Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Program Themes Resource Backup' = '%APPDATA%\jvdktchwcjnby\ypjmjsagqs.exe'
Вредоносные функции:
Запускает на исполнение:
- '%APPDATA%\jvdktchwcjnby\kqnnzwcr.exe' "%APPDATA%\jvdktchwcjnby\ypjmjsagqs.exe"
- '%APPDATA%\jvdktchwcjnby\ypjmjsagqs.exe'
Изменения в файловой системе:
Создает следующие файлы:
- %APPDATA%\jvdktchwcjnby\ypjmjsagqs.nb1
- %APPDATA%\jvdktchwcjnby\kqnnzwcr.exe
- %APPDATA%\jvdktchwcjnby\ypjmjsagqs.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- %APPDATA%\jvdktchwcjnby\kqnnzwcr.exe
- %APPDATA%\jvdktchwcjnby\ypjmjsagqs.exe
Сетевая активность:
Подключается к:
- 'mo####gshore.net':80
- 'ra###rshore.net':80
- 'mo####gwritten.net':80
- 'ra####written.net':80
- 'tw####dollar.net':80
- 'mi####dollar.net':80
- 'tw####realize.net':80
- 'mi####realize.net':80
- 'ra####dollar.net':80
- 'st####ewritten.net':80
- 'hi####yshore.net':80
- 'st####edollar.net':80
- 'hi####ywritten.net':80
- 'ra####realize.net':80
- 'mo####gdollar.net':80
- 'st####eshore.net':80
- 'mo####grealize.net':80
- 'of###shore.net':80
- 'co####erealize.net':80
- 'of####ritten.net':80
- 'al###shore.net':80
- 'ch###dollar.net':80
- 'co####ewritten.net':80
- 'ch####ealize.net':80
- 'co####edollar.net':80
- 'al####ritten.net':80
- 'tw###eshore.net':80
- 'mi###eshore.net':80
- 'tw####written.net':80
- 'mi####written.net':80
- 'al###dollar.net':80
- 'of###dollar.net':80
- 'al####ealize.net':80
- 'of####ealize.net':80
TCP:
Запросы HTTP GET:
- http://mo####gshore.net/forum/search.php?em#################################
- http://ra###rshore.net/forum/search.php?em#################################
- http://mo####gwritten.net/forum/search.php?em#################################
- http://ra####written.net/forum/search.php?em#################################
- http://tw####dollar.net/forum/search.php?em#################################
- http://mi####dollar.net/forum/search.php?em#################################
- http://tw####realize.net/forum/search.php?em#################################
- http://mi####realize.net/forum/search.php?em#################################
- http://ra####dollar.net/forum/search.php?em#################################
- http://st####ewritten.net/forum/search.php?em#################################
- http://hi####yshore.net/forum/search.php?em#################################
- http://st####edollar.net/forum/search.php?em#################################
- http://hi####ywritten.net/forum/search.php?em#################################
- http://ra####realize.net/forum/search.php?em#################################
- http://mo####gdollar.net/forum/search.php?em#################################
- http://st####eshore.net/forum/search.php?em#################################
- http://mo####grealize.net/forum/search.php?em#################################
- http://of###shore.net/forum/search.php?em#################################
- http://co####erealize.net/forum/search.php?em#################################
- http://of####ritten.net/forum/search.php?em#################################
- http://al###shore.net/forum/search.php?em#################################
- http://ch###dollar.net/forum/search.php?em#################################
- http://co####ewritten.net/forum/search.php?em#################################
- http://ch####ealize.net/forum/search.php?em#################################
- http://co####edollar.net/forum/search.php?em#################################
- http://al####ritten.net/forum/search.php?em#################################
- http://tw###eshore.net/forum/search.php?em#################################
- http://mi###eshore.net/forum/search.php?em#################################
- http://tw####written.net/forum/search.php?em#################################
- http://mi####written.net/forum/search.php?em#################################
- http://al###dollar.net/forum/search.php?em#################################
- http://of###dollar.net/forum/search.php?em#################################
- http://al####ealize.net/forum/search.php?em#################################
- http://of####ealize.net/forum/search.php?em#################################
UDP:
- DNS ASK mo####gshore.net
- DNS ASK ra###rshore.net
- DNS ASK mo####gwritten.net
- DNS ASK ra####written.net
- DNS ASK tw####dollar.net
- DNS ASK mi####dollar.net
- DNS ASK tw####realize.net
- DNS ASK mi####realize.net
- DNS ASK ra####dollar.net
- DNS ASK st####ewritten.net
- DNS ASK hi####yshore.net
- DNS ASK st####edollar.net
- DNS ASK hi####ywritten.net
- DNS ASK ra####realize.net
- DNS ASK mo####gdollar.net
- DNS ASK st####eshore.net
- DNS ASK mo####grealize.net
- DNS ASK of###shore.net
- DNS ASK co####erealize.net
- DNS ASK of####ritten.net
- DNS ASK al###shore.net
- DNS ASK ch###dollar.net
- DNS ASK co####ewritten.net
- DNS ASK ch####ealize.net
- DNS ASK co####edollar.net
- DNS ASK al####ritten.net
- DNS ASK tw###eshore.net
- DNS ASK mi###eshore.net
- DNS ASK tw####written.net
- DNS ASK mi####written.net
- DNS ASK al###dollar.net
- DNS ASK of###dollar.net
- DNS ASK al####ealize.net
- DNS ASK of####ealize.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
