Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Name Time Diagnostic File Publication Link' = 'C:\tmnpgzyshdrng\ecjaten.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Problem Service Configuration Upgrade Session] 'ImagePath' = 'C:\tmnpgzyshdrng\ecjaten.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Problem Service Configuration Upgrade Session] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- 'C:\tmnpgzyshdrng\elbhtdvvc.exe' "c:\tmnpgzyshdrng\ecjaten.exe"
- 'C:\tmnpgzyshdrng\ecjaten.exe'
- 'C:\tmnpgzyshdrng\ss33fpqsekdz2ju.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\tmnpgzyshdrng\ecjaten.exe
- C:\tmnpgzyshdrng\elbhtdvvc.exe
- C:\tmnpgzyshdrng\ss33fpqsekdz2ju.exe
- %WINDIR%\tmnpgzyshdrng\zj4yqakj
- C:\tmnpgzyshdrng\zj4yqakj
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\tmnpgzyshdrng\elbhtdvvc.exe
- C:\tmnpgzyshdrng\ecjaten.exe
Удаляет следующие файлы:
- C:\tmnpgzyshdrng\ss33fpqsekdz2ju.exe
- %WINDIR%\tmnpgzyshdrng\zj4yqakj
Сетевая активность:
Подключается к:
- 'fi###bottom.net':80
- 'pa###bottom.net':80
- 'fr###flower.net':80
- 'fr###minute.net':80
- 'ex#####nceflower.net':80
- 'fi####orever.net':80
- 'fi###beyond.net':80
- 'pa###beyond.net':80
- 'pa###being.net':80
- 'pa####orever.net':80
- 'fi###being.net':80
- 'ex#####nceminute.net':80
- 'al####yminute.net':80
- 'ge####manminute.net':80
- 'ge#####anspecial.net':80
- 'ge####mancorner.net':80
- 'al####yspecial.net':80
- 'al####yflower.net':80
- 'ex#####ncespecial.net':80
- 'fr####pecial.net':80
- 'fr###corner.net':80
- 'ge####manflower.net':80
- 'ex#####ncecorner.net':80
- 'sm###bottom.net':80
- 'cr###bottom.net':80
- 'su####bottom.net':80
- 'th####tbeyond.net':80
- 'th####tbeing.net':80
- 'wa###beyond.net':80
- 'cr####orever.net':80
- 'cr###beyond.net':80
- 'su####beyond.net':80
- 'su###rbeing.net':80
- 'su####forever.net':80
- 'cr###being.net':80
- 'wa###being.net':80
- 'sm###being.net':80
- 'wo###being.net':80
- 'wo####orever.net':80
- 'wo###bottom.net':80
- 'sm####orever.net':80
- 'sm###beyond.net':80
- 'wa####orever.net':80
- 'th####tforever.net':80
- 'th####tbottom.net':80
- 'wo###beyond.net':80
- 'wa###bottom.net':80
TCP:
Запросы HTTP GET:
- http://fi###bottom.net/index.php
- http://pa###bottom.net/index.php
- http://fr###flower.net/index.php
- http://fr###minute.net/index.php
- http://ex#####nceflower.net/index.php
- http://fi####orever.net/index.php
- http://fi###beyond.net/index.php
- http://pa###beyond.net/index.php
- http://pa###being.net/index.php
- http://pa####orever.net/index.php
- http://fi###being.net/index.php
- http://ex#####nceminute.net/index.php
- http://al####yminute.net/index.php
- http://ge####manminute.net/index.php
- http://ge#####anspecial.net/index.php
- http://ge####mancorner.net/index.php
- http://al####yspecial.net/index.php
- http://al####yflower.net/index.php
- http://ex#####ncespecial.net/index.php
- http://fr####pecial.net/index.php
- http://fr###corner.net/index.php
- http://ge####manflower.net/index.php
- http://ex#####ncecorner.net/index.php
- http://sm###bottom.net/index.php
- http://cr###bottom.net/index.php
- http://su####bottom.net/index.php
- http://th####tbeyond.net/index.php
- http://th####tbeing.net/index.php
- http://wa###beyond.net/index.php
- http://cr####orever.net/index.php
- http://cr###beyond.net/index.php
- http://su####beyond.net/index.php
- http://su###rbeing.net/index.php
- http://su####forever.net/index.php
- http://cr###being.net/index.php
- http://wa###being.net/index.php
- http://sm###being.net/index.php
- http://wo###being.net/index.php
- http://wo####orever.net/index.php
- http://wo###bottom.net/index.php
- http://sm####orever.net/index.php
- http://sm###beyond.net/index.php
- http://wa####orever.net/index.php
- http://th####tforever.net/index.php
- http://th####tbottom.net/index.php
- http://wo###beyond.net/index.php
- http://wa###bottom.net/index.php
UDP:
- DNS ASK fr###flower.net
- DNS ASK fi###bottom.net
- DNS ASK pa###bottom.net
- DNS ASK ex#####nceminute.net
- DNS ASK fr###minute.net
- DNS ASK ex#####nceflower.net
- DNS ASK pa###being.net
- DNS ASK fi###beyond.net
- DNS ASK pa###beyond.net
- DNS ASK fi####orever.net
- DNS ASK pa####orever.net
- DNS ASK fi###being.net
- DNS ASK ge#####anspecial.net
- DNS ASK al####yminute.net
- DNS ASK ge####manminute.net
- DNS ASK al####ycorner.net
- DNS ASK ge####mancorner.net
- DNS ASK al####yspecial.net
- DNS ASK fr###corner.net
- DNS ASK ex#####ncespecial.net
- DNS ASK fr####pecial.net
- DNS ASK al####yflower.net
- DNS ASK ge####manflower.net
- DNS ASK ex#####ncecorner.net
- DNS ASK th####tbeyond.net
- DNS ASK cr###bottom.net
- DNS ASK su####bottom.net
- DNS ASK wa###being.net
- DNS ASK th####tbeing.net
- DNS ASK wa###beyond.net
- DNS ASK su###rbeing.net
- DNS ASK cr###beyond.net
- DNS ASK su####beyond.net
- DNS ASK cr####orever.net
- DNS ASK su####forever.net
- DNS ASK cr###being.net
- DNS ASK wo####orever.net
- DNS ASK sm###being.net
- DNS ASK wo###being.net
- DNS ASK sm###bottom.net
- DNS ASK wo###bottom.net
- DNS ASK sm####orever.net
- DNS ASK th####tbottom.net
- DNS ASK wa####orever.net
- DNS ASK th####tforever.net
- DNS ASK sm###beyond.net
- DNS ASK wo###beyond.net
- DNS ASK wa###bottom.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
