Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Awareness Counter Publication' = 'C:\htnegejhvev\ogvmoskpcdi.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\UserMode Collector Configuration Driver] 'ImagePath' = 'C:\htnegejhvev\ogvmoskpcdi.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\UserMode Collector Configuration Driver] 'Start' = '00000002'
Вредоносные функции:
Запускает на исполнение:
- 'C:\htnegejhvev\desyjpoq.exe' "c:\htnegejhvev\ogvmoskpcdi.exe"
- 'C:\htnegejhvev\ogvmoskpcdi.exe'
- 'C:\htnegejhvev\ikec2qtqoskevctwkf.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\htnegejhvev\ogvmoskpcdi.exe
- C:\htnegejhvev\desyjpoq.exe
- C:\htnegejhvev\p1wueda
- %WINDIR%\htnegejhvev\kjmq8zfukeik
- C:\htnegejhvev\kjmq8zfukeik
- C:\htnegejhvev\ikec2qtqoskevctwkf.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\htnegejhvev\desyjpoq.exe
- C:\htnegejhvev\ogvmoskpcdi.exe
Удаляет следующие файлы:
- C:\htnegejhvev\ikec2qtqoskevctwkf.exe
- %WINDIR%\htnegejhvev\kjmq8zfukeik
Подменяет следующие файлы:
- %WINDIR%\htnegejhvev\kjmq8zfukeik
Сетевая активность:
Подключается к:
- 'wi###wheart.net':80
- 'pe####sheart.net':80
- 'wi####perfect.net':80
- 'pe####sperfect.net':80
- 'po####lebattle.net':80
- 'mo####inmayor.net':80
- 'po####leperfect.net':80
- 'mo####inbattle.net':80
- 'po####lemayor.net':80
- 'pe####smayor.net':80
- 'wi###rmayor.net':80
- 'su####tperfect.net':80
- 'su####tbattle.net':80
- 'su####tmayor.net':80
- 'su####theart.net':80
- 'pe####sbattle.net':80
- 'wi###wmayor.net':80
- 'wi###rheart.net':80
- 'wi####battle.net':80
- 'se####battle.net':80
- 'la###mayor.net':80
- 'si###eheart.net':80
- 'la###battle.net':80
- 'se###amayor.net':80
- 'la###heart.net':80
- 'se###aheart.net':80
- 'la####erfect.net':80
- 'se####perfect.net':80
- 'mo###rheart.net':80
- 'mo####inheart.net':80
- 'mo####battle.net':80
- 'mo####inperfect.net':80
- 'po####leheart.net':80
- 'si####battle.net':80
- 'mo####perfect.net':80
- 'si####perfect.net':80
- 'mo###rmayor.net':80
- 'si###emayor.net':80
TCP:
Запросы HTTP GET:
- http://wi###wheart.net/index.php
- http://pe####sheart.net/index.php
- http://wi####perfect.net/index.php
- http://pe####sperfect.net/index.php
- http://po####lebattle.net/index.php
- http://mo####inmayor.net/index.php
- http://po####leperfect.net/index.php
- http://mo####inbattle.net/index.php
- http://po####lemayor.net/index.php
- http://pe####smayor.net/index.php
- http://wi###rmayor.net/index.php
- http://su####tperfect.net/index.php
- http://su####tbattle.net/index.php
- http://su####tmayor.net/index.php
- http://su####theart.net/index.php
- http://pe####sbattle.net/index.php
- http://wi###wmayor.net/index.php
- http://wi###rheart.net/index.php
- http://wi####battle.net/index.php
- http://se####battle.net/index.php
- http://la###mayor.net/index.php
- http://si###eheart.net/index.php
- http://la###battle.net/index.php
- http://se###amayor.net/index.php
- http://la###heart.net/index.php
- http://se###aheart.net/index.php
- http://la####erfect.net/index.php
- http://se####perfect.net/index.php
- http://mo###rheart.net/index.php
- http://mo####inheart.net/index.php
- http://mo####battle.net/index.php
- http://mo####inperfect.net/index.php
- http://po####leheart.net/index.php
- http://si####battle.net/index.php
- http://mo####perfect.net/index.php
- http://si####perfect.net/index.php
- http://mo###rmayor.net/index.php
- http://si###emayor.net/index.php
UDP:
- DNS ASK pe####sperfect.net
- DNS ASK wi###wheart.net
- DNS ASK pe####smayor.net
- DNS ASK wi####perfect.net
- DNS ASK pe####sheart.net
- DNS ASK po####lemayor.net
- DNS ASK mo####inmayor.net
- DNS ASK po####lebattle.net
- DNS ASK mo####inbattle.net
- DNS ASK wi###wmayor.net
- DNS ASK su####tmayor.net
- DNS ASK wi###rmayor.net
- DNS ASK fi###hheart.net
- DNS ASK su####tbattle.net
- DNS ASK su####tperfect.net
- DNS ASK wi####battle.net
- DNS ASK pe####sbattle.net
- DNS ASK su####theart.net
- DNS ASK wi###rheart.net
- DNS ASK po####leperfect.net
- DNS ASK se####battle.net
- DNS ASK la###mayor.net
- DNS ASK si###eheart.net
- DNS ASK la###battle.net
- DNS ASK se###amayor.net
- DNS ASK la###heart.net
- DNS ASK se###aheart.net
- DNS ASK la####erfect.net
- DNS ASK se####perfect.net
- DNS ASK mo###rheart.net
- DNS ASK mo####inheart.net
- DNS ASK mo####battle.net
- DNS ASK mo####inperfect.net
- DNS ASK po####leheart.net
- DNS ASK si####battle.net
- DNS ASK mo####perfect.net
- DNS ASK si####perfect.net
- DNS ASK mo###rmayor.net
- DNS ASK si###emayor.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
