Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Desktop Installer Web IPsec' = 'C:\niwwdxesq\qmppyyipqrv.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Shell Identity IKE Port Update Audio Source] 'ImagePath' = 'C:\niwwdxesq\qmppyyipqrv.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Shell Identity IKE Port Update Audio Source] 'Start' = '00000002'
Вредоносные функции:
Запускает на исполнение:
- 'C:\niwwdxesq\ztohopkyc.exe' "c:\niwwdxesq\qmppyyipqrv.exe"
- 'C:\niwwdxesq\qmppyyipqrv.exe'
- 'C:\niwwdxesq\oj355sztwesssvsn.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\niwwdxesq\qmppyyipqrv.exe
- C:\niwwdxesq\ztohopkyc.exe
- C:\niwwdxesq\vg59lzfhvgva
- %WINDIR%\niwwdxesq\e5ogmmsgia
- C:\niwwdxesq\e5ogmmsgia
- C:\niwwdxesq\oj355sztwesssvsn.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\niwwdxesq\ztohopkyc.exe
- C:\niwwdxesq\qmppyyipqrv.exe
Удаляет следующие файлы:
- C:\niwwdxesq\oj355sztwesssvsn.exe
- %WINDIR%\niwwdxesq\e5ogmmsgia
Подменяет следующие файлы:
- %WINDIR%\niwwdxesq\e5ogmmsgia
Сетевая активность:
Подключается к:
- 'fl###yellow.net':80
- 'br###travel.net':80
- 'fl###travel.net':80
- 'br###close.net':80
- 'fl###close.net':80
- 'br###yellow.net':80
- 'br###space.net':80
- 'ga####yellow.net':80
- 'be####yellow.net':80
- 'ga####travel.net':80
- 'fl###space.net':80
- 'ga###rclose.net':80
- 'be###rclose.net':80
- 'pr####tbeyond.net':80
- 'th###beyond.net':80
- 'se###nclose.net':80
- 'th####orever.net':80
- 'pr####tbeing.net':80
- 'th###being.net':80
- 'qu###close.net':80
- 'qu###travel.net':80
- 'se###nspace.net':80
- 'qu###space.net':80
- 'se####yellow.net':80
- 'qu###yellow.net':80
- 'se####travel.net':80
- 'be####travel.net':80
- 'el####icspace.net':80
- 're###dspace.net':80
- 'ca####nclose.net':80
- 're####yellow.net':80
- 'el####ictravel.net':80
- 're####travel.net':80
- 'la###close.net':80
- 'la###travel.net':80
- 'ca####nspace.net':80
- 'la###space.net':80
- 'ca####nyellow.net':80
- 'la###yellow.net':80
- 'ca####ntravel.net':80
- 'st###tclose.net':80
- 'tr###yellow.net':80
- 'st####yellow.net':80
- 'ga###rspace.net':80
- 'be###rspace.net':80
- 'tr###close.net':80
- 'tr###travel.net':80
- 'el####icclose.net':80
- 're###dclose.net':80
- 'el####icyellow.net':80
- 'st####travel.net':80
- 'tr###space.net':80
- 'st###tspace.net':80
TCP:
Запросы HTTP GET:
- http://fl###yellow.net/index.php
- http://br###travel.net/index.php
- http://fl###travel.net/index.php
- http://br###close.net/index.php
- http://fl###close.net/index.php
- http://br###yellow.net/index.php
- http://br###space.net/index.php
- http://ga####yellow.net/index.php
- http://be####yellow.net/index.php
- http://ga####travel.net/index.php
- http://fl###space.net/index.php
- http://ga###rclose.net/index.php
- http://be###rclose.net/index.php
- http://pr####tbeyond.net/index.php
- http://th###beyond.net/index.php
- http://se###nclose.net/index.php
- http://th####orever.net/index.php
- http://pr####tbeing.net/index.php
- http://th###being.net/index.php
- http://qu###close.net/index.php
- http://qu###travel.net/index.php
- http://se###nspace.net/index.php
- http://qu###space.net/index.php
- http://se####yellow.net/index.php
- http://qu###yellow.net/index.php
- http://se####travel.net/index.php
- http://be####travel.net/index.php
- http://el####icspace.net/index.php
- http://re###dspace.net/index.php
- http://ca####nclose.net/index.php
- http://re####yellow.net/index.php
- http://el####ictravel.net/index.php
- http://re####travel.net/index.php
- http://la###close.net/index.php
- http://la###travel.net/index.php
- http://ca####nspace.net/index.php
- http://la###space.net/index.php
- http://ca####nyellow.net/index.php
- http://la###yellow.net/index.php
- http://ca####ntravel.net/index.php
- http://st###tclose.net/index.php
- http://tr###yellow.net/index.php
- http://st####yellow.net/index.php
- http://ga###rspace.net/index.php
- http://be###rspace.net/index.php
- http://tr###close.net/index.php
- http://tr###travel.net/index.php
- http://el####icclose.net/index.php
- http://re###dclose.net/index.php
- http://el####icyellow.net/index.php
- http://st####travel.net/index.php
- http://tr###space.net/index.php
- http://st###tspace.net/index.php
UDP:
- DNS ASK fl###yellow.net
- DNS ASK br###travel.net
- DNS ASK fl###travel.net
- DNS ASK br###close.net
- DNS ASK fl###close.net
- DNS ASK br###yellow.net
- DNS ASK br###space.net
- DNS ASK ga####yellow.net
- DNS ASK be####yellow.net
- DNS ASK ga####travel.net
- DNS ASK fl###space.net
- DNS ASK ga###rclose.net
- DNS ASK be###rclose.net
- DNS ASK pr####tbeyond.net
- DNS ASK th###beyond.net
- DNS ASK se###nclose.net
- DNS ASK th####orever.net
- DNS ASK pr####tbeing.net
- DNS ASK th###being.net
- DNS ASK qu###close.net
- DNS ASK qu###travel.net
- DNS ASK se###nspace.net
- DNS ASK qu###space.net
- DNS ASK se####yellow.net
- DNS ASK qu###yellow.net
- DNS ASK se####travel.net
- DNS ASK be####travel.net
- DNS ASK el####icspace.net
- DNS ASK re###dspace.net
- DNS ASK ca####nclose.net
- DNS ASK re####yellow.net
- DNS ASK el####ictravel.net
- DNS ASK re####travel.net
- DNS ASK la###close.net
- DNS ASK la###travel.net
- DNS ASK ca####nspace.net
- DNS ASK la###space.net
- DNS ASK ca####nyellow.net
- DNS ASK la###yellow.net
- DNS ASK ca####ntravel.net
- DNS ASK st###tclose.net
- DNS ASK tr###yellow.net
- DNS ASK st####yellow.net
- DNS ASK ga###rspace.net
- DNS ASK be###rspace.net
- DNS ASK tr###close.net
- DNS ASK tr###travel.net
- DNS ASK el####icclose.net
- DNS ASK re###dclose.net
- DNS ASK el####icyellow.net
- DNS ASK st####travel.net
- DNS ASK tr###space.net
- DNS ASK st###tspace.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
