Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'engel' = '%APPDATA%\updates\updates.exe'
Вредоносные функции:
Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'
Запускает на исполнение:
- <SYSTEM32>\netsh.exe advfirewall firewall add rule name="<Имя вируса>" dir=in action=allow program="<Полный путь к вирусу>"
Изменения в файловой системе:
Создает следующие файлы:
- %APPDATA%\engel\updates.exe
Сетевая активность:
Подключается к:
- '12#.#45.22.38':3128
- '19#.#07.110.169':3128
- '68.#10.86.3':3128
- '12#.#22.106.169':3128
- '92.##.142.167':3128
- '84.##0.129.241':3128
- '19#.#5.26.198':3128
- '95.##2.33.169':3128
- '21#.#86.183.4':3128
- '18#.#37.9.125':3128
- '12#.#8.95.39':3128
- '19#.#25.236.208':3128
- '19#.#2.243.146':3128
- '94.##8.27.97':3128
- '94.##6.151.80':3128
- '68.##.102.81':3128
- '95.##2.226.113':3128
- '94.##.177.90':3128
- '17#.#65.19.33':3128
- '59.##3.172.14':3128
- '77.##4.54.208':3128
- '78.##.73.199':3128
- '11#.#11.37.202':3128
- '95.##.238.24':3128
- '77.##6.62.190':3128
- '88.##5.193.113':3128
- '87.##6.203.32':3128
- '61.##.170.173':3128
- '81.##.215.203':3128
- '18#.#6.43.141':3128
- '18#.#25.187.120':3128
- '74.#15.5.41':3128
- '11#.#12.131.155':3128
- '41.##0.11.47':3128
- '87.##7.49.67':3128
- '19#.#03.111.51':3128
- '11#.#12.131.200':3128
- '94.##.159.128':3128
- '94.#78.4.40':3128
- '93.##3.109.162':3128
- '59.#5.27.8':3128
- '92.##5.174.196':3128
- '11#.#8.240.45':3128
- '19#.#26.148.225':3128
- '85.##6.139.163':3128
- '88.#7.14.23':3128
- '79.##6.10.186':3128
- '59.##5.193.84':3128
- '18#.#46.40.179':3128
- '24.##2.219.145':3128
- '61.##.217.171':3128
- '62.##.110.66':3128
- '77.##.190.15':3128
- '19#.#8.8.117':3128
- '41.##1.150.146':3128
- '84.#2.8.72':3128
- '10#.#4.160.195':3128
- '94.##8.86.48':3128
- '95.##.139.86':3128
- '72.##2.188.10':3128
- '46.##.145.40':3128
- '85.##6.139.142':3128
- '20#.#64.238.149':3128
- '87.##0.166.58':3128
- '41.##1.251.106':3128
- '12#.#18.153.19':3128
- '77.##7.55.44':3128
- '86.##4.146.147':3128
- '95.##.167.125':3128
- '17#.#48.245.192':3128
- '94.##8.141.84':3128
- '94.##.95.151':3128
- '77.##4.158.188':3128
- '11#.#41.136.60':3128
- '79.#41.77.6':3128
- '41.##4.174.117':3128
- '24.##2.25.216':3128
- '22#.#2.80.14':3128
- '95.##.71.141':3128
- '41.##5.54.223':3128
- '12#.#65.113.205':3128
- '77.##7.13.118':3128
- '77.##4.238.137':3128
- '74.#15.3.63':3128
- '11#.44.7.63':3128
- '19#.#58.53.209':3128
- '11#.#12.131.156':3128
- '61.##.191.209':3128
- '21#.#6.136.165':3128
- '18#.#96.132.93':3128
- '18#.#8.112.37':3128
- '46.##7.254.73':3128
- '77.##.42.227':3128
- '95.##2.11.132':3128
- '11#.#13.187.131':3128
- '18#.#5.77.12':3128
- '41.##1.77.159':3128
- '84.##8.128.231':3128
- '81.##.183.22':3128
- '20#.#09.62.172':3128
- '18#.#92.154.187':3128
- '21#.#02.24.139':3128
- '62.##3.174.192':3128
- '83.##.232.105':3128
- '21#.#32.245.19':3128
- '89.##6.178.211':3128
- '77.##4.115.85':3128
- '19#.#7.188.133':3128
- '59.##3.51.145':3128
- '82.##1.88.128':3128
- '46.##7.131.42':3128
- '19#.#7.38.89':3128
- '58.#.104.15':3128
- '16#.#7.221.216':3128
- '11#.#2.218.96':3128
- '62.##3.176.118':3128
- '78.##.242.233':3128
- '21#.#2.200.158':3128
- '18#.#20.226.164':3128
- '17#.#23.78.135':3128
- '61.##.180.152':3128
- '61.##.183.212':3128
- '11#.#12.131.201':3128
- '86.##7.239.143':3128
- '61.##.254.130':3128
- '82.##1.88.129':3128
- '11#.#16.62.235':3128
- '20#.#67.53.132':3128
- '95.##2.65.207':3128
- '19#.#6.196.3':3128
- '11#.#48.73.106':3128
- '62.##3.159.36':3128
- '88.##5.40.159':3128
- '20#.#32.61.93':3128
- '11#.#4.65.217':3128
- '11#.#2.163.177':3128
- '70.##2.223.59':3128
- '10#.#6.130.98':3128
- '77.##0.161.40':3128
- '19#.#06.212.28':3128
- '60.##4.78.236':3128
- '82.##7.106.170':3128
- '95.##.72.247':3128
- '95.##0.100.99':3128
- '20#.#65.165.252':3128
- '60.##0.147.209':3128
- '19#.#3.84.19':3128
- '84.##8.70.161':3128
- '12#.#22.108.111':3128
- '20#.#17.51.159':3128
- '62.##8.214.33':3128
- '22#.#6.108.221':3128
- '13#.#.157.199':3128
- '78.##.105.182':3128
- '22#.#20.58.230':3128
- '46.##9.129.108':3128
- '77.##.191.97':3128
- '41.##3.57.74':3128
- '19#.#04.74.153':3128
- '21#.#86.50.94':3128
- '77.##6.164.130':3128
- '11#.#12.131.144':3128
- '79.##9.202.44':3128
- '95.#6.29.22':3128
- '84.##9.68.98':3128
- '71.#4.23.37':3128
- '41.##3.57.76':3128
- '61.#.70.29':3128
- '20#.#7.212.60':3128
- '59.##3.54.57':3128
- '19#.#1.117.6':3128
- '18#.#3.64.157':3128
- '61.##7.100.211':3128
- '84.#2.63.48':3128
- '89.##2.109.116':3128
- '20#.#87.228.5':3128
- '11#.#41.136.150':3128
- '93.##6.235.9':3128
- '12#.#81.201.75':3128
- '82.##2.103.247':3128
- '61.##.254.162':3128
- '78.##.121.114':3128
- '19#.#86.6.239':3128
- '16#.9.22.67':3128
- '61.##.188.157':3128
- '85.##0.81.228':3128
- '20#.#48.139.97':3128
- '22#.#20.31.112':3128
- '92.##3.92.235':3128
- '20#.#1.160.62':3128
- '92.##3.223.122':3128
- '61.##.56.232':3128
- '95.##1.246.86':3128
- '20#.#43.5.17':3128
- '11#.#06.148.138':3128
- '77.##6.141.8':3128
- '82.##4.163.132':3128
- '84.#.230.196':3128
- '20#.#9.201.9':3128
- '61.##.190.24':3128
- '94.##2.239.203':3128
- '11#.#41.32.76':3128
- '89.##9.226.173':3128
- '11#.#7.184.29':3128
- '22#.#7.120.3':3128
- '19#.#31.213.225':3128
- '20#.#01.45.5':3128
- '71.##.19.129':3128
- '22#.#1.243.218':3128
- '10#.#85.136.152':3128
- '12#.#05.186.8':3128
- '21#.#45.152.202':3128
- '62.##9.117.97':3128
- '68.##4.177.244':3128
- '95.##1.231.1':3128
- '61.##.212.248':3128
- '19#.#1.46.12':3128
- '11#.#3.240.46':3128
- '11#.#68.150.66':3128
- '19#.#51.53.33':3128
- '59.##3.48.191':3128
- '85.##8.128.101':3128
- '18#.#21.135.75':3128
- '78.##.116.26':3128
- '76.##9.223.49':3128
- '22#.#25.22.14':3128
- '95.##.152.16':3128
- '18#.#2.135.122':3128
- '77.##4.143.98':3128
- '11#.#65.14.146':3128
- '89.##3.69.41':3128
- '11#.#65.2.118':3128
- '94.##6.144.28':3128
- '76.##3.127.4':3128
- '11#.#6.46.204':3128
- '18#.#08.214.22':3128
- '18#.#.196.28':3128
- '92.##3.234.142':3128
- '11#.#12.131.207':3128
- '11#.#12.131.132':3128
- '19#.#32.139.32':3128
- '19#.#5.233.166':3128
- '79.##1.18.26':3128
- '18#.#27.102.198':3128
- '83.##8.82.159':3128
- '11#.#41.136.43':3128
- '62.##9.196.203':3128
- '41.##1.112.152':3128
- '12#.#44.8.237':3128
- '20#.#54.63.147':3128
- '84.##9.74.194':3128
- '59.##3.52.133':3128
- '21#.#67.188.27':3128
- '20#.#22.206.121':3128
- '58.#.53.217':3128
- '18#.#3.208.68':3128
- '82.##5.46.58':3128
- '86.##5.144.234':3128
- '22#.#6.233.35':3128
- '11#.#12.131.214':3128
- '46.##8.201.141':3128
- '91.##6.161.145':3128
- '18#.#12.138.52':3128
- '92.##.148.204':3128
- '20#.#38.120.25':3128
- '12#.#40.44.135':3128
- '41.##5.58.40':3128
- '59.#6.91.50':3128
- '83.##5.185.244':3128
- '61.##.250.250':3128
- '19#.#31.208.120':3128
- '19#.#9.197.242':3128
- '95.#9.65.70':3128
- '19#.#25.208.136':3128
- '77.##7.159.108':3128
- '11#.#6.12.94':3128
- '11#.#12.131.138':3128
- '19#.#73.144.127':3128
- '95.##.229.178':3128
- '70.##.116.31':3128
- '93.#4.69.29':3128
- '20#.#3.125.224':3128
- '79.##5.253.7':3128
- '92.##3.144.242':3128
- '41.##3.57.72':3128
- '22#.#43.62.44':3128
- '12#.#.41.218':3128
- '19#.#03.81.118':3128
- '11#.#2.218.27':3128
- '83.##2.81.217':3128
- '12#.#22.108.76':3128
- '95.##2.47.54':3128
- '95.##.214.37':3128
- '84.##0.183.115':3128
- '18#.#4.141.92':3128
Другое:
Ищет следующие окна:
- ClassName: 'Indicator' WindowName: ''
