Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Tunneling Trap Transfer Compatibility Proxy' = 'C:\ynwuofuixlj\ypvmfoexaeiu.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Center Search VC Credential Transaction] 'ImagePath' = 'C:\ynwuofuixlj\ypvmfoexaeiu.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Center Search VC Credential Transaction] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- 'C:\ynwuofuixlj\blfziyvl.exe' "c:\ynwuofuixlj\ypvmfoexaeiu.exe"
- 'C:\ynwuofuixlj\ypvmfoexaeiu.exe'
- 'C:\ynwuofuixlj\udsw38x7mm8sfbad3vyj.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\ynwuofuixlj\ypvmfoexaeiu.exe
- C:\ynwuofuixlj\blfziyvl.exe
- C:\ynwuofuixlj\udsw38x7mm8sfbad3vyj.exe
- %WINDIR%\ynwuofuixlj\rgddexmjjjj
- C:\ynwuofuixlj\rgddexmjjjj
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\ynwuofuixlj\blfziyvl.exe
- C:\ynwuofuixlj\ypvmfoexaeiu.exe
Удаляет следующие файлы:
- C:\ynwuofuixlj\udsw38x7mm8sfbad3vyj.exe
- %WINDIR%\ynwuofuixlj\rgddexmjjjj
Подменяет следующие файлы:
- %WINDIR%\ynwuofuixlj\rgddexmjjjj
Сетевая активность:
Подключается к:
- 'se####lsettle.net':80
- 'pr####lybefore.net':80
- 'ma####alsettle.net':80
- 'ma#####llanguage.net':80
- 'se####llanguage.net':80
- 'sw###before.net':80
- 'sw####anguage.net':80
- 'pr####lysettle.net':80
- 'pr#####ylanguage.net':80
- 'pr####lydevice.net':80
- 'sw###device.net':80
- 'la###spring.net':80
- 'se####spring.net':80
- 'se####success.net':80
- 'se####banker.net':80
- 'la####uccess.net':80
- 'la###found.net':80
- 'ma####aldevice.net':80
- 'se####ldevice.net':80
- 'se####lbefore.net':80
- 'se###afound.net':80
- 'ma####albefore.net':80
- 'sw###settle.net':80
- 'wi####device.net':80
- 'pe####sdevice.net':80
- 'pe####sbefore.net':80
- 'su####tsettle.net':80
- 'wi####before.net':80
- 'wi####language.net':80
- 'po####lebefore.net':80
- 'mo####inbefore.net':80
- 'pe####ssettle.net':80
- 'pe####slanguage.net':80
- 'wi####settle.net':80
- 'fi####device.net':80
- 'le####anguage.net':80
- 'le###device.net':80
- 'le###before.net':80
- 'fi####before.net':80
- 'fi####language.net':80
- 'su####tdevice.net':80
- 'su####tlanguage.net':80
- 'su####tbefore.net':80
- 'le###settle.net':80
- 'fi####settle.net':80
TCP:
Запросы HTTP GET:
- http://se####lsettle.net/index.php
- http://pr####lybefore.net/index.php
- http://ma####alsettle.net/index.php
- http://ma#####llanguage.net/index.php
- http://se####llanguage.net/index.php
- http://sw###before.net/index.php
- http://sw####anguage.net/index.php
- http://pr####lysettle.net/index.php
- http://pr#####ylanguage.net/index.php
- http://pr####lydevice.net/index.php
- http://sw###device.net/index.php
- http://la###spring.net/index.php
- http://se####spring.net/index.php
- http://se####success.net/index.php
- http://se####banker.net/index.php
- http://la####uccess.net/index.php
- http://la###found.net/index.php
- http://ma####aldevice.net/index.php
- http://se####ldevice.net/index.php
- http://se####lbefore.net/index.php
- http://se###afound.net/index.php
- http://ma####albefore.net/index.php
- http://sw###settle.net/index.php
- http://wi####device.net/index.php
- http://pe####sdevice.net/index.php
- http://pe####sbefore.net/index.php
- http://su####tsettle.net/index.php
- http://wi####before.net/index.php
- http://wi####language.net/index.php
- http://po####lebefore.net/index.php
- http://mo####inbefore.net/index.php
- http://pe####ssettle.net/index.php
- http://pe####slanguage.net/index.php
- http://wi####settle.net/index.php
- http://fi####device.net/index.php
- http://le####anguage.net/index.php
- http://le###device.net/index.php
- http://le###before.net/index.php
- http://fi####before.net/index.php
- http://fi####language.net/index.php
- http://su####tdevice.net/index.php
- http://su####tlanguage.net/index.php
- http://su####tbefore.net/index.php
- http://le###settle.net/index.php
- http://fi####settle.net/index.php
UDP:
- DNS ASK se####lsettle.net
- DNS ASK pr####lybefore.net
- DNS ASK ma####alsettle.net
- DNS ASK ma#####llanguage.net
- DNS ASK se####llanguage.net
- DNS ASK sw###before.net
- DNS ASK sw####anguage.net
- DNS ASK pr####lysettle.net
- DNS ASK pr#####ylanguage.net
- DNS ASK pr####lydevice.net
- DNS ASK sw###device.net
- DNS ASK la###spring.net
- DNS ASK se####spring.net
- DNS ASK se####success.net
- DNS ASK se####banker.net
- DNS ASK la####uccess.net
- DNS ASK la###found.net
- DNS ASK ma####aldevice.net
- DNS ASK se####ldevice.net
- DNS ASK se####lbefore.net
- DNS ASK se###afound.net
- DNS ASK ma####albefore.net
- DNS ASK sw###settle.net
- DNS ASK wi####device.net
- DNS ASK pe####sdevice.net
- DNS ASK pe####sbefore.net
- DNS ASK su####tsettle.net
- DNS ASK wi####before.net
- DNS ASK wi####language.net
- DNS ASK po####lebefore.net
- DNS ASK mo####inbefore.net
- DNS ASK pe####ssettle.net
- DNS ASK pe####slanguage.net
- DNS ASK wi####settle.net
- DNS ASK fi####device.net
- DNS ASK le####anguage.net
- DNS ASK le###device.net
- DNS ASK le###before.net
- DNS ASK fi####before.net
- DNS ASK fi####language.net
- DNS ASK su####tdevice.net
- DNS ASK su####tlanguage.net
- DNS ASK su####tbefore.net
- DNS ASK le###settle.net
- DNS ASK fi####settle.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
