Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Key Counter IKE Net.Tcp Center Session' = 'C:\parihybgsu\oqkezko.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Application Program Encryption Access] 'ImagePath' = 'C:\parihybgsu\oqkezko.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Application Program Encryption Access] 'Start' = '00000002'
Вредоносные функции:
Запускает на исполнение:
- 'C:\parihybgsu\ipuknxua.exe' "c:\parihybgsu\oqkezko.exe"
- 'C:\parihybgsu\oqkezko.exe'
- 'C:\parihybgsu\tibi2f9hdhdkbevcoe1q.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\parihybgsu\oqkezko.exe
- C:\parihybgsu\ipuknxua.exe
- C:\parihybgsu\tibi2f9hdhdkbevcoe1q.exe
- %WINDIR%\parihybgsu\tiwiqxb7pnp
- C:\parihybgsu\tiwiqxb7pnp
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\parihybgsu\ipuknxua.exe
- C:\parihybgsu\oqkezko.exe
Удаляет следующие файлы:
- C:\parihybgsu\tibi2f9hdhdkbevcoe1q.exe
- %WINDIR%\parihybgsu\tiwiqxb7pnp
Подменяет следующие файлы:
- %WINDIR%\parihybgsu\tiwiqxb7pnp
Сетевая активность:
Подключается к:
- 're####thrown.net':80
- 'br####thrown.net':80
- 'pr####ehunger.net':80
- 'pr####etraining.net':80
- 'de####hunger.net':80
- 'br####training.net':80
- 're####hunger.net':80
- 're####training.net':80
- 're###tstorm.net':80
- 'br###nstorm.net':80
- 'st###hunger.net':80
- 'st####thhunger.net':80
- 'st#####htraining.net':80
- 'st####ththrown.net':80
- 'st####thstorm.net':80
- 'pr####estorm.net':80
- 'de####training.net':80
- 'de###estorm.net':80
- 'de####thrown.net':80
- 'pr####ethrown.net':80
- 'br####hunger.net':80
- 'mi###thrown.net':80
- 'st###thrown.net':80
- 'do####hunger.net':80
- 'do####training.net':80
- 'pr####hunger.net':80
- 'st####raining.net':80
- 'mi###hunger.net':80
- 'mi####raining.net':80
- 'mi###storm.net':80
- 'st###storm.net':80
- 'fe####training.net':80
- 'fe####hunger.net':80
- 'fe###wstorm.net':80
- 'fe####thrown.net':80
- 'do###estorm.net':80
- 'do###rstorm.net':80
- 'pr####training.net':80
- 'pr###ystorm.net':80
- 'pr####thrown.net':80
- 'do####thrown.net':80
TCP:
Запросы HTTP GET:
- http://re####thrown.net/index.php
- http://br####thrown.net/index.php
- http://pr####ehunger.net/index.php
- http://pr####etraining.net/index.php
- http://de####hunger.net/index.php
- http://br####training.net/index.php
- http://re####hunger.net/index.php
- http://re####training.net/index.php
- http://re###tstorm.net/index.php
- http://br###nstorm.net/index.php
- http://st###hunger.net/index.php
- http://st####thhunger.net/index.php
- http://st#####htraining.net/index.php
- http://st####ththrown.net/index.php
- http://st####thstorm.net/index.php
- http://pr####estorm.net/index.php
- http://de####training.net/index.php
- http://de###estorm.net/index.php
- http://de####thrown.net/index.php
- http://pr####ethrown.net/index.php
- http://br####hunger.net/index.php
- http://mi###thrown.net/index.php
- http://st###thrown.net/index.php
- http://do####hunger.net/index.php
- http://do####training.net/index.php
- http://pr####hunger.net/index.php
- http://st####raining.net/index.php
- http://mi###hunger.net/index.php
- http://mi####raining.net/index.php
- http://mi###storm.net/index.php
- http://st###storm.net/index.php
- http://fe####training.net/index.php
- http://fe####hunger.net/index.php
- http://fe###wstorm.net/index.php
- http://fe####thrown.net/index.php
- http://do###estorm.net/index.php
- http://do###rstorm.net/index.php
- http://pr####training.net/index.php
- http://pr###ystorm.net/index.php
- http://pr####thrown.net/index.php
- http://do####thrown.net/index.php
UDP:
- DNS ASK re####thrown.net
- DNS ASK br####thrown.net
- DNS ASK pr####ehunger.net
- DNS ASK pr####etraining.net
- DNS ASK de####hunger.net
- DNS ASK br####training.net
- DNS ASK re####hunger.net
- DNS ASK re####training.net
- DNS ASK re###tstorm.net
- DNS ASK br###nstorm.net
- DNS ASK st###hunger.net
- DNS ASK st####thhunger.net
- DNS ASK st#####htraining.net
- DNS ASK st####ththrown.net
- DNS ASK st####thstorm.net
- DNS ASK pr####estorm.net
- DNS ASK de####training.net
- DNS ASK de###estorm.net
- DNS ASK de####thrown.net
- DNS ASK pr####ethrown.net
- DNS ASK br####hunger.net
- DNS ASK mi###thrown.net
- DNS ASK st###thrown.net
- DNS ASK do####hunger.net
- DNS ASK do####training.net
- DNS ASK pr####hunger.net
- DNS ASK st####raining.net
- DNS ASK mi###hunger.net
- DNS ASK mi####raining.net
- DNS ASK mi###storm.net
- DNS ASK st###storm.net
- DNS ASK fe####training.net
- DNS ASK fe####hunger.net
- DNS ASK fe###wstorm.net
- DNS ASK fe####thrown.net
- DNS ASK do###estorm.net
- DNS ASK do###rstorm.net
- DNS ASK pr####training.net
- DNS ASK pr###ystorm.net
- DNS ASK pr####thrown.net
- DNS ASK do####thrown.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
