Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Extensible Call Keying WinHTTP ActiveX' = 'C:\xngbkgq\jmzyywgih.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Distributed Configuration Config Keying] 'ImagePath' = 'C:\xngbkgq\jmzyywgih.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Distributed Configuration Config Keying] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- 'C:\xngbkgq\wdwihqdd.exe' "c:\xngbkgq\jmzyywgih.exe"
- 'C:\xngbkgq\jmzyywgih.exe'
- 'C:\xngbkgq\bca2rozcfolzzdizmrh.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\xngbkgq\jmzyywgih.exe
- C:\xngbkgq\wdwihqdd.exe
- C:\xngbkgq\bca2rozcfolzzdizmrh.exe
- %WINDIR%\xngbkgq\gbbiwmnj
- C:\xngbkgq\gbbiwmnj
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\xngbkgq\wdwihqdd.exe
- C:\xngbkgq\jmzyywgih.exe
Удаляет следующие файлы:
- C:\xngbkgq\bca2rozcfolzzdizmrh.exe
- %WINDIR%\xngbkgq\gbbiwmnj
Подменяет следующие файлы:
- %WINDIR%\xngbkgq\gbbiwmnj
Сетевая активность:
Подключается к:
- 'ga####needle.net':80
- 'be####needle.net':80
- 'ga####nature.net':80
- 'be####govern.net':80
- 'ga####enough.net':80
- 'be####enough.net':80
- 'tr###enough.net':80
- 'st####enough.net':80
- 'tr###needle.net':80
- 'be####nature.net':80
- 'tr###govern.net':80
- 'st####govern.net':80
- 'br###govern.net':80
- 'fl###govern.net':80
- 'br###enough.net':80
- 'qu###needle.net':80
- 'se####nature.net':80
- 'qu###nature.net':80
- 'br###nature.net':80
- 'fl###nature.net':80
- 'ga####govern.net':80
- 'fl###enough.net':80
- 'br###needle.net':80
- 'fl###needle.net':80
- 'ca####nneedle.net':80
- 'la###needle.net':80
- 'ca####nnature.net':80
- 'la###govern.net':80
- 'ca####nenough.net':80
- 'la###enough.net':80
- 'de####enough.net':80
- 'ni###enough.net':80
- 'de####needle.net':80
- 'la###nature.net':80
- 'de####govern.net':80
- 'ni###govern.net':80
- 'el####icgovern.net':80
- 're####govern.net':80
- 'el####icenough.net':80
- 'st####needle.net':80
- 'tr###nature.net':80
- 'st####nature.net':80
- 'el####icnature.net':80
- 're####nature.net':80
- 'ca####ngovern.net':80
- 're####enough.net':80
- 'el####icneedle.net':80
- 're####needle.net':80
TCP:
Запросы HTTP GET:
- http://ga####needle.net/index.php
- http://be####needle.net/index.php
- http://ga####nature.net/index.php
- http://be####govern.net/index.php
- http://ga####enough.net/index.php
- http://be####enough.net/index.php
- http://tr###enough.net/index.php
- http://st####enough.net/index.php
- http://tr###needle.net/index.php
- http://be####nature.net/index.php
- http://tr###govern.net/index.php
- http://st####govern.net/index.php
- http://br###govern.net/index.php
- http://fl###govern.net/index.php
- http://br###enough.net/index.php
- http://qu###needle.net/index.php
- http://se####nature.net/index.php
- http://qu###nature.net/index.php
- http://br###nature.net/index.php
- http://fl###nature.net/index.php
- http://ga####govern.net/index.php
- http://fl###enough.net/index.php
- http://br###needle.net/index.php
- http://fl###needle.net/index.php
- http://ca####nneedle.net/index.php
- http://la###needle.net/index.php
- http://ca####nnature.net/index.php
- http://la###govern.net/index.php
- http://ca####nenough.net/index.php
- http://la###enough.net/index.php
- http://de####enough.net/index.php
- http://ni###enough.net/index.php
- http://de####needle.net/index.php
- http://la###nature.net/index.php
- http://de####govern.net/index.php
- http://ni###govern.net/index.php
- http://el####icgovern.net/index.php
- http://re####govern.net/index.php
- http://el####icenough.net/index.php
- http://st####needle.net/index.php
- http://tr###nature.net/index.php
- http://st####nature.net/index.php
- http://el####icnature.net/index.php
- http://re####nature.net/index.php
- http://ca####ngovern.net/index.php
- http://re####enough.net/index.php
- http://el####icneedle.net/index.php
- http://re####needle.net/index.php
UDP:
- DNS ASK ga####needle.net
- DNS ASK be####needle.net
- DNS ASK ga####nature.net
- DNS ASK be####govern.net
- DNS ASK ga####enough.net
- DNS ASK be####enough.net
- DNS ASK tr###enough.net
- DNS ASK st####enough.net
- DNS ASK tr###needle.net
- DNS ASK be####nature.net
- DNS ASK tr###govern.net
- DNS ASK st####govern.net
- DNS ASK br###govern.net
- DNS ASK fl###govern.net
- DNS ASK br###enough.net
- DNS ASK qu###needle.net
- DNS ASK se####nature.net
- DNS ASK qu###nature.net
- DNS ASK br###nature.net
- DNS ASK fl###nature.net
- DNS ASK ga####govern.net
- DNS ASK fl###enough.net
- DNS ASK br###needle.net
- DNS ASK fl###needle.net
- DNS ASK ca####nneedle.net
- DNS ASK la###needle.net
- DNS ASK ca####nnature.net
- DNS ASK la###govern.net
- DNS ASK ca####nenough.net
- DNS ASK la###enough.net
- DNS ASK de####enough.net
- DNS ASK ni###enough.net
- DNS ASK de####needle.net
- DNS ASK la###nature.net
- DNS ASK de####govern.net
- DNS ASK ni###govern.net
- DNS ASK el####icgovern.net
- DNS ASK re####govern.net
- DNS ASK el####icenough.net
- DNS ASK st####needle.net
- DNS ASK tr###nature.net
- DNS ASK st####nature.net
- DNS ASK el####icnature.net
- DNS ASK re####nature.net
- DNS ASK ca####ngovern.net
- DNS ASK re####enough.net
- DNS ASK el####icneedle.net
- DNS ASK re####needle.net
