Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Driver Identity Image Certificate Base Machine' = 'C:\vgipudeyyhl\xasiabmdedrz.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Transaction Propagation Performance VC] 'ImagePath' = 'C:\vgipudeyyhl\xasiabmdedrz.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Transaction Propagation Performance VC] 'Start' = '00000002'
Вредоносные функции:
Запускает на исполнение:
- 'C:\vgipudeyyhl\tyrtxjre.exe' "c:\vgipudeyyhl\xasiabmdedrz.exe"
- 'C:\vgipudeyyhl\xasiabmdedrz.exe'
- 'C:\vgipudeyyhl\ax32bsbousmt7fl9.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\vgipudeyyhl\xasiabmdedrz.exe
- C:\vgipudeyyhl\tyrtxjre.exe
- C:\vgipudeyyhl\xqkbttcqbblo
- %WINDIR%\vgipudeyyhl\gfchcnunl
- C:\vgipudeyyhl\gfchcnunl
- C:\vgipudeyyhl\ax32bsbousmt7fl9.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\vgipudeyyhl\tyrtxjre.exe
- C:\vgipudeyyhl\xasiabmdedrz.exe
Удаляет следующие файлы:
- C:\vgipudeyyhl\ax32bsbousmt7fl9.exe
- %WINDIR%\vgipudeyyhl\gfchcnunl
Подменяет следующие файлы:
- %WINDIR%\vgipudeyyhl\gfchcnunl
Сетевая активность:
Подключается к:
- 'pe####spread.net':80
- 'ma####eneighbor.net':80
- 'su####attempt.net':80
- 'ma####espread.net':80
- 'pe####neighbor.net':80
- 'ma####eattempt.net':80
- 'pe####attempt.net':80
- 'ma####esquare.net':80
- 'pe####square.net':80
- 'fo####nspread.net':80
- 'su####spread.net':80
- 'ri####ttempt.net':80
- 'wh####rattempt.net':80
- 'fo####nneighbor.net':80
- 'su####square.net':80
- 'fo####nattempt.net':80
- 'su####neighbor.net':80
- 'fo####nsquare.net':80
- 'be####espread.net':80
- 'en####hposition.net':80
- 'ei####position.net':80
- 'en####hstrike.net':80
- 'ei####strike.net':80
- 'en####hnumber.net':80
- 'ch####enpartial.net':80
- 'ch####enstrike.net':80
- 'ei####number.net':80
- 'fa####partial.net':80
- 'ex####neighbor.net':80
- 'be####esquare.net':80
- 'ex####spread.net':80
- 'be####eneighbor.net':80
- 'ex####square.net':80
- 'en####hpartial.net':80
- 'ei####partial.net':80
- 'be####eattempt.net':80
- 'ex####attempt.net':80
TCP:
Запросы HTTP GET:
- http://pe####spread.net/index.php
- http://ma####eneighbor.net/index.php
- http://su####attempt.net/index.php
- http://ma####espread.net/index.php
- http://pe####neighbor.net/index.php
- http://ma####eattempt.net/index.php
- http://pe####attempt.net/index.php
- http://ma####esquare.net/index.php
- http://pe####square.net/index.php
- http://fo####nspread.net/index.php
- http://su####spread.net/index.php
- http://ri####ttempt.net/index.php
- http://wh####rattempt.net/index.php
- http://fo####nneighbor.net/index.php
- http://su####square.net/index.php
- http://fo####nattempt.net/index.php
- http://su####neighbor.net/index.php
- http://fo####nsquare.net/index.php
- http://be####espread.net/index.php
- http://en####hposition.net/index.php
- http://ei####position.net/index.php
- http://en####hstrike.net/index.php
- http://ei####strike.net/index.php
- http://en####hnumber.net/index.php
- http://ch####enpartial.net/index.php
- http://ch####enstrike.net/index.php
- http://ei####number.net/index.php
- http://fa####partial.net/index.php
- http://ex####neighbor.net/index.php
- http://be####esquare.net/index.php
- http://ex####spread.net/index.php
- http://be####eneighbor.net/index.php
- http://ex####square.net/index.php
- http://en####hpartial.net/index.php
- http://ei####partial.net/index.php
- http://be####eattempt.net/index.php
- http://ex####attempt.net/index.php
UDP:
- DNS ASK pe####spread.net
- DNS ASK ma####eneighbor.net
- DNS ASK su####attempt.net
- DNS ASK ma####espread.net
- DNS ASK pe####neighbor.net
- DNS ASK ma####eattempt.net
- DNS ASK pe####attempt.net
- DNS ASK ma####esquare.net
- DNS ASK pe####square.net
- DNS ASK fo####nattempt.net
- DNS ASK wh####rattempt.net
- DNS ASK fo####nspread.net
- DNS ASK wh####rsquare.net
- DNS ASK ri####ttempt.net
- DNS ASK su####spread.net
- DNS ASK fo####nsquare.net
- DNS ASK su####square.net
- DNS ASK fo####nneighbor.net
- DNS ASK su####neighbor.net
- DNS ASK be####espread.net
- DNS ASK ei####position.net
- DNS ASK en####hnumber.net
- DNS ASK ei####strike.net
- DNS ASK en####hposition.net
- DNS ASK ei####number.net
- DNS ASK fa####strike.net
- DNS ASK ch####enstrike.net
- DNS ASK fa####partial.net
- DNS ASK ch####enpartial.net
- DNS ASK en####hstrike.net
- DNS ASK ex####neighbor.net
- DNS ASK be####esquare.net
- DNS ASK ex####spread.net
- DNS ASK be####eneighbor.net
- DNS ASK ex####square.net
- DNS ASK en####hpartial.net
- DNS ASK ei####partial.net
- DNS ASK be####eattempt.net
- DNS ASK ex####attempt.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
