Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Task Link-Layer Procedure IKE' = 'C:\wznawgdacvgjae\rfgexfkapvvx.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\VC Collector Resource Link Group Power] 'ImagePath' = 'C:\wznawgdacvgjae\rfgexfkapvvx.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\VC Collector Resource Link Group Power] 'Start' = '00000002'
Вредоносные функции:
Запускает на исполнение:
- 'C:\wznawgdacvgjae\mjbrzatp.exe' "c:\wznawgdacvgjae\rfgexfkapvvx.exe"
- 'C:\wznawgdacvgjae\rfgexfkapvvx.exe'
- 'C:\wznawgdacvgjae\e4y2w60hxlwwcnjhj.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\wznawgdacvgjae\rfgexfkapvvx.exe
- C:\wznawgdacvgjae\mjbrzatp.exe
- C:\wznawgdacvgjae\yawmzujjcbh
- %WINDIR%\wznawgdacvgjae\cz7af809
- C:\wznawgdacvgjae\cz7af809
- C:\wznawgdacvgjae\e4y2w60hxlwwcnjhj.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\wznawgdacvgjae\mjbrzatp.exe
- C:\wznawgdacvgjae\rfgexfkapvvx.exe
Удаляет следующие файлы:
- C:\wznawgdacvgjae\e4y2w60hxlwwcnjhj.exe
- %WINDIR%\wznawgdacvgjae\cz7af809
Подменяет следующие файлы:
- %WINDIR%\wznawgdacvgjae\cz7af809
Сетевая активность:
Подключается к:
- 'li###ewagon.net':80
- 'de####ywagon.net':80
- 'de####ywithout.net':80
- 'de####ykitchen.net':80
- 'li####without.net':80
- 'hu####dprobable.net':80
- 'hu####dwithout.net':80
- 'jo####ywithout.net':80
- 'jo####ykitchen.net':80
- 'jo####yprobable.net':80
- 'hu####dkitchen.net':80
- 'li####kitchen.net':80
- 'be####kitchen.net':80
- 'ri####kitchen.net':80
- 'ri####probable.net':80
- 'ch###wagon.net':80
- 'be####probable.net':80
- 'be####without.net':80
- 'li####probable.net':80
- 'de####yprobable.net':80
- 'ri###nwagon.net':80
- 'ri####without.net':80
- 'be###gwagon.net':80
- 'hu####dwagon.net':80
- 'in####seexcept.net':80
- 'fo####except.net':80
- 'fo####bridge.net':80
- 'fo####bicycle.net':80
- 'in####sebridge.net':80
- 'th####hwhose.net':80
- 'th####hbridge.net':80
- 'ef####bridge.net':80
- 'ef####bicycle.net':80
- 'ef###twhose.net':80
- 'th####hbicycle.net':80
- 'in####sebicycle.net':80
- 're####erbicycle.net':80
- 'wo####icycle.net':80
- 'wo###whose.net':80
- 'jo####ywagon.net':80
- 're####erwhose.net':80
- 're####erbridge.net':80
- 'in####sewhose.net':80
- 'fo###twhose.net':80
- 'wo###except.net':80
- 'wo###bridge.net':80
- 're####erexcept.net':80
TCP:
Запросы HTTP GET:
- http://li###ewagon.net/index.php
- http://de####ywagon.net/index.php
- http://de####ywithout.net/index.php
- http://de####ykitchen.net/index.php
- http://li####without.net/index.php
- http://hu####dprobable.net/index.php
- http://hu####dwithout.net/index.php
- http://jo####ywithout.net/index.php
- http://jo####ykitchen.net/index.php
- http://jo####yprobable.net/index.php
- http://hu####dkitchen.net/index.php
- http://li####kitchen.net/index.php
- http://be####kitchen.net/index.php
- http://ri####kitchen.net/index.php
- http://ri####probable.net/index.php
- http://ch###wagon.net/index.php
- http://be####probable.net/index.php
- http://be####without.net/index.php
- http://li####probable.net/index.php
- http://de####yprobable.net/index.php
- http://ri###nwagon.net/index.php
- http://ri####without.net/index.php
- http://be###gwagon.net/index.php
- http://hu####dwagon.net/index.php
- http://in####seexcept.net/index.php
- http://fo####except.net/index.php
- http://fo####bridge.net/index.php
- http://fo####bicycle.net/index.php
- http://in####sebridge.net/index.php
- http://th####hwhose.net/index.php
- http://th####hbridge.net/index.php
- http://ef####bridge.net/index.php
- http://ef####bicycle.net/index.php
- http://ef###twhose.net/index.php
- http://th####hbicycle.net/index.php
- http://in####sebicycle.net/index.php
- http://re####erbicycle.net/index.php
- http://wo####icycle.net/index.php
- http://wo###whose.net/index.php
- http://jo####ywagon.net/index.php
- http://re####erwhose.net/index.php
- http://re####erbridge.net/index.php
- http://in####sewhose.net/index.php
- http://fo###twhose.net/index.php
- http://wo###except.net/index.php
- http://wo###bridge.net/index.php
- http://re####erexcept.net/index.php
UDP:
- DNS ASK de####ywithout.net
- DNS ASK li###ewagon.net
- DNS ASK de####ywagon.net
- DNS ASK li####kitchen.net
- DNS ASK de####ykitchen.net
- DNS ASK li####without.net
- DNS ASK jo####ykitchen.net
- DNS ASK hu####dwithout.net
- DNS ASK jo####ywithout.net
- DNS ASK hu####dprobable.net
- DNS ASK jo####yprobable.net
- DNS ASK hu####dkitchen.net
- DNS ASK ri####probable.net
- DNS ASK be####kitchen.net
- DNS ASK ri####kitchen.net
- DNS ASK th###wagon.net
- DNS ASK ch###wagon.net
- DNS ASK be####probable.net
- DNS ASK ri###nwagon.net
- DNS ASK li####probable.net
- DNS ASK de####yprobable.net
- DNS ASK be####without.net
- DNS ASK ri####without.net
- DNS ASK be###gwagon.net
- DNS ASK fo####bridge.net
- DNS ASK in####seexcept.net
- DNS ASK fo####except.net
- DNS ASK in####sebicycle.net
- DNS ASK fo####bicycle.net
- DNS ASK in####sebridge.net
- DNS ASK ef####bicycle.net
- DNS ASK th####hbridge.net
- DNS ASK ef####bridge.net
- DNS ASK th####hwhose.net
- DNS ASK ef###twhose.net
- DNS ASK th####hbicycle.net
- DNS ASK wo###whose.net
- DNS ASK re####erbicycle.net
- DNS ASK wo####icycle.net
- DNS ASK hu####dwagon.net
- DNS ASK jo####ywagon.net
- DNS ASK re####erwhose.net
- DNS ASK wo###except.net
- DNS ASK in####sewhose.net
- DNS ASK fo###twhose.net
- DNS ASK re####erbridge.net
- DNS ASK wo###bridge.net
- DNS ASK re####erexcept.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
