Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Protection Acquisition Key Parental' = 'C:\crotqlmkjgn69\kgftrilqnplfo.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Enumerator Reporting Firewall Coordinator] 'ImagePath' = 'C:\crotqlmkjgn69\kgftrilqnplfo.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Enumerator Reporting Firewall Coordinator] 'Start' = '00000002'
Вредоносные функции:
Запускает на исполнение:
- 'C:\crotqlmkjgn69\jicnhue.exe' "c:\crotqlmkjgn69\kgftrilqnplfo.exe"
- 'C:\crotqlmkjgn69\kgftrilqnplfo.exe'
- 'C:\crotqlmkjgn69\jjsjtzy2i0ggv7naokefgh.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\crotqlmkjgn69\kgftrilqnplfo.exe
- C:\crotqlmkjgn69\jicnhue.exe
- C:\crotqlmkjgn69\ibghrq
- %WINDIR%\crotqlmkjgn69\izkqvuyddou
- C:\crotqlmkjgn69\izkqvuyddou
- C:\crotqlmkjgn69\jjsjtzy2i0ggv7naokefgh.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\crotqlmkjgn69\jicnhue.exe
- C:\crotqlmkjgn69\kgftrilqnplfo.exe
Удаляет следующие файлы:
- C:\crotqlmkjgn69\jjsjtzy2i0ggv7naokefgh.exe
- %WINDIR%\crotqlmkjgn69\izkqvuyddou
Подменяет следующие файлы:
- %WINDIR%\crotqlmkjgn69\izkqvuyddou
Сетевая активность:
Подключается к:
- 'ka#####necassarah.net':80
- 'al#####ercassarah.net':80
- 'ka#####neharrison.net':80
- 'al#####erharrison.net':80
- 'ka#####neviviette.net':80
- 'al#####raangelica.net':80
- 'ma#####naharrison.net':80
- 'al#####erviviette.net':80
- 'ma#####naangelica.net':80
- 'al#####erangelica.net':80
- 'ro#####ltrowbottom.net':80
- 'ra#####ferowbottom.net':80
- 'ro#####ltcarpenter.net':80
- 'ra#####fecarpenter.net':80
- 'qu#####lagranville.net':80
- 'qu#####larowbottom.net':80
- 'ka#####neangelica.net':80
- 'qu#####larupertson.net':80
- 'qu#####lacarpenter.net':80
- 'ce#####neviviette.net':80
- 'ch#####neangelica.net':80
- 'ce#####necassarah.net':80
- 'am#####neviviette.net':80
- 'sh#####leangelica.net':80
- 'ch#####necassarah.net':80
- 'sh#####lecassarah.net':80
- 'ch#####neharrison.net':80
- 'sh#####leharrison.net':80
- 'am#####necassarah.net':80
- 'al#####racassarah.net':80
- 'ma#####naviviette.net':80
- 'al#####raharrison.net':80
- 'ma#####nacassarah.net':80
- 'al#####raviviette.net':80
- 'am#####neharrison.net':80
- 'ce#####neharrison.net':80
- 'am#####neangelica.net':80
- 'ce#####neangelica.net':80
- 'co#####usrupertson.net':80
- 'ma#####nerupertson.net':80
- 'co#####usgranville.net':80
- 'ma#####negranville.net':80
- 'co#####uscarpenter.net':80
- 'ma#####nerowbottom.net':80
- 'ch#####asgranville.net':80
- 'ma#####necarpenter.net':80
- 'co#####usrowbottom.net':80
- 'ra#####lerowbottom.net':80
- 'co#####ergranville.net':80
- 'ra#####legranville.net':80
- 'tr#####anrowbottom.net':80
- 'se#####errowbottom.net':80
- 'co#####errupertson.net':80
- 'ra#####lecarpenter.net':80
- 'co#####errowbottom.net':80
- 'ra#####lerupertson.net':80
- 'co#####ercarpenter.net':80
- 'co#####necarpenter.net':80
- 'ka#####nerowbottom.net':80
- 'co#####nerupertson.net':80
- 'ka#####necarpenter.net':80
- 'co#####nerowbottom.net':80
- 'ro#####ltrupertson.net':80
- 'ra#####ferupertson.net':80
- 'ro#####ltgranville.net':80
- 'ra#####fegranville.net':80
- 'ka#####nerupertson.net':80
- 'sh#####nerupertson.net':80
- 'ch#####ascarpenter.net':80
- 'sh#####negranville.net':80
- 'ch#####asrupertson.net':80
- 'sh#####necarpenter.net':80
- 'ka#####negranville.net':80
- 'co#####negranville.net':80
- 'ch#####asrowbottom.net':80
- 'sh#####nerowbottom.net':80
TCP:
Запросы HTTP GET:
- http://ka#####necassarah.net/index.php
- http://al#####ercassarah.net/index.php
- http://ka#####neharrison.net/index.php
- http://al#####erharrison.net/index.php
- http://ka#####neviviette.net/index.php
- http://al#####raangelica.net/index.php
- http://ma#####naharrison.net/index.php
- http://al#####erviviette.net/index.php
- http://ma#####naangelica.net/index.php
- http://al#####erangelica.net/index.php
- http://ro#####ltrowbottom.net/index.php
- http://ra#####ferowbottom.net/index.php
- http://ro#####ltcarpenter.net/index.php
- http://ra#####fecarpenter.net/index.php
- http://qu#####lagranville.net/index.php
- http://qu#####larowbottom.net/index.php
- http://ka#####neangelica.net/index.php
- http://qu#####larupertson.net/index.php
- http://qu#####lacarpenter.net/index.php
- http://ce#####neviviette.net/index.php
- http://ch#####neangelica.net/index.php
- http://ce#####necassarah.net/index.php
- http://am#####neviviette.net/index.php
- http://sh#####leangelica.net/index.php
- http://ch#####necassarah.net/index.php
- http://sh#####lecassarah.net/index.php
- http://ch#####neharrison.net/index.php
- http://sh#####leharrison.net/index.php
- http://am#####necassarah.net/index.php
- http://al#####racassarah.net/index.php
- http://ma#####naviviette.net/index.php
- http://al#####raharrison.net/index.php
- http://ma#####nacassarah.net/index.php
- http://al#####raviviette.net/index.php
- http://am#####neharrison.net/index.php
- http://ce#####neharrison.net/index.php
- http://am#####neangelica.net/index.php
- http://ce#####neangelica.net/index.php
- http://co#####usrupertson.net/index.php
- http://ma#####nerupertson.net/index.php
- http://co#####usgranville.net/index.php
- http://ma#####negranville.net/index.php
- http://co#####uscarpenter.net/index.php
- http://ma#####nerowbottom.net/index.php
- http://ch#####asgranville.net/index.php
- http://ma#####necarpenter.net/index.php
- http://co#####usrowbottom.net/index.php
- http://ra#####lerowbottom.net/index.php
- http://co#####ergranville.net/index.php
- http://ra#####legranville.net/index.php
- http://tr#####anrowbottom.net/index.php
- http://se#####errowbottom.net/index.php
- http://co#####errupertson.net/index.php
- http://ra#####lecarpenter.net/index.php
- http://co#####errowbottom.net/index.php
- http://ra#####lerupertson.net/index.php
- http://co#####ercarpenter.net/index.php
- http://co#####necarpenter.net/index.php
- http://ka#####nerowbottom.net/index.php
- http://co#####nerupertson.net/index.php
- http://ka#####necarpenter.net/index.php
- http://co#####nerowbottom.net/index.php
- http://ro#####ltrupertson.net/index.php
- http://ra#####ferupertson.net/index.php
- http://ro#####ltgranville.net/index.php
- http://ra#####fegranville.net/index.php
- http://ka#####nerupertson.net/index.php
- http://sh#####nerupertson.net/index.php
- http://ch#####ascarpenter.net/index.php
- http://sh#####negranville.net/index.php
- http://ch#####asrupertson.net/index.php
- http://sh#####necarpenter.net/index.php
- http://ka#####negranville.net/index.php
- http://co#####negranville.net/index.php
- http://ch#####asrowbottom.net/index.php
- http://sh#####nerowbottom.net/index.php
UDP:
- DNS ASK ka#####necassarah.net
- DNS ASK al#####ercassarah.net
- DNS ASK ka#####neharrison.net
- DNS ASK al#####erharrison.net
- DNS ASK ka#####neviviette.net
- DNS ASK al#####raangelica.net
- DNS ASK ma#####naharrison.net
- DNS ASK al#####erviviette.net
- DNS ASK ma#####naangelica.net
- DNS ASK al#####erangelica.net
- DNS ASK ro#####ltrowbottom.net
- DNS ASK ra#####ferowbottom.net
- DNS ASK ro#####ltcarpenter.net
- DNS ASK ra#####fecarpenter.net
- DNS ASK qu#####lagranville.net
- DNS ASK qu#####larowbottom.net
- DNS ASK ka#####neangelica.net
- DNS ASK qu#####larupertson.net
- DNS ASK qu#####lacarpenter.net
- DNS ASK ce#####neviviette.net
- DNS ASK ch#####neangelica.net
- DNS ASK ce#####necassarah.net
- DNS ASK am#####neviviette.net
- DNS ASK sh#####leangelica.net
- DNS ASK ch#####necassarah.net
- DNS ASK sh#####lecassarah.net
- DNS ASK ch#####neharrison.net
- DNS ASK sh#####leharrison.net
- DNS ASK am#####necassarah.net
- DNS ASK al#####racassarah.net
- DNS ASK ma#####naviviette.net
- DNS ASK al#####raharrison.net
- DNS ASK ma#####nacassarah.net
- DNS ASK al#####raviviette.net
- DNS ASK am#####neharrison.net
- DNS ASK ce#####neharrison.net
- DNS ASK am#####neangelica.net
- DNS ASK ce#####neangelica.net
- DNS ASK co#####usrupertson.net
- DNS ASK ma#####nerupertson.net
- DNS ASK co#####usgranville.net
- DNS ASK ma#####negranville.net
- DNS ASK co#####uscarpenter.net
- DNS ASK ma#####nerowbottom.net
- DNS ASK ch#####asgranville.net
- DNS ASK ma#####necarpenter.net
- DNS ASK co#####usrowbottom.net
- DNS ASK ra#####lerowbottom.net
- DNS ASK co#####ergranville.net
- DNS ASK ra#####legranville.net
- DNS ASK tr#####anrowbottom.net
- DNS ASK se#####errowbottom.net
- DNS ASK co#####errupertson.net
- DNS ASK ra#####lecarpenter.net
- DNS ASK co#####errowbottom.net
- DNS ASK ra#####lerupertson.net
- DNS ASK co#####ercarpenter.net
- DNS ASK co#####necarpenter.net
- DNS ASK ka#####nerowbottom.net
- DNS ASK co#####nerupertson.net
- DNS ASK ka#####necarpenter.net
- DNS ASK co#####nerowbottom.net
- DNS ASK ro#####ltrupertson.net
- DNS ASK ra#####ferupertson.net
- DNS ASK ro#####ltgranville.net
- DNS ASK ra#####fegranville.net
- DNS ASK ka#####nerupertson.net
- DNS ASK sh#####nerupertson.net
- DNS ASK ch#####ascarpenter.net
- DNS ASK sh#####negranville.net
- DNS ASK ch#####asrupertson.net
- DNS ASK sh#####necarpenter.net
- DNS ASK ka#####negranville.net
- DNS ASK co#####negranville.net
- DNS ASK ch#####asrowbottom.net
- DNS ASK sh#####nerowbottom.net
