Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Defender WMI Error CNG Function' = 'C:\evyfauo\npzzfrztaimq.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Upgrade TPM Level Reports Class] 'ImagePath' = 'C:\evyfauo\npzzfrztaimq.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Upgrade TPM Level Reports Class] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- 'C:\evyfauo\xpsipsn.exe' "c:\evyfauo\npzzfrztaimq.exe"
- 'C:\evyfauo\npzzfrztaimq.exe'
- 'C:\evyfauo\m92lg5tdnigujdn6l.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\evyfauo\npzzfrztaimq.exe
- C:\evyfauo\xpsipsn.exe
- C:\evyfauo\m92lg5tdnigujdn6l.exe
- %WINDIR%\evyfauo\g9daoqhw
- C:\evyfauo\g9daoqhw
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\evyfauo\xpsipsn.exe
- C:\evyfauo\npzzfrztaimq.exe
Удаляет следующие файлы:
- C:\evyfauo\m92lg5tdnigujdn6l.exe
- %WINDIR%\evyfauo\g9daoqhw
Подменяет следующие файлы:
- %WINDIR%\evyfauo\g9daoqhw
Сетевая активность:
Подключается к:
- 'mo####gfurther.net':80
- 'ra####further.net':80
- 'tw####company.net':80
- 'ra###rcover.net':80
- 'mo####gbecome.net':80
- 'ra####become.net':80
- 'mo####gcover.net':80
- 'mi####company.net':80
- 'tw####further.net':80
- 'mi####further.net':80
- 'al####ompany.net':80
- 'mi###ecover.net':80
- 'tw####become.net':80
- 'mi####become.net':80
- 'tw###ecover.net':80
- 'am####further.net':80
- 'hi####ycompany.net':80
- 'st####ecompany.net':80
- 'we####rfurther.net':80
- 'am####become.net':80
- 'we####rcover.net':80
- 'am###tcover.net':80
- 'hi####ybecome.net':80
- 'st####efurther.net':80
- 'mo####gcompany.net':80
- 'ra####company.net':80
- 'hi####yfurther.net':80
- 'st####ebecome.net':80
- 'hi####ycover.net':80
- 'st####ecover.net':80
- 'pr####tcover.net':80
- 'th###cover.net':80
- 'pr####tfurther.net':80
- 'th###become.net':80
- 'pr####tcompany.net':80
- 'th####ompany.net':80
- 'pr####tbecome.net':80
- 'th####urther.net':80
- 'cl###needle.net':80
- 'th###needle.net':80
- 'cl###nature.net':80
- 'th###enough.net':80
- 'cl###govern.net':80
- 'th###govern.net':80
- 'cl###enough.net':80
- 'of###cover.net':80
- 'al####urther.net':80
- 'of####urther.net':80
- 'al###cover.net':80
- 'of####ompany.net':80
- 'al###become.net':80
- 'of###become.net':80
- 'co####ecompany.net':80
- 'ch###cover.net':80
- 'co####efurther.net':80
- 'ch####urther.net':80
- 'co####ecover.net':80
- 'ch####ompany.net':80
- 'co####ebecome.net':80
- 'ch###become.net':80
TCP:
Запросы HTTP GET:
- http://mo####gfurther.net/index.php
- http://ra####further.net/index.php
- http://tw####company.net/index.php
- http://ra###rcover.net/index.php
- http://mo####gbecome.net/index.php
- http://ra####become.net/index.php
- http://mo####gcover.net/index.php
- http://mi####company.net/index.php
- http://tw####further.net/index.php
- http://mi####further.net/index.php
- http://al####ompany.net/index.php
- http://mi###ecover.net/index.php
- http://tw####become.net/index.php
- http://mi####become.net/index.php
- http://tw###ecover.net/index.php
- http://am####further.net/index.php
- http://hi####ycompany.net/index.php
- http://st####ecompany.net/index.php
- http://we####rfurther.net/index.php
- http://am####become.net/index.php
- http://we####rcover.net/index.php
- http://am###tcover.net/index.php
- http://hi####ybecome.net/index.php
- http://st####efurther.net/index.php
- http://mo####gcompany.net/index.php
- http://ra####company.net/index.php
- http://hi####yfurther.net/index.php
- http://st####ebecome.net/index.php
- http://hi####ycover.net/index.php
- http://st####ecover.net/index.php
- http://pr####tcover.net/index.php
- http://th###cover.net/index.php
- http://pr####tfurther.net/index.php
- http://th###become.net/index.php
- http://pr####tcompany.net/index.php
- http://th####ompany.net/index.php
- http://pr####tbecome.net/index.php
- http://th####urther.net/index.php
- http://cl###needle.net/index.php
- http://th###needle.net/index.php
- http://cl###nature.net/index.php
- http://th###enough.net/index.php
- http://cl###govern.net/index.php
- http://th###govern.net/index.php
- http://cl###enough.net/index.php
- http://of###cover.net/index.php
- http://al####urther.net/index.php
- http://of####urther.net/index.php
- http://al###cover.net/index.php
- http://of####ompany.net/index.php
- http://al###become.net/index.php
- http://of###become.net/index.php
- http://co####ecompany.net/index.php
- http://ch###cover.net/index.php
- http://co####efurther.net/index.php
- http://ch####urther.net/index.php
- http://co####ecover.net/index.php
- http://ch####ompany.net/index.php
- http://co####ebecome.net/index.php
- http://ch###become.net/index.php
UDP:
- DNS ASK mo####gfurther.net
- DNS ASK ra####further.net
- DNS ASK tw####company.net
- DNS ASK ra###rcover.net
- DNS ASK mo####gbecome.net
- DNS ASK ra####become.net
- DNS ASK mo####gcover.net
- DNS ASK mi####company.net
- DNS ASK tw####further.net
- DNS ASK mi####further.net
- DNS ASK al####ompany.net
- DNS ASK mi###ecover.net
- DNS ASK tw####become.net
- DNS ASK mi####become.net
- DNS ASK tw###ecover.net
- DNS ASK am####further.net
- DNS ASK hi####ycompany.net
- DNS ASK st####ecompany.net
- DNS ASK we####rfurther.net
- DNS ASK am####become.net
- DNS ASK we####rcover.net
- DNS ASK am###tcover.net
- DNS ASK hi####ybecome.net
- DNS ASK st####efurther.net
- DNS ASK mo####gcompany.net
- DNS ASK ra####company.net
- DNS ASK hi####yfurther.net
- DNS ASK st####ebecome.net
- DNS ASK hi####ycover.net
- DNS ASK st####ecover.net
- DNS ASK pr####tcover.net
- DNS ASK th###cover.net
- DNS ASK pr####tfurther.net
- DNS ASK th###become.net
- DNS ASK pr####tcompany.net
- DNS ASK th####ompany.net
- DNS ASK pr####tbecome.net
- DNS ASK th####urther.net
- DNS ASK cl###needle.net
- DNS ASK th###needle.net
- DNS ASK cl###nature.net
- DNS ASK th###enough.net
- DNS ASK cl###govern.net
- DNS ASK th###govern.net
- DNS ASK cl###enough.net
- DNS ASK of###cover.net
- DNS ASK al####urther.net
- DNS ASK of####urther.net
- DNS ASK al###cover.net
- DNS ASK of####ompany.net
- DNS ASK al###become.net
- DNS ASK of###become.net
- DNS ASK co####ecompany.net
- DNS ASK ch###cover.net
- DNS ASK co####efurther.net
- DNS ASK ch####urther.net
- DNS ASK co####ecover.net
- DNS ASK ch####ompany.net
- DNS ASK co####ebecome.net
- DNS ASK ch###become.net
