Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Human TPM Engine WMI Proxy Biometric Alerts' = '<LS_APPDATA>\qktikcyjotd\luuiivkmleny.exe'
Вредоносные функции:
Создает и запускает на исполнение:
- '<LS_APPDATA>\qktikcyjotd\mngmwtqfo.exe' "<LS_APPDATA>\qktikcyjotd\luuiivkmleny.exe"
- '<LS_APPDATA>\qktikcyjotd\luuiivkmleny.exe'
Изменения в файловой системе:
Создает следующие файлы:
- <LS_APPDATA>\qktikcyjotd\luuiivkmleny.gl1
- <LS_APPDATA>\qktikcyjotd\mngmwtqfo.exe
- <LS_APPDATA>\qktikcyjotd\luuiivkmleny.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- <LS_APPDATA>\qktikcyjotd\mngmwtqfo.exe
- <LS_APPDATA>\qktikcyjotd\luuiivkmleny.exe
Сетевая активность:
Подключается к:
- 'va####ssquare.net':80
- 're####square.net':80
- 're####attempt.net':80
- 'ge####spread.net':80
- 'va####sattempt.net':80
- 're####spread.net':80
- 'de####market.net':80
- 'va####sspread.net':80
- 'va####sneighbor.net':80
- 're####neighbor.net':80
- 'le####neighbor.net':80
- 'he####neighbor.net':80
- 'he####square.net':80
- 'he####attempt.net':80
- 'le####square.net':80
- 'ge####square.net':80
- 'ge####neighbor.net':80
- 'ge####attempt.net':80
- 'le####spread.net':80
- 'he####spread.net':80
- 'an####garden.net':80
- 'gl###garden.net':80
- 'gl###beauty.net':80
- 'gl###report.net':80
- 'an####beauty.net':80
- 'he###report.net':80
- 'di####ultbeauty.net':80
- 'di####ultreport.net':80
- 'di####ultmarket.net':80
- 'he###market.net':80
- 'de####beauty.net':80
- 'fo####dbeauty.net':80
- 'fo####dreport.net':80
- 'fo####dmarket.net':80
- 'de####report.net':80
- 'gl###market.net':80
- 'an####report.net':80
- 'an####market.net':80
- 'de####garden.net':80
- 'fo####dgarden.net':80
- 'le####attempt.net':80
- 'gl####eighbor.net':80
- 'an####spread.net':80
- 'an####neighbor.net':80
- 'an####square.net':80
- 'gl###square.net':80
- 'di####ultsquare.net':80
- 'he###square.net':80
- 'he####ttempt.net':80
- 'gl###spread.net':80
- 'di#####ltattempt.net':80
- 'fo####dsquare.net':80
- 'de####neighbor.net':80
- 'de####square.net':80
- 'de####attempt.net':80
- 'fo####dattempt.net':80
- 'an####attempt.net':80
- 'gl####ttempt.net':80
- 'fo####dspread.net':80
- 'fo####dneighbor.net':80
- 'de####spread.net':80
- 're####eattempt.net':80
- 'or###square.net':80
- 'or####ttempt.net':80
- 'pl####ntspread.net':80
- 'ne####aryspread.net':80
- 'or###spread.net':80
- 're####espread.net':80
- 're####eneighbor.net':80
- 're####esquare.net':80
- 'or####eighbor.net':80
- 'he###spread.net':80
- 'pl####ntattempt.net':80
- 'di####ultspread.net':80
- 'di#####ltneighbor.net':80
- 'he####eighbor.net':80
- 'pl#####tneighbor.net':80
- 'ne#####ryneighbor.net':80
- 'ne####arysquare.net':80
- 'ne#####ryattempt.net':80
- 'pl####ntsquare.net':80
TCP:
Запросы HTTP GET:
- va####ssquare.net/forum/search.php?em#################################
- re####square.net/forum/search.php?em#################################
- re####attempt.net/forum/search.php?em#################################
- ge####spread.net/forum/search.php?em#################################
- va####sattempt.net/forum/search.php?em#################################
- re####spread.net/forum/search.php?em#################################
- de####market.net/forum/search.php?em#################################
- va####sspread.net/forum/search.php?em#################################
- va####sneighbor.net/forum/search.php?em#################################
- re####neighbor.net/forum/search.php?em#################################
- le####neighbor.net/forum/search.php?em#################################
- he####neighbor.net/forum/search.php?em#################################
- he####square.net/forum/search.php?em#################################
- he####attempt.net/forum/search.php?em#################################
- le####square.net/forum/search.php?em#################################
- ge####square.net/forum/search.php?em#################################
- ge####neighbor.net/forum/search.php?em#################################
- ge####attempt.net/forum/search.php?em#################################
- le####spread.net/forum/search.php?em#################################
- he####spread.net/forum/search.php?em#################################
- an####garden.net/forum/search.php?em#################################
- gl###garden.net/forum/search.php?em#################################
- gl###beauty.net/forum/search.php?em#################################
- gl###report.net/forum/search.php?em#################################
- an####beauty.net/forum/search.php?em#################################
- he###report.net/forum/search.php?em#################################
- di####ultbeauty.net/forum/search.php?em#################################
- di####ultreport.net/forum/search.php?em#################################
- di####ultmarket.net/forum/search.php?em#################################
- he###market.net/forum/search.php?em#################################
- de####beauty.net/forum/search.php?em#################################
- fo####dbeauty.net/forum/search.php?em#################################
- fo####dreport.net/forum/search.php?em#################################
- fo####dmarket.net/forum/search.php?em#################################
- de####report.net/forum/search.php?em#################################
- gl###market.net/forum/search.php?em#################################
- an####report.net/forum/search.php?em#################################
- an####market.net/forum/search.php?em#################################
- de####garden.net/forum/search.php?em#################################
- fo####dgarden.net/forum/search.php?em#################################
- le####attempt.net/forum/search.php?em#################################
- gl####eighbor.net/forum/search.php?em#################################
- an####spread.net/forum/search.php?em#################################
- an####neighbor.net/forum/search.php?em#################################
- an####square.net/forum/search.php?em#################################
- gl###square.net/forum/search.php?em#################################
- di####ultsquare.net/forum/search.php?em#################################
- he###square.net/forum/search.php?em#################################
- he####ttempt.net/forum/search.php?em#################################
- gl###spread.net/forum/search.php?em#################################
- di#####ltattempt.net/forum/search.php?em#################################
- fo####dsquare.net/forum/search.php?em#################################
- de####neighbor.net/forum/search.php?em#################################
- de####square.net/forum/search.php?em#################################
- de####attempt.net/forum/search.php?em#################################
- fo####dattempt.net/forum/search.php?em#################################
- an####attempt.net/forum/search.php?em#################################
- gl####ttempt.net/forum/search.php?em#################################
- fo####dspread.net/forum/search.php?em#################################
- fo####dneighbor.net/forum/search.php?em#################################
- de####spread.net/forum/search.php?em#################################
- re####eattempt.net/forum/search.php?em#################################
- or###square.net/forum/search.php?em#################################
- or####ttempt.net/forum/search.php?em#################################
- pl####ntspread.net/forum/search.php?em#################################
- ne####aryspread.net/forum/search.php?em#################################
- or###spread.net/forum/search.php?em#################################
- re####espread.net/forum/search.php?em#################################
- re####eneighbor.net/forum/search.php?em#################################
- re####esquare.net/forum/search.php?em#################################
- or####eighbor.net/forum/search.php?em#################################
- he###spread.net/forum/search.php?em#################################
- pl####ntattempt.net/forum/search.php?em#################################
- di####ultspread.net/forum/search.php?em#################################
- di#####ltneighbor.net/forum/search.php?em#################################
- he####eighbor.net/forum/search.php?em#################################
- pl#####tneighbor.net/forum/search.php?em#################################
- ne#####ryneighbor.net/forum/search.php?em#################################
- ne####arysquare.net/forum/search.php?em#################################
- ne#####ryattempt.net/forum/search.php?em#################################
- pl####ntsquare.net/forum/search.php?em#################################
UDP:
- DNS ASK va####ssquare.net
- DNS ASK re####square.net
- DNS ASK re####attempt.net
- DNS ASK ge####spread.net
- DNS ASK va####sattempt.net
- DNS ASK re####spread.net
- DNS ASK de####market.net
- DNS ASK va####sspread.net
- DNS ASK va####sneighbor.net
- DNS ASK re####neighbor.net
- DNS ASK le####neighbor.net
- DNS ASK he####neighbor.net
- DNS ASK he####square.net
- DNS ASK he####attempt.net
- DNS ASK le####square.net
- DNS ASK ge####square.net
- DNS ASK ge####neighbor.net
- DNS ASK ge####attempt.net
- DNS ASK le####spread.net
- DNS ASK he####spread.net
- DNS ASK an####garden.net
- DNS ASK gl###garden.net
- DNS ASK gl###beauty.net
- DNS ASK gl###report.net
- DNS ASK an####beauty.net
- DNS ASK he###report.net
- DNS ASK di####ultbeauty.net
- DNS ASK di####ultreport.net
- DNS ASK di####ultmarket.net
- DNS ASK he###market.net
- DNS ASK de####beauty.net
- DNS ASK fo####dbeauty.net
- DNS ASK fo####dreport.net
- DNS ASK fo####dmarket.net
- DNS ASK de####report.net
- DNS ASK gl###market.net
- DNS ASK an####report.net
- DNS ASK an####market.net
- DNS ASK de####garden.net
- DNS ASK fo####dgarden.net
- DNS ASK le####attempt.net
- DNS ASK gl####eighbor.net
- DNS ASK an####spread.net
- DNS ASK an####neighbor.net
- DNS ASK an####square.net
- DNS ASK gl###square.net
- DNS ASK di####ultsquare.net
- DNS ASK he###square.net
- DNS ASK he####ttempt.net
- DNS ASK gl###spread.net
- DNS ASK di#####ltattempt.net
- DNS ASK fo####dsquare.net
- DNS ASK de####neighbor.net
- DNS ASK de####square.net
- DNS ASK de####attempt.net
- DNS ASK fo####dattempt.net
- DNS ASK an####attempt.net
- DNS ASK gl####ttempt.net
- DNS ASK fo####dspread.net
- DNS ASK fo####dneighbor.net
- DNS ASK de####spread.net
- DNS ASK re####eattempt.net
- DNS ASK or###square.net
- DNS ASK or####ttempt.net
- DNS ASK pl####ntspread.net
- DNS ASK ne####aryspread.net
- DNS ASK or###spread.net
- DNS ASK re####espread.net
- DNS ASK re####eneighbor.net
- DNS ASK re####esquare.net
- DNS ASK or####eighbor.net
- DNS ASK he###spread.net
- DNS ASK pl####ntattempt.net
- DNS ASK di####ultspread.net
- DNS ASK di#####ltneighbor.net
- DNS ASK he####eighbor.net
- DNS ASK pl#####tneighbor.net
- DNS ASK ne#####ryneighbor.net
- DNS ASK ne####arysquare.net
- DNS ASK ne#####ryattempt.net
- DNS ASK pl####ntsquare.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'Indicator' WindowName: ''
