Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Identity Drive Manager Bus' = 'C:\mdsegzevuaujss\zpryegjnchfb.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Coordinator Service Host CNG Health Netlogon] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- 'C:\mdsegzevuaujss\lojwwlu.exe' "c:\mdsegzevuaujss\zpryegjnchfb.exe"
- 'C:\mdsegzevuaujss\zpryegjnchfb.exe'
- 'C:\mdsegzevuaujss\cbqtv2qampekuossg.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\mdsegzevuaujss\zpryegjnchfb.exe
- C:\mdsegzevuaujss\lojwwlu.exe
- C:\mdsegzevuaujss\tkny5bpik
- %WINDIR%\mdsegzevuaujss\k9cvr2y
- C:\mdsegzevuaujss\k9cvr2y
- C:\mdsegzevuaujss\cbqtv2qampekuossg.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\mdsegzevuaujss\lojwwlu.exe
- C:\mdsegzevuaujss\zpryegjnchfb.exe
Удаляет следующие файлы:
- C:\mdsegzevuaujss\cbqtv2qampekuossg.exe
- %WINDIR%\mdsegzevuaujss\k9cvr2y
Сетевая активность:
Подключается к:
- 'be####delight.net':80
- 'ch###borrow.net':80
- 'be#####lectricity.net':80
- 'ri####delight.net':80
- 'th###borrow.net':80
- 'ch#####ectricity.net':80
- 'th#####ectricity.net':80
- 'ch###train.net':80
- 'th###train.net':80
- 'ri#####lectricity.net':80
- 'li#####lectricity.net':80
- 'de####ydelight.net':80
- 'li###etrain.net':80
- 'de#####electricity.net':80
- 'li####delight.net':80
- 'ri###ntrain.net':80
- 'be###gtrain.net':80
- 'ri####borrow.net':80
- 'be####borrow.net':80
- 'ef###ttrain.net':80
- 'th####htrain.net':80
- 'ef####borrow.net':80
- 'th####hborrow.net':80
- 'ef#####lectricity.net':80
- 'th####hdelight.net':80
- 'fo####borrow.net':80
- 'th#####electricity.net':80
- 'ef####delight.net':80
- 'su####delight.net':80
- 'wi####borrow.net':80
- 'su####borrow.net':80
- 'ch####elight.net':80
- 'th####elight.net':80
- 'wi###ntrain.net':80
- 'su#####lectricity.net':80
- 'wi####delight.net':80
- 'su###rtrain.net':80
- 'wi#####lectricity.net':80
- 'de####ytrain.net':80
- 'fo####chance.net':80
- 'in####sechance.net':80
- 'ef#####nderstood.net':80
- 'th#####understood.net':80
- 'fo####meeting.net':80
- 'in####setwenty.net':80
- 'fo#####nderstood.net':80
- 'in####semeeting.net':80
- 'fo####twenty.net':80
- 'th####htwenty.net':80
- 'wi#####nderstood.net':80
- 'su#####nderstood.net':80
- 'wi####twenty.net':80
- 'su####twenty.net':80
- 'ef####chance.net':80
- 'th####hmeeting.net':80
- 'ef####twenty.net':80
- 'th####hchance.net':80
- 'ef####meeting.net':80
- 'hu####dtrain.net':80
- 'jo#####electricity.net':80
- 'hu####dborrow.net':80
- 'jo####ytrain.net':80
- 'hu#####electricity.net':80
- 'de####yborrow.net':80
- 'li####borrow.net':80
- 'jo####ydelight.net':80
- 'hu####ddelight.net':80
- 'jo####yborrow.net':80
- 're####erchance.net':80
- 'wo####eeting.net':80
- 'in#####eunderstood.net':80
- 'wo###chance.net':80
- 're####ermeeting.net':80
- 'wo####nderstood.net':80
- 're#####runderstood.net':80
- 'wo###twenty.net':80
- 're####ertwenty.net':80
TCP:
Запросы HTTP GET:
- http://be####delight.net/index.php?me########
- http://ch###borrow.net/index.php?me########
- http://be#####lectricity.net/index.php?me########
- http://ri####delight.net/index.php?me########
- http://th###borrow.net/index.php?me########
- http://ch#####ectricity.net/index.php?me########
- http://th#####ectricity.net/index.php?me########
- http://ch###train.net/index.php?me########
- http://th###train.net/index.php?me########
- http://ri#####lectricity.net/index.php?me########
- http://li#####lectricity.net/index.php?me########
- http://de####ydelight.net/index.php?me########
- http://li###etrain.net/index.php?me########
- http://de#####electricity.net/index.php?me########
- http://li####delight.net/index.php?me########
- http://ri###ntrain.net/index.php?me########
- http://be###gtrain.net/index.php?me########
- http://ri####borrow.net/index.php?me########
- http://be####borrow.net/index.php?me########
- http://ef###ttrain.net/index.php?me########
- http://th####htrain.net/index.php?me########
- http://ef####borrow.net/index.php?me########
- http://th####hborrow.net/index.php?me########
- http://ef#####lectricity.net/index.php?me########
- http://th####hdelight.net/index.php?me########
- http://fo####borrow.net/index.php?me########
- http://th#####electricity.net/index.php?me########
- http://ef####delight.net/index.php?me########
- http://su####delight.net/index.php?me########
- http://wi####borrow.net/index.php?me########
- http://su####borrow.net/index.php?me########
- http://ch####elight.net/index.php?me########
- http://th####elight.net/index.php?me########
- http://wi###ntrain.net/index.php?me########
- http://su#####lectricity.net/index.php?me########
- http://wi####delight.net/index.php?me########
- http://su###rtrain.net/index.php?me########
- http://wi#####lectricity.net/index.php?me########
- http://de####ytrain.net/index.php?me########
- http://fo####chance.net/index.php?me########
- http://in####sechance.net/index.php?me########
- http://ef#####nderstood.net/index.php?me########
- http://th#####understood.net/index.php?me########
- http://fo####meeting.net/index.php?me########
- http://in####setwenty.net/index.php?me########
- http://fo#####nderstood.net/index.php?me########
- http://in####semeeting.net/index.php?me########
- http://fo####twenty.net/index.php?me########
- http://th####htwenty.net/index.php?me########
- http://wi#####nderstood.net/index.php?me########
- http://su#####nderstood.net/index.php?me########
- http://wi####twenty.net/index.php?me########
- http://su####twenty.net/index.php?me########
- http://ef####chance.net/index.php?me########
- http://th####hmeeting.net/index.php?me########
- http://ef####twenty.net/index.php?me########
- http://th####hchance.net/index.php?me########
- http://ef####meeting.net/index.php?me########
- http://hu####dtrain.net/index.php?me########
- http://jo#####electricity.net/index.php?me########
- http://hu####dborrow.net/index.php?me########
- http://jo####ytrain.net/index.php?me########
- http://hu#####electricity.net/index.php?me########
- http://de####yborrow.net/index.php?me########
- http://li####borrow.net/index.php?me########
- http://jo####ydelight.net/index.php?me########
- http://hu####ddelight.net/index.php?me########
- http://jo####yborrow.net/index.php?me########
- http://re####erchance.net/index.php?me########
- http://wo####eeting.net/index.php?me########
- http://in#####eunderstood.net/index.php?me########
- http://wo###chance.net/index.php?me########
- http://re####ermeeting.net/index.php?me########
- http://wo####nderstood.net/index.php?me########
- http://re#####runderstood.net/index.php?me########
- http://wo###twenty.net/index.php?me########
- http://re####ertwenty.net/index.php?me########
UDP:
- DNS ASK be####delight.net
- DNS ASK ch###borrow.net
- DNS ASK be#####lectricity.net
- DNS ASK ri####delight.net
- DNS ASK th###borrow.net
- DNS ASK ch#####ectricity.net
- DNS ASK th#####ectricity.net
- DNS ASK ch###train.net
- DNS ASK th###train.net
- DNS ASK ri#####lectricity.net
- DNS ASK li#####lectricity.net
- DNS ASK de####ydelight.net
- DNS ASK li###etrain.net
- DNS ASK de#####electricity.net
- DNS ASK li####delight.net
- DNS ASK ri###ntrain.net
- DNS ASK be###gtrain.net
- DNS ASK ri####borrow.net
- DNS ASK be####borrow.net
- DNS ASK ch####elight.net
- DNS ASK th####htrain.net
- DNS ASK ef#####lectricity.net
- DNS ASK th####hborrow.net
- DNS ASK ef###ttrain.net
- DNS ASK th#####electricity.net
- DNS ASK fo####borrow.net
- DNS ASK in####seborrow.net
- DNS ASK ef####delight.net
- DNS ASK th####hdelight.net
- DNS ASK ef####borrow.net
- DNS ASK su####borrow.net
- DNS ASK wi###ntrain.net
- DNS ASK th####elight.net
- DNS ASK wi####borrow.net
- DNS ASK su###rtrain.net
- DNS ASK wi####delight.net
- DNS ASK su####delight.net
- DNS ASK wi#####lectricity.net
- DNS ASK su#####lectricity.net
- DNS ASK fo####chance.net
- DNS ASK in####sechance.net
- DNS ASK ef#####nderstood.net
- DNS ASK th#####understood.net
- DNS ASK fo####meeting.net
- DNS ASK in####setwenty.net
- DNS ASK fo#####nderstood.net
- DNS ASK in####semeeting.net
- DNS ASK fo####twenty.net
- DNS ASK th####htwenty.net
- DNS ASK wi#####nderstood.net
- DNS ASK su#####nderstood.net
- DNS ASK wi####twenty.net
- DNS ASK su####twenty.net
- DNS ASK ef####chance.net
- DNS ASK th####hmeeting.net
- DNS ASK ef####twenty.net
- DNS ASK th####hchance.net
- DNS ASK ef####meeting.net
- DNS ASK in#####eunderstood.net
- DNS ASK jo#####electricity.net
- DNS ASK hu#####electricity.net
- DNS ASK jo####ytrain.net
- DNS ASK hu####dtrain.net
- DNS ASK jo####ydelight.net
- DNS ASK li####borrow.net
- DNS ASK de####ytrain.net
- DNS ASK hu####ddelight.net
- DNS ASK de####yborrow.net
- DNS ASK hu####dborrow.net
- DNS ASK wo####eeting.net
- DNS ASK re####ermeeting.net
- DNS ASK wo###chance.net
- DNS ASK re####erchance.net
- DNS ASK wo###twenty.net
- DNS ASK re#####runderstood.net
- DNS ASK jo####yborrow.net
- DNS ASK re####ertwenty.net
- DNS ASK wo####nderstood.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
