Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Launcher Mapper Gateway Class' = 'C:\zzblvwyqfwan\nridviv.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Credential ActiveX UserMode Block] 'ImagePath' = 'C:\zzblvwyqfwan\nridviv.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Credential ActiveX UserMode Block] 'Start' = '00000002'
Изменения в файловой системе:
Создает следующие файлы:
- C:\zzblvwyqfwan\nridviv.exe
- C:\zzblvwyqfwan\pzpgxcgl.exe
- C:\zzblvwyqfwan\zy2z7deltmusghr0.exe
- %WINDIR%\zzblvwyqfwan\p4wcfvw0ipnj
- C:\zzblvwyqfwan\p4wcfvw0ipnj
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\zzblvwyqfwan\pzpgxcgl.exe
- C:\zzblvwyqfwan\nridviv.exe
Удаляет следующие файлы:
- C:\zzblvwyqfwan\zy2z7deltmusghr0.exe
- %WINDIR%\zzblvwyqfwan\p4wcfvw0ipnj
Подменяет следующие файлы:
- %WINDIR%\zzblvwyqfwan\p4wcfvw0ipnj
Сетевая активность:
Подключается к:
- 'hu####dcaught.net':80
- 'jo####ycaught.net':80
- 'hu#####president.net':80
- 'de####ytrouble.net':80
- 'li####strong.net':80
- 'de####ystrong.net':80
- 'hu####dstrong.net':80
- 'jo####ystrong.net':80
- 're####erarrive.net':80
- 'jo#####president.net':80
- 'hu####dtrouble.net':80
- 'jo####ytrouble.net':80
- 'li####trouble.net':80
- 'ri####president.net':80
- 'be####trouble.net':80
- 'ri####trouble.net':80
- 'be####caught.net':80
- 'ri####caught.net':80
- 'be####president.net':80
- 'de####ycaught.net':80
- 'li####president.net':80
- 'de#####president.net':80
- 'be####strong.net':80
- 'ri####strong.net':80
- 'li####caught.net':80
- 'ef####arrive.net':80
- 'th####hoffice.net':80
- 'ef####office.net':80
- 'in####sesupply.net':80
- 'fo####supply.net':80
- 'th####harrive.net':80
- 'ef####supply.net':80
- 'su####arrive.net':80
- 'wi####arrive.net':80
- 'th####hdistance.net':80
- 'ef####distance.net':80
- 'th####hsupply.net':80
- 'fo####distance.net':80
- 're#####rdistance.net':80
- 'wo####istance.net':80
- 're####ersupply.net':80
- 'wo###arrive.net':80
- 're####eroffice.net':80
- 'wo###office.net':80
- 'in####seoffice.net':80
- 'fo####office.net':80
- 'in#####edistance.net':80
- 'wo###supply.net':80
- 'in####searrive.net':80
- 'fo####arrive.net':80
TCP:
Запросы HTTP GET:
- http://hu####dcaught.net/index.php
- http://jo####ycaught.net/index.php
- http://hu#####president.net/index.php
- http://de####ytrouble.net/index.php
- http://li####strong.net/index.php
- http://de####ystrong.net/index.php
- http://hu####dstrong.net/index.php
- http://jo####ystrong.net/index.php
- http://re####erarrive.net/index.php
- http://jo#####president.net/index.php
- http://hu####dtrouble.net/index.php
- http://jo####ytrouble.net/index.php
- http://li####trouble.net/index.php
- http://ri####president.net/index.php
- http://be####trouble.net/index.php
- http://ri####trouble.net/index.php
- http://be####caught.net/index.php
- http://ri####caught.net/index.php
- http://be####president.net/index.php
- http://de####ycaught.net/index.php
- http://li####president.net/index.php
- http://de#####president.net/index.php
- http://be####strong.net/index.php
- http://ri####strong.net/index.php
- http://li####caught.net/index.php
- http://ef####arrive.net/index.php
- http://th####hoffice.net/index.php
- http://ef####office.net/index.php
- http://in####sesupply.net/index.php
- http://fo####supply.net/index.php
- http://th####harrive.net/index.php
- http://ef####supply.net/index.php
- http://su####arrive.net/index.php
- http://wi####arrive.net/index.php
- http://th####hdistance.net/index.php
- http://ef####distance.net/index.php
- http://th####hsupply.net/index.php
- http://fo####distance.net/index.php
- http://re#####rdistance.net/index.php
- http://wo####istance.net/index.php
- http://re####ersupply.net/index.php
- http://wo###arrive.net/index.php
- http://re####eroffice.net/index.php
- http://wo###office.net/index.php
- http://in####seoffice.net/index.php
- http://fo####office.net/index.php
- http://in#####edistance.net/index.php
- http://wo###supply.net/index.php
- http://in####searrive.net/index.php
- http://fo####arrive.net/index.php
UDP:
- DNS ASK de####ystrong.net
- DNS ASK hu####dcaught.net
- DNS ASK jo####ycaught.net
- DNS ASK li####trouble.net
- DNS ASK de####ytrouble.net
- DNS ASK li####strong.net
- DNS ASK jo####ytrouble.net
- DNS ASK hu####dstrong.net
- DNS ASK jo####ystrong.net
- DNS ASK hu#####president.net
- DNS ASK jo#####president.net
- DNS ASK hu####dtrouble.net
- DNS ASK de#####president.net
- DNS ASK be####president.net
- DNS ASK ri####president.net
- DNS ASK be####trouble.net
- DNS ASK ch###strong.net
- DNS ASK be####caught.net
- DNS ASK ri####caught.net
- DNS ASK li####caught.net
- DNS ASK de####ycaught.net
- DNS ASK li####president.net
- DNS ASK ri####trouble.net
- DNS ASK be####strong.net
- DNS ASK ri####strong.net
- DNS ASK re####erarrive.net
- DNS ASK ef####arrive.net
- DNS ASK th####hoffice.net
- DNS ASK ef####office.net
- DNS ASK in####sesupply.net
- DNS ASK fo####supply.net
- DNS ASK th####harrive.net
- DNS ASK ef####supply.net
- DNS ASK su####arrive.net
- DNS ASK wi####arrive.net
- DNS ASK th####hdistance.net
- DNS ASK ef####distance.net
- DNS ASK th####hsupply.net
- DNS ASK fo####distance.net
- DNS ASK re#####rdistance.net
- DNS ASK wo####istance.net
- DNS ASK re####ersupply.net
- DNS ASK wo###arrive.net
- DNS ASK re####eroffice.net
- DNS ASK wo###office.net
- DNS ASK in####seoffice.net
- DNS ASK fo####office.net
- DNS ASK in#####edistance.net
- DNS ASK wo###supply.net
- DNS ASK in####searrive.net
- DNS ASK fo####arrive.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
