Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Tracking Panel Source Collector Internet Security' = 'C:\rlnpqfdgcued\tjnancs.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Human List Parental Center] 'ImagePath' = 'C:\rlnpqfdgcued\tjnancs.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Human List Parental Center] 'Start' = '00000002'
Вредоносные функции:
Запускает на исполнение:
- 'C:\rlnpqfdgcued\vfczxpuchu.exe' "c:\rlnpqfdgcued\tjnancs.exe"
- 'C:\rlnpqfdgcued\tjnancs.exe'
- 'C:\rlnpqfdgcued\d42j6jhrvs7apfyr.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\rlnpqfdgcued\tjnancs.exe
- C:\rlnpqfdgcued\vfczxpuchu.exe
- C:\rlnpqfdgcued\tb82wkru
- %WINDIR%\rlnpqfdgcued\sqczuvp4p
- C:\rlnpqfdgcued\sqczuvp4p
- C:\rlnpqfdgcued\d42j6jhrvs7apfyr.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\rlnpqfdgcued\vfczxpuchu.exe
- C:\rlnpqfdgcued\tjnancs.exe
Удаляет следующие файлы:
- C:\rlnpqfdgcued\d42j6jhrvs7apfyr.exe
- %WINDIR%\rlnpqfdgcued\sqczuvp4p
Подменяет следующие файлы:
- %WINDIR%\rlnpqfdgcued\sqczuvp4p
Сетевая активность:
Подключается к:
- 'su###rpower.net':80
- 'cr###famous.net':80
- 'su####famous.net':80
- 'cr###power.net':80
- 'th####tcentury.net':80
- 'cr####ountry.net':80
- 'su####country.net':80
- 'kn###power.net':80
- 'be###power.net':80
- 'kn###famous.net':80
- 'be####ountry.net':80
- 'cr####entury.net':80
- 'su####century.net':80
- 'kn####ountry.net':80
- 'wo###famous.net':80
- 'sm####entury.net':80
- 'wo####entury.net':80
- 'sm###famous.net':80
- 'wo####ountry.net':80
- 'sm###power.net':80
- 'wo###power.net':80
- 'wa###famous.net':80
- 'th####tfamous.net':80
- 'wa####entury.net':80
- 'th####tpower.net':80
- 'wa####ountry.net':80
- 'th####tcountry.net':80
- 'wa###power.net':80
- 'ge#####ancentury.net':80
- 'ex#####ncecountry.net':80
- 'fr####ountry.net':80
- 'al####ycentury.net':80
- 'ge####manpower.net':80
- 'al####yfamous.net':80
- 'ge####manfamous.net':80
- 'ex#####ncecentury.net':80
- 'fr####entury.net':80
- 'fi####ondition.net':80
- 'fr###famous.net':80
- 'ex####encepower.net':80
- 'fr###power.net':80
- 'ex#####ncefamous.net':80
- 'fo####country.net':80
- 'me###rpower.net':80
- 'fo###wpower.net':80
- 'me####country.net':80
- 'be###famous.net':80
- 'kn####entury.net':80
- 'be####entury.net':80
- 'al####ycountry.net':80
- 'ge#####ancountry.net':80
- 'al####ypower.net':80
- 'fo####century.net':80
- 'me####famous.net':80
- 'fo####famous.net':80
- 'me####century.net':80
TCP:
Запросы HTTP GET:
- http://su###rpower.net/index.php
- http://cr###famous.net/index.php
- http://su####famous.net/index.php
- http://cr###power.net/index.php
- http://th####tcentury.net/index.php
- http://cr####ountry.net/index.php
- http://su####country.net/index.php
- http://kn###power.net/index.php
- http://be###power.net/index.php
- http://kn###famous.net/index.php
- http://be####ountry.net/index.php
- http://cr####entury.net/index.php
- http://su####century.net/index.php
- http://kn####ountry.net/index.php
- http://wo###famous.net/index.php
- http://sm####entury.net/index.php
- http://wo####entury.net/index.php
- http://sm###famous.net/index.php
- http://wo####ountry.net/index.php
- http://sm###power.net/index.php
- http://wo###power.net/index.php
- http://wa###famous.net/index.php
- http://th####tfamous.net/index.php
- http://wa####entury.net/index.php
- http://th####tpower.net/index.php
- http://wa####ountry.net/index.php
- http://th####tcountry.net/index.php
- http://wa###power.net/index.php
- http://ge#####ancentury.net/index.php
- http://ex#####ncecountry.net/index.php
- http://fr####ountry.net/index.php
- http://al####ycentury.net/index.php
- http://ge####manpower.net/index.php
- http://al####yfamous.net/index.php
- http://ge####manfamous.net/index.php
- http://ex#####ncecentury.net/index.php
- http://fr####entury.net/index.php
- http://fi####ondition.net/index.php
- http://fr###famous.net/index.php
- http://ex####encepower.net/index.php
- http://fr###power.net/index.php
- http://ex#####ncefamous.net/index.php
- http://fo####country.net/index.php
- http://me###rpower.net/index.php
- http://fo###wpower.net/index.php
- http://me####country.net/index.php
- http://be###famous.net/index.php
- http://kn####entury.net/index.php
- http://be####entury.net/index.php
- http://al####ycountry.net/index.php
- http://ge#####ancountry.net/index.php
- http://al####ypower.net/index.php
- http://fo####century.net/index.php
- http://me####famous.net/index.php
- http://fo####famous.net/index.php
- http://me####century.net/index.php
UDP:
- DNS ASK cr###power.net
- DNS ASK su###rpower.net
- DNS ASK cr###famous.net
- DNS ASK su####country.net
- DNS ASK wa####entury.net
- DNS ASK th####tcentury.net
- DNS ASK cr####ountry.net
- DNS ASK be####ountry.net
- DNS ASK kn###power.net
- DNS ASK be###power.net
- DNS ASK kn####ountry.net
- DNS ASK su####famous.net
- DNS ASK cr####entury.net
- DNS ASK su####century.net
- DNS ASK sm###famous.net
- DNS ASK wo###famous.net
- DNS ASK sm####entury.net
- DNS ASK wo###power.net
- DNS ASK sm####ountry.net
- DNS ASK wo####ountry.net
- DNS ASK sm###power.net
- DNS ASK th####tpower.net
- DNS ASK wa###famous.net
- DNS ASK th####tfamous.net
- DNS ASK wa###power.net
- DNS ASK wo####entury.net
- DNS ASK wa####ountry.net
- DNS ASK th####tcountry.net
- DNS ASK kn###famous.net
- DNS ASK ge#####ancentury.net
- DNS ASK ex#####ncecountry.net
- DNS ASK fr####ountry.net
- DNS ASK al####ycentury.net
- DNS ASK ge####manpower.net
- DNS ASK al####yfamous.net
- DNS ASK ge####manfamous.net
- DNS ASK ex#####ncecentury.net
- DNS ASK fr####entury.net
- DNS ASK fi####ondition.net
- DNS ASK fr###famous.net
- DNS ASK ex####encepower.net
- DNS ASK fr###power.net
- DNS ASK ex#####ncefamous.net
- DNS ASK fo####country.net
- DNS ASK me###rpower.net
- DNS ASK fo###wpower.net
- DNS ASK me####country.net
- DNS ASK be###famous.net
- DNS ASK kn####entury.net
- DNS ASK be####entury.net
- DNS ASK al####ycountry.net
- DNS ASK ge#####ancountry.net
- DNS ASK al####ypower.net
- DNS ASK fo####century.net
- DNS ASK me####famous.net
- DNS ASK fo####famous.net
- DNS ASK me####century.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
