.net
- DNS ASK hi####ygovern.net
- DNS ASK am####nature.net
- DNS ASK st####egovern.net
- DNS ASK st####eenough.net
- DNS ASK hi####yenough.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
