Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Upgrade Shadow Service WLAN Grouping' = '<SYSTEM32>\stddvmtw.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Presentation Awareness PC Problem File] 'ImagePath' = '<SYSTEM32>\stddvmtw.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Presentation Awareness PC Problem File] 'Start' = '00000002'
Вредоносные функции:
Для затруднения выявления своего присутствия в системе
блокирует:
- Центр обеспечения безопасности (Security Center)
Создает и запускает на исполнение:
- '<SYSTEM32>\ofqhtzlwqwn.exe' "<SYSTEM32>\stddvmtw.exe"
- '%WINDIR%\Temp\xdboun3iw5nk.exe' -r 35052 tcp
- '%TEMP%\xdboun3b4mnki0hokc.exe'
- '<SYSTEM32>\stddvmtw.exe'
Изменения в файловой системе:
Создает следующие файлы:
- <SYSTEM32>\yyxynqear\run
- <SYSTEM32>\yyxynqear\rng
- %WINDIR%\Temp\xdboun3iw5nk.exe
- <SYSTEM32>\yyxynqear\cfg
- <SYSTEM32>\ofqhtzlwqwn.exe
- %TEMP%\xdboun3b4mnki0hokc.exe
- <SYSTEM32>\yyxynqear\tst
- <SYSTEM32>\stddvmtw.exe
- <SYSTEM32>\yyxynqear\etc
Присваивает атрибут 'скрытый' для следующих файлов:
- <SYSTEM32>\ofqhtzlwqwn.exe
- <SYSTEM32>\stddvmtw.exe
Удаляет следующие файлы:
- %WINDIR%\Temp\xdboun3iw5nk.exe
- <DRIVERS>\etc\hosts
- %TEMP%\xdboun3b4mnki0hokc.exe
Подменяет файл HOSTS.
Сетевая активность:
Подключается к:
- 'na####sterday.net':80
- 'dr###wedge.net':80
- 'na###ach.net':80
- 'dr####esterday.net':80
- 'qu###gray.net':80
- 'fi###april.net':80
- 'na###edge.net':80
- 'fi###gray.net':80
- 'we#####ayyesterday.net':80
- 'se###edge.net':80
- 'we####dayeach.net':80
- 'se####sterday.net':80
- 'na###eet.net':80
- 'dr###each.net':80
- 'we####daywedge.net':80
- 'dr###feet.net':80
- 'ga###rmy.net':80
- 'bo###dge.net':80
- 'ga###pril.net':80
- 'bo###rmy.net':80
- 'fa###ray.net':80
- 'le###april.net':80
- 'ga###dge.net':80
- 'le###gray.net':80
- 'qu###army.net':80
- 'fi###edge.net':80
- 'qu###april.net':80
- 'fi###army.net':80
- 'ga###ray.net':80
- 'bo###pril.net':80
- 'qu###edge.net':80
- 'bo###ray.net':80
- 'se###ach.net':80
- 'be##lxc.com':80
- 'wa####sterday.net':80
- 'al###being.net':80
- 'ri###nstorm.net':80
- 'st###feet.net':80
- 'we###eet.net':80
- 'mo###wedge.net':80
- 'wa###edge.net':80
- 'mo###ugust.net':80
- 'mi###hown.net':80
- 'cr#####onaraminta.net':80
- 'le###form.net':80
- 'pr####tbottom.net':80
- 'ca####nbring.net':80
- 'ab###ell.net':80
- 'mo###olor.net':80
- 'af####esterday.net':80
- 'fo####esterday.net':80
- 'af###each.net':80
- 'fo###each.net':80
- 'se###eet.net':80
- 'we####dayfeet.net':80
- 'af###wedge.net':80
- 'fo###wedge.net':80
- 'st####esterday.net':80
- 'we####sterday.net':80
- 'st###each.net':80
- 'we###ach.net':80
- 'af###feet.net':80
- 'fo###feet.net':80
- 'st###wedge.net':80
- 'we###edge.net':80
TCP:
Запросы HTTP GET:
- http://na####sterday.net/index.php
- http://dr###wedge.net/index.php
- http://na###ach.net/index.php
- http://dr####esterday.net/index.php
- http://qu###gray.net/index.php
- http://fi###april.net/index.php
- http://na###edge.net/index.php
- http://fi###gray.net/index.php
- http://we#####ayyesterday.net/index.php
- http://se###edge.net/index.php
- http://we####dayeach.net/index.php
- http://se####sterday.net/index.php
- http://na###eet.net/index.php
- http://dr###each.net/index.php
- http://we####daywedge.net/index.php
- http://dr###feet.net/index.php
- http://ga###rmy.net/index.php
- http://bo###dge.net/index.php
- http://ga###pril.net/index.php
- http://bo###rmy.net/index.php
- http://fa###ray.net/index.php
- http://le###april.net/index.php
- http://ga###dge.net/index.php
- http://le###gray.net/index.php
- http://qu###army.net/index.php
- http://fi###edge.net/index.php
- http://qu###april.net/index.php
- http://fi###army.net/index.php
- http://ga###ray.net/index.php
- http://bo###pril.net/index.php
- http://qu###edge.net/index.php
- http://bo###ray.net/index.php
- http://se###ach.net/index.php
- http://be##lxc.com/index.php
- http://wa####sterday.net/index.php
- http://al###being.net/index.php
- http://ri###nstorm.net/index.php
- http://st###feet.net/index.php
- http://we###eet.net/index.php
- http://mo###wedge.net/index.php
- http://wa###edge.net/index.php
- http://mo###ugust.net/index.php
- http://mi###hown.net/index.php
- http://cr#####onaraminta.net/index.php
- http://le###form.net/index.php
- http://pr####tbottom.net/index.php
- http://ca####nbring.net/index.php
- http://ab###ell.net/index.php
- http://mo###olor.net/index.php
- http://af####esterday.net/index.php
- http://fo####esterday.net/index.php
- http://af###each.net/index.php
- http://fo###each.net/index.php
- http://se###eet.net/index.php
- http://we####dayfeet.net/index.php
- http://af###wedge.net/index.php
- http://fo###wedge.net/index.php
- http://st####esterday.net/index.php
- http://we####sterday.net/index.php
- http://st###each.net/index.php
- http://we###ach.net/index.php
- http://af###feet.net/index.php
- http://fo###feet.net/index.php
- http://st###wedge.net/index.php
- http://we###edge.net/index.php
UDP:
- DNS ASK na####sterday.net
- DNS ASK dr###wedge.net
- DNS ASK na###ach.net
- DNS ASK dr####esterday.net
- DNS ASK qu###gray.net
- DNS ASK fi###april.net
- DNS ASK na###edge.net
- DNS ASK fi###gray.net
- DNS ASK we#####ayyesterday.net
- DNS ASK se###edge.net
- DNS ASK we####dayeach.net
- DNS ASK se####sterday.net
- DNS ASK na###eet.net
- DNS ASK dr###each.net
- DNS ASK we####daywedge.net
- DNS ASK dr###feet.net
- DNS ASK qu###april.net
- DNS ASK bo###dge.net
- DNS ASK ga###dge.net
- DNS ASK bo###rmy.net
- DNS ASK ga###rmy.net
- DNS ASK le###april.net
- DNS ASK fa###pril.net
- DNS ASK le###gray.net
- DNS ASK fa###ray.net
- DNS ASK fi###edge.net
- DNS ASK qu###edge.net
- DNS ASK fi###army.net
- DNS ASK qu###army.net
- DNS ASK bo###pril.net
- DNS ASK ga###pril.net
- DNS ASK bo###ray.net
- DNS ASK ga###ray.net
- DNS ASK se###ach.net
- DNS ASK be##lxc.com
- DNS ASK wa####sterday.net
- DNS ASK al###being.net
- DNS ASK ri###nstorm.net
- DNS ASK st###feet.net
- DNS ASK we###eet.net
- DNS ASK mo###wedge.net
- DNS ASK wa###edge.net
- DNS ASK mo###ugust.net
- DNS ASK mi###hown.net
- DNS ASK cr#####onaraminta.net
- DNS ASK le###form.net
- DNS ASK pr####tbottom.net
- DNS ASK ca####nbring.net
- DNS ASK ab###ell.net
- DNS ASK mo###olor.net
- DNS ASK af####esterday.net
- DNS ASK fo####esterday.net
- DNS ASK af###each.net
- DNS ASK fo###each.net
- DNS ASK se###eet.net
- DNS ASK we####dayfeet.net
- DNS ASK af###wedge.net
- DNS ASK fo###wedge.net
- DNS ASK st####esterday.net
- DNS ASK we####sterday.net
- DNS ASK st###each.net
- DNS ASK we###ach.net
- DNS ASK af###feet.net
- DNS ASK fo###feet.net
- DNS ASK st###wedge.net
- DNS ASK we###edge.net
- '23#.#55.255.250':1900
