Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Internet Secondary Update' = '<SYSTEM32>\itfntrtwn.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Cache Audio Profile Session Studio] 'ImagePath' = '<SYSTEM32>\itfntrtwn.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Cache Audio Profile Session Studio] 'Start' = '00000002'
Вредоносные функции:
Для затруднения выявления своего присутствия в системе
блокирует:
- Центр обеспечения безопасности (Security Center)
Запускает на исполнение:
- '<SYSTEM32>\rseqnfldjrua.exe' "<SYSTEM32>\itfntrtwn.exe"
- '%WINDIR%\Temp\rbsekrhkjqgnoizq5.exe' -r 35942 tcp
- '%TEMP%\rbsekrhk7tm34czq5buy8hu.exe'
- '<SYSTEM32>\itfntrtwn.exe'
Изменения в файловой системе:
Создает следующие файлы:
- <SYSTEM32>\swfbcyzb\run
- <SYSTEM32>\swfbcyzb\rng
- %WINDIR%\Temp\rbsekrhkjqgnoizq5.exe
- <SYSTEM32>\swfbcyzb\cfg
- %TEMP%\rbsekrhk7tm34czq5buy8hu.exe
- <SYSTEM32>\swfbcyzb\tst
- <SYSTEM32>\rseqnfldjrua.exe
- <SYSTEM32>\itfntrtwn.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- <SYSTEM32>\rseqnfldjrua.exe
- <SYSTEM32>\itfntrtwn.exe
Удаляет следующие файлы:
- %WINDIR%\Temp\rbsekrhkjqgnoizq5.exe
- %TEMP%\rbsekrhk7tm34czq5buy8hu.exe
Сетевая активность:
Подключается к:
- 'fe###ver.net':80
- 'we###ver.net':80
- 'lo####thepings.ru':80
- 'fe##over.ru':80
- 'th###gold.net':80
- 'we###ome.net':80
- 'fe###ome.net':80
- '18#.#06.120.168':80
- '17#.#36.150.135':8080
- '13#.#2.139.16':80
- 'wi###bout.net':80
- 'er#####udesymphony.net':80
- 'ri###nstorm.net':80
- 're####needle.net':80
TCP:
Запросы HTTP GET:
- http://fe##over.ru/index.php
- http://fe###ver.net/index.php
- http://we###ver.net/index.php
- http://th###gold.net/index.php
- http://we###ome.net/index.php
- http://fe###ome.net/index.php
- http://lo####thepings.ru/index.php
- http://wi###bout.net/index.php
- http://18#.#06.120.168/index.php
- http://13#.#2.139.16/index.php
- http://er#####udesymphony.net/index.php
- http://ri###nstorm.net/index.php
- http://re####needle.net/index.php
UDP:
- DNS ASK we###ash.net
- DNS ASK fa###hirt.ru
- DNS ASK fi###alk.net
- DNS ASK le###talk.ru
- DNS ASK pl###shirt.net
- DNS ASK le###wash.net
- DNS ASK to###hirt.net
- DNS ASK pl###talk.net
- DNS ASK ve###ash.net
- DNS ASK se###wash.ru
- DNS ASK we###hirt.net
- DNS ASK ve###alk.net
- DNS ASK pi###wash.net
- DNS ASK ve###hirt.net
- DNS ASK ve###elow.net
- DNS ASK we###elow.net
- DNS ASK se###talk.net
- DNS ASK we##talk.ru
- DNS ASK we###alk.net
- DNS ASK fi###hirt.net
- DNS ASK le###talk.net
- DNS ASK se###wash.net
- DNS ASK fa###elow.net
- DNS ASK to###elow.ru
- DNS ASK fi###elow.net
- DNS ASK fi###ash.net
- DNS ASK pl###cause.net
- DNS ASK fi###elow.ru
- DNS ASK pl###below.net
- DNS ASK se###shirt.net
- DNS ASK fa###hirt.net
- DNS ASK to###ash.net
- DNS ASK se###below.net
- DNS ASK le###below.net
- DNS ASK le###shirt.net
- DNS ASK to###alk.net
- DNS ASK fa###ash.net
- DNS ASK fa###alk.net
- DNS ASK to###elow.net
- DNS ASK mu##wash.ru
- DNS ASK vi###ure.net
- DNS ASK tr###shot.net
- DNS ASK lr###cause.ru
- DNS ASK lr###sure.net
- DNS ASK yo###ack.net
- DNS ASK yo###ause.net
- DNS ASK tr###cause.net
- DNS ASK yo###hot.net
- DNS ASK yo##shot.ru
- DNS ASK tr###back.net
- DNS ASK vi###ack.net
- DNS ASK vi##back.ru
- DNS ASK fi###ure.net
- DNS ASK pl###sure.net
- DNS ASK vi###hot.net
- DNS ASK vi###ause.net
- DNS ASK lr###cause.net
- DNS ASK lr###shot.net
- DNS ASK lr###back.net
- DNS ASK tr###sure.net
- DNS ASK pi###shirt.net
- DNS ASK pi###shirt.ru
- DNS ASK wa###elow.net
- DNS ASK mu###hirt.net
- DNS ASK mu###alk.net
- DNS ASK pi###below.net
- DNS ASK mu###ash.net
- DNS ASK pi###talk.net
- DNS ASK mu###elow.net
- DNS ASK ta###ash.net
- DNS ASK wa###hirt.net
- DNS ASK ta###hirt.net
- DNS ASK yo###ure.net
- DNS ASK ta###alk.net
- DNS ASK tr###sure.ru
- DNS ASK ta###elow.ru
- DNS ASK wa###ash.net
- DNS ASK wa###alk.net
- DNS ASK ta###elow.net
- DNS ASK li###ver.net
- DNS ASK po###gold.net
- DNS ASK we##gold.ru
- DNS ASK le###ome.net
- DNS ASK we###rain.net
- DNS ASK fe###rain.net
- DNS ASK po###over.net
- DNS ASK we###old.net
- DNS ASK le###old.net
- DNS ASK ta###home.net
- DNS ASK ca##home.ru
- DNS ASK ca###old.net
- DNS ASK ta###grain.net
- DNS ASK ca###ome.net
- DNS ASK li###ome.net
- DNS ASK no###ver.net
- DNS ASK po###home.net
- DNS ASK ta###gold.net
- DNS ASK ta###over.net
- DNS ASK po###gold.ru
- DNS ASK we###ver.net
- DNS ASK lo####thepings.ru
- DNS ASK fe##over.ru
- DNS ASK fe###ver.net
- DNS ASK er#####udesymphony.net
- DNS ASK wi###bout.net
- DNS ASK pl###wash.net
- DNS ASK ri###nstorm.net
- DNS ASK re####needle.net
- DNS ASK fe###ome.net
- DNS ASK ta###grain.ru
- DNS ASK th###grain.net
- DNS ASK th###over.net
- DNS ASK fe###old.net
- DNS ASK li###rain.net
- DNS ASK th###gold.net
- DNS ASK we###ome.net
- DNS ASK li###rain.ru
- DNS ASK li###old.net
- DNS ASK po###grain.net
- DNS ASK yo###alk.net
- DNS ASK tr###talk.net
- DNS ASK yo###hirt.net
- DNS ASK tr###shirt.net
- DNS ASK tr###below.net
- DNS ASK yo###ash.net
- DNS ASK tr###wash.net
- DNS ASK tr###talk.ru
- DNS ASK yo###elow.net
- DNS ASK lr###wash.net
- DNS ASK lr###shirt.ru
- DNS ASK vi###alk.net
- DNS ASK vi###hirt.net
- DNS ASK lr###shirt.net
- DNS ASK lr###talk.net
- DNS ASK vi###ash.net
- DNS ASK vi##wash.ru
- DNS ASK lr###below.net
- DNS ASK vi###elow.net
- DNS ASK fa###gold.net
- DNS ASK no###rain.net
- DNS ASK li##over.ru
- DNS ASK we##home.ru
- DNS ASK no###old.net
- DNS ASK le###ver.net
- DNS ASK ca###ver.net
- DNS ASK no###ome.net
- DNS ASK le###rain.net
- DNS ASK ca###rain.net
- DNS ASK fa###home.net
- DNS ASK fa###grain.net
- DNS ASK ri##over.ru
- DNS ASK fa###gold.ru
- DNS ASK ri###old.net
- DNS ASK fa###over.net
- DNS ASK ri###ver.net
- DNS ASK ri###ome.net
- DNS ASK no###rain.ru
- DNS ASK ri###rain.net
- '23#.#55.255.250':1900
