Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Server Isolation Level Agent Coordinator WinHTTP' = '%APPDATA%\cscybhlxbb\hctapqjb.exe'
Вредоносные функции:
Создает и запускает на исполнение:
- '%APPDATA%\cscybhlxbb\efijucfxax.exe' "%APPDATA%\cscybhlxbb\hctapqjb.exe"
- '%APPDATA%\cscybhlxbb\hctapqjb.exe'
Изменения в файловой системе:
Создает следующие файлы:
- %APPDATA%\cscybhlxbb\hctapqjb.oomqe
- %APPDATA%\cscybhlxbb\efijucfxax.exe
- %APPDATA%\cscybhlxbb\hctapqjb.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- %APPDATA%\cscybhlxbb\efijucfxax.exe
- %APPDATA%\cscybhlxbb\hctapqjb.exe
Сетевая активность:
Подключается к:
- 'in####sesystem.net':80
- 'fo###ttrust.net':80
- 'in####seneither.net':80
- 'fo####system.net':80
- 're####erhonor.net':80
- 'wo####either.net':80
- 'in####setrust.net':80
- 'wo###honor.net':80
- 'th####hsystem.net':80
- 'ef###ttrust.net':80
- 'th####hneither.net':80
- 'ef####system.net':80
- 'in####sehonor.net':80
- 'fo####neither.net':80
- 'th####htrust.net':80
- 'fo###thonor.net':80
- 're####erneither.net':80
- 'jo####yfriend.net':80
- 'hu####dfriend.net':80
- 'jo####yconsider.net':80
- 'hu####dconsider.net':80
- 'de####yfancy.net':80
- 'li###efancy.net':80
- 'de####ylaughter.net':80
- 'li####laughter.net':80
- 'wo###trust.net':80
- 're####ertrust.net':80
- 'wo###system.net':80
- 're####ersystem.net':80
- 'jo####yfancy.net':80
- 'hu####dfancy.net':80
- 'jo####ylaughter.net':80
- 'hu####dlaughter.net':80
- 'ef####neither.net':80
- 'be####neither.net':80
- 'ri####system.net':80
- 'be###ghonor.net':80
- 'ri####neither.net':80
- 'be###gtrust.net':80
- 'ch###honor.net':80
- 'be####system.net':80
- 'ri###ntrust.net':80
- 'li####neither.net':80
- 'de####ysystem.net':80
- 'li###ehonor.net':80
- 'de####yneither.net':80
- 'li###etrust.net':80
- 'ri###nhonor.net':80
- 'li####system.net':80
- 'de####ytrust.net':80
- 'th###honor.net':80
- 'wi####system.net':80
- 'su####system.net':80
- 'wi####neither.net':80
- 'su####neither.net':80
- 'ef###thonor.net':80
- 'th####hhonor.net':80
- 'wi###ntrust.net':80
- 'su###rtrust.net':80
- 'ch###system.net':80
- 'th###system.net':80
- 'ch####either.net':80
- 'th####either.net':80
- 'wi###nhonor.net':80
- 'su###rhonor.net':80
- 'ch###trust.net':80
- 'th###trust.net':80
TCP:
Запросы HTTP GET:
- http://in####sesystem.net/forum/search.php?em##################################
- http://fo###ttrust.net/forum/search.php?em##################################
- http://in####seneither.net/forum/search.php?em##################################
- http://fo####system.net/forum/search.php?em##################################
- http://re####erhonor.net/forum/search.php?em##################################
- http://wo####either.net/forum/search.php?em##################################
- http://in####setrust.net/forum/search.php?em##################################
- http://wo###honor.net/forum/search.php?em##################################
- http://th####hsystem.net/forum/search.php?em##################################
- http://ef###ttrust.net/forum/search.php?em##################################
- http://th####hneither.net/forum/search.php?em##################################
- http://ef####system.net/forum/search.php?em##################################
- http://in####sehonor.net/forum/search.php?em##################################
- http://fo####neither.net/forum/search.php?em##################################
- http://th####htrust.net/forum/search.php?em##################################
- http://fo###thonor.net/forum/search.php?em##################################
- http://re####erneither.net/forum/search.php?em##################################
- http://jo####yfriend.net/forum/search.php?em##################################
- http://hu####dfriend.net/forum/search.php?em##################################
- http://jo####yconsider.net/forum/search.php?em##################################
- http://hu####dconsider.net/forum/search.php?em##################################
- http://de####yfancy.net/forum/search.php?em##################################
- http://li###efancy.net/forum/search.php?em##################################
- http://de####ylaughter.net/forum/search.php?em##################################
- http://li####laughter.net/forum/search.php?em##################################
- http://wo###trust.net/forum/search.php?em##################################
- http://re####ertrust.net/forum/search.php?em##################################
- http://wo###system.net/forum/search.php?em##################################
- http://re####ersystem.net/forum/search.php?em##################################
- http://jo####yfancy.net/forum/search.php?em##################################
- http://hu####dfancy.net/forum/search.php?em##################################
- http://jo####ylaughter.net/forum/search.php?em##################################
- http://hu####dlaughter.net/forum/search.php?em##################################
- http://ef####neither.net/forum/search.php?em##################################
- http://be####neither.net/forum/search.php?em##################################
- http://ri####system.net/forum/search.php?em##################################
- http://be###ghonor.net/forum/search.php?em##################################
- http://ri####neither.net/forum/search.php?em##################################
- http://be###gtrust.net/forum/search.php?em##################################
- http://ch###honor.net/forum/search.php?em##################################
- http://be####system.net/forum/search.php?em##################################
- http://ri###ntrust.net/forum/search.php?em##################################
- http://li####neither.net/forum/search.php?em##################################
- http://de####ysystem.net/forum/search.php?em##################################
- http://li###ehonor.net/forum/search.php?em##################################
- http://de####yneither.net/forum/search.php?em##################################
- http://li###etrust.net/forum/search.php?em##################################
- http://ri###nhonor.net/forum/search.php?em##################################
- http://li####system.net/forum/search.php?em##################################
- http://de####ytrust.net/forum/search.php?em##################################
- http://th###honor.net/forum/search.php?em##################################
- http://wi####system.net/forum/search.php?em##################################
- http://su####system.net/forum/search.php?em##################################
- http://wi####neither.net/forum/search.php?em##################################
- http://su####neither.net/forum/search.php?em##################################
- http://ef###thonor.net/forum/search.php?em##################################
- http://th####hhonor.net/forum/search.php?em##################################
- http://wi###ntrust.net/forum/search.php?em##################################
- http://su###rtrust.net/forum/search.php?em##################################
- http://ch###system.net/forum/search.php?em##################################
- http://th###system.net/forum/search.php?em##################################
- http://ch####either.net/forum/search.php?em##################################
- http://th####either.net/forum/search.php?em##################################
- http://wi###nhonor.net/forum/search.php?em##################################
- http://su###rhonor.net/forum/search.php?em##################################
- http://ch###trust.net/forum/search.php?em##################################
- http://th###trust.net/forum/search.php?em##################################
UDP:
- DNS ASK in####sesystem.net
- DNS ASK fo###ttrust.net
- DNS ASK in####seneither.net
- DNS ASK fo####system.net
- DNS ASK re####erhonor.net
- DNS ASK wo####either.net
- DNS ASK in####setrust.net
- DNS ASK wo###honor.net
- DNS ASK th####hsystem.net
- DNS ASK ef###ttrust.net
- DNS ASK th####hneither.net
- DNS ASK ef####system.net
- DNS ASK in####sehonor.net
- DNS ASK fo####neither.net
- DNS ASK th####htrust.net
- DNS ASK fo###thonor.net
- DNS ASK re####erneither.net
- DNS ASK jo####yfriend.net
- DNS ASK hu####dfriend.net
- DNS ASK jo####yconsider.net
- DNS ASK hu####dconsider.net
- DNS ASK de####yfancy.net
- DNS ASK li###efancy.net
- DNS ASK de####ylaughter.net
- DNS ASK li####laughter.net
- DNS ASK wo###trust.net
- DNS ASK re####ertrust.net
- DNS ASK wo###system.net
- DNS ASK re####ersystem.net
- DNS ASK jo####yfancy.net
- DNS ASK hu####dfancy.net
- DNS ASK jo####ylaughter.net
- DNS ASK hu####dlaughter.net
- DNS ASK ef####neither.net
- DNS ASK be####neither.net
- DNS ASK ri####system.net
- DNS ASK be###ghonor.net
- DNS ASK ri####neither.net
- DNS ASK be###gtrust.net
- DNS ASK ch###honor.net
- DNS ASK be####system.net
- DNS ASK ri###ntrust.net
- DNS ASK li####neither.net
- DNS ASK de####ysystem.net
- DNS ASK li###ehonor.net
- DNS ASK de####yneither.net
- DNS ASK li###etrust.net
- DNS ASK ri###nhonor.net
- DNS ASK li####system.net
- DNS ASK de####ytrust.net
- DNS ASK th###honor.net
- DNS ASK wi####system.net
- DNS ASK su####system.net
- DNS ASK wi####neither.net
- DNS ASK su####neither.net
- DNS ASK ef###thonor.net
- DNS ASK th####hhonor.net
- DNS ASK wi###ntrust.net
- DNS ASK su###rtrust.net
- DNS ASK ch###system.net
- DNS ASK th###system.net
- DNS ASK ch####either.net
- DNS ASK th####either.net
- DNS ASK wi###nhonor.net
- DNS ASK su###rhonor.net
- DNS ASK ch###trust.net
- DNS ASK th###trust.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'Indicator' WindowName: ''
