Техническая информация
Вредоносные функции:
Ищет следующие окна с целью
обнаружения утилит для анализа:
- ClassName: 'Filemonclass' WindowName: ''
- ClassName: 'Regmonclass' WindowName: ''
Изменения в файловой системе:
Создает следующие файлы:
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\getimage[1].795963832951284
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\getimage[1].736161619405741
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\getimage[1].75144755900705
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\getimage[1].610611616521937
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\getimage[1].28877079103489
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\getimage[1].623991927124757
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\getimage[1].33669987639230
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\getimage[1].108663744817049
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\getimage[1].956204E-024921318
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\getimage[1].684866432812924
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\getimage[1].134886E-0243259496
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\getimage[1].453923912144238
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\getimage[1].168467643408728
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\getimage[1].903522441689319
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\getimage[1].639232915237773
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\getimage[1].447581541098530
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\getimage[1].806504140757454
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\getimage[1].659324145286841
- <SYSTEM32>\yzm
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\getimage[1].90900672225328
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\v2.60[1].thml
- <SYSTEM32>\MSWINSCK.OCX
- <SYSTEM32>\VSListview.ocx
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\getimage[1].672573330836088
- <SYSTEM32>\MSINET.OCX
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\getimage[1].486696514192451
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\getimage[1].498307429095108
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\getimage[1].479152410996682
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\getimage[1].21153989823871
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\getimage[1].61941891779211
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\getimage[1].68477511002890
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\getimage[1].380646836093569
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\getimage[1].72548861499862
Сетевая активность:
Подключается к:
- 'pt###in2.qq.com':80
- 'co###.uucount.com':80
- 'localhost':1035
- 'yz.##count.com':80
TCP:
Запросы HTTP GET:
- pt###in2.qq.com/getimage?ai###############################
- pt###in2.qq.com/getimage?ai################################
- pt###in2.qq.com/getimage?ai############################
- pt###in2.qq.com/getimage?ai#############################
- co###.uucount.com/count/v2.60.thml
Запросы HTTP POST:
- yz.##count.com/soft/qqbanlv/yz9.asp?13########
UDP:
- DNS ASK co###.uucount.com
- DNS ASK pt###in2.qq.com
- DNS ASK yz.##count.com
Другое:
Ищет следующие окна:
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: '18467-41' WindowName: ''
- ClassName: '4823-00000029' WindowName: ''
