Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'File DLL Files Tracking Services Card' = 'C:\iddrdqu\lcd6bgegq.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Fax Name Cryptographic SSDP Web] 'ImagePath' = 'C:\iddrdqu\lcd6bgegq.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Fax Name Cryptographic SSDP Web] 'Start' = '00000002'
Вредоносные функции:
Запускает на исполнение:
- 'C:\iddrdqu\bwzawrzfmp.exe' "c:\iddrdqu\lcd6bgegq.exe"
- 'C:\iddrdqu\lcd6bgegq.exe'
- 'C:\iddrdqu\voltl4ne34m9fzjmstemzu.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\iddrdqu\lcd6bgegq.exe
- C:\iddrdqu\bwzawrzfmp.exe
- C:\iddrdqu\o6nrboacr
- %WINDIR%\iddrdqu\dnccd98
- C:\iddrdqu\dnccd98
- C:\iddrdqu\voltl4ne34m9fzjmstemzu.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\iddrdqu\bwzawrzfmp.exe
- C:\iddrdqu\lcd6bgegq.exe
Удаляет следующие файлы:
- C:\iddrdqu\voltl4ne34m9fzjmstemzu.exe
- %WINDIR%\iddrdqu\dnccd98
Подменяет следующие файлы:
- %WINDIR%\iddrdqu\dnccd98
Сетевая активность:
Подключается к:
- 'ar######dshakesheave.net':80
- 'za#####ahtimberlake.net':80
- 'za######hshakesheave.net':80
- 'za#####ahchristians.net':80
- 'ar#####ldchristians.net':80
- 'sh#####lechristians.net':80
- 'ch#####nechristians.net':80
- 'ar######dstainthorpe.net':80
- 'ar#####ldtimberlake.net':80
- 'za######hstainthorpe.net':80
- 'ge######astainthorpe.net':80
- 'gu######nstainthorpe.net':80
- 'an######estainthorpe.net':80
- 'an#####letimberlake.net':80
- 'an######eshakesheave.net':80
- 'gu#####entimberlake.net':80
- 'ch#####letimberlake.net':80
- 'ge#####natimberlake.net':80
- 'ge######ashakesheave.net':80
- 'ch#####lechristians.net':80
- 'ge#####nachristians.net':80
- 'al#####rachristians.net':80
- 'ma#####nachristians.net':80
- 'am######estainthorpe.net':80
- 'am#####netimberlake.net':80
- 'ce######estainthorpe.net':80
- 'ma#####natimberlake.net':80
- 'al######astainthorpe.net':80
- 'al#####ratimberlake.net':80
- 'al######ashakesheave.net':80
- 'ma######ashakesheave.net':80
- 'ce#####netimberlake.net':80
- 'ch#####netimberlake.net':80
- 'sh######estainthorpe.net':80
- 'sh#####letimberlake.net':80
- 'sh######eshakesheave.net':80
- 'ch######eshakesheave.net':80
- 'ce######eshakesheave.net':80
- 'am######eshakesheave.net':80
- 'am#####nechristians.net':80
- 'ch######estainthorpe.net':80
- 'ce#####nechristians.net':80
TCP:
Запросы HTTP GET:
- http://ar######dshakesheave.net/index.php
- http://za#####ahtimberlake.net/index.php
- http://za######hshakesheave.net/index.php
- http://za#####ahchristians.net/index.php
- http://ar#####ldchristians.net/index.php
- http://sh#####lechristians.net/index.php
- http://ch#####nechristians.net/index.php
- http://ar######dstainthorpe.net/index.php
- http://ar#####ldtimberlake.net/index.php
- http://za######hstainthorpe.net/index.php
- http://ge######astainthorpe.net/index.php
- http://gu######nstainthorpe.net/index.php
- http://an######estainthorpe.net/index.php
- http://an#####letimberlake.net/index.php
- http://an######eshakesheave.net/index.php
- http://gu#####entimberlake.net/index.php
- http://ch#####letimberlake.net/index.php
- http://ge#####natimberlake.net/index.php
- http://ge######ashakesheave.net/index.php
- http://ch#####lechristians.net/index.php
- http://ge#####nachristians.net/index.php
- http://al#####rachristians.net/index.php
- http://ma#####nachristians.net/index.php
- http://am######estainthorpe.net/index.php
- http://am#####netimberlake.net/index.php
- http://ce######estainthorpe.net/index.php
- http://ma#####natimberlake.net/index.php
- http://al######astainthorpe.net/index.php
- http://al#####ratimberlake.net/index.php
- http://al######ashakesheave.net/index.php
- http://ma######ashakesheave.net/index.php
- http://ce#####netimberlake.net/index.php
- http://ch#####netimberlake.net/index.php
- http://sh######estainthorpe.net/index.php
- http://sh#####letimberlake.net/index.php
- http://sh######eshakesheave.net/index.php
- http://ch######eshakesheave.net/index.php
- http://ce######eshakesheave.net/index.php
- http://am######eshakesheave.net/index.php
- http://am#####nechristians.net/index.php
- http://ch######estainthorpe.net/index.php
- http://ce#####nechristians.net/index.php
UDP:
- DNS ASK za######hshakesheave.net
- DNS ASK ar######dshakesheave.net
- DNS ASK ar#####ldchristians.net
- DNS ASK ge######astainthorpe.net
- DNS ASK za#####ahchristians.net
- DNS ASK ar######dstainthorpe.net
- DNS ASK sh#####lechristians.net
- DNS ASK za######hstainthorpe.net
- DNS ASK za#####ahtimberlake.net
- DNS ASK ar#####ldtimberlake.net
- DNS ASK ge#####natimberlake.net
- DNS ASK an#####letimberlake.net
- DNS ASK gu######nstainthorpe.net
- DNS ASK gu#####entimberlake.net
- DNS ASK gu######nshakesheave.net
- DNS ASK an######eshakesheave.net
- DNS ASK ge######ashakesheave.net
- DNS ASK ch#####letimberlake.net
- DNS ASK ge#####nachristians.net
- DNS ASK an######estainthorpe.net
- DNS ASK ch#####lechristians.net
- DNS ASK ch#####nechristians.net
- DNS ASK al#####rachristians.net
- DNS ASK ma#####nachristians.net
- DNS ASK am######estainthorpe.net
- DNS ASK am#####netimberlake.net
- DNS ASK ce######estainthorpe.net
- DNS ASK ma#####natimberlake.net
- DNS ASK al######astainthorpe.net
- DNS ASK al#####ratimberlake.net
- DNS ASK al######ashakesheave.net
- DNS ASK ma######ashakesheave.net
- DNS ASK ce#####netimberlake.net
- DNS ASK ch#####netimberlake.net
- DNS ASK sh######estainthorpe.net
- DNS ASK sh#####letimberlake.net
- DNS ASK sh######eshakesheave.net
- DNS ASK ch######eshakesheave.net
- DNS ASK ce######eshakesheave.net
- DNS ASK am######eshakesheave.net
- DNS ASK am#####nechristians.net
- DNS ASK ch######estainthorpe.net
- DNS ASK ce#####nechristians.net
