Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Redirector Agent Performance' = 'C:\bk5tpne\q02cmouq.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Proxy Office Problem Service] 'ImagePath' = 'C:\bk5tpne\q02cmouq.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Proxy Office Problem Service] 'Start' = '00000002'
Вредоносные функции:
Запускает на исполнение:
- 'C:\bk5tpne\eerk6zwnkazd.exe' "c:\bk5tpne\q02cmouq.exe"
- 'C:\bk5tpne\q02cmouq.exe'
- 'C:\bk5tpne\b8s86mf2omqjuzvdxyxi.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\bk5tpne\q02cmouq.exe
- C:\bk5tpne\eerk6zwnkazd.exe
- C:\bk5tpne\pdmkmr
- %WINDIR%\bk5tpne\k89yp8awbiwg
- C:\bk5tpne\k89yp8awbiwg
- C:\bk5tpne\b8s86mf2omqjuzvdxyxi.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\bk5tpne\eerk6zwnkazd.exe
- C:\bk5tpne\q02cmouq.exe
Удаляет следующие файлы:
- C:\bk5tpne\b8s86mf2omqjuzvdxyxi.exe
- %WINDIR%\bk5tpne\k89yp8awbiwg
Подменяет следующие файлы:
- %WINDIR%\bk5tpne\k89yp8awbiwg
Сетевая активность:
Подключается к:
- 'ka#####neelyzabeth.net':80
- 'ch#####anjeremiah.net':80
- 'gw#####rejeremiah.net':80
- 'al#####erterrance.net':80
- 'ka#####neterrance.net':80
- 'al#####erelyzabeth.net':80
- 'gw#####rethaddeus.net':80
- 'ch#####anjohnathan.net':80
- 'gw#####rejohnathan.net':80
- 'ch#####anperegrine.net':80
- 'gw#####reperegrine.net':80
- 'ch#####anthaddeus.net':80
- 'ma#####nabrittania.net':80
- 'al#####raterrance.net':80
- 'ma#####naterrance.net':80
- 'al#####rashavonne.net':80
- 'ma#####nashavonne.net':80
- 'al#####rabrittania.net':80
- 'ka#####neshavonne.net':80
- 'al#####erbrittania.net':80
- 'ka#####nebrittania.net':80
- 'al#####raelyzabeth.net':80
- 'ma#####naelyzabeth.net':80
- 'al#####ershavonne.net':80
- 'gu#####enjeremiah.net':80
- 'za#####ahjeremiah.net':80
- 'ar#####ldjeremiah.net':80
- 'za#####ahperegrine.net':80
- 'ge#####nathaddeus.net':80
- 'ch#####lejohnathan.net':80
- 'ge#####najohnathan.net':80
- 'za#####ahjohnathan.net':80
- 'ar#####ldjohnathan.net':80
- 'sh#####lejeremiah.net':80
- 'ar#####ldperegrine.net':80
- 'za#####ahthaddeus.net':80
- 'ar#####ldthaddeus.net':80
- 'gu#####enthaddeus.net':80
- 'an#####lethaddeus.net':80
- 'gu#####enjohnathan.net':80
- 'an#####lejeremiah.net':80
- 'gu#####enperegrine.net':80
- 'an#####leperegrine.net':80
- 'ch#####leperegrine.net':80
- 'ge#####naperegrine.net':80
- 'ch#####lethaddeus.net':80
- 'an#####lejohnathan.net':80
- 'ch#####lejeremiah.net':80
- 'ge#####najeremiah.net':80
TCP:
Запросы HTTP GET:
- http://ka#####neelyzabeth.net/index.php
- http://ch#####anjeremiah.net/index.php
- http://gw#####rejeremiah.net/index.php
- http://al#####erterrance.net/index.php
- http://ka#####neterrance.net/index.php
- http://al#####erelyzabeth.net/index.php
- http://gw#####rethaddeus.net/index.php
- http://ch#####anjohnathan.net/index.php
- http://gw#####rejohnathan.net/index.php
- http://ch#####anperegrine.net/index.php
- http://gw#####reperegrine.net/index.php
- http://ch#####anthaddeus.net/index.php
- http://ma#####nabrittania.net/index.php
- http://al#####raterrance.net/index.php
- http://ma#####naterrance.net/index.php
- http://al#####rashavonne.net/index.php
- http://ma#####nashavonne.net/index.php
- http://al#####rabrittania.net/index.php
- http://ka#####neshavonne.net/index.php
- http://al#####erbrittania.net/index.php
- http://ka#####nebrittania.net/index.php
- http://al#####raelyzabeth.net/index.php
- http://ma#####naelyzabeth.net/index.php
- http://al#####ershavonne.net/index.php
- http://gu#####enjeremiah.net/index.php
- http://za#####ahjeremiah.net/index.php
- http://ar#####ldjeremiah.net/index.php
- http://za#####ahperegrine.net/index.php
- http://ge#####nathaddeus.net/index.php
- http://ch#####lejohnathan.net/index.php
- http://ge#####najohnathan.net/index.php
- http://za#####ahjohnathan.net/index.php
- http://ar#####ldjohnathan.net/index.php
- http://sh#####lejeremiah.net/index.php
- http://ar#####ldperegrine.net/index.php
- http://za#####ahthaddeus.net/index.php
- http://ar#####ldthaddeus.net/index.php
- http://gu#####enthaddeus.net/index.php
- http://an#####lethaddeus.net/index.php
- http://gu#####enjohnathan.net/index.php
- http://an#####lejeremiah.net/index.php
- http://gu#####enperegrine.net/index.php
- http://an#####leperegrine.net/index.php
- http://ch#####leperegrine.net/index.php
- http://ge#####naperegrine.net/index.php
- http://ch#####lethaddeus.net/index.php
- http://an#####lejohnathan.net/index.php
- http://ch#####lejeremiah.net/index.php
- http://ge#####najeremiah.net/index.php
UDP:
- DNS ASK ka#####neelyzabeth.net
- DNS ASK ch#####anjeremiah.net
- DNS ASK gw#####rejeremiah.net
- DNS ASK al#####erterrance.net
- DNS ASK ka#####neterrance.net
- DNS ASK al#####erelyzabeth.net
- DNS ASK gw#####rethaddeus.net
- DNS ASK ch#####anjohnathan.net
- DNS ASK gw#####rejohnathan.net
- DNS ASK ch#####anperegrine.net
- DNS ASK gw#####reperegrine.net
- DNS ASK ch#####anthaddeus.net
- DNS ASK ka#####nebrittania.net
- DNS ASK al#####rabrittania.net
- DNS ASK ma#####nabrittania.net
- DNS ASK al#####raterrance.net
- DNS ASK am#####neelyzabeth.net
- DNS ASK al#####rashavonne.net
- DNS ASK ma#####nashavonne.net
- DNS ASK al#####ershavonne.net
- DNS ASK ka#####neshavonne.net
- DNS ASK al#####erbrittania.net
- DNS ASK ma#####naterrance.net
- DNS ASK al#####raelyzabeth.net
- DNS ASK ma#####naelyzabeth.net
- DNS ASK za#####ahjeremiah.net
- DNS ASK ar#####ldjeremiah.net
- DNS ASK za#####ahperegrine.net
- DNS ASK ge#####nathaddeus.net
- DNS ASK ch#####lejohnathan.net
- DNS ASK ge#####najohnathan.net
- DNS ASK za#####ahjohnathan.net
- DNS ASK ar#####ldjohnathan.net
- DNS ASK sh#####lejeremiah.net
- DNS ASK ar#####ldperegrine.net
- DNS ASK za#####ahthaddeus.net
- DNS ASK ar#####ldthaddeus.net
- DNS ASK ch#####lethaddeus.net
- DNS ASK an#####leperegrine.net
- DNS ASK gu#####enthaddeus.net
- DNS ASK an#####lethaddeus.net
- DNS ASK gu#####enjeremiah.net
- DNS ASK an#####lejeremiah.net
- DNS ASK gu#####enperegrine.net
- DNS ASK ge#####najeremiah.net
- DNS ASK ch#####leperegrine.net
- DNS ASK ge#####naperegrine.net
- DNS ASK gu#####enjohnathan.net
- DNS ASK an#####lejohnathan.net
- DNS ASK ch#####lejeremiah.net
