Техническая информация
Вредоносные функции:
Запускает на исполнение:
- %PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE http://www.cs###uxi.com/iclk/?zo###############
- %PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE http://82####.9lwan.com/cj/direct/628147.html
- %PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE http://ww.###zhao99.com/union.html?P=###################################################################
- %PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE http://www.9d##m.com/union.html?P=########
Изменения в файловой системе:
Создает следующие файлы:
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\index-1[1].htm
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\52rjwg[1]
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\union[1].html
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\iclk[1]
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\84191[1]
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\tcgg[1].html
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\gg.cokku[1]
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\jxfw.co[1]
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\ad[1].htm
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\chaos4[1]
Сетевая активность:
Подключается к:
- 'www.dn##828.com':80
- 'www.ch##s4.com':80
- 'localhost':1045
- '52##wg.com':80
- 'www.cs###uxi.com':80
- 'www.84##1.com':80
- 's1.##w100.cn':80
- 'www.zh##iwg.com':80
- 'gg.##kku.com':80
- 'localhost':1034
- 'jx##.co.cc':80
- 'localhost':1044
- 'localhost':1042
- 'localhost':1043
TCP:
Запросы HTTP GET:
- 52##wg.com/index-1.htm
- 52##wg.com/
- s1.##w100.cn/union.html?P=########
- www.cs###uxi.com/iclk/?zo###############
- www.84##1.com/
- www.zh##iwg.com/tcgg.html
- gg.##kku.com/
- jx##.co.cc/
- www.dn##828.com/ad.htm
- www.ch##s4.com/
UDP:
- DNS ASK www.9d##m.com
- DNS ASK ww.###zhao99.com
- DNS ASK www.cs###uxi.com
- DNS ASK 82####.9lwan.com
- DNS ASK www.32#4.cn
- DNS ASK www.sh###iandao.cn
- DNS ASK www.le##v8.net
- DNS ASK www.84##1.com
- DNS ASK jx##.co.cc
- DNS ASK www.zh##iwg.com
- DNS ASK gg.##kku.com
- DNS ASK www.ch##s4.com
- DNS ASK s1.##w100.cn
- DNS ASK 52##wg.com
- DNS ASK www.dn##828.com
Другое:
Ищет следующие окна:
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
