Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Locator Logon Presentation' = '%APPDATA%\wkqlrwckb\ocndkufm.exe'
Вредоносные функции:
Создает и запускает на исполнение:
- '%APPDATA%\wkqlrwckb\jlzjsgcddqyk.exe' "%APPDATA%\wkqlrwckb\ocndkufm.exe"
- '%APPDATA%\wkqlrwckb\ocndkufm.exe'
Изменения в файловой системе:
Создает следующие файлы:
- %APPDATA%\wkqlrwckb\ocndkufm.nhaen
- %APPDATA%\wkqlrwckb\jlzjsgcddqyk.exe
- %APPDATA%\wkqlrwckb\ocndkufm.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- %APPDATA%\wkqlrwckb\jlzjsgcddqyk.exe
- %APPDATA%\wkqlrwckb\ocndkufm.exe
Сетевая активность:
Подключается к:
- 'li####however.net':80
- 'ri####choose.net':80
- 'de####yhowever.net':80
- 'de####yperiod.net':80
- 'li####period.net':80
- 'ri####period.net':80
- 'be####period.net':80
- 'be####although.net':80
- 'be####choose.net':80
- 'ri####although.net':80
- 'li####although.net':80
- 'jo####yperiod.net':80
- 'hu####dperiod.net':80
- 'hu####dalthough.net':80
- 'hu####dchoose.net':80
- 'jo####yalthough.net':80
- 'li####choose.net':80
- 'de####yalthough.net':80
- 'de####ychoose.net':80
- 'jo####yhowever.net':80
- 'hu####dhowever.net':80
- 'wi####period.net':80
- 'su####period.net':80
- 'su####although.net':80
- 'su####choose.net':80
- 'wi####although.net':80
- 'th####hchoose.net':80
- 'ef####although.net':80
- 'ef####choose.net':80
- 'wi####however.net':80
- 'su####however.net':80
- 'wi####choose.net':80
- 'th###choose.net':80
- 'ch####lthough.net':80
- 'ch###choose.net':80
- 'ri####however.net':80
- 'be####however.net':80
- 'ch####owever.net':80
- 'th####owever.net':80
- 'th###period.net':80
- 'th####lthough.net':80
- 'ch###period.net':80
- 'jo####ychoose.net':80
- 'wi###nstorm.net':80
- 'su###rstorm.net':80
- 'su####training.net':80
- 'su####hunger.net':80
- 'wi####training.net':80
- 'th####hhunger.net':80
- 'ef####training.net':80
- 'ef####hunger.net':80
- 'wi####thrown.net':80
- 'su####thrown.net':80
- 'wi####hunger.net':80
- 'th###hunger.net':80
- 'ch####raining.net':80
- 'ch###hunger.net':80
- 'ri####thrown.net':80
- 'be####thrown.net':80
- 'ch###thrown.net':80
- 'th###thrown.net':80
- 'th###storm.net':80
- 'th####raining.net':80
- 'ch###storm.net':80
- 're####erhunger.net':80
- 'wo####raining.net':80
- 'wo###hunger.net':80
- 'fo####thrown.net':80
- 'in####sethrown.net':80
- 'wo###thrown.net':80
- 're####erthrown.net':80
- 're####erstorm.net':80
- 're#####rtraining.net':80
- 'wo###storm.net':80
- 'in####sestorm.net':80
- 'ef####thrown.net':80
- 'th####hthrown.net':80
- 'th####hstorm.net':80
- 'th####htraining.net':80
- 'ef###tstorm.net':80
- 'in#####etraining.net':80
- 'fo###tstorm.net':80
- 'fo####training.net':80
- 'fo####hunger.net':80
- 'in####sehunger.net':80
TCP:
Запросы HTTP GET:
- li####however.net/forum/search.php?em#####################################
- ri####choose.net/forum/search.php?em#####################################
- de####yhowever.net/forum/search.php?em#####################################
- de####yperiod.net/forum/search.php?em#####################################
- li####period.net/forum/search.php?em#####################################
- ri####period.net/forum/search.php?em#####################################
- be####period.net/forum/search.php?em#####################################
- be####although.net/forum/search.php?em#####################################
- be####choose.net/forum/search.php?em#####################################
- ri####although.net/forum/search.php?em#####################################
- li####although.net/forum/search.php?em#####################################
- jo####yperiod.net/forum/search.php?em#####################################
- hu####dperiod.net/forum/search.php?em#####################################
- hu####dalthough.net/forum/search.php?em#####################################
- hu####dchoose.net/forum/search.php?em#####################################
- jo####yalthough.net/forum/search.php?em#####################################
- li####choose.net/forum/search.php?em#####################################
- de####yalthough.net/forum/search.php?em#####################################
- de####ychoose.net/forum/search.php?em#####################################
- jo####yhowever.net/forum/search.php?em#####################################
- hu####dhowever.net/forum/search.php?em#####################################
- wi####period.net/forum/search.php?em#####################################
- su####period.net/forum/search.php?em#####################################
- su####although.net/forum/search.php?em#####################################
- su####choose.net/forum/search.php?em#####################################
- wi####although.net/forum/search.php?em#####################################
- th####hchoose.net/forum/search.php?em#####################################
- ef####although.net/forum/search.php?em#####################################
- ef####choose.net/forum/search.php?em#####################################
- wi####however.net/forum/search.php?em#####################################
- su####however.net/forum/search.php?em#####################################
- wi####choose.net/forum/search.php?em#####################################
- th###choose.net/forum/search.php?em#####################################
- ch####lthough.net/forum/search.php?em#####################################
- ch###choose.net/forum/search.php?em#####################################
- ri####however.net/forum/search.php?em#####################################
- be####however.net/forum/search.php?em#####################################
- ch####owever.net/forum/search.php?em#####################################
- th####owever.net/forum/search.php?em#####################################
- th###period.net/forum/search.php?em#####################################
- th####lthough.net/forum/search.php?em#####################################
- ch###period.net/forum/search.php?em#####################################
- jo####ychoose.net/forum/search.php?em#####################################
- wi###nstorm.net/forum/search.php?em#####################################
- su###rstorm.net/forum/search.php?em#####################################
- su####training.net/forum/search.php?em#####################################
- su####hunger.net/forum/search.php?em#####################################
- wi####training.net/forum/search.php?em#####################################
- th####hhunger.net/forum/search.php?em#####################################
- ef####training.net/forum/search.php?em#####################################
- ef####hunger.net/forum/search.php?em#####################################
- wi####thrown.net/forum/search.php?em#####################################
- su####thrown.net/forum/search.php?em#####################################
- wi####hunger.net/forum/search.php?em#####################################
- th###hunger.net/forum/search.php?em#####################################
- ch####raining.net/forum/search.php?em#####################################
- ch###hunger.net/forum/search.php?em#####################################
- ri####thrown.net/forum/search.php?em#####################################
- be####thrown.net/forum/search.php?em#####################################
- ch###thrown.net/forum/search.php?em#####################################
- th###thrown.net/forum/search.php?em#####################################
- th###storm.net/forum/search.php?em#####################################
- th####raining.net/forum/search.php?em#####################################
- ch###storm.net/forum/search.php?em#####################################
- re####erhunger.net/forum/search.php?em#####################################
- wo####raining.net/forum/search.php?em#####################################
- wo###hunger.net/forum/search.php?em#####################################
- fo####thrown.net/forum/search.php?em#####################################
- in####sethrown.net/forum/search.php?em#####################################
- wo###thrown.net/forum/search.php?em#####################################
- re####erthrown.net/forum/search.php?em#####################################
- re####erstorm.net/forum/search.php?em#####################################
- re#####rtraining.net/forum/search.php?em#####################################
- wo###storm.net/forum/search.php?em#####################################
- in####sestorm.net/forum/search.php?em#####################################
- ef####thrown.net/forum/search.php?em#####################################
- th####hthrown.net/forum/search.php?em#####################################
- th####hstorm.net/forum/search.php?em#####################################
- th####htraining.net/forum/search.php?em#####################################
- ef###tstorm.net/forum/search.php?em#####################################
- in#####etraining.net/forum/search.php?em#####################################
- fo###tstorm.net/forum/search.php?em#####################################
- fo####training.net/forum/search.php?em#####################################
- fo####hunger.net/forum/search.php?em#####################################
- in####sehunger.net/forum/search.php?em#####################################
UDP:
- DNS ASK li####however.net
- DNS ASK ri####choose.net
- DNS ASK de####yhowever.net
- DNS ASK de####yperiod.net
- DNS ASK li####period.net
- DNS ASK ri####period.net
- DNS ASK be####period.net
- DNS ASK be####although.net
- DNS ASK be####choose.net
- DNS ASK ri####although.net
- DNS ASK li####although.net
- DNS ASK jo####yperiod.net
- DNS ASK hu####dperiod.net
- DNS ASK hu####dalthough.net
- DNS ASK hu####dchoose.net
- DNS ASK jo####yalthough.net
- DNS ASK li####choose.net
- DNS ASK de####yalthough.net
- DNS ASK de####ychoose.net
- DNS ASK jo####yhowever.net
- DNS ASK hu####dhowever.net
- DNS ASK wi####period.net
- DNS ASK su####period.net
- DNS ASK su####although.net
- DNS ASK su####choose.net
- DNS ASK wi####although.net
- DNS ASK th####hchoose.net
- DNS ASK ef####although.net
- DNS ASK ef####choose.net
- DNS ASK wi####however.net
- DNS ASK su####however.net
- DNS ASK wi####choose.net
- DNS ASK th###choose.net
- DNS ASK ch####lthough.net
- DNS ASK ch###choose.net
- DNS ASK ri####however.net
- DNS ASK be####however.net
- DNS ASK ch####owever.net
- DNS ASK th####owever.net
- DNS ASK th###period.net
- DNS ASK th####lthough.net
- DNS ASK ch###period.net
- DNS ASK jo####ychoose.net
- DNS ASK wi###nstorm.net
- DNS ASK su###rstorm.net
- DNS ASK su####training.net
- DNS ASK su####hunger.net
- DNS ASK wi####training.net
- DNS ASK th####hhunger.net
- DNS ASK ef####training.net
- DNS ASK ef####hunger.net
- DNS ASK wi####thrown.net
- DNS ASK su####thrown.net
- DNS ASK wi####hunger.net
- DNS ASK th###hunger.net
- DNS ASK ch####raining.net
- DNS ASK ch###hunger.net
- DNS ASK ri####thrown.net
- DNS ASK be####thrown.net
- DNS ASK ch###thrown.net
- DNS ASK th###thrown.net
- DNS ASK th###storm.net
- DNS ASK th####raining.net
- DNS ASK ch###storm.net
- DNS ASK re####erhunger.net
- DNS ASK wo####raining.net
- DNS ASK wo###hunger.net
- DNS ASK fo####thrown.net
- DNS ASK in####sethrown.net
- DNS ASK wo###thrown.net
- DNS ASK re####erthrown.net
- DNS ASK re####erstorm.net
- DNS ASK re#####rtraining.net
- DNS ASK wo###storm.net
- DNS ASK in####sestorm.net
- DNS ASK ef####thrown.net
- DNS ASK th####hthrown.net
- DNS ASK th####hstorm.net
- DNS ASK th####htraining.net
- DNS ASK ef###tstorm.net
- DNS ASK in#####etraining.net
- DNS ASK fo###tstorm.net
- DNS ASK fo####training.net
- DNS ASK fo####hunger.net
- DNS ASK in####sehunger.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'Indicator' WindowName: ''
