Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Ofvi' = '%APPDATA%\Roaming\Myvia\ofvi.exe'
Вредоносные функции:
Создает и запускает на исполнение:
- '%APPDATA%\Roaming\Myvia\ofvi.exe'
Запускает на исполнение:
- '<SYSTEM32>\wermgr.exe' -queuereporting
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 4 "<SYSTEM32>\taskhost.exe"
Внедряет код в
следующие системные процессы:
- <SYSTEM32>\wermgr.exe
Изменения в файловой системе:
Создает следующие файлы:
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\fujzzdbiaihlblxcskaycauc_org[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\njxamgirgkrwhyemprbqsotrgrw_biz[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\hhelzpqkdyphmnypaixuktskfeu_com[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\lnkzbtltrsytxkcyylpbcqpb_ru[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\qgqgtsgfyhadetbxkrd_com[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\uohtlzpkfmovcmgamnpzojeqt_net[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\chpbmtmfamfeluhykzuonizy_biz[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\hiribtpnderpnzlpzhaudehu_net[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\kjetwxgnhqaybqcmnjovgaxdqo_com[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\gmzfehizhceytbmxskeauoeagudmrw_ru[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\zaexkjnwpkbxgfyuhufkn_com[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\amfmzbirwaqmfprghucpeapjov_info[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\pvwtggmtoirusxovrkivxei_org[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\uwpmrlrdcdmhmrxwhqcqwovsnv_info[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\zldgarsskpcadwglryhmbuob_com[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\lvgayukovtoqogaxszddlftkwgtw_ru[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\ojuofqeiygavgvdbqzpnrg_biz[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\qwytxjbxtofxsxvqeupfpylxc_net[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\rkpuvhwcxnbmnnrzhhaijdov_org[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\usxglrytpflnpvppxolbaknwolh_net[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\nvfobnjgyeapvpfbufdyssgdipv_biz[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\rghayltsqwmrovcqjpzaqlvltzxz_ru[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\mnxrcxkvxdqfyypthajnpzknl_com[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\lfsoceayswvwsxprwydwomwo_info[1]
- <LS_APPDATA>\Microsoft\Windows Mail\Local Folders\Inbox\winmail.fol
- <LS_APPDATA>\Microsoft\Windows Mail\Backup\temp\WindowsMail.pat
- <LS_APPDATA>\Microsoft\Windows Mail\edb.log
- <LS_APPDATA>\Microsoft\Windows Mail\Local Folders\Deleted Items\winmail.fol
- <LS_APPDATA>\Microsoft\Windows Mail\Local Folders\Sent Items\winmail.fol
- <LS_APPDATA>\Microsoft\Windows Mail\Local Folders\Outbox\winmail.fol
- %TEMP%\LRKED8A.bat
- <LS_APPDATA>\Microsoft\Windows Mail\tmp.edb
- %APPDATA%\Roaming\Myvia\ofvi.exe
- <LS_APPDATA>\Microsoft\Windows Mail\Backup\temp\edb00002.log
- <LS_APPDATA>\Microsoft\Windows Mail\edbtmp.log
- <LS_APPDATA>\Microsoft\Windows Mail\Backup\temp\WindowsMail.MSMessageStore
- <LS_APPDATA>Low\Microsoft\CryptnetUrlCache\Content\E6024EAC88E6B6165D49FE3C95ADD735
- <LS_APPDATA>Low\Microsoft\CryptnetUrlCache\MetaData\E6024EAC88E6B6165D49FE3C95ADD735
- %TEMP%\ppcrlui_3380_2
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\jbkraefaceydpborvsekrqcwcbgmga_ru[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\zlgmdxeyzthtcgqlxcatobvw_com[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\wsowogmozmjpjbuqwfmnpvdakzrkn_biz[1]
- <LS_APPDATA>\Microsoft\Windows Mail\Local Folders\Inbox\35AB0E03-00000001.eml
- <LS_APPDATA>\Microsoft\Windows Mail\Local Folders\Junk E-mail\winmail.fol
- <LS_APPDATA>\Microsoft\Windows Mail\Local Folders\Drafts\winmail.fol
- %TEMP%\Tar957C.tmp
- %TEMP%\Cab957B.tmp
- <LS_APPDATA>\Microsoft\Windows Mail\Local Folders\Inbox\35AB0E03-00000001.eml:OECustomProperty
Удаляет следующие файлы:
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\usxglrytpflnpvppxolbaknwolh_net[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\rkpuvhwcxnbmnnrzhhaijdov_org[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\lfsoceayswvwsxprwydwomwo_info[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\nvfobnjgyeapvpfbufdyssgdipv_biz[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\uohtlzpkfmovcmgamnpzojeqt_net[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\qgqgtsgfyhadetbxkrd_com[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\lnkzbtltrsytxkcyylpbcqpb_ru[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\mnxrcxkvxdqfyypthajnpzknl_com[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\qwytxjbxtofxsxvqeupfpylxc_net[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\ojuofqeiygavgvdbqzpnrg_biz[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\lvgayukovtoqogaxszddlftkwgtw_ru[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\pvwtggmtoirusxovrkivxei_org[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\rghayltsqwmrovcqjpzaqlvltzxz_ru[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\zldgarsskpcadwglryhmbuob_com[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\uwpmrlrdcdmhmrxwhqcqwovsnv_info[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\zlgmdxeyzthtcgqlxcatobvw_com[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\jbkraefaceydpborvsekrqcwcbgmga_ru[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\kjetwxgnhqaybqcmnjovgaxdqo_com[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\wsowogmozmjpjbuqwfmnpvdakzrkn_biz[1]
- %TEMP%\Cab957B.tmp
- %TEMP%\Tar957C.tmp
- %TEMP%\ppcrlui_3380_2
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\hiribtpnderpnzlpzhaudehu_net[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\hhelzpqkdyphmnypaixuktskfeu_com[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\njxamgirgkrwhyemprbqsotrgrw_biz[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\fujzzdbiaihlblxcskaycauc_org[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\gmzfehizhceytbmxskeauoeagudmrw_ru[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\chpbmtmfamfeluhykzuonizy_biz[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\amfmzbirwaqmfprghucpeapjov_info[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\zaexkjnwpkbxgfyuhufkn_com[1]
Перемещает следующие файлы:
- <LS_APPDATA>\Microsoft\Windows Mail\edbtmp.log в <LS_APPDATA>\Microsoft\Windows Mail\edb.log
Самоудаляется.
Сетевая активность:
Подключается к:
- 'us#######flnpvppxolbaknwolh.net':80
- 'rk#######nbmnnrzhhaijdov.org':80
- 'lf#######wvwsxprwydwomwo.info':80
- 'nv#######eapvpfbufdyssgdipv.biz':80
- 'uo#######movcmgamnpzojeqt.net':80
- 'qg#####fyhadetbxkrd.com':80
- 'ln######rsytxkcyylpbcqpb.ru':80
- 'mn#######dqfyypthajnpzknl.com':80
- 'qw#######ofxsxvqeupfpylxc.net':80
- 'oj######ygavgvdbqzpnrg.biz':80
- 'lv#######toqogaxszddlftkwgtw.ru':80
- 'pv######oirusxovrkivxei.org':80
- 'rg#######wmrovcqjpzaqlvltzxz.ru':80
- 'zl#######pcadwglryhmbuob.com':80
- 'uw#######dmhmrxwhqcqwovsnv.info':80
- 'zl#######thtcgqlxcatobvw.com':80
- 'jb########ydpborvsekrqcwcbgmga.ru':80
- 'kj#######qaybqcmnjovgaxdqo.com':80
- 'ws########jpjbuqwfmnpvdakzrkn.biz':80
- '20#.#6.232.182':80
- '74.##5.232.51':80
- 'www.bing.com':80
- 'hi#######erpnzlpzhaudehu.net':80
- 'hh#######yphmnypaixuktskfeu.com':80
- 'nj#######krwhyemprbqsotrgrw.biz':80
- 'fu#######ihlblxcskaycauc.org':80
- 'gm########eytbmxskeauoeagudmrw.ru':80
- 'ch#######mfeluhykzuonizy.biz':80
- 'am#######aqmfprghucpeapjov.info':80
- 'za######pkbxgfyuhufkn.com':80
TCP:
Запросы HTTP GET:
- us#######flnpvppxolbaknwolh.net/
- rk#######nbmnnrzhhaijdov.org/
- lf#######wvwsxprwydwomwo.info/
- nv#######eapvpfbufdyssgdipv.biz/
- uo#######movcmgamnpzojeqt.net/
- qg#####fyhadetbxkrd.com/
- ln######rsytxkcyylpbcqpb.ru/
- mn#######dqfyypthajnpzknl.com/
- qw#######ofxsxvqeupfpylxc.net/
- oj######ygavgvdbqzpnrg.biz/
- lv#######toqogaxszddlftkwgtw.ru/
- pv######oirusxovrkivxei.org/
- rg#######wmrovcqjpzaqlvltzxz.ru/
- zl#######pcadwglryhmbuob.com/
- uw#######dmhmrxwhqcqwovsnv.info/
- zl#######thtcgqlxcatobvw.com/
- jb########ydpborvsekrqcwcbgmga.ru/
- kj#######qaybqcmnjovgaxdqo.com/
- ws########jpjbuqwfmnpvdakzrkn.biz/
- 20#.#6.232.182/pki/crl/products/CodeSignPCA.crl
- 74.##5.232.51/
- www.bing.com/
- hi#######erpnzlpzhaudehu.net/
- hh#######yphmnypaixuktskfeu.com/
- nj#######krwhyemprbqsotrgrw.biz/
- fu#######ihlblxcskaycauc.org/
- gm########eytbmxskeauoeagudmrw.ru/
- ch#######mfeluhykzuonizy.biz/
- am#######aqmfprghucpeapjov.info/
- za######pkbxgfyuhufkn.com/
UDP:
- DNS ASK uo#######movcmgamnpzojeqt.net
- DNS ASK fu#######ihlblxcskaycauc.org
- DNS ASK nj#######krwhyemprbqsotrgrw.biz
- DNS ASK nv#######eapvpfbufdyssgdipv.biz
- DNS ASK ln######rsytxkcyylpbcqpb.ru
- DNS ASK qg#####fyhadetbxkrd.com
- DNS ASK am#######aqmfprghucpeapjov.info
- DNS ASK ch#######mfeluhykzuonizy.biz
- DNS ASK dn#.##ftncsi.com
- DNS ASK hh#######yphmnypaixuktskfeu.com
- DNS ASK gm########eytbmxskeauoeagudmrw.ru
- DNS ASK za######pkbxgfyuhufkn.com
- DNS ASK us#######flnpvppxolbaknwolh.net
- DNS ASK oj######ygavgvdbqzpnrg.biz
- DNS ASK qw#######ofxsxvqeupfpylxc.net
- DNS ASK pv######oirusxovrkivxei.org
- DNS ASK us########paumbizuccqgiwsctkh.net
- DNS ASK ei######vosoghknfapraxb.com
- DNS ASK lv#######toqogaxszddlftkwgtw.ru
- DNS ASK mn#######dqfyypthajnpzknl.com
- DNS ASK lf#######wvwsxprwydwomwo.info
- DNS ASK rk#######nbmnnrzhhaijdov.org
- DNS ASK uw#######dmhmrxwhqcqwovsnv.info
- DNS ASK zl#######pcadwglryhmbuob.com
- DNS ASK rg#######wmrovcqjpzaqlvltzxz.ru
- DNS ASK www.google.com
- DNS ASK www.bing.com
- DNS ASK crl.microsoft.com
- DNS ASK hi#######erpnzlpzhaudehu.net
- DNS ASK jb########ydpborvsekrqcwcbgmga.ru
- DNS ASK kj#######qaybqcmnjovgaxdqo.com
- DNS ASK ws########jpjbuqwfmnpvdakzrkn.biz
- DNS ASK zl#######thtcgqlxcatobvw.com
- '76.##6.114.217':1684
- '21#.#4.146.36':1732
- '10#.#4.172.39':3059
- '2.###.133.66':6474
- '20#.#09.58.176':24069
- '18#.#42.108.42':4510
- '64.##6.115.72':10010
- '66.##.204.26':24382
- '2.##.50.124':24606
- '10#.#17.117.139':8593
- '10#.#34.133.110':8387
- '46.#9.36.20':9752
- '84.#9.131.0':7605
- '82.##1.180.182':5457
- '17#.#3.147.65':3319
- '12#.#38.67.140':4636
- '90.##6.118.144':2081
- '21#.#32.249.173':2848
Другое:
Ищет следующие окна:
- ClassName: 'OutlookExpressHiddenWindow' WindowName: '(null)'
- ClassName: 'Indicator' WindowName: '(null)'
