Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Card Scheduler Studio Drive File' = 'C:\zgheixdd\xvdxnlahbw.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Event Distributed Accounts Secure] 'ImagePath' = 'C:\zgheixdd\xvdxnlahbw.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Event Distributed Accounts Secure] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- 'C:\zgheixdd\htfdwi5vz.exe' "c:\zgheixdd\xvdxnlahbw.exe"
- 'C:\zgheixdd\xvdxnlahbw.exe'
- 'C:\zgheixdd\fkzoiy32eenjmapta1kpc.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\zgheixdd\xvdxnlahbw.exe
- C:\zgheixdd\htfdwi5vz.exe
- C:\zgheixdd\jzgrppkbrrlk
- %WINDIR%\zgheixdd\eplyak7scbl
- C:\zgheixdd\eplyak7scbl
- C:\zgheixdd\fkzoiy32eenjmapta1kpc.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\zgheixdd\htfdwi5vz.exe
- C:\zgheixdd\xvdxnlahbw.exe
Удаляет следующие файлы:
- C:\zgheixdd\fkzoiy32eenjmapta1kpc.exe
- %WINDIR%\zgheixdd\eplyak7scbl
Подменяет следующие файлы:
- %WINDIR%\zgheixdd\eplyak7scbl
Сетевая активность:
Подключается к:
- 'ch#####anaphilomena.net':80
- 'wi#####hbykristina.net':80
- 'ch#####anafrederick.net':80
- 'du#####llaphilomena.net':80
- 'ba#####omewkristina.net':80
- 'wi#####hbyfrederick.net':80
- 'ba######mewfrederick.net':80
- 'wi#####hbygallagher.net':80
- 'ba######mewgallagher.net':80
- 'du#####llafrederick.net':80
- 'wa#####tonfrederick.net':80
- 'ea#####inephilomena.net':80
- 'wa#####tongallagher.net':80
- 'ea#####inefrederick.net':80
- 'wa#####tonphilomena.net':80
- 'du#####llagallagher.net':80
- 'ch#####anagallagher.net':80
- 'du#####llakristina.net':80
- 'ch#####anakristina.net':80
- 'wi#####hbyphilomena.net':80
- 'ri######necristiansen.net':80
- 'ev######nematthewson.net':80
- 'ri######nemurgatroyd.net':80
- 'ev######necristiansen.net':80
- 'ri######nematthewson.net':80
- 'ev######namurgatroyd.net':80
- 'be######rdmurgatroyd.net':80
- 'ev######neoutterridge.net':80
- 'ri######neoutterridge.net':80
- 'ev######nemurgatroyd.net':80
- 'al#####rinakristina.net':80
- 'ma#####llagallagher.net':80
- 'ba######mewphilomena.net':80
- 'ma#####llakristina.net':80
- 'al######inagallagher.net':80
- 'ma#####llaphilomena.net':80
- 'al######inaphilomena.net':80
- 'ma#####llafrederick.net':80
- 'al######inafrederick.net':80
TCP:
Запросы HTTP GET:
- http://ch#####anaphilomena.net/index.php
- http://wi#####hbykristina.net/index.php
- http://ch#####anafrederick.net/index.php
- http://du#####llaphilomena.net/index.php
- http://ba#####omewkristina.net/index.php
- http://wi#####hbyfrederick.net/index.php
- http://ba######mewfrederick.net/index.php
- http://wi#####hbygallagher.net/index.php
- http://ba######mewgallagher.net/index.php
- http://du#####llafrederick.net/index.php
- http://wa#####tonfrederick.net/index.php
- http://ea#####inephilomena.net/index.php
- http://wa#####tongallagher.net/index.php
- http://ea#####inefrederick.net/index.php
- http://wa#####tonphilomena.net/index.php
- http://du#####llagallagher.net/index.php
- http://ch#####anagallagher.net/index.php
- http://du#####llakristina.net/index.php
- http://ch#####anakristina.net/index.php
- http://wi#####hbyphilomena.net/index.php
- http://ri######necristiansen.net/index.php
- http://ev######nematthewson.net/index.php
- http://ri######nemurgatroyd.net/index.php
- http://ev######necristiansen.net/index.php
- http://ri######nematthewson.net/index.php
- http://ev######namurgatroyd.net/index.php
- http://be######rdmurgatroyd.net/index.php
- http://ev######neoutterridge.net/index.php
- http://ri######neoutterridge.net/index.php
- http://ev######nemurgatroyd.net/index.php
- http://al#####rinakristina.net/index.php
- http://ma#####llagallagher.net/index.php
- http://ba######mewphilomena.net/index.php
- http://ma#####llakristina.net/index.php
- http://al######inagallagher.net/index.php
- http://ma#####llaphilomena.net/index.php
- http://al######inaphilomena.net/index.php
- http://ma#####llafrederick.net/index.php
- http://al######inafrederick.net/index.php
UDP:
- DNS ASK ch#####anaphilomena.net
- DNS ASK wi#####hbykristina.net
- DNS ASK du#####llaphilomena.net
- DNS ASK du#####llafrederick.net
- DNS ASK ch#####anafrederick.net
- DNS ASK wi#####hbyfrederick.net
- DNS ASK ba######mewfrederick.net
- DNS ASK ba######mewgallagher.net
- DNS ASK ba#####omewkristina.net
- DNS ASK wi#####hbygallagher.net
- DNS ASK wa#####tonfrederick.net
- DNS ASK ea#####inephilomena.net
- DNS ASK ea#####inefrederick.net
- DNS ASK ea#####inegallagher.net
- DNS ASK wa#####tongallagher.net
- DNS ASK du#####llagallagher.net
- DNS ASK ch#####anagallagher.net
- DNS ASK ch#####anakristina.net
- DNS ASK wa#####tonphilomena.net
- DNS ASK du#####llakristina.net
- DNS ASK ri######necristiansen.net
- DNS ASK ev######nematthewson.net
- DNS ASK ev######necristiansen.net
- DNS ASK ev######nemurgatroyd.net
- DNS ASK ri######nemurgatroyd.net
- DNS ASK ev######namurgatroyd.net
- DNS ASK be######rdmurgatroyd.net
- DNS ASK ri######neoutterridge.net
- DNS ASK ri######nematthewson.net
- DNS ASK ev######neoutterridge.net
- DNS ASK al#####rinakristina.net
- DNS ASK ma#####llagallagher.net
- DNS ASK ma#####llakristina.net
- DNS ASK wi#####hbyphilomena.net
- DNS ASK ba######mewphilomena.net
- DNS ASK ma#####llaphilomena.net
- DNS ASK al######inaphilomena.net
- DNS ASK al######inafrederick.net
- DNS ASK al######inagallagher.net
- DNS ASK ma#####llafrederick.net
