Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Storage Accounts Player' = '%APPDATA%\tvkaohfc\dzrqhfz.exe'
Вредоносные функции:
Создает и запускает на исполнение:
- '%APPDATA%\tvkaohfc\rdguwvzcphx.exe' "%APPDATA%\tvkaohfc\dzrqhfz.exe"
- '%APPDATA%\tvkaohfc\dzrqhfz.exe'
Изменения в файловой системе:
Создает следующие файлы:
- %APPDATA%\tvkaohfc\dzrqhfz.ilq
- %APPDATA%\tvkaohfc\rdguwvzcphx.exe
- %APPDATA%\tvkaohfc\dzrqhfz.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- %APPDATA%\tvkaohfc\rdguwvzcphx.exe
- %APPDATA%\tvkaohfc\dzrqhfz.exe
Сетевая активность:
Подключается к:
- 'in####seinclude.net':80
- 'fo####include.net':80
- 'in####segeneral.net':80
- 'fo###tnorth.net':80
- 're####erclear.net':80
- 'wo###clear.net':80
- 'in####senorth.net':80
- 'ef###tnorth.net':80
- 'th####hinclude.net':80
- 'ef####include.net':80
- 'th####hnorth.net':80
- 'fo####general.net':80
- 'in####seclear.net':80
- 'fo###tclear.net':80
- 'hu####dbelieve.net':80
- 'jo####ybelieve.net':80
- 'hu####dbranch.net':80
- 'jo####yreceive.net':80
- 'hu####dquarter.net':80
- 'jo####yquarter.net':80
- 'hu####dreceive.net':80
- 'wo####nclude.net':80
- 're####ergeneral.net':80
- 'wo####eneral.net':80
- 're####erinclude.net':80
- 'jo####ybranch.net':80
- 're####ernorth.net':80
- 'wo###north.net':80
- 'th####hgeneral.net':80
- 'ch###clear.net':80
- 'be###gnorth.net':80
- 'ri###nnorth.net':80
- 'th###clear.net':80
- 'ch####nclude.net':80
- 'th####eneral.net':80
- 'ch####eneral.net':80
- 'be###gclear.net':80
- 'ri###nclear.net':80
- 'li###enorth.net':80
- 'ri####general.net':80
- 'be####include.net':80
- 'ri####include.net':80
- 'be####general.net':80
- 'wi###nnorth.net':80
- 'su####include.net':80
- 'wi####include.net':80
- 'su###rnorth.net':80
- 'ef####general.net':80
- 'th####hclear.net':80
- 'ef###tclear.net':80
- 'th###north.net':80
- 'ch###north.net':80
- 'th####nclude.net':80
- 'wi###nclear.net':80
- 'su####general.net':80
- 'wi####general.net':80
- 'su###rclear.net':80
TCP:
Запросы HTTP GET:
- http://in####seinclude.net/forum/search.php?em#####################################
- http://fo####include.net/forum/search.php?em#####################################
- http://in####segeneral.net/forum/search.php?em#####################################
- http://fo###tnorth.net/forum/search.php?em#####################################
- http://re####erclear.net/forum/search.php?em#####################################
- http://wo###clear.net/forum/search.php?em#####################################
- http://in####senorth.net/forum/search.php?em#####################################
- http://ef###tnorth.net/forum/search.php?em#####################################
- http://th####hinclude.net/forum/search.php?em#####################################
- http://ef####include.net/forum/search.php?em#####################################
- http://th####hnorth.net/forum/search.php?em#####################################
- http://fo####general.net/forum/search.php?em#####################################
- http://in####seclear.net/forum/search.php?em#####################################
- http://fo###tclear.net/forum/search.php?em#####################################
- http://hu####dbelieve.net/forum/search.php?em#####################################
- http://jo####ybelieve.net/forum/search.php?em#####################################
- http://hu####dbranch.net/forum/search.php?em#####################################
- http://jo####yreceive.net/forum/search.php?em#####################################
- http://hu####dquarter.net/forum/search.php?em#####################################
- http://jo####yquarter.net/forum/search.php?em#####################################
- http://hu####dreceive.net/forum/search.php?em#####################################
- http://wo####nclude.net/forum/search.php?em#####################################
- http://re####ergeneral.net/forum/search.php?em#####################################
- http://wo####eneral.net/forum/search.php?em#####################################
- http://re####erinclude.net/forum/search.php?em#####################################
- http://jo####ybranch.net/forum/search.php?em#####################################
- http://re####ernorth.net/forum/search.php?em#####################################
- http://wo###north.net/forum/search.php?em#####################################
- http://th####hgeneral.net/forum/search.php?em#####################################
- http://ch###clear.net/forum/search.php?em#####################################
- http://be###gnorth.net/forum/search.php?em#####################################
- http://ri###nnorth.net/forum/search.php?em#####################################
- http://th###clear.net/forum/search.php?em#####################################
- http://ch####nclude.net/forum/search.php?em#####################################
- http://th####eneral.net/forum/search.php?em#####################################
- http://ch####eneral.net/forum/search.php?em#####################################
- http://be###gclear.net/forum/search.php?em#####################################
- http://ri###nclear.net/forum/search.php?em#####################################
- http://li###enorth.net/forum/search.php?em#####################################
- http://ri####general.net/forum/search.php?em#####################################
- http://be####include.net/forum/search.php?em#####################################
- http://ri####include.net/forum/search.php?em#####################################
- http://be####general.net/forum/search.php?em#####################################
- http://wi###nnorth.net/forum/search.php?em#####################################
- http://su####include.net/forum/search.php?em#####################################
- http://wi####include.net/forum/search.php?em#####################################
- http://su###rnorth.net/forum/search.php?em#####################################
- http://ef####general.net/forum/search.php?em#####################################
- http://th####hclear.net/forum/search.php?em#####################################
- http://ef###tclear.net/forum/search.php?em#####################################
- http://th###north.net/forum/search.php?em#####################################
- http://ch###north.net/forum/search.php?em#####################################
- http://th####nclude.net/forum/search.php?em#####################################
- http://wi###nclear.net/forum/search.php?em#####################################
- http://su####general.net/forum/search.php?em#####################################
- http://wi####general.net/forum/search.php?em#####################################
- http://su###rclear.net/forum/search.php?em#####################################
UDP:
- DNS ASK in####seinclude.net
- DNS ASK fo####include.net
- DNS ASK in####segeneral.net
- DNS ASK fo###tnorth.net
- DNS ASK re####erclear.net
- DNS ASK wo###clear.net
- DNS ASK in####senorth.net
- DNS ASK ef###tnorth.net
- DNS ASK th####hinclude.net
- DNS ASK ef####include.net
- DNS ASK th####hnorth.net
- DNS ASK fo####general.net
- DNS ASK in####seclear.net
- DNS ASK fo###tclear.net
- DNS ASK hu####dbelieve.net
- DNS ASK jo####ybelieve.net
- DNS ASK hu####dbranch.net
- DNS ASK jo####yreceive.net
- DNS ASK hu####dquarter.net
- DNS ASK jo####yquarter.net
- DNS ASK hu####dreceive.net
- DNS ASK wo####nclude.net
- DNS ASK re####ergeneral.net
- DNS ASK wo####eneral.net
- DNS ASK re####erinclude.net
- DNS ASK jo####ybranch.net
- DNS ASK re####ernorth.net
- DNS ASK wo###north.net
- DNS ASK th####hgeneral.net
- DNS ASK ch###clear.net
- DNS ASK be###gnorth.net
- DNS ASK ri###nnorth.net
- DNS ASK th###clear.net
- DNS ASK ch####nclude.net
- DNS ASK th####eneral.net
- DNS ASK ch####eneral.net
- DNS ASK be###gclear.net
- DNS ASK ri###nclear.net
- DNS ASK li###enorth.net
- DNS ASK ri####general.net
- DNS ASK be####include.net
- DNS ASK ri####include.net
- DNS ASK be####general.net
- DNS ASK wi###nnorth.net
- DNS ASK su####include.net
- DNS ASK wi####include.net
- DNS ASK su###rnorth.net
- DNS ASK ef####general.net
- DNS ASK th####hclear.net
- DNS ASK ef###tclear.net
- DNS ASK th###north.net
- DNS ASK ch###north.net
- DNS ASK th####nclude.net
- DNS ASK wi###nclear.net
- DNS ASK su####general.net
- DNS ASK wi####general.net
- DNS ASK su###rclear.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'Indicator' WindowName: ''
