Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Procedure CardSpace Debugger Health' = 'C:\kioudqjrv\jvnahgeq0h3e1.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Helper WMI Certificate Foundation Net.Tcp Level] 'ImagePath' = 'C:\kioudqjrv\jvnahgeq0h3e1.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Helper WMI Certificate Foundation Net.Tcp Level] 'Start' = '00000002'
Вредоносные функции:
Запускает на исполнение:
- 'C:\kioudqjrv\fafdnye.exe' "c:\kioudqjrv\jvnahgeq0h3e1.exe"
- 'C:\kioudqjrv\jvnahgeq0h3e1.exe'
- 'C:\kioudqjrv\m3ladlm2ryysbzap6a7hm.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\kioudqjrv\jvnahgeq0h3e1.exe
- C:\kioudqjrv\fafdnye.exe
- C:\kioudqjrv\zptq8n
- %WINDIR%\kioudqjrv\m9obzwaqfjo
- C:\kioudqjrv\m9obzwaqfjo
- C:\kioudqjrv\m3ladlm2ryysbzap6a7hm.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\kioudqjrv\fafdnye.exe
- C:\kioudqjrv\jvnahgeq0h3e1.exe
Удаляет следующие файлы:
- C:\kioudqjrv\m3ladlm2ryysbzap6a7hm.exe
- %WINDIR%\kioudqjrv\m9obzwaqfjo
Подменяет следующие файлы:
- %WINDIR%\kioudqjrv\m9obzwaqfjo
Сетевая активность:
Подключается к:
- 'ra#####lemarcelyn.net':80
- 'co#####ermarcelyn.net':80
- 'se#####erkristeen.net':80
- 'co#####ercallahan.net':80
- 'ra#####leshaquila.net':80
- 'co#####ershaquila.net':80
- 'tr#####ankristeen.net':80
- 'tr#####anshaquila.net':80
- 'se#####ermarcelyn.net':80
- 'tr#####anmarcelyn.net':80
- 'se#####ercallahan.net':80
- 'tr#####ancallahan.net':80
- 'se#####ershaquila.net':80
- 'ra#####lecallahan.net':80
- 'ma#####nekristeen.net':80
- 'co#####uskristeen.net':80
- 'ma#####necallahan.net':80
- 'ch#####asshaquila.net':80
- 'sh#####nemarcelyn.net':80
- 'ch#####asmarcelyn.net':80
- 'co#####uscallahan.net':80
- 'co#####usmarcelyn.net':80
- 'ra#####lekristeen.net':80
- 'co#####erkristeen.net':80
- 'ma#####neshaquila.net':80
- 'co#####usshaquila.net':80
- 'ma#####nemarcelyn.net':80
- 'se#####nakristeen.net':80
- 'ra#####febradford.net':80
- 'ro#####ltbradford.net':80
- 'ra#####fekiersten.net':80
- 'ma#####nesymphony.net':80
- 'ra#####fecheyenne.net':80
- 'ro#####ltcheyenne.net':80
- 'ro#####ltkiersten.net':80
- 'ka#####necheyenne.net':80
- 'co#####nebradford.net':80
- 'ka#####nebradford.net':80
- 'ra#####fesymphony.net':80
- 'ro#####ltsymphony.net':80
- 'co#####necheyenne.net':80
- 'qu#####lasymphony.net':80
- 'se#####nashaquila.net':80
- 'jo#####neshaquila.net':80
- 'se#####namarcelyn.net':80
- 'jo#####nekristeen.net':80
- 'se#####nacallahan.net':80
- 'jo#####necallahan.net':80
- 'jo#####nemarcelyn.net':80
- 'ma#####nebradford.net':80
- 'qu#####lakiersten.net':80
- 'ma#####nekiersten.net':80
- 'qu#####lacheyenne.net':80
- 'ma#####necheyenne.net':80
- 'qu#####labradford.net':80
TCP:
Запросы HTTP GET:
- http://ra#####lemarcelyn.net/index.php
- http://co#####ermarcelyn.net/index.php
- http://se#####erkristeen.net/index.php
- http://co#####ercallahan.net/index.php
- http://ra#####leshaquila.net/index.php
- http://co#####ershaquila.net/index.php
- http://tr#####ankristeen.net/index.php
- http://tr#####anshaquila.net/index.php
- http://se#####ermarcelyn.net/index.php
- http://tr#####anmarcelyn.net/index.php
- http://se#####ercallahan.net/index.php
- http://tr#####ancallahan.net/index.php
- http://se#####ershaquila.net/index.php
- http://ra#####lecallahan.net/index.php
- http://ma#####nekristeen.net/index.php
- http://co#####uskristeen.net/index.php
- http://ma#####necallahan.net/index.php
- http://ch#####asshaquila.net/index.php
- http://sh#####nemarcelyn.net/index.php
- http://ch#####asmarcelyn.net/index.php
- http://co#####uscallahan.net/index.php
- http://co#####usmarcelyn.net/index.php
- http://ra#####lekristeen.net/index.php
- http://co#####erkristeen.net/index.php
- http://ma#####neshaquila.net/index.php
- http://co#####usshaquila.net/index.php
- http://ma#####nemarcelyn.net/index.php
- http://se#####nakristeen.net/index.php
- http://ra#####febradford.net/index.php
- http://ro#####ltbradford.net/index.php
- http://ra#####fekiersten.net/index.php
- http://ma#####nesymphony.net/index.php
- http://ra#####fecheyenne.net/index.php
- http://ro#####ltcheyenne.net/index.php
- http://ro#####ltkiersten.net/index.php
- http://ka#####necheyenne.net/index.php
- http://co#####nebradford.net/index.php
- http://ka#####nebradford.net/index.php
- http://ra#####fesymphony.net/index.php
- http://ro#####ltsymphony.net/index.php
- http://co#####necheyenne.net/index.php
- http://qu#####lasymphony.net/index.php
- http://se#####nashaquila.net/index.php
- http://jo#####neshaquila.net/index.php
- http://se#####namarcelyn.net/index.php
- http://jo#####nekristeen.net/index.php
- http://se#####nacallahan.net/index.php
- http://jo#####necallahan.net/index.php
- http://jo#####nemarcelyn.net/index.php
- http://ma#####nebradford.net/index.php
- http://qu#####lakiersten.net/index.php
- http://ma#####nekiersten.net/index.php
- http://qu#####lacheyenne.net/index.php
- http://ma#####necheyenne.net/index.php
- http://qu#####labradford.net/index.php
UDP:
- DNS ASK ra#####lemarcelyn.net
- DNS ASK co#####ermarcelyn.net
- DNS ASK se#####erkristeen.net
- DNS ASK co#####ershaquila.net
- DNS ASK ra#####lecallahan.net
- DNS ASK co#####ercallahan.net
- DNS ASK ra#####leshaquila.net
- DNS ASK tr#####anshaquila.net
- DNS ASK se#####ermarcelyn.net
- DNS ASK tr#####anmarcelyn.net
- DNS ASK se#####ershaquila.net
- DNS ASK tr#####ankristeen.net
- DNS ASK se#####ercallahan.net
- DNS ASK tr#####ancallahan.net
- DNS ASK ma#####nekristeen.net
- DNS ASK co#####uskristeen.net
- DNS ASK ma#####necallahan.net
- DNS ASK ch#####asmarcelyn.net
- DNS ASK sh#####neshaquila.net
- DNS ASK ch#####asshaquila.net
- DNS ASK sh#####nemarcelyn.net
- DNS ASK co#####usmarcelyn.net
- DNS ASK ra#####lekristeen.net
- DNS ASK co#####erkristeen.net
- DNS ASK ma#####nemarcelyn.net
- DNS ASK co#####uscallahan.net
- DNS ASK ma#####neshaquila.net
- DNS ASK co#####usshaquila.net
- DNS ASK ra#####febradford.net
- DNS ASK ro#####ltbradford.net
- DNS ASK ra#####fekiersten.net
- DNS ASK ro#####ltcheyenne.net
- DNS ASK qu#####lasymphony.net
- DNS ASK ma#####nesymphony.net
- DNS ASK ra#####fecheyenne.net
- DNS ASK ka#####necheyenne.net
- DNS ASK co#####nebradford.net
- DNS ASK ka#####nebradford.net
- DNS ASK co#####necheyenne.net
- DNS ASK ro#####ltkiersten.net
- DNS ASK ra#####fesymphony.net
- DNS ASK ro#####ltsymphony.net
- DNS ASK se#####nashaquila.net
- DNS ASK jo#####neshaquila.net
- DNS ASK se#####namarcelyn.net
- DNS ASK jo#####necallahan.net
- DNS ASK se#####nakristeen.net
- DNS ASK jo#####nekristeen.net
- DNS ASK se#####nacallahan.net
- DNS ASK ma#####nebradford.net
- DNS ASK qu#####lakiersten.net
- DNS ASK ma#####nekiersten.net
- DNS ASK qu#####labradford.net
- DNS ASK jo#####nemarcelyn.net
- DNS ASK qu#####lacheyenne.net
- DNS ASK ma#####necheyenne.net
