Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Visual Topology Play Intelligent Browser CNG Name' = 'C:\mqfbofamsaikdy\zzynawscpjwd.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Resolution Acquisition Logs Ordering] 'ImagePath' = 'C:\mqfbofamsaikdy\zzynawscpjwd.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Resolution Acquisition Logs Ordering] 'Start' = '00000002'
Вредоносные функции:
Запускает на исполнение:
- 'C:\mqfbofamsaikdy\iqvduvtlpjdi.exe' "c:\mqfbofamsaikdy\zzynawscpjwd.exe"
- 'C:\mqfbofamsaikdy\zzynawscpjwd.exe'
- 'C:\mqfbofamsaikdy\g4fw2i2muyfnmpky3b.exe'
- '%WINDIR%\XXInstall\ps.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\mqfbofamsaikdy\zzynawscpjwd.exe
- C:\mqfbofamsaikdy\iqvduvtlpjdi.exe
- C:\mqfbofamsaikdy\mnxjgwp1
- %WINDIR%\mqfbofamsaikdy\mefuhak
- C:\mqfbofamsaikdy\mefuhak
- C:\mqfbofamsaikdy\g4fw2i2muyfnmpky3b.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\mqfbofamsaikdy\iqvduvtlpjdi.exe
- C:\mqfbofamsaikdy\zzynawscpjwd.exe
Удаляет следующие файлы:
- C:\mqfbofamsaikdy\g4fw2i2muyfnmpky3b.exe
- %WINDIR%\mqfbofamsaikdy\mefuhak
Подменяет следующие файлы:
- %WINDIR%\mqfbofamsaikdy\mefuhak
Сетевая активность:
Подключается к:
- 'ei####promise.net':80
- 'en####hopinion.net':80
- 'ei####opinion.net':80
- 'en####hpromise.net':80
- 'ex####distance.net':80
- 'be####esupply.net':80
- 'ex####supply.net':80
- 'fa####promise.net':80
- 'ch####enpromise.net':80
- 'fa####opinion.net':80
- 'ei####should.net':80
- 'en####hshort.net':80
- 'ei###rshort.net':80
- 'en####hshould.net':80
- 'be####edistance.net':80
- 'ma####eoffice.net':80
- 'pe####office.net':80
- 'ma####edistance.net':80
- 'pe####arrive.net':80
- 'fo####nsupply.net':80
- 'su####supply.net':80
- 'ma####earrive.net':80
- 'ex####arrive.net':80
- 'be####eoffice.net':80
- 'ex####office.net':80
- 'be####earrive.net':80
- 'pe####distance.net':80
- 'ma####esupply.net':80
- 'pe####supply.net':80
- 'ch####enopinion.net':80
- 'fi####should.net':80
- 'ri####romise.net':80
- 'wh####rpromise.net':80
- 'th####should.net':80
- 'fi####opinion.net':80
- 'th###hshort.net':80
- 'fi###eshort.net':80
- 'ri###should.net':80
- 'fo####npromise.net':80
- 'su####promise.net':80
- 'wh####rshort.net':80
- 'ri####pinion.net':80
- 'wh####ropinion.net':80
- 'ri###short.net':80
- 'th####opinion.net':80
- 'ci#####tepromise.net':80
- 'pi####epromise.net':80
- 'ci#####teopinion.net':80
- 'ch####enshould.net':80
- 'fa###yshort.net':80
- 'ch####enshort.net':80
- 'fa####should.net':80
- 'pi####eshould.net':80
- 'th####promise.net':80
- 'fi####promise.net':80
- 'ci####tteshould.net':80
- 'pi####eopinion.net':80
- 'ci####tteshort.net':80
- 'pi####eshort.net':80
TCP:
Запросы HTTP GET:
- http://ei####promise.net/index.php
- http://en####hopinion.net/index.php
- http://ei####opinion.net/index.php
- http://en####hpromise.net/index.php
- http://ex####distance.net/index.php
- http://be####esupply.net/index.php
- http://ex####supply.net/index.php
- http://fa####promise.net/index.php
- http://ch####enpromise.net/index.php
- http://fa####opinion.net/index.php
- http://ei####should.net/index.php
- http://en####hshort.net/index.php
- http://ei###rshort.net/index.php
- http://en####hshould.net/index.php
- http://be####edistance.net/index.php
- http://ma####eoffice.net/index.php
- http://pe####office.net/index.php
- http://ma####edistance.net/index.php
- http://pe####arrive.net/index.php
- http://fo####nsupply.net/index.php
- http://su####supply.net/index.php
- http://ma####earrive.net/index.php
- http://ex####arrive.net/index.php
- http://be####eoffice.net/index.php
- http://ex####office.net/index.php
- http://be####earrive.net/index.php
- http://pe####distance.net/index.php
- http://ma####esupply.net/index.php
- http://pe####supply.net/index.php
- http://ch####enopinion.net/index.php
- http://fi####should.net/index.php
- http://ri####romise.net/index.php
- http://wh####rpromise.net/index.php
- http://th####should.net/index.php
- http://fi####opinion.net/index.php
- http://th###hshort.net/index.php
- http://fi###eshort.net/index.php
- http://ri###should.net/index.php
- http://fo####npromise.net/index.php
- http://su####promise.net/index.php
- http://wh####rshort.net/index.php
- http://ri####pinion.net/index.php
- http://wh####ropinion.net/index.php
- http://ri###short.net/index.php
- http://th####opinion.net/index.php
- http://ci#####tepromise.net/index.php
- http://pi####epromise.net/index.php
- http://ci#####teopinion.net/index.php
- http://ch####enshould.net/index.php
- http://fa###yshort.net/index.php
- http://ch####enshort.net/index.php
- http://fa####should.net/index.php
- http://pi####eshould.net/index.php
- http://th####promise.net/index.php
- http://fi####promise.net/index.php
- http://ci####tteshould.net/index.php
- http://pi####eopinion.net/index.php
- http://ci####tteshort.net/index.php
- http://pi####eshort.net/index.php
UDP:
- DNS ASK en####hpromise.net
- DNS ASK ei####promise.net
- DNS ASK en####hopinion.net
- DNS ASK ex####supply.net
- DNS ASK be####edistance.net
- DNS ASK ex####distance.net
- DNS ASK be####esupply.net
- DNS ASK ei####opinion.net
- DNS ASK fa####promise.net
- DNS ASK ch####enpromise.net
- DNS ASK fa####opinion.net
- DNS ASK ei####should.net
- DNS ASK en####hshort.net
- DNS ASK ei###rshort.net
- DNS ASK en####hshould.net
- DNS ASK pe####arrive.net
- DNS ASK ma####eoffice.net
- DNS ASK pe####office.net
- DNS ASK ma####earrive.net
- DNS ASK su####distance.net
- DNS ASK fo####nsupply.net
- DNS ASK su####supply.net
- DNS ASK ma####edistance.net
- DNS ASK ex####arrive.net
- DNS ASK be####eoffice.net
- DNS ASK ex####office.net
- DNS ASK be####earrive.net
- DNS ASK pe####distance.net
- DNS ASK ma####esupply.net
- DNS ASK pe####supply.net
- DNS ASK ch####enopinion.net
- DNS ASK fi####should.net
- DNS ASK ri####romise.net
- DNS ASK wh####rpromise.net
- DNS ASK th####should.net
- DNS ASK fi####opinion.net
- DNS ASK th###hshort.net
- DNS ASK fi###eshort.net
- DNS ASK ri####pinion.net
- DNS ASK wh####rshould.net
- DNS ASK fo####npromise.net
- DNS ASK su####promise.net
- DNS ASK ri###should.net
- DNS ASK wh####ropinion.net
- DNS ASK ri###short.net
- DNS ASK wh####rshort.net
- DNS ASK ci#####tepromise.net
- DNS ASK pi####epromise.net
- DNS ASK ci#####teopinion.net
- DNS ASK ch####enshould.net
- DNS ASK fa###yshort.net
- DNS ASK ch####enshort.net
- DNS ASK fa####should.net
- DNS ASK pi####eopinion.net
- DNS ASK th####promise.net
- DNS ASK fi####promise.net
- DNS ASK th####opinion.net
- DNS ASK pi####eshould.net
- DNS ASK ci####tteshort.net
- DNS ASK pi####eshort.net
- DNS ASK ci####tteshould.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
