Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Config COM Microsoft WinHTTP' = '<SYSTEM32>\oadlpzufk.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\PnP-X Intelligent Procedure Host Defragmenter] 'Start' = '00000002'
Вредоносные функции:
Для затруднения выявления своего присутствия в системе
блокирует:
- Центр обеспечения безопасности (Security Center)
Создает и запускает на исполнение:
- '<SYSTEM32>\jqsziptvuew.exe' "<SYSTEM32>\oadlpzufk.exe"
- '%WINDIR%\Temp\udxolcm03sihx6bxx.exe' -r 31388 tcp
- '%TEMP%\udxolcm03irdx6bxxxlrpxxsp.exe'
- '<SYSTEM32>\oadlpzufk.exe'
Изменения в файловой системе:
Создает следующие файлы:
- <SYSTEM32>\uczjmzy\run
- <SYSTEM32>\uczjmzy\rng
- %WINDIR%\Temp\udxolcm03sihx6bxx.exe
- <SYSTEM32>\uczjmzy\cfg
- <SYSTEM32>\jqsziptvuew.exe
- %TEMP%\udxolcm03irdx6bxxxlrpxxsp.exe
- <SYSTEM32>\uczjmzy\tst
- <SYSTEM32>\oadlpzufk.exe
- <SYSTEM32>\uczjmzy\etc
Присваивает атрибут 'скрытый' для следующих файлов:
- <SYSTEM32>\jqsziptvuew.exe
- <SYSTEM32>\oadlpzufk.exe
Удаляет следующие файлы:
- %WINDIR%\Temp\udxolcm03sihx6bxx.exe
- <DRIVERS>\etc\hosts
- %TEMP%\udxolcm03irdx6bxxxlrpxxsp.exe
Подменяет файл HOSTS.
Сетевая активность:
Подключается к:
- 'hi###urry.net':80
- 'wh####irteen.net':80
- 'hi####irteen.net':80
- 'wh###urry.net':80
- 'fe###eft.net':80
- 'lo###ope.net':80
- 'fe###ope.net':80
- 'ju###urry.net':80
- 'mo###urry.net':80
- 'ju####irteen.net':80
- 'hi###ope.net':80
- 'wh###eft.net':80
- 'hi###eft.net':80
- 'wh###ope.net':80
- 'lo###eft.net':80
- 'wi###ope.net':80
- 'dr###hope.net':80
- 'th###hurry.net':80
- 'dr###left.net':80
- 'wi####irteen.net':80
- 'dr####hirteen.net':80
- 'wi###eft.net':80
- 'fe###urry.net':80
- 'lo####irteen.net':80
- 'fe####irteen.net':80
- 'lo###urry.net':80
- 'th####hirteen.net':80
- 'th###left.net':80
- 'th###hope.net':80
- 'mo####irteen.net':80
- 'pi###ope.net':80
- 'ab###urry.net':80
- 'kn###urry.net':80
- 'so###ope.net':80
- 'pi####irteen.net':80
- 'so###eft.net':80
- 'pi###eft.net':80
- 'be##lxc.com':80
- 'af###sllc.com':80
- 'ri###nstorm.net':80
- 'de###lxc.com':80
- 'ab####irteen.net':80
- 'kn####irteen.net':80
- 'ab###eft.net':80
- 'so####irteen.net':80
- 'si###urry.net':80
- 'ro###urry.net':80
- 'si####irteen.net':80
- 'mo###ope.net':80
- 'ju###eft.net':80
- 'mo###eft.net':80
- 'ju###ope.net':80
- 'ro###ope.net':80
- 'so###urry.net':80
- 'pi###urry.net':80
- 'si###ope.net':80
- 'ro####irteen.net':80
- 'si###eft.net':80
- 'ro###eft.net':80
TCP:
Запросы HTTP GET:
- http://hi###urry.net/index.php
- http://wh####irteen.net/index.php
- http://hi####irteen.net/index.php
- http://wh###urry.net/index.php
- http://fe###eft.net/index.php
- http://lo###ope.net/index.php
- http://fe###ope.net/index.php
- http://ju###urry.net/index.php
- http://mo###urry.net/index.php
- http://ju####irteen.net/index.php
- http://hi###ope.net/index.php
- http://wh###eft.net/index.php
- http://hi###eft.net/index.php
- http://wh###ope.net/index.php
- http://lo###eft.net/index.php
- http://wi###ope.net/index.php
- http://dr###hope.net/index.php
- http://th###hurry.net/index.php
- http://dr###left.net/index.php
- http://wi####irteen.net/index.php
- http://dr####hirteen.net/index.php
- http://wi###eft.net/index.php
- http://fe###urry.net/index.php
- http://lo####irteen.net/index.php
- http://fe####irteen.net/index.php
- http://lo###urry.net/index.php
- http://th####hirteen.net/index.php
- http://th###left.net/index.php
- http://th###hope.net/index.php
- http://mo####irteen.net/index.php
- http://pi###ope.net/index.php
- http://ab###urry.net/index.php
- http://kn###urry.net/index.php
- http://so###ope.net/index.php
- http://pi####irteen.net/index.php
- http://so###eft.net/index.php
- http://pi###eft.net/index.php
- http://be##lxc.com/index.php
- http://af###sllc.com/index.php
- http://ri###nstorm.net/index.php
- http://de###lxc.com/index.php
- http://ab####irteen.net/index.php
- http://kn####irteen.net/index.php
- http://ab###eft.net/index.php
- http://so####irteen.net/index.php
- http://si###urry.net/index.php
- http://ro###urry.net/index.php
- http://si####irteen.net/index.php
- http://mo###ope.net/index.php
- http://ju###eft.net/index.php
- http://mo###eft.net/index.php
- http://ju###ope.net/index.php
- http://ro###ope.net/index.php
- http://so###urry.net/index.php
- http://pi###urry.net/index.php
- http://si###ope.net/index.php
- http://ro####irteen.net/index.php
- http://si###eft.net/index.php
- http://ro###eft.net/index.php
UDP:
- DNS ASK wh###urry.net
- DNS ASK hi###urry.net
- DNS ASK wh####irteen.net
- DNS ASK fe###ope.net
- DNS ASK lo###eft.net
- DNS ASK fe###eft.net
- DNS ASK lo###ope.net
- DNS ASK hi####irteen.net
- DNS ASK ju###urry.net
- DNS ASK mo###urry.net
- DNS ASK ju####irteen.net
- DNS ASK hi###ope.net
- DNS ASK wh###eft.net
- DNS ASK hi###eft.net
- DNS ASK wh###ope.net
- DNS ASK dr###left.net
- DNS ASK wi###ope.net
- DNS ASK dr###hope.net
- DNS ASK wi###eft.net
- DNS ASK dr###hurry.net
- DNS ASK wi####irteen.net
- DNS ASK dr####hirteen.net
- DNS ASK th###hurry.net
- DNS ASK fe###urry.net
- DNS ASK lo####irteen.net
- DNS ASK fe####irteen.net
- DNS ASK lo###urry.net
- DNS ASK th####hirteen.net
- DNS ASK th###left.net
- DNS ASK th###hope.net
- DNS ASK mo####irteen.net
- DNS ASK pi###ope.net
- DNS ASK ab###urry.net
- DNS ASK kn###urry.net
- DNS ASK so###ope.net
- DNS ASK pi####irteen.net
- DNS ASK so###eft.net
- DNS ASK pi###eft.net
- DNS ASK be##lxc.com
- DNS ASK af###sllc.com
- DNS ASK ri###nstorm.net
- DNS ASK de###lxc.com
- DNS ASK ab####irteen.net
- DNS ASK kn####irteen.net
- DNS ASK ab###eft.net
- DNS ASK so####irteen.net
- DNS ASK si###urry.net
- DNS ASK ro###urry.net
- DNS ASK si####irteen.net
- DNS ASK mo###ope.net
- DNS ASK ju###eft.net
- DNS ASK mo###eft.net
- DNS ASK ju###ope.net
- DNS ASK ro###ope.net
- DNS ASK so###urry.net
- DNS ASK pi###urry.net
- DNS ASK si###ope.net
- DNS ASK ro####irteen.net
- DNS ASK si###eft.net
- DNS ASK ro###eft.net
- '23#.#55.255.250':1900
