Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '396571093' = '<LS_APPDATA>\jiu.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'ctfmon.exe' = '<SYSTEM32>\ctfmon.exe'
Вредоносные функции:
Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] 'EnableFirewall' = '00000000'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] 'DoNotAllowExceptions' = '00000000'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] 'DisableNotifications' = '00000001'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'DoNotAllowExceptions' = '00000000'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'DisableNotifications' = '00000001'
Для затруднения выявления своего присутствия в системе
блокирует запуск следующих системных утилит:
- Обновления системы (Windows Update)
блокирует:
- Центр обеспечения безопасности (Security Center)
Запускает на исполнение:
- '<LS_APPDATA>\jiu.exe' -gav <Полный путь к файлу>
Ищет ветки реестра, отвечающие за хранение паролей сторонними программами:
- [<HKCU>\Software\VanDyke\SecureFX]
- [<HKCU>\Software\FTPWare\COREFTP\Sites]
- [<HKCU>\Software\Cryer\WebSitePublisher]
- [<HKLM>\Software\NCH Software\ClassicFTP\FTPAccounts]
- [<HKCU>\Software\ExpanDrive\Sessions]
- [<HKCU>\Software\CoffeeCup Software\Internet\Profiles]
- [<HKCU>\Software\BPFTP]
- [<HKCU>\Software\BulletProof Software\BulletProof FTP Client\Options]
- [<HKCU>\Software\TurboFTP]
- [<HKCU>\Software\Sota\FFFTP\Options]
- [<HKCU>\Software\Sota\FFFTP]
- [<HKCU>\Software\NCH Software\ClassicFTP\FTPAccounts]
- [<HKLM>\Software\Martin Prikryl]
- [<HKCU>\Software\Martin Prikryl]
- [<HKCU>\Software\South River Technologies\WebDrive\Connections]
- [<HKCU>\Software\Microsoft\Internet Explorer\IntelliForms\Storage2]
- [<HKLM>\Software\South River Technologies\WebDrive\Connections]
- [<HKLM>\Software\SoftX.org\FTPClient\Sites]
- [<HKLM>\SOFTWARE\NCH Software\Fling\Accounts]
- [<HKCU>\SOFTWARE\NCH Software\Fling\Accounts]
- [<HKCU>\Software\FTPClient\Sites]
- [<HKCU>\Software\SoftX.org\FTPClient\Sites]
- [<HKLM>\Software\FTPClient\Sites]
- [<HKCU>\Software\GlobalSCAPE\CuteFTP 6 Professional\QCToolbar]
- [<HKCU>\Software\GlobalSCAPE\CuteFTP 6 Home\QCToolbar]
- [<HKCU>\Software\GlobalSCAPE\CuteFTP 7 Home\QCToolbar]
- [<HKCU>\Software\GlobalSCAPE\CuteFTP 8 Home\QCToolbar]
- [<HKCU>\Software\GlobalSCAPE\CuteFTP 7 Professional\QCToolbar]
- [<HKLM>\Software\Ghisler\Total Commander]
- [<HKCU>\Software\Far2\SavedDialogHistory\FTPHost]
- [<HKCU>\Software\Far\SavedDialogHistory\FTPHost]
- [<HKCU>\Software\Ghisler\Windows Commander]
- [<HKLM>\Software\Ghisler\Windows Commander]
- [<HKCU>\Software\Ghisler\Total Commander]
- [<HKCU>\Software\GlobalSCAPE\CuteFTP 8 Professional\QCToolbar]
- [<HKLM>\Software\FileZilla Client]
- [<HKLM>\Software\FileZilla]
- [<HKCU>\Software\BPFTP\Bullet Proof FTP\Main]
- [<HKCU>\Software\BPFTP\Bullet Proof FTP\Options]
- [<HKCU>\Software\BulletProof Software\BulletProof FTP Client\Main]
- [<HKCU>\Software\FileZilla Client]
- [<HKCU>\Software\FlashFXP]
- [<HKCU>\Software\FlashFXP\3]
- [<HKLM>\Software\FlashFXP\3]
- [<HKCU>\Software\FileZilla]
- [<HKLM>\Software\FlashFXP]
Изменения в файловой системе:
Создает следующие файлы:
- <LS_APPDATA>\avuk.exe
- %HOMEPATH%\Templates\xapi.exe
- %ALLUSERSPROFILE%\Application Data\nlsj.exe
- %TEMP%\iilD.tmp
- %TEMP%\iilC.tmp
- %ALLUSERSPROFILE%\Application Data\owyu.exe
- %TEMP%\iilA.tmp
- %TEMP%\nmts.exe
- %TEMP%\iilB.tmp
- %ALLUSERSPROFILE%\Application Data\5py486o12u2s7
- <LS_APPDATA>\5py486o12u2s7
- %HOMEPATH%\Templates\5py486o12u2s7
- %TEMP%\5py486o12u2s7
- %TEMP%\iil10.tmp
- %TEMP%\iilE.tmp
- %TEMP%\qocs.exe
- %TEMP%\iilF.tmp
- %HOMEPATH%\Templates\thmd.exe
- <LS_APPDATA>\oyqv.exe
- %TEMP%\iil7.tmp
- %TEMP%\iil6.tmp
- <LS_APPDATA>\jiu.exe
- %TEMP%\iil8.tmp
- %TEMP%\iil5.tmp
- %TEMP%\iil2.tmp
- %TEMP%\iil1.tmp
- %TEMP%\iil4.tmp
- %TEMP%\iil3.tmp
- %TEMP%\poxb.exe
- %ALLUSERSPROFILE%\Application Data\jxyh.exe
- %HOMEPATH%\Templates\jasa.exe
- %TEMP%\iil9.tmp
- <LS_APPDATA>\rrsf.exe
- %ALLUSERSPROFILE%\Application Data\beos.exe
- <LS_APPDATA>\xqnj.exe
- %HOMEPATH%\Templates\cuod.exe
- %TEMP%\cmsi.exe
Удаляет следующие файлы:
- %TEMP%\iilB.tmp
- %TEMP%\iilC.tmp
- %TEMP%\iil9.tmp
- %TEMP%\iilA.tmp
- %TEMP%\iilF.tmp
- %TEMP%\iil10.tmp
- %TEMP%\iilD.tmp
- %TEMP%\iilE.tmp
- %TEMP%\iil3.tmp
- %TEMP%\iil4.tmp
- %TEMP%\iil1.tmp
- %TEMP%\iil2.tmp
- %TEMP%\iil7.tmp
- %TEMP%\iil8.tmp
- %TEMP%\iil5.tmp
- %TEMP%\iil6.tmp
Самоудаляется.
Сетевая активность:
Подключается к:
- 'he####bufusoz.com':80
- 'wu####litezum.com':80
- 'ko###inamu.com':80
- 'di####mydupi.com':80
- 'ro###ymici.com':80
- 'ce####zugyky.com':80
- 'vu###uzuxil.com':80
- 'me####pulafod.com':80
- 'gi####fopupygy.com':80
- 'co####tijixik.com':80
- 'xo####mevotequ.com':80
- 'bi###ebij.com':80
- 'ko####lepehavy.com':80
- 'qu###ewyqa.com':80
- 'ma####vadorode.com':80
- 'se####wytuzek.com':80
- 'vu####hevixaf.com':80
- 'nu####jilamipu.com':80
- 'lo###ejav.com':80
- 'dy###owid.com':80
- 'vi###oxis.com':80
- 'bo####lawiqo.com':80
- 'qa####pojewiv.com':80
- 'wu###omovom.com':80
- 'so###yzev.com':80
- 'ly####fotoqy.com':80
- 'xe####kawuhady.com':80
- 'zo###ymiz.com':80
- 'vo####dacyfyki.com':80
- 'so###urepu.com':80
TCP:
Запросы HTTP GET:
- http://he####bufusoz.com/1003000312
- http://wu####litezum.com/1003000312
- http://ko###inamu.com/1003000312
- http://di####mydupi.com/1003000312
- http://ro###ymici.com/1003000312
- http://ce####zugyky.com/1003000312
- http://vu###uzuxil.com/1003000312
- http://me####pulafod.com/1003000312
- http://gi####fopupygy.com/1003000312
- http://co####tijixik.com/1003000312
- http://xo####mevotequ.com/1003000312
- http://bi###ebij.com/1003000312
- http://ko####lepehavy.com/1003000312
- http://qu###ewyqa.com/1003000312
- http://ma####vadorode.com/1003000312
- http://se####wytuzek.com/1003000312
- http://vu####hevixaf.com/1003000312
- http://nu####jilamipu.com/1003000312
- http://lo###ejav.com/1003000312
- http://dy###owid.com/1003000312
- http://vi###oxis.com/1003000312
- http://bo####lawiqo.com/1003000312
- http://qa####pojewiv.com/1003000312
- http://wu###omovom.com/1003000312
- http://so###yzev.com/1003000312
- http://ly####fotoqy.com/1003000312
- http://xe####kawuhady.com/1003000312
- http://zo###ymiz.com/1003000312
- http://vo####dacyfyki.com/1003000312
- http://so###urepu.com/1003000312
UDP:
- DNS ASK he####bufusoz.com
- DNS ASK wu####litezum.com
- DNS ASK ko###inamu.com
- DNS ASK di####mydupi.com
- DNS ASK ro###ymici.com
- DNS ASK ce####zugyky.com
- DNS ASK vu###uzuxil.com
- DNS ASK me####pulafod.com
- DNS ASK gi####fopupygy.com
- DNS ASK co####tijixik.com
- DNS ASK xo####mevotequ.com
- DNS ASK bi###ebij.com
- DNS ASK ko####lepehavy.com
- DNS ASK qu###ewyqa.com
- DNS ASK ma####vadorode.com
- DNS ASK se####wytuzek.com
- DNS ASK vu####hevixaf.com
- DNS ASK nu####jilamipu.com
- DNS ASK lo###ejav.com
- DNS ASK dy###owid.com
- DNS ASK vi###oxis.com
- DNS ASK bo####lawiqo.com
- DNS ASK qa####pojewiv.com
- DNS ASK wu###omovom.com
- DNS ASK so###yzev.com
- DNS ASK ly####fotoqy.com
- DNS ASK xe####kawuhady.com
- DNS ASK zo###ymiz.com
- DNS ASK vo####dacyfyki.com
- DNS ASK so###urepu.com
Другое:
Ищет следующие окна:
- ClassName: 'g' WindowName: 'mo'
