Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'update' = '%CommonProgramFiles%\Microsoft Shared\Share.exe'
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\reg.exe' add "hkcu\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "update" /t reg_sz /d "%CommonProgramFiles%\Microsoft Shared\Share.exe" /f
- '<SYSTEM32>\cmd.exe' /C reg add "hkcu\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "update" /t reg_sz /d "%CommonProgramFiles%\Microsoft Shared\Share.exe" /f
Изменения в файловой системе:
Создает следующие файлы:
- %WINDIR%\AOqMwp5J
- %WINDIR%\wMG51qF
- %WINDIR%\qUHGw
- %WINDIR%\DDDP6
- %WINDIR%\f7X5I
- %WINDIR%\VdL3RKhs
- %WINDIR%\241b2
- %WINDIR%\IYqgn
- %WINDIR%\5EGlsqX
- %WINDIR%\L5qXm
- %WINDIR%\k1XAge
- %WINDIR%\7lRFaT
- %WINDIR%\HkY8pO
- %WINDIR%\vrTIeIFS
- %WINDIR%\IGu35Ky
- %WINDIR%\CDvPW
- %WINDIR%\X8yTH
- %WINDIR%\FkeUYgg
- %WINDIR%\AwSSYUR
- %WINDIR%\f8enVqbV
- %WINDIR%\XfaVdn6sxg
- %WINDIR%\HbQBS
- %WINDIR%\U1qN15
- %WINDIR%\rBAuPFOMMV
- %WINDIR%\kNpcu2
- %WINDIR%\m7aJT
- %WINDIR%\Xfjjlrm
- %WINDIR%\mRBVLc
- %WINDIR%\t2hKDUbu
- %WINDIR%\AP577H7u
- %WINDIR%\sl7IdSyT
- %CommonProgramFiles%\Microsoft Shared\Share.exe
- %WINDIR%\DSLYBhe
- %WINDIR%\8iVnfa
- %WINDIR%\7qLF8Vj
- %WINDIR%\ctwaIJS
- %WINDIR%\WxHG6
- %WINDIR%\NbxbEg6sUt
- %WINDIR%\FejP448J
- %WINDIR%\5dMOdOM
- %WINDIR%\MplAQLsisY
- %WINDIR%\3QFM1e
- %WINDIR%\trqhike
- %WINDIR%\iC5BSbLWFw
- %WINDIR%\hEXkNYiu
- %WINDIR%\gUE6kA1tH
- %WINDIR%\oYevfKPb1m
- %WINDIR%\iiqTUr
- %WINDIR%\AuGiOspIAI
- %WINDIR%\e3N3Cd
- %WINDIR%\IuQYc
- %WINDIR%\ag8N5L
- %WINDIR%\NJUxwG
- %WINDIR%\HFUpp
- %WINDIR%\URTYcM8
- %WINDIR%\ufiNw3T
- %WINDIR%\4LKAppJdRf
- %WINDIR%\PQlTuja
- %WINDIR%\HgPfWif6
- %WINDIR%\xhH6i
- %WINDIR%\CEBUwL
- %WINDIR%\xeP8ebJ
- %WINDIR%\S7oG5h
- %WINDIR%\rG8aC8pWeF
- %WINDIR%\jHYmFRi2vr
- %WINDIR%\BxDDG
- %WINDIR%\IbHIP
- %WINDIR%\6XHwk3ab
- %WINDIR%\YM7LSqL7Y
- %WINDIR%\RIJbr
- %WINDIR%\sxNfy5c8
- %WINDIR%\bi2KNFHYB1
- %WINDIR%\VjY3aUd3
- %WINDIR%\dSwDA
- %WINDIR%\21VqVBH
- %WINDIR%\QQnOidlYQv
- %WINDIR%\QQvdl8Lq
- %WINDIR%\FLktE
- %WINDIR%\qriXmUw
- %WINDIR%\eXQRHgxsc
- %WINDIR%\nTNDD4wAY
- %WINDIR%\JfKlUe5hS
- %WINDIR%\27XBT7HI
- %WINDIR%\jSrmWlpJKk
- %WINDIR%\KTQJdf
- %WINDIR%\RkAEXG
- %WINDIR%\bcBGuAAi
- %WINDIR%\rp77e6F1mh
- %WINDIR%\dL4ay
- %WINDIR%\PK4yw2OUY
- %WINDIR%\5q5bygGb
- %WINDIR%\eeOmGj1F7V
- %WINDIR%\SBImtO
- %WINDIR%\fEe666c
- %WINDIR%\NJvCrA
Сетевая активность:
Подключается к:
- 'ya##gat.org':80
TCP:
Запросы HTTP GET:
- http://ya##gat.org/online.php
UDP:
- DNS ASK ya##gat.org
