Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Backup Adaptive Visual Discovery' = 'C:\tpvvlnufljbwbn\eaghuwmt.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\TPM Offline Problem Endpoint BranchCache] 'ImagePath' = 'C:\tpvvlnufljbwbn\eaghuwmt.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\TPM Offline Problem Endpoint BranchCache] 'Start' = '00000002'
Вредоносные функции:
Запускает на исполнение:
- 'C:\tpvvlnufljbwbn\eshqkjqto.exe' "c:\tpvvlnufljbwbn\eaghuwmt.exe"
- 'C:\tpvvlnufljbwbn\eaghuwmt.exe'
- 'C:\tpvvlnufljbwbn\mxxw3bjdsedthajqqfd.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\tpvvlnufljbwbn\eaghuwmt.exe
- C:\tpvvlnufljbwbn\eshqkjqto.exe
- C:\tpvvlnufljbwbn\mxxw3bjdsedthajqqfd.exe
- %WINDIR%\tpvvlnufljbwbn\sl7ydd5
- C:\tpvvlnufljbwbn\sl7ydd5
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\tpvvlnufljbwbn\eshqkjqto.exe
- C:\tpvvlnufljbwbn\eaghuwmt.exe
Удаляет следующие файлы:
- C:\tpvvlnufljbwbn\mxxw3bjdsedthajqqfd.exe
- %WINDIR%\tpvvlnufljbwbn\sl7ydd5
Подменяет следующие файлы:
- %WINDIR%\tpvvlnufljbwbn\sl7ydd5
Сетевая активность:
Подключается к:
- 'ma####alspring.net':80
- 'se####lspring.net':80
- 'se####lsuccess.net':80
- 'se####lbanker.net':80
- 'ma####alsuccess.net':80
- 'ma####alfound.net':80
- 'pr####lysuccess.net':80
- 'sw####uccess.net':80
- 'sw###banker.net':80
- 'se####lfound.net':80
- 'pr####lybanker.net':80
- 'ma####albanker.net':80
- 'la###fence.net':80
- 'se###afence.net':80
- 'si####airplane.net':80
- 'si####straight.net':80
- 'mo####airplane.net':80
- 'la###guard.net':80
- 'la####irplane.net':80
- 'se####airplane.net':80
- 'se####straight.net':80
- 'se###aguard.net':80
- 'la####traight.net':80
- 'su####tfound.net':80
- 'wi###rfound.net':80
- 'su####tspring.net':80
- 'su####tbanker.net':80
- 'su####tsuccess.net':80
- 'wi####banker.net':80
- 'wi####spring.net':80
- 'pe####sspring.net':80
- 'pe####ssuccess.net':80
- 'pe####sbanker.net':80
- 'wi####success.net':80
- 'fi###hfound.net':80
- 'sw###found.net':80
- 'le###banker.net':80
- 'pr####lyfound.net':80
- 'pr####lyspring.net':80
- 'sw###spring.net':80
- 'fi####banker.net':80
- 'fi####spring.net':80
- 'le###found.net':80
- 'le###spring.net':80
- 'le####uccess.net':80
- 'fi####success.net':80
TCP:
Запросы HTTP GET:
- http://ma####alspring.net/index.php
- http://se####lspring.net/index.php
- http://se####lsuccess.net/index.php
- http://se####lbanker.net/index.php
- http://ma####alsuccess.net/index.php
- http://ma####alfound.net/index.php
- http://pr####lysuccess.net/index.php
- http://sw####uccess.net/index.php
- http://sw###banker.net/index.php
- http://se####lfound.net/index.php
- http://pr####lybanker.net/index.php
- http://ma####albanker.net/index.php
- http://la###fence.net/index.php
- http://se###afence.net/index.php
- http://si####airplane.net/index.php
- http://si####straight.net/index.php
- http://mo####airplane.net/index.php
- http://la###guard.net/index.php
- http://la####irplane.net/index.php
- http://se####airplane.net/index.php
- http://se####straight.net/index.php
- http://se###aguard.net/index.php
- http://la####traight.net/index.php
- http://su####tfound.net/index.php
- http://wi###rfound.net/index.php
- http://su####tspring.net/index.php
- http://su####tbanker.net/index.php
- http://su####tsuccess.net/index.php
- http://wi####banker.net/index.php
- http://wi####spring.net/index.php
- http://pe####sspring.net/index.php
- http://pe####ssuccess.net/index.php
- http://pe####sbanker.net/index.php
- http://wi####success.net/index.php
- http://fi###hfound.net/index.php
- http://sw###found.net/index.php
- http://le###banker.net/index.php
- http://pr####lyfound.net/index.php
- http://pr####lyspring.net/index.php
- http://sw###spring.net/index.php
- http://fi####banker.net/index.php
- http://fi####spring.net/index.php
- http://le###found.net/index.php
- http://le###spring.net/index.php
- http://le####uccess.net/index.php
- http://fi####success.net/index.php
UDP:
- DNS ASK se####lsuccess.net
- DNS ASK ma####alspring.net
- DNS ASK ma####alsuccess.net
- DNS ASK ma####albanker.net
- DNS ASK se####lbanker.net
- DNS ASK se####lspring.net
- DNS ASK sw###banker.net
- DNS ASK pr####lysuccess.net
- DNS ASK pr####lybanker.net
- DNS ASK ma####alfound.net
- DNS ASK se####lfound.net
- DNS ASK se####airplane.net
- DNS ASK si####airplane.net
- DNS ASK la###fence.net
- DNS ASK mo####airplane.net
- DNS ASK mo####straight.net
- DNS ASK si####straight.net
- DNS ASK se###afence.net
- DNS ASK se####straight.net
- DNS ASK la####irplane.net
- DNS ASK la####traight.net
- DNS ASK la###guard.net
- DNS ASK se###aguard.net
- DNS ASK sw####uccess.net
- DNS ASK su####tfound.net
- DNS ASK wi###rfound.net
- DNS ASK su####tspring.net
- DNS ASK su####tbanker.net
- DNS ASK su####tsuccess.net
- DNS ASK wi####banker.net
- DNS ASK wi####spring.net
- DNS ASK pe####sspring.net
- DNS ASK pe####ssuccess.net
- DNS ASK pe####sbanker.net
- DNS ASK wi####success.net
- DNS ASK fi###hfound.net
- DNS ASK sw###found.net
- DNS ASK le###banker.net
- DNS ASK pr####lyfound.net
- DNS ASK pr####lyspring.net
- DNS ASK sw###spring.net
- DNS ASK fi####banker.net
- DNS ASK fi####spring.net
- DNS ASK le###found.net
- DNS ASK le###spring.net
- DNS ASK le####uccess.net
- DNS ASK fi####success.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
