Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Files Resource Transaction' = 'C:\ytutzmjba\jolymbv.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Encrypting Distributed Endpoint] 'ImagePath' = 'C:\ytutzmjba\jolymbv.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Encrypting Distributed Endpoint] 'Start' = '00000002'
Вредоносные функции:
Запускает на исполнение:
- 'C:\ytutzmjba\rfkhfgucn.exe' "c:\ytutzmjba\jolymbv.exe"
- 'C:\ytutzmjba\jolymbv.exe'
- 'C:\ytutzmjba\xsrkd2sdpnhtxkatg4u.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\ytutzmjba\jolymbv.exe
- C:\ytutzmjba\rfkhfgucn.exe
- C:\ytutzmjba\kbwbf0caudm
- %WINDIR%\ytutzmjba\qjopx9zf
- C:\ytutzmjba\qjopx9zf
- C:\ytutzmjba\xsrkd2sdpnhtxkatg4u.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\ytutzmjba\rfkhfgucn.exe
- C:\ytutzmjba\jolymbv.exe
Удаляет следующие файлы:
- C:\ytutzmjba\xsrkd2sdpnhtxkatg4u.exe
- %WINDIR%\ytutzmjba\qjopx9zf
Подменяет следующие файлы:
- %WINDIR%\ytutzmjba\qjopx9zf
Сетевая активность:
Подключается к:
- 'pr####neighbor.net':80
- 'do####neighbor.net':80
- 'pr####spread.net':80
- 'do####spread.net':80
- 'pr####square.net':80
- 'do####attempt.net':80
- 'mi###spread.net':80
- 'do####square.net':80
- 'pr####attempt.net':80
- 'br####square.net':80
- 're####attempt.net':80
- 'br####neighbor.net':80
- 're####square.net':80
- 'br####attempt.net':80
- 'fe####square.net':80
- 'fe####attempt.net':80
- 'fe####spread.net':80
- 'fe####neighbor.net':80
- 'st###spread.net':80
- 'bu####ngsquare.net':80
- 'ev####gattempt.net':80
- 'bu#####gneighbor.net':80
- 'ev####gsquare.net':80
- 'bu####ngattempt.net':80
- 'ou####eneighbor.net':80
- 'mo#####tneighbor.net':80
- 'ou####espread.net':80
- 'mo####ntspread.net':80
- 'mi###square.net':80
- 'st###square.net':80
- 'mi####eighbor.net':80
- 'st####eighbor.net':80
- 'mi####ttempt.net':80
- 'bu####ngspread.net':80
- 'ev####gneighbor.net':80
- 'st####ttempt.net':80
- 'ev####gspread.net':80
TCP:
Запросы HTTP GET:
- http://pr####neighbor.net/index.php?me########
- http://do####neighbor.net/index.php?me########
- http://pr####spread.net/index.php?me########
- http://do####spread.net/index.php?me########
- http://pr####square.net/index.php?me########
- http://do####attempt.net/index.php?me########
- http://mi###spread.net/index.php?me########
- http://do####square.net/index.php?me########
- http://pr####attempt.net/index.php?me########
- http://br####square.net/index.php?me########
- http://re####attempt.net/index.php?me########
- http://br####neighbor.net/index.php?me########
- http://re####square.net/index.php?me########
- http://br####attempt.net/index.php?me########
- http://fe####square.net/index.php?me########
- http://fe####attempt.net/index.php?me########
- http://fe####spread.net/index.php?me########
- http://fe####neighbor.net/index.php?me########
- http://st###spread.net/index.php?me########
- http://bu####ngsquare.net/index.php?me########
- http://ev####gattempt.net/index.php?me########
- http://bu#####gneighbor.net/index.php?me########
- http://ev####gsquare.net/index.php?me########
- http://bu####ngattempt.net/index.php?me########
- http://ou####eneighbor.net/index.php?me########
- http://mo#####tneighbor.net/index.php?me########
- http://ou####espread.net/index.php?me########
- http://mo####ntspread.net/index.php?me########
- http://mi###square.net/index.php?me########
- http://st###square.net/index.php?me########
- http://mi####eighbor.net/index.php?me########
- http://st####eighbor.net/index.php?me########
- http://mi####ttempt.net/index.php?me########
- http://bu####ngspread.net/index.php?me########
- http://ev####gneighbor.net/index.php?me########
- http://st####ttempt.net/index.php?me########
- http://ev####gspread.net/index.php?me########
UDP:
- DNS ASK pr####neighbor.net
- DNS ASK do####neighbor.net
- DNS ASK pr####spread.net
- DNS ASK do####spread.net
- DNS ASK pr####square.net
- DNS ASK do####attempt.net
- DNS ASK mi###spread.net
- DNS ASK do####square.net
- DNS ASK pr####attempt.net
- DNS ASK fe####attempt.net
- DNS ASK re####square.net
- DNS ASK br####square.net
- DNS ASK re####neighbor.net
- DNS ASK br####neighbor.net
- DNS ASK re####attempt.net
- DNS ASK fe####neighbor.net
- DNS ASK fe####square.net
- DNS ASK br####attempt.net
- DNS ASK fe####spread.net
- DNS ASK bu####ngsquare.net
- DNS ASK ev####gattempt.net
- DNS ASK bu#####gneighbor.net
- DNS ASK ev####gsquare.net
- DNS ASK bu####ngattempt.net
- DNS ASK ou####eneighbor.net
- DNS ASK mo#####tneighbor.net
- DNS ASK ou####espread.net
- DNS ASK mo####ntspread.net
- DNS ASK ev####gneighbor.net
- DNS ASK st####eighbor.net
- DNS ASK mi###square.net
- DNS ASK st###spread.net
- DNS ASK mi####eighbor.net
- DNS ASK st###square.net
- DNS ASK ev####gspread.net
- DNS ASK bu####ngspread.net
- DNS ASK mi####ttempt.net
- DNS ASK st####ttempt.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
