Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Detection Shadow Security' = 'C:\lyyditiv\xc7qnjbxrjta.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Parental Virtual Error Process Enumerator] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\Parental Virtual Error Process Enumerator] 'ImagePath' = 'C:\lyyditiv\xc7qnjbxrjta.exe'
Изменения в файловой системе:
Создает следующие файлы:
- %WINDIR%\lyyditiv\cvlcznpwebj
- C:\lyyditiv\cvlcznpwebj
- C:\lyyditiv\pbaxtvz2p69ftdagylq3r6f.exe
- C:\lyyditiv\xc7qnjbxrjta.exe
- C:\lyyditiv\ep03biis8qpiz.exe
- C:\lyyditiv\mpwfnu
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\lyyditiv\xc7qnjbxrjta.exe
- C:\lyyditiv\ep03biis8qpiz.exe
Удаляет следующие файлы:
- %WINDIR%\lyyditiv\cvlcznpwebj
- C:\lyyditiv\pbaxtvz2p69ftdagylq3r6f.exe
Подменяет следующие файлы:
- %WINDIR%\lyyditiv\cvlcznpwebj
Сетевая активность:
Подключается к:
- 'la#####ialeonardson.net':80
- 'cr#####onfairclough.net':80
- 'ja#####ynfairclough.net':80
- 'cr#####onaugustine.net':80
- 'ja#####ynaugustine.net':80
- 'ro#####netimothyson.net':80
- 'ja#####tatimothyson.net':80
- 'ro#####nefairbairn.net':80
- 'ro#####nefairclough.net':80
- 'ha#####tafairclough.net':80
- 'ja#####tafairclough.net':80
- 'ro#####neaugustine.net':80
- 'ja#####taaugustine.net':80
- 'ha#####tatimothyson.net':80
- 'co#####cetimothyson.net':80
- 'ha#####tafairbairn.net':80
- 'co#####cefairbairn.net':80
- 'ja#####ynfairbairn.net':80
- 'ja#####tafairbairn.net':80
- 'cr#####onfairbairn.net':80
- 'se#####anaugustine.net':80
- 'ch#####natimothyson.net':80
- 'se#####antimothyson.net':80
- 'ch#####nafairbairn.net':80
- 'se#####anfairbairn.net':80
- 'ch#####nafairclough.net':80
- 'se#####anfairclough.net':80
- 'ch#####naaugustine.net':80
- 'ch#####netimothyson.net':80
- 'cr#####ontimothyson.net':80
- 'cl#####ndtimothyson.net':80
- 'ch#####nefairbairn.net':80
- 'cl#####ndfairbairn.net':80
- 'ch#####nefairclough.net':80
- 'cl#####ndfairclough.net':80
- 'ch#####neaugustine.net':80
- 'cl#####ndaugustine.net':80
- 'ja#####yntimothyson.net':80
- 'co#####cefairclough.net':80
TCP:
Запросы HTTP GET:
- http://la#####ialeonardson.net/index.php
- http://cr#####onfairclough.net/index.php
- http://ja#####ynfairclough.net/index.php
- http://cr#####onaugustine.net/index.php
- http://ja#####ynaugustine.net/index.php
- http://ro#####netimothyson.net/index.php
- http://ja#####tatimothyson.net/index.php
- http://ro#####nefairbairn.net/index.php
- http://ro#####nefairclough.net/index.php
- http://ha#####tafairclough.net/index.php
- http://ja#####tafairclough.net/index.php
- http://ro#####neaugustine.net/index.php
- http://ja#####taaugustine.net/index.php
- http://ha#####tatimothyson.net/index.php
- http://co#####cetimothyson.net/index.php
- http://ha#####tafairbairn.net/index.php
- http://co#####cefairbairn.net/index.php
- http://ja#####ynfairbairn.net/index.php
- http://ja#####tafairbairn.net/index.php
- http://cr#####onfairbairn.net/index.php
- http://se#####anaugustine.net/index.php
- http://ch#####natimothyson.net/index.php
- http://se#####antimothyson.net/index.php
- http://ch#####nafairbairn.net/index.php
- http://se#####anfairbairn.net/index.php
- http://ch#####nafairclough.net/index.php
- http://se#####anfairclough.net/index.php
- http://ch#####naaugustine.net/index.php
- http://ch#####netimothyson.net/index.php
- http://cr#####ontimothyson.net/index.php
- http://cl#####ndtimothyson.net/index.php
- http://ch#####nefairbairn.net/index.php
- http://cl#####ndfairbairn.net/index.php
- http://ch#####nefairclough.net/index.php
- http://cl#####ndfairclough.net/index.php
- http://ch#####neaugustine.net/index.php
- http://cl#####ndaugustine.net/index.php
- http://ja#####yntimothyson.net/index.php
- http://co#####cefairclough.net/index.php
UDP:
- DNS ASK la#####ialeonardson.net
- DNS ASK cr#####onaugustine.net
- DNS ASK ja#####ynaugustine.net
- DNS ASK ro#####netimothyson.net
- DNS ASK ja#####tatimothyson.net
- DNS ASK ro#####nefairbairn.net
- DNS ASK ja#####tafairbairn.net
- DNS ASK cr#####onfairclough.net
- DNS ASK ja#####ynfairclough.net
- DNS ASK ro#####nefairclough.net
- DNS ASK ja#####taaugustine.net
- DNS ASK ha#####tatimothyson.net
- DNS ASK co#####cetimothyson.net
- DNS ASK ha#####tafairbairn.net
- DNS ASK co#####cefairbairn.net
- DNS ASK ha#####tafairclough.net
- DNS ASK ja#####tafairclough.net
- DNS ASK ro#####neaugustine.net
- DNS ASK ja#####ynfairbairn.net
- DNS ASK cr#####onfairbairn.net
- DNS ASK ja#####yntimothyson.net
- DNS ASK se#####antimothyson.net
- DNS ASK ch#####nafairbairn.net
- DNS ASK se#####anfairbairn.net
- DNS ASK ch#####nafairclough.net
- DNS ASK se#####anfairclough.net
- DNS ASK ch#####naaugustine.net
- DNS ASK se#####anaugustine.net
- DNS ASK ch#####natimothyson.net
- DNS ASK ch#####netimothyson.net
- DNS ASK ch#####nefairbairn.net
- DNS ASK cl#####ndfairbairn.net
- DNS ASK ch#####nefairclough.net
- DNS ASK cl#####ndfairclough.net
- DNS ASK ch#####neaugustine.net
- DNS ASK cl#####ndaugustine.net
- DNS ASK cr#####ontimothyson.net
- DNS ASK cl#####ndtimothyson.net
- DNS ASK co#####cefairclough.net
- DNS ASK ha#####taaugustine.net
Другое:
Создает и запускает на исполнение:
- 'C:\lyyditiv\pbaxtvz2p69ftdagylq3r6f.exe'
- 'C:\lyyditiv\xc7qnjbxrjta.exe'
- 'C:\lyyditiv\ep03biis8qpiz.exe' "c:\lyyditiv\xc7qnjbxrjta.exe"
