Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'OygyGmJC.exe' = '"<LS_APPDATA>\AePSQBACd1\OygyGmJC.exe"'
- [<HKLM>\SOFTWARE\Microsoft\Command Processor] 'Autorun' = '"<LS_APPDATA>\AePSQBACd1\OygyGmJC.exe"'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'cmd.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'OygyGmJC.exe' = '"<LS_APPDATA>\AePSQBACd1\OygyGmJC.exe"'
- [<HKCU>\Software\Microsoft\Command Processor] 'Autorun' = '"<LS_APPDATA>\AePSQBACd1\OygyGmJC.exe"'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'cmd.exe'
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe'
Завершает или пытается завершить
следующие пользовательские процессы:
- ecmd.exe
Изменения в файловой системе:
Создает следующие файлы:
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\sbmecwntcy[1]
- %TEMP%\N9kQG0rQDV
- <Полный путь к вирусу>
- <LS_APPDATA>\AePSQBACd1\OygyGmJC.exe
Удаляет следующие файлы:
- %TEMP%\N9kQG0rQDV
Сетевая активность:
Подключается к:
- 'sb###wntcy.at':80
- 'localhost':1037
TCP:
Запросы HTTP GET:
- sb###wntcy.at/?bv############################################################################################################################################################################################
UDP:
- DNS ASK sb###wntcy.at
Другое:
Ищет следующие окна:
- ClassName: '(null)' WindowName: 'qGX'
- ClassName: '(null)' WindowName: 'eKHzzcev a'
- ClassName: '(null)' WindowName: ' Z gBp'
- ClassName: '(null)' WindowName: 'nnd fc fR'
- ClassName: '(null)' WindowName: ' rxXtbJh'
- ClassName: '(null)' WindowName: 'weznywirtdoBn t'
- ClassName: '(null)' WindowName: 'h xbvdgh bp'
- ClassName: '(null)' WindowName: 'omrYl'
- ClassName: '(null)' WindowName: 'VxoUwHoZpKqscKBw'
- ClassName: '(null)' WindowName: 'Emxr yhfHbhl'
- ClassName: '(null)' WindowName: 'k fKt cpEL'
- ClassName: '(null)' WindowName: 'nvNAmprmyh e'
- ClassName: '(null)' WindowName: 'akqzwe RtF k'
- ClassName: '(null)' WindowName: 'HPvgwF'
- ClassName: '(null)' WindowName: 'lkxRIcWyar'
- ClassName: '(null)' WindowName: 'bjKpY'
- ClassName: '(null)' WindowName: 'RWJ w yZk jMQ i '
- ClassName: '(null)' WindowName: 'u B'
- ClassName: '(null)' WindowName: 'zI '
- ClassName: '(null)' WindowName: 'xmhUuh '
- ClassName: '(null)' WindowName: ' rkgu'
- ClassName: '(null)' WindowName: 'uNwx ldnf'
- ClassName: '(null)' WindowName: ' uHgTt'
- ClassName: '(null)' WindowName: 'pueCT'
- ClassName: '(null)' WindowName: 'dclegdpAybuT'
- ClassName: '(null)' WindowName: 'EpI Jjs Z igknzh '
- ClassName: '(null)' WindowName: 'riIuxcd gdv '
- ClassName: '(null)' WindowName: ' uhJmu '
- ClassName: '(null)' WindowName: 'PxNyxcRLyn'
- ClassName: '(null)' WindowName: 'Gqvo'
- ClassName: '(null)' WindowName: 'utzk vl'
- ClassName: '(null)' WindowName: 'd ocxpx'
- ClassName: '(null)' WindowName: 'iKSpgkZzl czloe '
- ClassName: '(null)' WindowName: 'Fda oD'
- ClassName: '(null)' WindowName: 'fzlqdcmPeTV'
- ClassName: '(null)' WindowName: 'DbctKKrqv'
- ClassName: '(null)' WindowName: 'IaKDv '
- ClassName: '(null)' WindowName: 'AulU b'
- ClassName: '(null)' WindowName: 'uq kyzdtwgUTwWb'
- ClassName: '(null)' WindowName: ' FfIndBDqs'
- ClassName: '(null)' WindowName: 'pzmpjaspq TcCye'
- ClassName: '(null)' WindowName: 'c Jmzp dwocr'
- ClassName: 'Indicator' WindowName: '(null)'
- ClassName: '(null)' WindowName: 'glwWuy zApl xvpctm'
- ClassName: '(null)' WindowName: 'dyJSU'
- ClassName: '(null)' WindowName: ' t u'
- ClassName: '(null)' WindowName: 'ozcRmiq'
- ClassName: '(null)' WindowName: 'qlyavuzi'
- ClassName: '(null)' WindowName: 'vCbeeK'
- ClassName: '(null)' WindowName: 'WxOnh '
- ClassName: '(null)' WindowName: 'lkjOAjYLl'
- ClassName: '(null)' WindowName: 'nXoQEanhpucqsmL'
- ClassName: '(null)' WindowName: 'jrGb'
- ClassName: '(null)' WindowName: 'rvx fvb'
- ClassName: '(null)' WindowName: 'geu'
- ClassName: '(null)' WindowName: 'atSx X '
- ClassName: '(null)' WindowName: 'vqqc'
- ClassName: '(null)' WindowName: 'gqG Tel'
- ClassName: '(null)' WindowName: 'x kpQmcVhg U'
- ClassName: '(null)' WindowName: 'Nvz dmzkhFWL'
- ClassName: '(null)' WindowName: 'cmf'
- ClassName: '(null)' WindowName: 'RdRflFu'
- ClassName: '(null)' WindowName: 'Gvf nQ zprkm'
- ClassName: '(null)' WindowName: 'qne nksYF i m'
- ClassName: '(null)' WindowName: ' k wipCuvwPgi'
- ClassName: '(null)' WindowName: 'W IgbafkOilg L'
- ClassName: '(null)' WindowName: 'NUXeuBDdA'
- ClassName: '(null)' WindowName: 'Kk aJx'
- ClassName: '(null)' WindowName: 'W aUarrmhvzYk'
- ClassName: '(null)' WindowName: 'InvWpRjFkm '
- ClassName: '(null)' WindowName: 'mz xia'
- ClassName: '(null)' WindowName: 'pbbeV'
- ClassName: '(null)' WindowName: ' rUkyl uldm'
- ClassName: '(null)' WindowName: 'QUb dl ngx'
- ClassName: '(null)' WindowName: ' Higb'
- ClassName: '(null)' WindowName: ' uh csd'
- ClassName: '(null)' WindowName: 'lItS '
- ClassName: '(null)' WindowName: 'ws'
- ClassName: '(null)' WindowName: 'iTcXd x'
- ClassName: '(null)' WindowName: 'zKxphe'
- ClassName: '(null)' WindowName: 'bsvxhqs'
- ClassName: '(null)' WindowName: 'iqsas ry'
- ClassName: '(null)' WindowName: ' pvAgpU Pb'
- ClassName: '(null)' WindowName: 'QmhHBqbMu'
- ClassName: '(null)' WindowName: ' fezx'
- ClassName: '(null)' WindowName: 'uvfJLmE'
- ClassName: '(null)' WindowName: 'jaavjvX'
- ClassName: '(null)' WindowName: 'fgr ltbifn'
- ClassName: '(null)' WindowName: 'izneoM'
- ClassName: '(null)' WindowName: 'ZeS r J'
- ClassName: '(null)' WindowName: 'jsykMJlat'
- ClassName: '(null)' WindowName: 'nupvYKzxDwsprhbe in'
- ClassName: '(null)' WindowName: 'LRfs'
- ClassName: '(null)' WindowName: 'bORFI zMioEk '
- ClassName: '(null)' WindowName: 'dtySbT'
- ClassName: '(null)' WindowName: 'fxQ '
- ClassName: '(null)' WindowName: 'TtW uom'
- ClassName: '(null)' WindowName: 'cg hkzgY'
- ClassName: '(null)' WindowName: 'ae s Sa '
- ClassName: '(null)' WindowName: 'ezMsPrewubnYKV'
- ClassName: '(null)' WindowName: 'iivQZz S'
- ClassName: '(null)' WindowName: 'PplKwpkMl j'
- ClassName: '(null)' WindowName: 'wuXdeavnY'
- ClassName: '(null)' WindowName: 'JSyTvsn F'
- ClassName: '(null)' WindowName: 'iGGWw Bfj '
- ClassName: '(null)' WindowName: 'kWf '
- ClassName: '(null)' WindowName: 'ecOZ xPNdpdE'
- ClassName: '(null)' WindowName: 'wqveI d w'
- ClassName: '(null)' WindowName: ' Pn'
- ClassName: '(null)' WindowName: ' obzrq'
- ClassName: '(null)' WindowName: 'vTCrmHPwg Gd '
- ClassName: '(null)' WindowName: 'X zykoTgjINg'
- ClassName: '(null)' WindowName: 'caPnf q'
- ClassName: '(null)' WindowName: 'xu'
- ClassName: '(null)' WindowName: 'MqvUXHzj '
- ClassName: '(null)' WindowName: 'wXc Ayp'
- ClassName: '(null)' WindowName: 'iMpJ BxD'
- ClassName: '(null)' WindowName: 'aBs '
- ClassName: '(null)' WindowName: 'luuk Fq z Z'
- ClassName: '(null)' WindowName: 'acZfFz kg'
- ClassName: '(null)' WindowName: 'Uj ER'
- ClassName: '(null)' WindowName: 'fJkvsugp'
- ClassName: '(null)' WindowName: 'jL dyfuM xk'
- ClassName: '(null)' WindowName: 'Uow '
- ClassName: '(null)' WindowName: 'PNr'
- ClassName: '(null)' WindowName: 'd kxwgREJ'
- ClassName: '(null)' WindowName: ' wtb'
