Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Coordinator Microsoft Controls' = '<SYSTEM32>\fxmklnox.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\SPP Grouping Foundation Counter Port] 'ImagePath' = '<SYSTEM32>\fxmklnox.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\SPP Grouping Foundation Counter Port] 'Start' = '00000002'
Вредоносные функции:
Для затруднения выявления своего присутствия в системе
блокирует:
- Центр обеспечения безопасности (Security Center)
Запускает на исполнение:
- '<SYSTEM32>\bipwpwvnwqb.exe' "<SYSTEM32>\fxmklnox.exe"
- '%WINDIR%\Temp\wmewpisw4xuesrro.exe' -r 27168 tcp
- '%TEMP%\wmewpif0xibbsrrodvigkfzq.exe'
- '<SYSTEM32>\fxmklnox.exe'
Изменения в файловой системе:
Создает следующие файлы:
- <SYSTEM32>\vbbeankhtdjctfs\run
- <SYSTEM32>\vbbeankhtdjctfs\rng
- %WINDIR%\Temp\wmewpisw4xuesrro.exe
- <SYSTEM32>\vbbeankhtdjctfs\cfg
- %TEMP%\wmewpif0xibbsrrodvigkfzq.exe
- <SYSTEM32>\vbbeankhtdjctfs\tst
- <SYSTEM32>\bipwpwvnwqb.exe
- <SYSTEM32>\fxmklnox.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- <SYSTEM32>\bipwpwvnwqb.exe
- <SYSTEM32>\fxmklnox.exe
Удаляет следующие файлы:
- %WINDIR%\Temp\wmewpisw4xuesrro.exe
- %TEMP%\wmewpif0xibbsrrodvigkfzq.exe
Сетевая активность:
Подключается к:
- 'pl###back.net':80
- 'fi###ack.net':80
- 'pl###shot.net':80
- 'fi###hot.net':80
- 'se###cause.net':80
- 'le###cause.net':80
- 'se###sure.net':80
- 'le###sure.net':80
- 'lr###back.net':80
- 'vi###ack.net':80
- 'lr###shot.net':80
- 'vi###hot.net':80
- 'pl###cause.net':80
- 'fi###ause.net':80
- 'pl###sure.net':80
- 'fi###ure.net':80
- 'to###ack.net':80
- 'fa###ack.net':80
- 'to###hot.net':80
- 'fa###hot.net':80
- 'we###ause.net':80
- 've###ause.net':80
- 'we###ure.net':80
- 've###ure.net':80
- 'se###back.net':80
- 'le###back.net':80
- 'se###shot.net':80
- 'le###shot.net':80
- 'to###ause.net':80
- 'fa###ause.net':80
- 'to###ure.net':80
- 'fa###ure.net':80
- 'vi###ause.net':80
- 'ri###nstorm.net':80
- 'ef###tbuilt.net':80
- 'gw#####ynhuddleston.net':80
- 'of####urprise.net':80
- 'ta###ash.net':80
- 'wa###elow.net':80
- 'th###while.net':80
- 'wa###ash.net':80
- 'jo####ymeasure.net':80
- 'de####promise.net':80
- 'any':105
- 'or###thrown.net':80
- 'mo####gduring.net':80
- 'ch####nother.net':80
- 'se####strong.net':80
- 'si######edwerryhouse.net':80
- 'yo###hot.net':80
- 'tr###back.net':80
- 'yo###ause.net':80
- 'tr###shot.net':80
- 'vi###ure.net':80
- 'lr###cause.net':80
- 'yo###ack.net':80
- 'lr###sure.net':80
- 'ta###alk.net':80
- 'wa###hirt.net':80
- 'ta###elow.net':80
- 'wa###alk.net':80
- 'yo###ure.net':80
- 'tr###cause.net':80
- 'ta###hirt.net':80
- 'tr###sure.net':80
TCP:
Запросы HTTP GET:
- http://pl###back.net/index.php
- http://fi###ack.net/index.php
- http://pl###shot.net/index.php
- http://fi###hot.net/index.php
- http://se###cause.net/index.php
- http://le###cause.net/index.php
- http://se###sure.net/index.php
- http://le###sure.net/index.php
- http://lr###back.net/index.php
- http://vi###ack.net/index.php
- http://lr###shot.net/index.php
- http://vi###hot.net/index.php
- http://pl###cause.net/index.php
- http://fi###ause.net/index.php
- http://pl###sure.net/index.php
- http://fi###ure.net/index.php
- http://to###ack.net/index.php
- http://fa###ack.net/index.php
- http://to###hot.net/index.php
- http://fa###hot.net/index.php
- http://we###ause.net/index.php
- http://ve###ause.net/index.php
- http://we###ure.net/index.php
- http://ve###ure.net/index.php
- http://se###back.net/index.php
- http://le###back.net/index.php
- http://se###shot.net/index.php
- http://le###shot.net/index.php
- http://to###ause.net/index.php
- http://fa###ause.net/index.php
- http://to###ure.net/index.php
- http://fa###ure.net/index.php
- http://ef###tbuilt.net/index.php
- http://th###while.net/index.php
- http://of####urprise.net/index.php
- http://ri###nstorm.net/index.php
- http://wa###elow.net/index.php
- http://ta###elow.net/index.php
- http://wa###ash.net/index.php
- http://ta###ash.net/index.php
- http://de####promise.net/index.php
- http://se####strong.net/index.php
- http://or###thrown.net/index.php
- http://jo####ymeasure.net/index.php
- http://ch####nother.net/index.php
- http://gw#####ynhuddleston.net/index.php
- http://si######edwerryhouse.net/index.php
- http://mo####gduring.net/index.php
- http://tr###back.net/index.php
- http://yo###ack.net/index.php
- http://tr###shot.net/index.php
- http://yo###hot.net/index.php
- http://lr###cause.net/index.php
- http://vi###ause.net/index.php
- http://lr###sure.net/index.php
- http://vi###ure.net/index.php
- http://wa###hirt.net/index.php
- http://ta###hirt.net/index.php
- http://wa###alk.net/index.php
- http://ta###alk.net/index.php
- http://tr###cause.net/index.php
- http://yo###ause.net/index.php
- http://tr###sure.net/index.php
- http://yo###ure.net/index.php
UDP:
- DNS ASK pl###back.net
- DNS ASK fi###ack.net
- DNS ASK pl###shot.net
- DNS ASK fi###hot.net
- DNS ASK se###cause.net
- DNS ASK le###cause.net
- DNS ASK se###sure.net
- DNS ASK le###sure.net
- DNS ASK lr###back.net
- DNS ASK vi###ack.net
- DNS ASK lr###shot.net
- DNS ASK vi###hot.net
- DNS ASK pl###cause.net
- DNS ASK fi###ause.net
- DNS ASK pl###sure.net
- DNS ASK fi###ure.net
- DNS ASK to###ack.net
- DNS ASK fa###ack.net
- DNS ASK to###hot.net
- DNS ASK fa###hot.net
- DNS ASK we###ause.net
- DNS ASK ve###ause.net
- DNS ASK we###ure.net
- DNS ASK ve###ure.net
- DNS ASK se###back.net
- DNS ASK le###back.net
- DNS ASK se###shot.net
- DNS ASK le###shot.net
- DNS ASK to###ause.net
- DNS ASK fa###ause.net
- DNS ASK to###ure.net
- DNS ASK fa###ure.net
- DNS ASK we###hot.net
- DNS ASK ri###nstorm.net
- DNS ASK ef###tbuilt.net
- DNS ASK gw#####ynhuddleston.net
- DNS ASK of####urprise.net
- DNS ASK ta###ash.net
- DNS ASK wa###elow.net
- DNS ASK th###while.net
- DNS ASK wa###ash.net
- DNS ASK jo####ymeasure.net
- DNS ASK de####promise.net
- DNS ASK vi###ause.net
- DNS ASK or###thrown.net
- DNS ASK mo####gduring.net
- DNS ASK ch####nother.net
- DNS ASK se####strong.net
- DNS ASK si######edwerryhouse.net
- DNS ASK yo###hot.net
- DNS ASK tr###back.net
- DNS ASK yo###ause.net
- DNS ASK tr###shot.net
- DNS ASK vi###ure.net
- DNS ASK lr###cause.net
- DNS ASK yo###ack.net
- DNS ASK lr###sure.net
- DNS ASK ta###alk.net
- DNS ASK wa###hirt.net
- DNS ASK ta###elow.net
- DNS ASK wa###alk.net
- DNS ASK yo###ure.net
- DNS ASK tr###cause.net
- DNS ASK ta###hirt.net
- DNS ASK tr###sure.net
- '23#.#55.255.250':1900
