Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'SNMP Initiator Socket Net.Tcp User-mode Agent' = 'C:\unzjuqsii\mulee4aml.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Now Cryptographic Extender Class Media Bus] 'ImagePath' = 'C:\unzjuqsii\mulee4aml.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Now Cryptographic Extender Class Media Bus] 'Start' = '00000002'
Вредоносные функции:
Запускает на исполнение:
- 'C:\unzjuqsii\ewdlypqk51fou.exe' "c:\unzjuqsii\mulee4aml.exe"
- 'C:\unzjuqsii\mulee4aml.exe'
- 'C:\unzjuqsii\x1gzjlfy2ifngffk5u6eqolv.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\unzjuqsii\mulee4aml.exe
- C:\unzjuqsii\ewdlypqk51fou.exe
- C:\unzjuqsii\duouhi7abqd
- %WINDIR%\unzjuqsii\ytmmty1b
- C:\unzjuqsii\ytmmty1b
- C:\unzjuqsii\x1gzjlfy2ifngffk5u6eqolv.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\unzjuqsii\ewdlypqk51fou.exe
- C:\unzjuqsii\mulee4aml.exe
Удаляет следующие файлы:
- C:\unzjuqsii\x1gzjlfy2ifngffk5u6eqolv.exe
- %WINDIR%\unzjuqsii\ytmmty1b
Подменяет следующие файлы:
- %WINDIR%\unzjuqsii\ytmmty1b
Сетевая активность:
Подключается к:
- 'gw#####restephenson.net':80
- 'ch######ncollingwood.net':80
- 'gw######ecollingwood.net':80
- 'al#####erwilloughby.net':80
- 'ka#####newilloughby.net':80
- 'ch#####anstephenson.net':80
- 'ch#####angabrielson.net':80
- 'gu#####enstephenson.net':80
- 'an#####lestephenson.net':80
- 'gu######ncollingwood.net':80
- 'gw#####regabrielson.net':80
- 'ch######nchristinsen.net':80
- 'gw######echristinsen.net':80
- 'al#####raarthurson.net':80
- 'ma#####naarthurson.net':80
- 'al#####rawilloughby.net':80
- 'ma#####nanormanson.net':80
- 'al#####ramontgomery.net':80
- 'ma#####namontgomery.net':80
- 'ma#####nawilloughby.net':80
- 'ka#####nemontgomery.net':80
- 'al#####erarthurson.net':80
- 'ka#####nearthurson.net':80
- 'al#####ernormanson.net':80
- 'ka#####nenormanson.net':80
- 'al#####ermontgomery.net':80
- 'an######ecollingwood.net':80
- 'ar#####ldgabrielson.net':80
- 'za######hchristinsen.net':80
- 'ar######dchristinsen.net':80
- 'za######hcollingwood.net':80
- 'ar######dcollingwood.net':80
- 'za#####ahgabrielson.net':80
- 'sh#####lestephenson.net':80
- 'sh#####legabrielson.net':80
- 'ch#####negabrielson.net':80
- 'sh######echristinsen.net':80
- 'ch#####nestephenson.net':80
- 'sh######ecollingwood.net':80
- 'ch######ecollingwood.net':80
- 'an######echristinsen.net':80
- 'ch#####lestephenson.net':80
- 'ge#####nastephenson.net':80
- 'gu#####engabrielson.net':80
- 'an#####legabrielson.net':80
- 'gu######nchristinsen.net':80
- 'ge######acollingwood.net':80
- 'ge######achristinsen.net':80
- 'za#####ahstephenson.net':80
- 'ar#####ldstephenson.net':80
- 'ch#####legabrielson.net':80
- 'ge#####nagabrielson.net':80
- 'ch######echristinsen.net':80
TCP:
Запросы HTTP GET:
- http://gw#####restephenson.net/index.php
- http://ch######ncollingwood.net/index.php
- http://gw######ecollingwood.net/index.php
- http://al#####erwilloughby.net/index.php
- http://ka#####newilloughby.net/index.php
- http://ch#####anstephenson.net/index.php
- http://ch#####angabrielson.net/index.php
- http://gu#####enstephenson.net/index.php
- http://an#####lestephenson.net/index.php
- http://gu######ncollingwood.net/index.php
- http://gw#####regabrielson.net/index.php
- http://ch######nchristinsen.net/index.php
- http://gw######echristinsen.net/index.php
- http://al#####raarthurson.net/index.php
- http://ma#####naarthurson.net/index.php
- http://al#####rawilloughby.net/index.php
- http://ma#####nanormanson.net/index.php
- http://al#####ramontgomery.net/index.php
- http://ma#####namontgomery.net/index.php
- http://ma#####nawilloughby.net/index.php
- http://ka#####nemontgomery.net/index.php
- http://al#####erarthurson.net/index.php
- http://ka#####nearthurson.net/index.php
- http://al#####ernormanson.net/index.php
- http://ka#####nenormanson.net/index.php
- http://al#####ermontgomery.net/index.php
- http://an######ecollingwood.net/index.php
- http://ar#####ldgabrielson.net/index.php
- http://za######hchristinsen.net/index.php
- http://ar######dchristinsen.net/index.php
- http://za######hcollingwood.net/index.php
- http://ar######dcollingwood.net/index.php
- http://za#####ahgabrielson.net/index.php
- http://sh#####lestephenson.net/index.php
- http://sh#####legabrielson.net/index.php
- http://ch#####negabrielson.net/index.php
- http://sh######echristinsen.net/index.php
- http://ch#####nestephenson.net/index.php
- http://sh######ecollingwood.net/index.php
- http://ch######ecollingwood.net/index.php
- http://an######echristinsen.net/index.php
- http://ch#####lestephenson.net/index.php
- http://ge#####nastephenson.net/index.php
- http://gu#####engabrielson.net/index.php
- http://an#####legabrielson.net/index.php
- http://gu######nchristinsen.net/index.php
- http://ge######acollingwood.net/index.php
- http://ge######achristinsen.net/index.php
- http://za#####ahstephenson.net/index.php
- http://ar#####ldstephenson.net/index.php
- http://ch#####legabrielson.net/index.php
- http://ge#####nagabrielson.net/index.php
- http://ch######echristinsen.net/index.php
UDP:
- DNS ASK gw#####restephenson.net
- DNS ASK ch######ncollingwood.net
- DNS ASK gw######ecollingwood.net
- DNS ASK al#####erwilloughby.net
- DNS ASK ka#####newilloughby.net
- DNS ASK ch#####anstephenson.net
- DNS ASK ch#####angabrielson.net
- DNS ASK gu#####enstephenson.net
- DNS ASK an#####lestephenson.net
- DNS ASK gu######ncollingwood.net
- DNS ASK gw#####regabrielson.net
- DNS ASK ch######nchristinsen.net
- DNS ASK gw######echristinsen.net
- DNS ASK ka#####nearthurson.net
- DNS ASK ma#####namontgomery.net
- DNS ASK al#####raarthurson.net
- DNS ASK ma#####naarthurson.net
- DNS ASK al#####ranormanson.net
- DNS ASK ma#####nanormanson.net
- DNS ASK al#####ramontgomery.net
- DNS ASK al#####rawilloughby.net
- DNS ASK al#####ermontgomery.net
- DNS ASK ka#####nemontgomery.net
- DNS ASK al#####erarthurson.net
- DNS ASK ma#####nawilloughby.net
- DNS ASK al#####ernormanson.net
- DNS ASK ka#####nenormanson.net
- DNS ASK ar#####ldgabrielson.net
- DNS ASK za######hchristinsen.net
- DNS ASK ar######dchristinsen.net
- DNS ASK za######hcollingwood.net
- DNS ASK ar######dcollingwood.net
- DNS ASK za#####ahgabrielson.net
- DNS ASK sh#####lestephenson.net
- DNS ASK sh#####legabrielson.net
- DNS ASK ch#####negabrielson.net
- DNS ASK sh######echristinsen.net
- DNS ASK ch#####nestephenson.net
- DNS ASK sh######ecollingwood.net
- DNS ASK ch######ecollingwood.net
- DNS ASK ar#####ldstephenson.net
- DNS ASK gu######nchristinsen.net
- DNS ASK an######echristinsen.net
- DNS ASK ch#####lestephenson.net
- DNS ASK an######ecollingwood.net
- DNS ASK gu#####engabrielson.net
- DNS ASK an#####legabrielson.net
- DNS ASK ge#####nastephenson.net
- DNS ASK ch######echristinsen.net
- DNS ASK ge######achristinsen.net
- DNS ASK za#####ahstephenson.net
- DNS ASK ge######acollingwood.net
- DNS ASK ch#####legabrielson.net
- DNS ASK ge#####nagabrielson.net
