Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Detection Wired Upgrade Logs' = '<SYSTEM32>\pbvgbwzy.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Class RPC Smart Visual Software Alerts Engine] 'Start' = '00000002'
Вредоносные функции:
Для затруднения выявления своего присутствия в системе
блокирует:
- Центр обеспечения безопасности (Security Center)
Создает и запускает на исполнение:
- '<SYSTEM32>\xzitgizfcm.exe' "<SYSTEM32>\pbvgbwzy.exe"
- '%WINDIR%\Temp\whcfwmbz2w86c4nlf.exe' -r 48521 tcp
- '%TEMP%\whcfwmbz2re4c4nlfrcy4vp.exe'
- '<SYSTEM32>\pbvgbwzy.exe'
Изменения в файловой системе:
Создает следующие файлы:
- <SYSTEM32>\adtigfdqotilt\run
- <SYSTEM32>\adtigfdqotilt\rng
- %WINDIR%\Temp\whcfwmbz2w86c4nlf.exe
- <SYSTEM32>\adtigfdqotilt\cfg
- <SYSTEM32>\xzitgizfcm.exe
- %TEMP%\whcfwmbz2re4c4nlfrcy4vp.exe
- <SYSTEM32>\adtigfdqotilt\tst
- <SYSTEM32>\pbvgbwzy.exe
- <SYSTEM32>\adtigfdqotilt\etc
Присваивает атрибут 'скрытый' для следующих файлов:
- <SYSTEM32>\xzitgizfcm.exe
- <SYSTEM32>\pbvgbwzy.exe
Удаляет следующие файлы:
- %WINDIR%\Temp\whcfwmbz2w86c4nlf.exe
- <DRIVERS>\etc\hosts
- %TEMP%\whcfwmbz2re4c4nlfrcy4vp.exe
Подменяет файл HOSTS.
Сетевая активность:
Подключается к:
- 'hi###lain.net':80
- 'wh###lain.net':80
- 'hi###tep.net':80
- 'wh###tep.net':80
- 'hi###lack.net':80
- 'wh###lack.net':80
- 'hi###rown.net':80
- 'wh###rown.net':80
- 'ju###lack.net':80
- 'ju###tep.net':80
- 'mo###lain.net':80
- 'si###lack.net':80
- 'mo###tep.net':80
- 'ju###rown.net':80
- 'mo###lack.net':80
- 'ju###lain.net':80
- 'mo###rown.net':80
- 'th###black.net':80
- 'dr###step.net':80
- 'th###plain.net':80
- 'th###grown.net':80
- 'wi###lain.net':80
- 'dr###grown.net':80
- 'wi###tep.net':80
- 'dr###plain.net':80
- 'th###step.net':80
- 'fe###lain.net':80
- 'lo###lain.net':80
- 'fe###tep.net':80
- 'lo###tep.net':80
- 'fe###lack.net':80
- 'lo###lack.net':80
- 'fe###rown.net':80
- 'lo###rown.net':80
- 'kn###tep.net':80
- 'ab###tep.net':80
- 'cl###wall.net':80
- 'da###all.net':80
- 'kn###rown.net':80
- 'ab###rown.net':80
- 'kn###lain.net':80
- 'ab###lain.net':80
- 'da###ther.net':80
- 'be##lxc.com':80
- 'de###lxc.com':80
- 'ri###nstorm.net':80
- 'af###sllc.com':80
- 'da###orty.net':80
- 'cl###other.net':80
- 'da###ree.net':80
- 'cl###forty.net':80
- 'si###tep.net':80
- 'ro###lain.net':80
- 'so###lack.net':80
- 'ro###tep.net':80
- 'si###rown.net':80
- 'ro###lack.net':80
- 'si###lain.net':80
- 'ro###rown.net':80
- 'pi###lack.net':80
- 'pi###tep.net':80
- 'so###tep.net':80
- 'kn###lack.net':80
- 'ab###lack.net':80
- 'pi###rown.net':80
- 'so###rown.net':80
- 'pi###lain.net':80
- 'so###lain.net':80
TCP:
Запросы HTTP GET:
- http://hi###lain.net/index.php
- http://wh###lain.net/index.php
- http://hi###tep.net/index.php
- http://wh###tep.net/index.php
- http://hi###lack.net/index.php
- http://wh###lack.net/index.php
- http://hi###rown.net/index.php
- http://wh###rown.net/index.php
- http://ju###lack.net/index.php
- http://ju###tep.net/index.php
- http://mo###lain.net/index.php
- http://si###lack.net/index.php
- http://mo###tep.net/index.php
- http://ju###rown.net/index.php
- http://mo###lack.net/index.php
- http://ju###lain.net/index.php
- http://mo###rown.net/index.php
- http://th###black.net/index.php
- http://dr###step.net/index.php
- http://th###plain.net/index.php
- http://th###grown.net/index.php
- http://wi###lain.net/index.php
- http://dr###grown.net/index.php
- http://wi###tep.net/index.php
- http://dr###plain.net/index.php
- http://th###step.net/index.php
- http://fe###lain.net/index.php
- http://lo###lain.net/index.php
- http://fe###tep.net/index.php
- http://lo###tep.net/index.php
- http://fe###lack.net/index.php
- http://lo###lack.net/index.php
- http://fe###rown.net/index.php
- http://lo###rown.net/index.php
- http://kn###tep.net/index.php
- http://ab###tep.net/index.php
- http://cl###wall.net/index.php
- http://da###all.net/index.php
- http://kn###rown.net/index.php
- http://ab###rown.net/index.php
- http://kn###lain.net/index.php
- http://ab###lain.net/index.php
- http://da###ther.net/index.php
- http://be##lxc.com/index.php
- http://de###lxc.com/index.php
- http://ri###nstorm.net/index.php
- http://af###sllc.com/index.php
- http://da###orty.net/index.php
- http://cl###other.net/index.php
- http://da###ree.net/index.php
- http://cl###forty.net/index.php
- http://si###tep.net/index.php
- http://ro###lain.net/index.php
- http://so###lack.net/index.php
- http://ro###tep.net/index.php
- http://si###rown.net/index.php
- http://ro###lack.net/index.php
- http://si###lain.net/index.php
- http://ro###rown.net/index.php
- http://pi###lack.net/index.php
- http://pi###tep.net/index.php
- http://so###tep.net/index.php
- http://kn###lack.net/index.php
- http://ab###lack.net/index.php
- http://pi###rown.net/index.php
- http://so###rown.net/index.php
- http://pi###lain.net/index.php
- http://so###lain.net/index.php
UDP:
- DNS ASK hi###lain.net
- DNS ASK wh###lain.net
- DNS ASK hi###tep.net
- DNS ASK wh###tep.net
- DNS ASK hi###lack.net
- DNS ASK wh###lack.net
- DNS ASK hi###rown.net
- DNS ASK wh###rown.net
- DNS ASK ju###lack.net
- DNS ASK ju###tep.net
- DNS ASK mo###lain.net
- DNS ASK si###lack.net
- DNS ASK mo###tep.net
- DNS ASK ju###rown.net
- DNS ASK mo###lack.net
- DNS ASK ju###lain.net
- DNS ASK mo###rown.net
- DNS ASK fe###tep.net
- DNS ASK dr###step.net
- DNS ASK wi###tep.net
- DNS ASK th###grown.net
- DNS ASK th###black.net
- DNS ASK dr###grown.net
- DNS ASK wi###rown.net
- DNS ASK dr###plain.net
- DNS ASK wi###lain.net
- DNS ASK th###plain.net
- DNS ASK lo###lain.net
- DNS ASK fe###rown.net
- DNS ASK lo###tep.net
- DNS ASK fe###lain.net
- DNS ASK lo###lack.net
- DNS ASK th###step.net
- DNS ASK lo###rown.net
- DNS ASK fe###lack.net
- DNS ASK kn###tep.net
- DNS ASK ab###tep.net
- DNS ASK cl###wall.net
- DNS ASK da###all.net
- DNS ASK kn###rown.net
- DNS ASK ab###rown.net
- DNS ASK kn###lain.net
- DNS ASK ab###lain.net
- DNS ASK da###ther.net
- DNS ASK be##lxc.com
- DNS ASK de###lxc.com
- DNS ASK ri###nstorm.net
- DNS ASK af###sllc.com
- DNS ASK da###orty.net
- DNS ASK cl###other.net
- DNS ASK da###ree.net
- DNS ASK cl###forty.net
- DNS ASK si###tep.net
- DNS ASK ro###lain.net
- DNS ASK so###lack.net
- DNS ASK ro###tep.net
- DNS ASK si###rown.net
- DNS ASK ro###lack.net
- DNS ASK si###lain.net
- DNS ASK ro###rown.net
- DNS ASK pi###lack.net
- DNS ASK pi###tep.net
- DNS ASK so###tep.net
- DNS ASK kn###lack.net
- DNS ASK ab###lack.net
- DNS ASK pi###rown.net
- DNS ASK so###rown.net
- DNS ASK pi###lain.net
- DNS ASK so###lain.net
- '23#.#55.255.250':1900
