Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Bus User-mode Protected Defender' = 'C:\mkwawqom\bvfnmdpaik.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Device Color Isolation Connect] 'ImagePath' = 'C:\mkwawqom\bvfnmdpaik.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Device Color Isolation Connect] 'Start' = '00000002'
Вредоносные функции:
Запускает на исполнение:
- 'C:\mkwawqom\zcjanebwy.exe' "c:\mkwawqom\bvfnmdpaik.exe"
- 'C:\mkwawqom\bvfnmdpaik.exe'
- 'C:\mkwawqom\vrs2ox5qaeifmyln5.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\mkwawqom\bvfnmdpaik.exe
- C:\mkwawqom\zcjanebwy.exe
- C:\mkwawqom\jenza3dq
- %WINDIR%\mkwawqom\iqmjnp
- C:\mkwawqom\iqmjnp
- C:\mkwawqom\vrs2ox5qaeifmyln5.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\mkwawqom\zcjanebwy.exe
- C:\mkwawqom\bvfnmdpaik.exe
Удаляет следующие файлы:
- C:\mkwawqom\vrs2ox5qaeifmyln5.exe
- %WINDIR%\mkwawqom\iqmjnp
Подменяет следующие файлы:
- %WINDIR%\mkwawqom\iqmjnp
Сетевая активность:
Подключается к:
- 'al###beyond.net':80
- 'of###beyond.net':80
- 'co####ebottom.net':80
- 'of####orever.net':80
- 'al###being.net':80
- 'of###being.net':80
- 'ch###bottom.net':80
- 'ch###being.net':80
- 'co####ebeyond.net':80
- 'ch###beyond.net':80
- 'co####eforever.net':80
- 'ch####orever.net':80
- 'co####ebeing.net':80
- 'al####orever.net':80
- 'tw####bottom.net':80
- 'mi####bottom.net':80
- 'tw####forever.net':80
- 'ra###rbeing.net':80
- 'mo####gbeyond.net':80
- 'ra####beyond.net':80
- 'mi####forever.net':80
- 'mi####beyond.net':80
- 'al###bottom.net':80
- 'of###bottom.net':80
- 'tw###ebeing.net':80
- 'mi###ebeing.net':80
- 'tw####beyond.net':80
- 'fl###close.net':80
- 'br###yellow.net':80
- 'fl###yellow.net':80
- 'se###nspace.net':80
- 'qu###space.net':80
- 'br###close.net':80
- 'br###travel.net':80
- 'ga###rclose.net':80
- 'be###rclose.net':80
- 'ga####yellow.net':80
- 'fl###travel.net':80
- 'br###space.net':80
- 'fl###space.net':80
- 'qu###travel.net':80
- 'th####orever.net':80
- 'pr####tbeing.net':80
- 'th###being.net':80
- 'pr####tbottom.net':80
- 'th###bottom.net':80
- 'pr####tforever.net':80
- 'pr####tbeyond.net':80
- 'se####yellow.net':80
- 'qu###yellow.net':80
- 'se####travel.net':80
- 'th###beyond.net':80
- 'se###nclose.net':80
- 'qu###close.net':80
TCP:
Запросы HTTP GET:
- http://al###beyond.net/index.php
- http://of###beyond.net/index.php
- http://co####ebottom.net/index.php
- http://of####orever.net/index.php
- http://al###being.net/index.php
- http://of###being.net/index.php
- http://ch###bottom.net/index.php
- http://ch###being.net/index.php
- http://co####ebeyond.net/index.php
- http://ch###beyond.net/index.php
- http://co####eforever.net/index.php
- http://ch####orever.net/index.php
- http://co####ebeing.net/index.php
- http://al####orever.net/index.php
- http://tw####bottom.net/index.php
- http://mi####bottom.net/index.php
- http://tw####forever.net/index.php
- http://ra###rbeing.net/index.php
- http://mo####gbeyond.net/index.php
- http://ra####beyond.net/index.php
- http://mi####forever.net/index.php
- http://mi####beyond.net/index.php
- http://al###bottom.net/index.php
- http://of###bottom.net/index.php
- http://tw###ebeing.net/index.php
- http://mi###ebeing.net/index.php
- http://tw####beyond.net/index.php
- http://fl###close.net/index.php
- http://br###yellow.net/index.php
- http://fl###yellow.net/index.php
- http://se###nspace.net/index.php
- http://qu###space.net/index.php
- http://br###close.net/index.php
- http://br###travel.net/index.php
- http://ga###rclose.net/index.php
- http://be###rclose.net/index.php
- http://ga####yellow.net/index.php
- http://fl###travel.net/index.php
- http://br###space.net/index.php
- http://fl###space.net/index.php
- http://qu###travel.net/index.php
- http://th####orever.net/index.php
- http://pr####tbeing.net/index.php
- http://th###being.net/index.php
- http://pr####tbottom.net/index.php
- http://th###bottom.net/index.php
- http://pr####tforever.net/index.php
- http://pr####tbeyond.net/index.php
- http://se####yellow.net/index.php
- http://qu###yellow.net/index.php
- http://se####travel.net/index.php
- http://th###beyond.net/index.php
- http://se###nclose.net/index.php
- http://qu###close.net/index.php
UDP:
- DNS ASK al###beyond.net
- DNS ASK of###beyond.net
- DNS ASK co####ebottom.net
- DNS ASK of####orever.net
- DNS ASK al###being.net
- DNS ASK of###being.net
- DNS ASK ch###bottom.net
- DNS ASK ch###being.net
- DNS ASK co####ebeyond.net
- DNS ASK ch###beyond.net
- DNS ASK co####eforever.net
- DNS ASK ch####orever.net
- DNS ASK co####ebeing.net
- DNS ASK al####orever.net
- DNS ASK tw####bottom.net
- DNS ASK mi####bottom.net
- DNS ASK tw####forever.net
- DNS ASK ra###rbeing.net
- DNS ASK mo####gbeyond.net
- DNS ASK ra####beyond.net
- DNS ASK mi####forever.net
- DNS ASK mi####beyond.net
- DNS ASK al###bottom.net
- DNS ASK of###bottom.net
- DNS ASK tw###ebeing.net
- DNS ASK mi###ebeing.net
- DNS ASK tw####beyond.net
- DNS ASK fl###close.net
- DNS ASK br###yellow.net
- DNS ASK fl###yellow.net
- DNS ASK se###nspace.net
- DNS ASK qu###space.net
- DNS ASK br###close.net
- DNS ASK br###travel.net
- DNS ASK ga###rclose.net
- DNS ASK be###rclose.net
- DNS ASK ga####yellow.net
- DNS ASK fl###travel.net
- DNS ASK br###space.net
- DNS ASK fl###space.net
- DNS ASK qu###travel.net
- DNS ASK th####orever.net
- DNS ASK pr####tbeing.net
- DNS ASK th###being.net
- DNS ASK pr####tbottom.net
- DNS ASK th###bottom.net
- DNS ASK pr####tforever.net
- DNS ASK pr####tbeyond.net
- DNS ASK se####yellow.net
- DNS ASK qu###yellow.net
- DNS ASK se####travel.net
- DNS ASK th###beyond.net
- DNS ASK se###nclose.net
- DNS ASK qu###close.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
