Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Control Removal Block Location' = '<SYSTEM32>\fgakcxlequ.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Configuration SNMP Hardware] 'ImagePath' = '<SYSTEM32>\fgakcxlequ.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Configuration SNMP Hardware] 'Start' = '00000002'
Вредоносные функции:
Для затруднения выявления своего присутствия в системе
блокирует:
- Центр обеспечения безопасности (Security Center)
Запускает на исполнение:
- '<SYSTEM32>\gfoyqpyxznic.exe' "<SYSTEM32>\fgakcxlequ.exe"
- '%WINDIR%\Temp\zteels3bwucah.exe' -r 36539 tcp
- '%TEMP%\zteels333kcahhkl1vtva.exe'
- '<SYSTEM32>\fgakcxlequ.exe'
Изменения в файловой системе:
Создает следующие файлы:
- <SYSTEM32>\xafvqxjwejgghs\run
- <SYSTEM32>\xafvqxjwejgghs\rng
- %WINDIR%\Temp\zteels3bwucah.exe
- <SYSTEM32>\xafvqxjwejgghs\cfg
- <SYSTEM32>\gfoyqpyxznic.exe
- %TEMP%\zteels333kcahhkl1vtva.exe
- <SYSTEM32>\xafvqxjwejgghs\tst
- <SYSTEM32>\fgakcxlequ.exe
- <SYSTEM32>\xafvqxjwejgghs\etc
Присваивает атрибут 'скрытый' для следующих файлов:
- <SYSTEM32>\gfoyqpyxznic.exe
- <SYSTEM32>\fgakcxlequ.exe
Удаляет следующие файлы:
- %WINDIR%\Temp\zteels3bwucah.exe
- <DRIVERS>\etc\hosts
- %TEMP%\zteels333kcahhkl1vtva.exe
Подменяет файл HOSTS.
Сетевая активность:
Подключается к:
- 'wa###hot.net':80
- 'ta###ause.net':80
- 'wa###ause.net':80
- 'ta###ack.net':80
- 'wa###ack.net':80
- 'ta###hot.net':80
- 'ta###ure.net':80
- 'mu###hot.net':80
- 'pi###shot.net':80
- 'mu###ause.net':80
- 'wa###ure.net':80
- 'mu###ack.net':80
- 'pi###back.net':80
- 'vi###lept.net':80
- 'lr###slept.net':80
- 'yo###reak.net':80
- 'lr###prove.net':80
- 'vi###ers.net':80
- 'lr###hers.net':80
- 'tr###break.net':80
- 'tr###hers.net':80
- 'yo###lept.net':80
- 'tr###slept.net':80
- 'yo###rove.net':80
- 'tr###prove.net':80
- 'yo###ers.net':80
- 'pi###cause.net':80
- 'fa###ure.net':80
- 'to###ure.net':80
- 'le###back.net':80
- 'to###hot.net':80
- 'fa###ause.net':80
- 'to###ause.net':80
- 'se###back.net':80
- 'be##lxc.com':80
- 'af###sllc.com':80
- 'ri###nstorm.net':80
- 'le###shot.net':80
- 'se###shot.net':80
- 'de###lxc.com':80
- 'we###ack.net':80
- 've###hot.net':80
- 'we###hot.net':80
- 'mu###ure.net':80
- 'pi###sure.net':80
- 've###ack.net':80
- 've###ause.net':80
- 'fa###ack.net':80
- 'to###ack.net':80
- 'fa###hot.net':80
- 'we###ause.net':80
- 've###ure.net':80
- 'we###ure.net':80
TCP:
Запросы HTTP GET:
- http://wa###hot.net/index.php
- http://ta###ause.net/index.php
- http://wa###ause.net/index.php
- http://ta###ack.net/index.php
- http://wa###ack.net/index.php
- http://ta###hot.net/index.php
- http://ta###ure.net/index.php
- http://mu###hot.net/index.php
- http://pi###shot.net/index.php
- http://mu###ause.net/index.php
- http://wa###ure.net/index.php
- http://mu###ack.net/index.php
- http://pi###back.net/index.php
- http://vi###lept.net/index.php
- http://lr###slept.net/index.php
- http://yo###reak.net/index.php
- http://lr###prove.net/index.php
- http://vi###ers.net/index.php
- http://lr###hers.net/index.php
- http://tr###break.net/index.php
- http://tr###hers.net/index.php
- http://yo###lept.net/index.php
- http://tr###slept.net/index.php
- http://yo###rove.net/index.php
- http://tr###prove.net/index.php
- http://yo###ers.net/index.php
- http://pi###cause.net/index.php
- http://fa###ure.net/index.php
- http://to###ure.net/index.php
- http://le###back.net/index.php
- http://to###hot.net/index.php
- http://fa###ause.net/index.php
- http://to###ause.net/index.php
- http://se###back.net/index.php
- http://be##lxc.com/index.php
- http://af###sllc.com/index.php
- http://ri###nstorm.net/index.php
- http://le###shot.net/index.php
- http://se###shot.net/index.php
- http://de###lxc.com/index.php
- http://we###ack.net/index.php
- http://ve###hot.net/index.php
- http://we###hot.net/index.php
- http://mu###ure.net/index.php
- http://pi###sure.net/index.php
- http://ve###ack.net/index.php
- http://ve###ause.net/index.php
- http://fa###ack.net/index.php
- http://to###ack.net/index.php
- http://fa###hot.net/index.php
- http://we###ause.net/index.php
- http://ve###ure.net/index.php
- http://we###ure.net/index.php
UDP:
- DNS ASK wa###hot.net
- DNS ASK ta###ause.net
- DNS ASK wa###ause.net
- DNS ASK ta###ack.net
- DNS ASK wa###ack.net
- DNS ASK ta###hot.net
- DNS ASK ta###ure.net
- DNS ASK mu###hot.net
- DNS ASK pi###shot.net
- DNS ASK mu###ause.net
- DNS ASK wa###ure.net
- DNS ASK mu###ack.net
- DNS ASK pi###back.net
- DNS ASK tr###slept.net
- DNS ASK lr###hers.net
- DNS ASK vi###lept.net
- DNS ASK lr###slept.net
- DNS ASK vi###rove.net
- DNS ASK lr###prove.net
- DNS ASK vi###ers.net
- DNS ASK yo###reak.net
- DNS ASK yo###ers.net
- DNS ASK tr###hers.net
- DNS ASK yo###lept.net
- DNS ASK tr###break.net
- DNS ASK yo###rove.net
- DNS ASK tr###prove.net
- DNS ASK pi###cause.net
- DNS ASK fa###ure.net
- DNS ASK to###ure.net
- DNS ASK le###back.net
- DNS ASK to###hot.net
- DNS ASK fa###ause.net
- DNS ASK to###ause.net
- DNS ASK se###back.net
- DNS ASK be##lxc.com
- DNS ASK af###sllc.com
- DNS ASK ri###nstorm.net
- DNS ASK le###shot.net
- DNS ASK se###shot.net
- DNS ASK de###lxc.com
- DNS ASK we###ack.net
- DNS ASK ve###hot.net
- DNS ASK we###hot.net
- DNS ASK mu###ure.net
- DNS ASK pi###sure.net
- DNS ASK ve###ack.net
- DNS ASK ve###ause.net
- DNS ASK fa###ack.net
- DNS ASK to###ack.net
- DNS ASK fa###hot.net
- DNS ASK we###ause.net
- DNS ASK ve###ure.net
- DNS ASK we###ure.net
- '23#.#55.255.250':1900
