Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Quality Framework Remote Computer' = '%APPDATA%\dqbekrxzcr\xdapynsewn.exe'
Вредоносные функции:
Создает и запускает на исполнение:
- '%APPDATA%\dqbekrxzcr\wsilvcr.exe' "%APPDATA%\dqbekrxzcr\xdapynsewn.exe"
- '%APPDATA%\dqbekrxzcr\xdapynsewn.exe'
Изменения в файловой системе:
Создает следующие файлы:
- %APPDATA%\dqbekrxzcr\xdapynsewn.ow
- %APPDATA%\dqbekrxzcr\wsilvcr.exe
- %APPDATA%\dqbekrxzcr\xdapynsewn.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- %APPDATA%\dqbekrxzcr\wsilvcr.exe
- %APPDATA%\dqbekrxzcr\xdapynsewn.exe
Сетевая активность:
Подключается к:
- 'he####icycle.net':80
- 'di####ultwhose.net':80
- 'he###whose.net':80
- 'di####ultbridge.net':80
- 'he###bridge.net':80
- 'di#####ltbicycle.net':80
- 'pl####ntexcept.net':80
- 'pl####ntbicycle.net':80
- 'ne#####rybicycle.net':80
- 'pl####ntwhose.net':80
- 'ne####aryexcept.net':80
- 'pl####ntbridge.net':80
- 'ne####arybridge.net':80
- 'an####except.net':80
- 'gl###except.net':80
- 'an####bridge.net':80
- 'fo####dbicycle.net':80
- 'de###ewhose.net':80
- 'fo####dwhose.net':80
- 'gl###bridge.net':80
- 'gl###whose.net':80
- 'di####ultexcept.net':80
- 'he###except.net':80
- 'an####bicycle.net':80
- 'gl####icycle.net':80
- 'an###rwhose.net':80
TCP:
Запросы HTTP GET:
- he####icycle.net/forum/search.php?em################################
- di####ultwhose.net/forum/search.php?em################################
- he###whose.net/forum/search.php?em################################
- di####ultbridge.net/forum/search.php?em################################
- he###bridge.net/forum/search.php?em################################
- di#####ltbicycle.net/forum/search.php?em################################
- pl####ntexcept.net/forum/search.php?em################################
- pl####ntbicycle.net/forum/search.php?em################################
- ne#####rybicycle.net/forum/search.php?em################################
- pl####ntwhose.net/forum/search.php?em################################
- ne####aryexcept.net/forum/search.php?em################################
- pl####ntbridge.net/forum/search.php?em################################
- ne####arybridge.net/forum/search.php?em################################
- an####except.net/forum/search.php?em################################
- gl###except.net/forum/search.php?em################################
- an####bridge.net/forum/search.php?em################################
- fo####dbicycle.net/forum/search.php?em################################
- de###ewhose.net/forum/search.php?em################################
- fo####dwhose.net/forum/search.php?em################################
- gl###bridge.net/forum/search.php?em################################
- gl###whose.net/forum/search.php?em################################
- di####ultexcept.net/forum/search.php?em################################
- he###except.net/forum/search.php?em################################
- an####bicycle.net/forum/search.php?em################################
- gl####icycle.net/forum/search.php?em################################
- an###rwhose.net/forum/search.php?em################################
UDP:
- DNS ASK di####ultwhose.net
- DNS ASK he###whose.net
- DNS ASK pl####ntexcept.net
- DNS ASK he###bridge.net
- DNS ASK di#####ltbicycle.net
- DNS ASK he####icycle.net
- DNS ASK ne####aryexcept.net
- DNS ASK ne#####rybicycle.net
- DNS ASK pl####ntwhose.net
- DNS ASK ne####arywhose.net
- DNS ASK pl####ntbridge.net
- DNS ASK ne####arybridge.net
- DNS ASK pl####ntbicycle.net
- DNS ASK di####ultbridge.net
- DNS ASK an####except.net
- DNS ASK gl###except.net
- DNS ASK an####bridge.net
- DNS ASK fo####dbicycle.net
- DNS ASK de###ewhose.net
- DNS ASK fo####dwhose.net
- DNS ASK gl###bridge.net
- DNS ASK gl###whose.net
- DNS ASK di####ultexcept.net
- DNS ASK he###except.net
- DNS ASK an####bicycle.net
- DNS ASK gl####icycle.net
- DNS ASK an###rwhose.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'Indicator' WindowName: '(null)'
