Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'TP Network Workstation Solutions' = 'C:\cte62afas7kl\meb0g1rwm.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Control Reporting Offline Connectivity] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\Control Reporting Offline Connectivity] 'ImagePath' = 'C:\cte62afas7kl\meb0g1rwm.exe'
Изменения в файловой системе:
Создает следующие файлы:
- %WINDIR%\cte62afas7kl\lcbtomx
- C:\cte62afas7kl\lcbtomx
- C:\cte62afas7kl\hgqoxt2hktunpgftusgd.exe
- C:\cte62afas7kl\meb0g1rwm.exe
- C:\cte62afas7kl\ez43uozaw.exe
- C:\cte62afas7kl\jw2tgxzrwxuv
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\cte62afas7kl\meb0g1rwm.exe
- C:\cte62afas7kl\ez43uozaw.exe
Удаляет следующие файлы:
- %WINDIR%\cte62afas7kl\lcbtomx
- C:\cte62afas7kl\hgqoxt2hktunpgftusgd.exe
Подменяет следующие файлы:
- %WINDIR%\cte62afas7kl\lcbtomx
Сетевая активность:
Подключается к:
- 'am######ecollingwood.net':80
- 'gu#####engabrielson.net':80
- 'an#####legabrielson.net':80
- 'gu######nchristinsen.net':80
- 'an######echristinsen.net':80
- 'ch#####lestephenson.net':80
- 'ge#####nastephenson.net':80
- 'ge######acollingwood.net':80
- 'ch#####legabrielson.net':80
- 'ge#####nagabrielson.net':80
- 'ge######achristinsen.net':80
- 'za#####ahstephenson.net':80
- 'ar#####ldstephenson.net':80
- 'za######hcollingwood.net':80
- 'ar######dcollingwood.net':80
- 'za#####ahgabrielson.net':80
- 'ar#####ldgabrielson.net':80
- 'za######hchristinsen.net':80
- 'ar######dchristinsen.net':80
- 'sh#####lestephenson.net':80
- 'ch#####nestephenson.net':80
- 'sh######ecollingwood.net':80
- 'ch######ecollingwood.net':80
- 'sh#####legabrielson.net':80
- 'ch#####negabrielson.net':80
- 'sh######echristinsen.net':80
- 'ch######echristinsen.net':80
- 'ce#####nestephenson.net':80
- 'am#####nestephenson.net':80
- 'ce######ecollingwood.net':80
- 'an######ecollingwood.net':80
- 'gu######ncollingwood.net':80
TCP:
Запросы HTTP GET:
- http://am######ecollingwood.net/index.php
- http://gu#####engabrielson.net/index.php
- http://an#####legabrielson.net/index.php
- http://gu######nchristinsen.net/index.php
- http://an######echristinsen.net/index.php
- http://ch#####lestephenson.net/index.php
- http://ge#####nastephenson.net/index.php
- http://ge######acollingwood.net/index.php
- http://ch#####legabrielson.net/index.php
- http://ge#####nagabrielson.net/index.php
- http://ge######achristinsen.net/index.php
- http://za#####ahstephenson.net/index.php
- http://ar#####ldstephenson.net/index.php
- http://za######hcollingwood.net/index.php
- http://ar######dcollingwood.net/index.php
- http://za#####ahgabrielson.net/index.php
- http://ar#####ldgabrielson.net/index.php
- http://za######hchristinsen.net/index.php
- http://ar######dchristinsen.net/index.php
- http://sh#####lestephenson.net/index.php
- http://ch#####nestephenson.net/index.php
- http://sh######ecollingwood.net/index.php
- http://ch######ecollingwood.net/index.php
- http://sh#####legabrielson.net/index.php
- http://ch#####negabrielson.net/index.php
- http://sh######echristinsen.net/index.php
- http://ch######echristinsen.net/index.php
- http://ce#####nestephenson.net/index.php
- http://am#####nestephenson.net/index.php
- http://ce######ecollingwood.net/index.php
- http://an######ecollingwood.net/index.php
- http://gu######ncollingwood.net/index.php
UDP:
- DNS ASK am######ecollingwood.net
- DNS ASK gu#####engabrielson.net
- DNS ASK an#####legabrielson.net
- DNS ASK gu######nchristinsen.net
- DNS ASK an######echristinsen.net
- DNS ASK ch#####lestephenson.net
- DNS ASK ge#####nastephenson.net
- DNS ASK ge######acollingwood.net
- DNS ASK ch#####legabrielson.net
- DNS ASK ge#####nagabrielson.net
- DNS ASK ge######achristinsen.net
- DNS ASK za#####ahstephenson.net
- DNS ASK ar#####ldstephenson.net
- DNS ASK za######hcollingwood.net
- DNS ASK ar######dcollingwood.net
- DNS ASK za#####ahgabrielson.net
- DNS ASK ar#####ldgabrielson.net
- DNS ASK za######hchristinsen.net
- DNS ASK ar######dchristinsen.net
- DNS ASK sh#####lestephenson.net
- DNS ASK ch#####nestephenson.net
- DNS ASK sh######ecollingwood.net
- DNS ASK ch######ecollingwood.net
- DNS ASK sh#####legabrielson.net
- DNS ASK ch#####negabrielson.net
- DNS ASK sh######echristinsen.net
- DNS ASK ch######echristinsen.net
- DNS ASK ce#####nestephenson.net
- DNS ASK am#####nestephenson.net
- DNS ASK ce######ecollingwood.net
- DNS ASK an######ecollingwood.net
- DNS ASK gu######ncollingwood.net
Другое:
Создает и запускает на исполнение:
- 'C:\cte62afas7kl\hgqoxt2hktunpgftusgd.exe'
- 'C:\cte62afas7kl\meb0g1rwm.exe'
- 'C:\cte62afas7kl\ez43uozaw.exe' "c:\cte62afas7kl\meb0g1rwm.exe"
