Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Device AuthIP Cache Base Copy Mapper' = 'C:\zwyovncwcxjql\pobpumnodjpc.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Defragmenter AuthIP Access Brightness Bus iSCSI] 'ImagePath' = 'C:\zwyovncwcxjql\pobpumnodjpc.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Defragmenter AuthIP Access Brightness Bus iSCSI] 'Start' = '00000002'
Вредоносные функции:
Запускает на исполнение:
- 'C:\zwyovncwcxjql\lqvfmajbrgrt.exe' "c:\zwyovncwcxjql\pobpumnodjpc.exe"
- 'C:\zwyovncwcxjql\pobpumnodjpc.exe'
- 'C:\zwyovncwcxjql\ubc1x3gt2gepcytsvln.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\zwyovncwcxjql\pobpumnodjpc.exe
- C:\zwyovncwcxjql\lqvfmajbrgrt.exe
- C:\zwyovncwcxjql\hektzbbmj9g
- %WINDIR%\zwyovncwcxjql\vzgund87
- C:\zwyovncwcxjql\vzgund87
- C:\zwyovncwcxjql\ubc1x3gt2gepcytsvln.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\zwyovncwcxjql\lqvfmajbrgrt.exe
- C:\zwyovncwcxjql\pobpumnodjpc.exe
Удаляет следующие файлы:
- C:\zwyovncwcxjql\ubc1x3gt2gepcytsvln.exe
- %WINDIR%\zwyovncwcxjql\vzgund87
Подменяет следующие файлы:
- %WINDIR%\zwyovncwcxjql\vzgund87
Сетевая активность:
Подключается к:
- 'gl####ompany.net':80
- 'an####company.net':80
- 'di#####ltfurther.net':80
- 'di####ultcover.net':80
- 'he####urther.net':80
- 'gl###become.net':80
- 'gl####urther.net':80
- 'an####further.net':80
- 'an###rcover.net':80
- 'an####become.net':80
- 'gl###cover.net':80
- 'pl####ntcover.net':80
- 'ne#####ryfurther.net':80
- 'ne####arycover.net':80
- 'ne####arybecome.net':80
- 'pl####ntbecome.net':80
- 'pl####ntfurther.net':80
- 'di####ultbecome.net':80
- 'he###cover.net':80
- 'he###become.net':80
- 'he####ompany.net':80
- 'di#####ltcompany.net':80
- 're####nature.net':80
- 'va####snature.net':80
- 'va####sneedle.net':80
- 'va####senough.net':80
- 're####needle.net':80
- 'ge####govern.net':80
- 'ge####needle.net':80
- 'he###needle.net':80
- 'he###enough.net':80
- 'he###govern.net':80
- 'ge####enough.net':80
- 'de####become.net':80
- 'fo####dcover.net':80
- 'fo####dbecome.net':80
- 'fo####dcompany.net':80
- 'de####company.net':80
- 'de###ecover.net':80
- 'va####sgovern.net':80
- 're####enough.net':80
- 're####govern.net':80
- 'fo####dfurther.net':80
- 'de####further.net':80
TCP:
Запросы HTTP GET:
- http://gl####ompany.net/index.php
- http://an####company.net/index.php
- http://di#####ltfurther.net/index.php
- http://di####ultcover.net/index.php
- http://he####urther.net/index.php
- http://gl###become.net/index.php
- http://gl####urther.net/index.php
- http://an####further.net/index.php
- http://an###rcover.net/index.php
- http://an####become.net/index.php
- http://gl###cover.net/index.php
- http://pl####ntcover.net/index.php
- http://ne#####ryfurther.net/index.php
- http://ne####arycover.net/index.php
- http://ne####arybecome.net/index.php
- http://pl####ntbecome.net/index.php
- http://pl####ntfurther.net/index.php
- http://di####ultbecome.net/index.php
- http://he###cover.net/index.php
- http://he###become.net/index.php
- http://he####ompany.net/index.php
- http://di#####ltcompany.net/index.php
- http://re####nature.net/index.php
- http://va####snature.net/index.php
- http://va####sneedle.net/index.php
- http://va####senough.net/index.php
- http://re####needle.net/index.php
- http://ge####govern.net/index.php
- http://ge####needle.net/index.php
- http://he###needle.net/index.php
- http://he###enough.net/index.php
- http://he###govern.net/index.php
- http://ge####enough.net/index.php
- http://de####become.net/index.php
- http://fo####dcover.net/index.php
- http://fo####dbecome.net/index.php
- http://fo####dcompany.net/index.php
- http://de####company.net/index.php
- http://de###ecover.net/index.php
- http://va####sgovern.net/index.php
- http://re####enough.net/index.php
- http://re####govern.net/index.php
- http://fo####dfurther.net/index.php
- http://de####further.net/index.php
UDP:
- DNS ASK di#####ltfurther.net
- DNS ASK gl####ompany.net
- DNS ASK he####urther.net
- DNS ASK he###cover.net
- DNS ASK di####ultcover.net
- DNS ASK an####company.net
- DNS ASK an###rcover.net
- DNS ASK gl####urther.net
- DNS ASK gl###cover.net
- DNS ASK gl###become.net
- DNS ASK an####become.net
- DNS ASK ne####arycover.net
- DNS ASK pl####ntcover.net
- DNS ASK pl####ntbecome.net
- DNS ASK pl####ntcompany.net
- DNS ASK ne####arybecome.net
- DNS ASK ne#####ryfurther.net
- DNS ASK he###become.net
- DNS ASK di####ultbecome.net
- DNS ASK di#####ltcompany.net
- DNS ASK pl####ntfurther.net
- DNS ASK he####ompany.net
- DNS ASK an####further.net
- DNS ASK re####nature.net
- DNS ASK va####snature.net
- DNS ASK va####sneedle.net
- DNS ASK va####senough.net
- DNS ASK re####needle.net
- DNS ASK ge####govern.net
- DNS ASK ge####needle.net
- DNS ASK he###needle.net
- DNS ASK he###enough.net
- DNS ASK he###govern.net
- DNS ASK ge####enough.net
- DNS ASK de####become.net
- DNS ASK fo####dcover.net
- DNS ASK fo####dbecome.net
- DNS ASK fo####dcompany.net
- DNS ASK de####company.net
- DNS ASK de###ecover.net
- DNS ASK va####sgovern.net
- DNS ASK re####enough.net
- DNS ASK re####govern.net
- DNS ASK fo####dfurther.net
- DNS ASK de####further.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
