Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Session Browser Authentication Files Input' = 'C:\mgeyicprlx\pjh3frxakq.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\CardSpace RPC Port Drive Awareness Filtering] 'ImagePath' = 'C:\mgeyicprlx\pjh3frxakq.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\CardSpace RPC Port Drive Awareness Filtering] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- 'C:\mgeyicprlx\rtcihyvtypix.exe' "c:\mgeyicprlx\pjh3frxakq.exe"
- 'C:\mgeyicprlx\pjh3frxakq.exe'
- 'C:\mgeyicprlx\cvldsp2s3avaligeghli.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\mgeyicprlx\pjh3frxakq.exe
- C:\mgeyicprlx\rtcihyvtypix.exe
- C:\mgeyicprlx\bcltayxje2f
- %WINDIR%\mgeyicprlx\ipsvp5booxi
- C:\mgeyicprlx\ipsvp5booxi
- C:\mgeyicprlx\cvldsp2s3avaligeghli.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\mgeyicprlx\rtcihyvtypix.exe
- C:\mgeyicprlx\pjh3frxakq.exe
Удаляет следующие файлы:
- C:\mgeyicprlx\cvldsp2s3avaligeghli.exe
- %WINDIR%\mgeyicprlx\ipsvp5booxi
Подменяет следующие файлы:
- %WINDIR%\mgeyicprlx\ipsvp5booxi
Сетевая активность:
Подключается к:
- 'ca#####neburgundy.net':80
- 'ca#####naburgundy.net':80
- 'ca#####nejaqueline.net':80
- 'ca#####nacherette.net':80
- 'ca#####neelizabeth.net':80
- 'ca#####naelizabeth.net':80
- 'ki#####eeelizabeth.net':80
- 'ma#####ianelizabeth.net':80
- 'ki#####eeburgundy.net':80
- 'ca#####najaqueline.net':80
- 'ki#####eecherette.net':80
- 'ma#####iancherette.net':80
- 'ma#####necherette.net':80
- 'an#####techerette.net':80
- 'ma#####neelizabeth.net':80
- 'ch#####teburgundy.net':80
- 'st#####iejaqueline.net':80
- 'ch#####tejaqueline.net':80
- 'ma#####nejaqueline.net':80
- 'an#####tejaqueline.net':80
- 'ca#####necherette.net':80
- 'an#####teelizabeth.net':80
- 'ma#####neburgundy.net':80
- 'an#####teburgundy.net':80
- 'ma#####kefrederick.net':80
- 'ze#####ahfrederick.net':80
- 'ma#####kephilomena.net':80
- 'ze#####ahkristina.net':80
- 'ma#####kegallagher.net':80
- 'ze#####ahgallagher.net':80
- 'ge#####vegallagher.net':80
- 'je#####negallagher.net':80
- 'ge#####vefrederick.net':80
- 'ze#####ahphilomena.net':80
- 'ge#####vekristina.net':80
- 'je#####nekristina.net':80
- 'ca#####racherette.net':80
- 'kr#####hercherette.net':80
- 'ca#####raelizabeth.net':80
- 'ma#####ianburgundy.net':80
- 'ki#####eejaqueline.net':80
- 'ma#####ianjaqueline.net':80
- 'ca#####rajaqueline.net':80
- 'kr#####herjaqueline.net':80
- 'ma#####kekristina.net':80
- 'kr#####herelizabeth.net':80
- 'ca#####raburgundy.net':80
- 'kr#####herburgundy.net':80
TCP:
Запросы HTTP GET:
- http://ca#####neburgundy.net/index.php
- http://ca#####naburgundy.net/index.php
- http://ca#####nejaqueline.net/index.php
- http://ca#####nacherette.net/index.php
- http://ca#####neelizabeth.net/index.php
- http://ca#####naelizabeth.net/index.php
- http://ki#####eeelizabeth.net/index.php
- http://ma#####ianelizabeth.net/index.php
- http://ki#####eeburgundy.net/index.php
- http://ca#####najaqueline.net/index.php
- http://ki#####eecherette.net/index.php
- http://ma#####iancherette.net/index.php
- http://ma#####necherette.net/index.php
- http://an#####techerette.net/index.php
- http://ma#####neelizabeth.net/index.php
- http://ch#####teburgundy.net/index.php
- http://st#####iejaqueline.net/index.php
- http://ch#####tejaqueline.net/index.php
- http://ma#####nejaqueline.net/index.php
- http://an#####tejaqueline.net/index.php
- http://ca#####necherette.net/index.php
- http://an#####teelizabeth.net/index.php
- http://ma#####neburgundy.net/index.php
- http://an#####teburgundy.net/index.php
- http://ma#####kefrederick.net/index.php
- http://ze#####ahfrederick.net/index.php
- http://ma#####kephilomena.net/index.php
- http://ze#####ahkristina.net/index.php
- http://ma#####kegallagher.net/index.php
- http://ze#####ahgallagher.net/index.php
- http://ge#####vegallagher.net/index.php
- http://je#####negallagher.net/index.php
- http://ge#####vefrederick.net/index.php
- http://ze#####ahphilomena.net/index.php
- http://ge#####vekristina.net/index.php
- http://je#####nekristina.net/index.php
- http://ca#####racherette.net/index.php
- http://kr#####hercherette.net/index.php
- http://ca#####raelizabeth.net/index.php
- http://ma#####ianburgundy.net/index.php
- http://ki#####eejaqueline.net/index.php
- http://ma#####ianjaqueline.net/index.php
- http://ca#####rajaqueline.net/index.php
- http://kr#####herjaqueline.net/index.php
- http://ma#####kekristina.net/index.php
- http://kr#####herelizabeth.net/index.php
- http://ca#####raburgundy.net/index.php
- http://kr#####herburgundy.net/index.php
UDP:
- DNS ASK ca#####naelizabeth.net
- DNS ASK ca#####neburgundy.net
- DNS ASK ca#####naburgundy.net
- DNS ASK ca#####necherette.net
- DNS ASK ca#####nacherette.net
- DNS ASK ca#####neelizabeth.net
- DNS ASK ma#####iancherette.net
- DNS ASK ki#####eeelizabeth.net
- DNS ASK ma#####ianelizabeth.net
- DNS ASK ca#####nejaqueline.net
- DNS ASK ca#####najaqueline.net
- DNS ASK ki#####eecherette.net
- DNS ASK ch#####tejaqueline.net
- DNS ASK ma#####necherette.net
- DNS ASK an#####techerette.net
- DNS ASK st#####ieburgundy.net
- DNS ASK ch#####teburgundy.net
- DNS ASK st#####iejaqueline.net
- DNS ASK an#####teburgundy.net
- DNS ASK ma#####nejaqueline.net
- DNS ASK an#####tejaqueline.net
- DNS ASK ma#####neelizabeth.net
- DNS ASK an#####teelizabeth.net
- DNS ASK ma#####neburgundy.net
- DNS ASK ki#####eeburgundy.net
- DNS ASK ma#####kefrederick.net
- DNS ASK ze#####ahfrederick.net
- DNS ASK ma#####kephilomena.net
- DNS ASK ze#####ahkristina.net
- DNS ASK ma#####kegallagher.net
- DNS ASK ze#####ahgallagher.net
- DNS ASK ge#####vegallagher.net
- DNS ASK je#####negallagher.net
- DNS ASK ge#####vefrederick.net
- DNS ASK ze#####ahphilomena.net
- DNS ASK ge#####vekristina.net
- DNS ASK je#####nekristina.net
- DNS ASK ca#####racherette.net
- DNS ASK kr#####hercherette.net
- DNS ASK ca#####raelizabeth.net
- DNS ASK ma#####ianburgundy.net
- DNS ASK ki#####eejaqueline.net
- DNS ASK ma#####ianjaqueline.net
- DNS ASK ca#####rajaqueline.net
- DNS ASK kr#####herjaqueline.net
- DNS ASK ma#####kekristina.net
- DNS ASK kr#####herelizabeth.net
- DNS ASK ca#####raburgundy.net
- DNS ASK kr#####herburgundy.net
