Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Service Time Computer Identity' = 'C:\auqculrhhxum\wgnezzbhco.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Extender NGEN Storage Play CardSpace] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- 'C:\auqculrhhxum\tbixtvotxta.exe' "c:\auqculrhhxum\wgnezzbhco.exe"
- 'C:\auqculrhhxum\wgnezzbhco.exe'
- 'C:\auqculrhhxum\wq2sdalpikxxfrz.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\auqculrhhxum\wgnezzbhco.exe
- C:\auqculrhhxum\tbixtvotxta.exe
- C:\auqculrhhxum\eq2ywyz
- %WINDIR%\auqculrhhxum\dhzdbxsku4
- C:\auqculrhhxum\dhzdbxsku4
- C:\auqculrhhxum\wq2sdalpikxxfrz.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\auqculrhhxum\tbixtvotxta.exe
- C:\auqculrhhxum\wgnezzbhco.exe
Удаляет следующие файлы:
- C:\auqculrhhxum\wq2sdalpikxxfrz.exe
- %WINDIR%\auqculrhhxum\dhzdbxsku4
Сетевая активность:
Подключается к:
- 'me###rheart.net':80
- 'fo####perfect.net':80
- 'al####ybattle.net':80
- 'fo###wheart.net':80
- 'me###rmayor.net':80
- 'fo####battle.net':80
- 'me####perfect.net':80
- 'fo###wmayor.net':80
- 'al####yheart.net':80
- 'ge#####anperfect.net':80
- 'ex#####ncebattle.net':80
- 'ge####manheart.net':80
- 'al####ymayor.net':80
- 'ge####manbattle.net':80
- 'al####yperfect.net':80
- 'ge####manmayor.net':80
- 'me####battle.net':80
- 'su####perfect.net':80
- 'cr####erfect.net':80
- 'su###rheart.net':80
- 'cr###heart.net':80
- 'su####battle.net':80
- 'cr###battle.net':80
- 'su###rmayor.net':80
- 'cr###mayor.net':80
- 'be####erfect.net':80
- 'kn####erfect.net':80
- 'be###heart.net':80
- 'kn###heart.net':80
- 'be###battle.net':80
- 'kn###battle.net':80
- 'be###mayor.net':80
- 'kn###mayor.net':80
- 'fr###battle.net':80
- 'wa###white.net':80
- 'wo###toward.net':80
- 'wa####illion.net':80
- 'th####twhite.net':80
- 'sm####leasure.net':80
- 'wo####illion.net':80
- 'sm###toward.net':80
- 'wo####leasure.net':80
- 'cr###white.net':80
- 'th####ttoward.net':80
- 'cr####illion.net':80
- 'su###rwhite.net':80
- 'wa####leasure.net':80
- 'th####tmillion.net':80
- 'wa###toward.net':80
- 'th####tpleasure.net':80
- 'sm####illion.net':80
- 'fr###heart.net':80
- 'ex####enceheart.net':80
- 'pa###white.net':80
- 'fi###white.net':80
- 'fr###mayor.net':80
- 'ex####encemayor.net':80
- 'fr####erfect.net':80
- 'ex#####nceperfect.net':80
- 'pa###toward.net':80
- 'fi###toward.net':80
- 'wo###white.net':80
- 'sm###white.net':80
- 'pa####illion.net':80
- 'fi####illion.net':80
- 'pa####leasure.net':80
- 'fi####leasure.net':80
TCP:
Запросы HTTP GET:
- http://me###rheart.net/index.php?me########
- http://fo####perfect.net/index.php?me########
- http://al####ybattle.net/index.php?me########
- http://fo###wheart.net/index.php?me########
- http://me###rmayor.net/index.php?me########
- http://fo####battle.net/index.php?me########
- http://me####perfect.net/index.php?me########
- http://fo###wmayor.net/index.php?me########
- http://al####yheart.net/index.php?me########
- http://ge#####anperfect.net/index.php?me########
- http://ex#####ncebattle.net/index.php?me########
- http://ge####manheart.net/index.php?me########
- http://al####ymayor.net/index.php?me########
- http://ge####manbattle.net/index.php?me########
- http://al####yperfect.net/index.php?me########
- http://ge####manmayor.net/index.php?me########
- http://me####battle.net/index.php?me########
- http://su####perfect.net/index.php?me########
- http://cr####erfect.net/index.php?me########
- http://su###rheart.net/index.php?me########
- http://cr###heart.net/index.php?me########
- http://su####battle.net/index.php?me########
- http://cr###battle.net/index.php?me########
- http://su###rmayor.net/index.php?me########
- http://cr###mayor.net/index.php?me########
- http://be####erfect.net/index.php?me########
- http://kn####erfect.net/index.php?me########
- http://be###heart.net/index.php?me########
- http://kn###heart.net/index.php?me########
- http://be###battle.net/index.php?me########
- http://kn###battle.net/index.php?me########
- http://be###mayor.net/index.php?me########
- http://kn###mayor.net/index.php?me########
- http://fr###battle.net/index.php?me########
- http://wa###white.net/index.php?me########
- http://wo###toward.net/index.php?me########
- http://wa####illion.net/index.php?me########
- http://th####twhite.net/index.php?me########
- http://sm####leasure.net/index.php?me########
- http://wo####illion.net/index.php?me########
- http://sm###toward.net/index.php?me########
- http://wo####leasure.net/index.php?me########
- http://cr###white.net/index.php?me########
- http://th####ttoward.net/index.php?me########
- http://cr####illion.net/index.php?me########
- http://su###rwhite.net/index.php?me########
- http://wa####leasure.net/index.php?me########
- http://th####tmillion.net/index.php?me########
- http://wa###toward.net/index.php?me########
- http://th####tpleasure.net/index.php?me########
- http://sm####illion.net/index.php?me########
- http://fr###heart.net/index.php?me########
- http://ex####enceheart.net/index.php?me########
- http://pa###white.net/index.php?me########
- http://fi###white.net/index.php?me########
- http://fr###mayor.net/index.php?me########
- http://ex####encemayor.net/index.php?me########
- http://fr####erfect.net/index.php?me########
- http://ex#####nceperfect.net/index.php?me########
- http://pa###toward.net/index.php?me########
- http://fi###toward.net/index.php?me########
- http://wo###white.net/index.php?me########
- http://sm###white.net/index.php?me########
- http://pa####illion.net/index.php?me########
- http://fi####illion.net/index.php?me########
- http://pa####leasure.net/index.php?me########
- http://fi####leasure.net/index.php?me########
UDP:
- DNS ASK fo####perfect.net
- DNS ASK me####perfect.net
- DNS ASK fo###wheart.net
- DNS ASK me###rheart.net
- DNS ASK fo####battle.net
- DNS ASK me####battle.net
- DNS ASK fo###wmayor.net
- DNS ASK me###rmayor.net
- DNS ASK al####ybattle.net
- DNS ASK al####yheart.net
- DNS ASK ge#####anperfect.net
- DNS ASK ex#####ncebattle.net
- DNS ASK ge####manheart.net
- DNS ASK al####ymayor.net
- DNS ASK ge####manbattle.net
- DNS ASK al####yperfect.net
- DNS ASK ge####manmayor.net
- DNS ASK cr####erfect.net
- DNS ASK su###rmayor.net
- DNS ASK cr###heart.net
- DNS ASK su####perfect.net
- DNS ASK cr###battle.net
- DNS ASK th####theart.net
- DNS ASK cr###mayor.net
- DNS ASK su####battle.net
- DNS ASK su###rheart.net
- DNS ASK be####erfect.net
- DNS ASK kn####erfect.net
- DNS ASK be###heart.net
- DNS ASK kn###heart.net
- DNS ASK be###battle.net
- DNS ASK kn###battle.net
- DNS ASK be###mayor.net
- DNS ASK kn###mayor.net
- DNS ASK wo###toward.net
- DNS ASK sm###toward.net
- DNS ASK th####twhite.net
- DNS ASK wa###white.net
- DNS ASK wo####illion.net
- DNS ASK sm####illion.net
- DNS ASK wo####leasure.net
- DNS ASK sm####leasure.net
- DNS ASK wa####illion.net
- DNS ASK cr###white.net
- DNS ASK th####ttoward.net
- DNS ASK cr####illion.net
- DNS ASK su###rwhite.net
- DNS ASK wa####leasure.net
- DNS ASK th####tmillion.net
- DNS ASK wa###toward.net
- DNS ASK th####tpleasure.net
- DNS ASK ex####enceheart.net
- DNS ASK fr####erfect.net
- DNS ASK fi###white.net
- DNS ASK fr###heart.net
- DNS ASK ex####encemayor.net
- DNS ASK fr###battle.net
- DNS ASK ex#####nceperfect.net
- DNS ASK fr###mayor.net
- DNS ASK pa###white.net
- DNS ASK pa###toward.net
- DNS ASK fi###toward.net
- DNS ASK wo###white.net
- DNS ASK sm###white.net
- DNS ASK pa####illion.net
- DNS ASK fi####illion.net
- DNS ASK pa####leasure.net
- DNS ASK fi####leasure.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
