Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Window Log RPC Themes Resource' = 'C:\esjkmaj\kkfmuarh9.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\DCOM Print Performance Bluetooth Ordering] 'ImagePath' = 'C:\esjkmaj\kkfmuarh9.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\DCOM Print Performance Bluetooth Ordering] 'Start' = '00000002'
Вредоносные функции:
Запускает на исполнение:
- 'C:\esjkmaj\bnbby6a.exe' "c:\esjkmaj\kkfmuarh9.exe"
- 'C:\esjkmaj\kkfmuarh9.exe'
- 'C:\esjkmaj\cfdddb2tdblrfmnvqq1.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\esjkmaj\kkfmuarh9.exe
- C:\esjkmaj\bnbby6a.exe
- C:\esjkmaj\zc8b4vsam
- %WINDIR%\esjkmaj\ozrv06amnvf
- C:\esjkmaj\ozrv06amnvf
- C:\esjkmaj\cfdddb2tdblrfmnvqq1.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\esjkmaj\bnbby6a.exe
- C:\esjkmaj\kkfmuarh9.exe
Удаляет следующие файлы:
- C:\esjkmaj\cfdddb2tdblrfmnvqq1.exe
- %WINDIR%\esjkmaj\ozrv06amnvf
Подменяет следующие файлы:
- %WINDIR%\esjkmaj\ozrv06amnvf
Сетевая активность:
Подключается к:
- 'co######echristopher.net':80
- 'ka######echristopher.net':80
- 'ka#####nesappington.net':80
- 'ka######ecristianson.net':80
- 'co#####nesappington.net':80
- 'ch######scristianson.net':80
- 'sh#####nesappington.net':80
- 'sh######ecristianson.net':80
- 'sh#####neleonardson.net':80
- 'ch#####asleonardson.net':80
- 'co######ecristianson.net':80
- 'ro#####ltleonardson.net':80
- 'ro######tcristianson.net':80
- 'ra#####feleonardson.net':80
- 'qu#####lasappington.net':80
- 'qu######achristopher.net':80
- 'co#####neleonardson.net':80
- 'ka#####neleonardson.net':80
- 'ro######tchristopher.net':80
- 'ra#####fesappington.net':80
- 'ro#####ltsappington.net':80
- 'ch#####assappington.net':80
- 'ra#####lesappington.net':80
- 'co#####ersappington.net':80
- 'co######rcristianson.net':80
- 'co#####erleonardson.net':80
- 'ra######ecristianson.net':80
- 'tr#####anleonardson.net':80
- 'se######rcristianson.net':80
- 'se#####erleonardson.net':80
- 'ra######echristopher.net':80
- 'co######rchristopher.net':80
- 'ra#####leleonardson.net':80
- 'co#####usleonardson.net':80
- 'ma######ecristianson.net':80
- 'ma#####neleonardson.net':80
- 'sh######echristopher.net':80
- 'ch######schristopher.net':80
- 'ma######echristopher.net':80
- 'co######schristopher.net':80
- 'co#####ussappington.net':80
- 'co######scristianson.net':80
- 'ma#####nesappington.net':80
TCP:
Запросы HTTP GET:
- http://co######echristopher.net/index.php
- http://ka######echristopher.net/index.php
- http://ka#####nesappington.net/index.php
- http://ka######ecristianson.net/index.php
- http://co#####nesappington.net/index.php
- http://ch######scristianson.net/index.php
- http://sh#####nesappington.net/index.php
- http://sh######ecristianson.net/index.php
- http://sh#####neleonardson.net/index.php
- http://ch#####asleonardson.net/index.php
- http://co######ecristianson.net/index.php
- http://ro#####ltleonardson.net/index.php
- http://ro######tcristianson.net/index.php
- http://ra#####feleonardson.net/index.php
- http://qu#####lasappington.net/index.php
- http://qu######achristopher.net/index.php
- http://co#####neleonardson.net/index.php
- http://ka#####neleonardson.net/index.php
- http://ro######tchristopher.net/index.php
- http://ra#####fesappington.net/index.php
- http://ro#####ltsappington.net/index.php
- http://ch#####assappington.net/index.php
- http://ra#####lesappington.net/index.php
- http://co#####ersappington.net/index.php
- http://co######rcristianson.net/index.php
- http://co#####erleonardson.net/index.php
- http://ra######ecristianson.net/index.php
- http://tr#####anleonardson.net/index.php
- http://se######rcristianson.net/index.php
- http://se#####erleonardson.net/index.php
- http://ra######echristopher.net/index.php
- http://co######rchristopher.net/index.php
- http://ra#####leleonardson.net/index.php
- http://co#####usleonardson.net/index.php
- http://ma######ecristianson.net/index.php
- http://ma#####neleonardson.net/index.php
- http://sh######echristopher.net/index.php
- http://ch######schristopher.net/index.php
- http://ma######echristopher.net/index.php
- http://co######schristopher.net/index.php
- http://co#####ussappington.net/index.php
- http://co######scristianson.net/index.php
- http://ma#####nesappington.net/index.php
UDP:
- DNS ASK co######echristopher.net
- DNS ASK ka######echristopher.net
- DNS ASK ka#####nesappington.net
- DNS ASK ka######ecristianson.net
- DNS ASK co#####nesappington.net
- DNS ASK ch######scristianson.net
- DNS ASK sh#####nesappington.net
- DNS ASK sh######ecristianson.net
- DNS ASK sh#####neleonardson.net
- DNS ASK ch#####asleonardson.net
- DNS ASK co######ecristianson.net
- DNS ASK ro#####ltleonardson.net
- DNS ASK ro######tcristianson.net
- DNS ASK ra#####feleonardson.net
- DNS ASK qu#####lasappington.net
- DNS ASK qu######achristopher.net
- DNS ASK co#####neleonardson.net
- DNS ASK ka#####neleonardson.net
- DNS ASK ro######tchristopher.net
- DNS ASK ra#####fesappington.net
- DNS ASK ro#####ltsappington.net
- DNS ASK ch#####assappington.net
- DNS ASK ra#####lesappington.net
- DNS ASK co#####ersappington.net
- DNS ASK co######rcristianson.net
- DNS ASK co#####erleonardson.net
- DNS ASK ra######ecristianson.net
- DNS ASK tr#####anleonardson.net
- DNS ASK se######rcristianson.net
- DNS ASK se#####erleonardson.net
- DNS ASK ra######echristopher.net
- DNS ASK co######rchristopher.net
- DNS ASK ra#####leleonardson.net
- DNS ASK co#####usleonardson.net
- DNS ASK ma######ecristianson.net
- DNS ASK ma#####neleonardson.net
- DNS ASK sh######echristopher.net
- DNS ASK ch######schristopher.net
- DNS ASK ma######echristopher.net
- DNS ASK co######schristopher.net
- DNS ASK co#####ussappington.net
- DNS ASK co######scristianson.net
- DNS ASK ma#####nesappington.net
