Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Control AutoConfig Information' = 'C:\fskoneoq\gusyfog.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Networking DHCP Builder Print] 'ImagePath' = 'C:\fskoneoq\gusyfog.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Networking DHCP Builder Print] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- 'C:\fskoneoq\dykjfkxxsjmg.exe' "c:\fskoneoq\gusyfog.exe"
- 'C:\fskoneoq\gusyfog.exe'
- 'C:\fskoneoq\opcs2vxbkr7bmfs3ugud.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\fskoneoq\gusyfog.exe
- C:\fskoneoq\dykjfkxxsjmg.exe
- C:\fskoneoq\weaxibo
- %WINDIR%\fskoneoq\tkt7cvifbb
- C:\fskoneoq\tkt7cvifbb
- C:\fskoneoq\opcs2vxbkr7bmfs3ugud.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\fskoneoq\dykjfkxxsjmg.exe
- C:\fskoneoq\gusyfog.exe
Удаляет следующие файлы:
- C:\fskoneoq\opcs2vxbkr7bmfs3ugud.exe
- %WINDIR%\fskoneoq\tkt7cvifbb
Подменяет следующие файлы:
- %WINDIR%\fskoneoq\tkt7cvifbb
Сетевая активность:
Подключается к:
- 'ne#####ryproblem.net':80
- 'pl####ntmodern.net':80
- 'ne####aryanimal.net':80
- 'pl####ntproblem.net':80
- 're####eescape.net':80
- 'or###animal.net':80
- 'ne####arymodern.net':80
- 'or###escape.net':80
- 'pl####ntanimal.net':80
- 'di#####ltproblem.net':80
- 'he####roblem.net':80
- 'di####ultanimal.net':80
- 'he###animal.net':80
- 'pl####ntescape.net':80
- 'ne####aryescape.net':80
- 'di####ultmodern.net':80
- 'he###modern.net':80
- 're####eanimal.net':80
- 'he####modern.net':80
- 'ge####escape.net':80
- 'he####problem.net':80
- 'le####modern.net':80
- 'ge####modern.net':80
- 'va####sescape.net':80
- 'ge####animal.net':80
- 'ge####problem.net':80
- 'le####problem.net':80
- 'or###modern.net':80
- 're####emodern.net':80
- 'or####roblem.net':80
- 're####eproblem.net':80
- 'le####animal.net':80
- 'he####animal.net':80
- 'le####escape.net':80
- 'he####escape.net':80
- 'he###escape.net':80
- 're####advance.net':80
- 'va####sstranger.net':80
- 'ge####fortieth.net':80
- 'va####sadvance.net':80
- 're####goodbye.net':80
- 'va####sfortieth.net':80
- 're####stranger.net':80
- 'va####sgoodbye.net':80
- 'he####ortieth.net':80
- 'he####dvance.net':80
- 'ge####advance.net':80
- 'le####fortieth.net':80
- 'he####fortieth.net':80
- 'he####oodbye.net':80
- 'ge####goodbye.net':80
- 'he####tranger.net':80
- 'ge####stranger.net':80
- 're####fortieth.net':80
- 'gl###animal.net':80
- 'an####problem.net':80
- 'gl###escape.net':80
- 'an####animal.net':80
- 'gl###modern.net':80
- 'di####ultescape.net':80
- 'gl####roblem.net':80
- 'an####modern.net':80
- 'an####escape.net':80
- 'de####animal.net':80
- 'fo####danimal.net':80
- 'de####escape.net':80
- 'fo####descape.net':80
- 'de####modern.net':80
- 'fo####dmodern.net':80
- 'de####problem.net':80
- 'fo####dproblem.net':80
TCP:
Запросы HTTP GET:
- http://ne#####ryproblem.net/index.php?me########
- http://pl####ntmodern.net/index.php?me########
- http://ne####aryanimal.net/index.php?me########
- http://pl####ntproblem.net/index.php?me########
- http://re####eescape.net/index.php?me########
- http://or###animal.net/index.php?me########
- http://ne####arymodern.net/index.php?me########
- http://or###escape.net/index.php?me########
- http://pl####ntanimal.net/index.php?me########
- http://di#####ltproblem.net/index.php?me########
- http://he####roblem.net/index.php?me########
- http://di####ultanimal.net/index.php?me########
- http://he###animal.net/index.php?me########
- http://pl####ntescape.net/index.php?me########
- http://ne####aryescape.net/index.php?me########
- http://di####ultmodern.net/index.php?me########
- http://he###modern.net/index.php?me########
- http://re####eanimal.net/index.php?me########
- http://he####modern.net/index.php?me########
- http://ge####escape.net/index.php?me########
- http://he####problem.net/index.php?me########
- http://le####modern.net/index.php?me########
- http://ge####modern.net/index.php?me########
- http://va####sescape.net/index.php?me########
- http://ge####animal.net/index.php?me########
- http://ge####problem.net/index.php?me########
- http://le####problem.net/index.php?me########
- http://or###modern.net/index.php?me########
- http://re####emodern.net/index.php?me########
- http://or####roblem.net/index.php?me########
- http://re####eproblem.net/index.php?me########
- http://le####animal.net/index.php?me########
- http://he####animal.net/index.php?me########
- http://le####escape.net/index.php?me########
- http://he####escape.net/index.php?me########
- http://he###escape.net/index.php?me########
- http://re####advance.net/index.php?me########
- http://va####sstranger.net/index.php?me########
- http://ge####fortieth.net/index.php?me########
- http://va####sadvance.net/index.php?me########
- http://re####goodbye.net/index.php?me########
- http://va####sfortieth.net/index.php?me########
- http://re####stranger.net/index.php?me########
- http://va####sgoodbye.net/index.php?me########
- http://he####ortieth.net/index.php?me########
- http://he####dvance.net/index.php?me########
- http://ge####advance.net/index.php?me########
- http://le####fortieth.net/index.php?me########
- http://he####fortieth.net/index.php?me########
- http://he####oodbye.net/index.php?me########
- http://ge####goodbye.net/index.php?me########
- http://he####tranger.net/index.php?me########
- http://ge####stranger.net/index.php?me########
- http://re####fortieth.net/index.php?me########
- http://gl###animal.net/index.php?me########
- http://an####problem.net/index.php?me########
- http://gl###escape.net/index.php?me########
- http://an####animal.net/index.php?me########
- http://gl###modern.net/index.php?me########
- http://di####ultescape.net/index.php?me########
- http://gl####roblem.net/index.php?me########
- http://an####modern.net/index.php?me########
- http://an####escape.net/index.php?me########
- http://de####animal.net/index.php?me########
- http://fo####danimal.net/index.php?me########
- http://de####escape.net/index.php?me########
- http://fo####descape.net/index.php?me########
- http://de####modern.net/index.php?me########
- http://fo####dmodern.net/index.php?me########
- http://de####problem.net/index.php?me########
- http://fo####dproblem.net/index.php?me########
UDP:
- DNS ASK ne#####ryproblem.net
- DNS ASK pl####ntmodern.net
- DNS ASK ne####aryanimal.net
- DNS ASK pl####ntproblem.net
- DNS ASK re####eescape.net
- DNS ASK or###animal.net
- DNS ASK ne####arymodern.net
- DNS ASK or###escape.net
- DNS ASK pl####ntanimal.net
- DNS ASK di#####ltproblem.net
- DNS ASK he####roblem.net
- DNS ASK di####ultanimal.net
- DNS ASK he###animal.net
- DNS ASK pl####ntescape.net
- DNS ASK ne####aryescape.net
- DNS ASK di####ultmodern.net
- DNS ASK he###modern.net
- DNS ASK re####eanimal.net
- DNS ASK he####modern.net
- DNS ASK ge####escape.net
- DNS ASK he####problem.net
- DNS ASK le####modern.net
- DNS ASK ge####modern.net
- DNS ASK va####sescape.net
- DNS ASK ge####animal.net
- DNS ASK ge####problem.net
- DNS ASK le####problem.net
- DNS ASK or###modern.net
- DNS ASK re####emodern.net
- DNS ASK or####roblem.net
- DNS ASK re####eproblem.net
- DNS ASK le####animal.net
- DNS ASK he####animal.net
- DNS ASK le####escape.net
- DNS ASK he####escape.net
- DNS ASK he###escape.net
- DNS ASK re####advance.net
- DNS ASK va####sstranger.net
- DNS ASK ge####fortieth.net
- DNS ASK va####sadvance.net
- DNS ASK re####goodbye.net
- DNS ASK va####sfortieth.net
- DNS ASK re####stranger.net
- DNS ASK va####sgoodbye.net
- DNS ASK he####ortieth.net
- DNS ASK he####dvance.net
- DNS ASK ge####advance.net
- DNS ASK le####fortieth.net
- DNS ASK he####fortieth.net
- DNS ASK he####oodbye.net
- DNS ASK ge####goodbye.net
- DNS ASK he####tranger.net
- DNS ASK ge####stranger.net
- DNS ASK re####fortieth.net
- DNS ASK gl###animal.net
- DNS ASK an####problem.net
- DNS ASK gl###escape.net
- DNS ASK an####animal.net
- DNS ASK gl###modern.net
- DNS ASK di####ultescape.net
- DNS ASK gl####roblem.net
- DNS ASK an####modern.net
- DNS ASK an####escape.net
- DNS ASK de####animal.net
- DNS ASK fo####danimal.net
- DNS ASK de####escape.net
- DNS ASK fo####descape.net
- DNS ASK de####modern.net
- DNS ASK fo####dmodern.net
- DNS ASK de####problem.net
- DNS ASK fo####dproblem.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
