Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Services Client Storage Netlogon Initiator' = '<LS_APPDATA>\eovkfqp\qdyhhdsjmdeo.exe'
Вредоносные функции:
Создает и запускает на исполнение:
- <LS_APPDATA>\eovkfqp\fsityzd.exe "<LS_APPDATA>\eovkfqp\qdyhhdsjmdeo.exe"
- <LS_APPDATA>\eovkfqp\qdyhhdsjmdeo.exe
Изменения в файловой системе:
Создает следующие файлы:
- <LS_APPDATA>\eovkfqp\qdyhhdsjmdeo.xoix
- <SYSTEM32>\wbem\Performance\WmiApRpl_new.ini
- <LS_APPDATA>\eovkfqp\qdyhhdsjmdeo.exe
- <LS_APPDATA>\eovkfqp\fsityzd.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- <LS_APPDATA>\eovkfqp\fsityzd.exe
- <LS_APPDATA>\eovkfqp\qdyhhdsjmdeo.exe
Сетевая активность:
Подключается к:
- 'al###became.net':80
- 'of###became.net':80
- 'al####ontain.net':80
- 'of####ontain.net':80
- 'al####ndustry.net':80
- 'ch###basket.net':80
- 'co####econtain.net':80
- 'of####ndustry.net':80
- 'co####ebasket.net':80
- 'mi####contain.net':80
- 'tw####became.net':80
- 'mi####basket.net':80
- 'tw####contain.net':80
- 'mi####became.net':80
- 'al###basket.net':80
- 'of###basket.net':80
- 'tw####industry.net':80
- 'mi####industry.net':80
- 'th####iscover.net':80
- 'cl###wonder.net':80
- 'th####ndustry.net':80
- 'cl####iscover.net':80
- 'th###wonder.net':80
- 'cl####ontinue.net':80
- 'th####ontinue.net':80
- 'cl###master.net':80
- 'th###master.net':80
- 'ch###became.net':80
- 'th###basket.net':80
- 'ch####ontain.net':80
- 'co####ebecame.net':80
- 'pr####tcontain.net':80
- 'th###became.net':80
- 'pr####tindustry.net':80
- 'th####ontain.net':80
- 'pr####tbecame.net':80
TCP:
Запросы HTTP GET:
- al###became.net/forum/search.php?em####################################
- of###became.net/forum/search.php?em####################################
- al####ontain.net/forum/search.php?em####################################
- of####ontain.net/forum/search.php?em####################################
- al####ndustry.net/forum/search.php?em####################################
- ch###basket.net/forum/search.php?em####################################
- co####econtain.net/forum/search.php?em####################################
- of####ndustry.net/forum/search.php?em####################################
- co####ebasket.net/forum/search.php?em####################################
- mi####contain.net/forum/search.php?em####################################
- tw####became.net/forum/search.php?em####################################
- mi####basket.net/forum/search.php?em####################################
- tw####contain.net/forum/search.php?em####################################
- mi####became.net/forum/search.php?em####################################
- al###basket.net/forum/search.php?em####################################
- of###basket.net/forum/search.php?em####################################
- tw####industry.net/forum/search.php?em####################################
- mi####industry.net/forum/search.php?em####################################
- th####iscover.net/forum/search.php?em####################################
- cl###wonder.net/forum/search.php?em####################################
- th####ndustry.net/forum/search.php?em####################################
- cl####iscover.net/forum/search.php?em####################################
- th###wonder.net/forum/search.php?em####################################
- cl####ontinue.net/forum/search.php?em####################################
- th####ontinue.net/forum/search.php?em####################################
- cl###master.net/forum/search.php?em####################################
- th###master.net/forum/search.php?em####################################
- ch###became.net/forum/search.php?em####################################
- th###basket.net/forum/search.php?em####################################
- ch####ontain.net/forum/search.php?em####################################
- co####ebecame.net/forum/search.php?em####################################
- pr####tcontain.net/forum/search.php?em####################################
- th###became.net/forum/search.php?em####################################
- pr####tindustry.net/forum/search.php?em####################################
- th####ontain.net/forum/search.php?em####################################
- pr####tbecame.net/forum/search.php?em####################################
UDP:
- DNS ASK of###became.net
- DNS ASK al####ndustry.net
- DNS ASK al###became.net
- DNS ASK al####ontain.net
- DNS ASK of####ontain.net
- DNS ASK co####econtain.net
- DNS ASK ch####ontain.net
- DNS ASK ch###basket.net
- DNS ASK of####ndustry.net
- DNS ASK co####ebasket.net
- DNS ASK mi####contain.net
- DNS ASK tw####became.net
- DNS ASK tw####contain.net
- DNS ASK tw####basket.net
- DNS ASK mi####basket.net
- DNS ASK al###basket.net
- DNS ASK of###basket.net
- DNS ASK mi####industry.net
- DNS ASK mi####became.net
- DNS ASK tw####industry.net
- DNS ASK th####iscover.net
- DNS ASK cl###wonder.net
- DNS ASK cl####iscover.net
- DNS ASK pr####tindustry.net
- DNS ASK th####ndustry.net
- DNS ASK cl####ontinue.net
- DNS ASK th####ontinue.net
- DNS ASK th###master.net
- DNS ASK th###wonder.net
- DNS ASK cl###master.net
- DNS ASK ch####ndustry.net
- DNS ASK pr####tbasket.net
- DNS ASK co####eindustry.net
- DNS ASK co####ebecame.net
- DNS ASK ch###became.net
- DNS ASK pr####tbecame.net
- DNS ASK th###became.net
- DNS ASK th####ontain.net
- DNS ASK th###basket.net
- DNS ASK pr####tcontain.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'Indicator' WindowName: ''
