Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'SPP Network NetBIOS Distributed' = '<SYSTEM32>\dlazpici.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\KtmRm Office Internet Peer Storage] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\KtmRm Office Internet Peer Storage] 'ImagePath' = '<SYSTEM32>\dlazpici.exe'
Вредоносные функции:
Для затруднения выявления своего присутствия в системе
блокирует:
- Центр обеспечения безопасности (Security Center)
Изменения в файловой системе:
Создает следующие файлы:
- <SYSTEM32>\thszoezedqdj\tst
- %TEMP%\rfkcsvc32sauakbwm25q.exe
- <SYSTEM32>\thszoezedqdj\etc
- <SYSTEM32>\dlazpici.exe
- <SYSTEM32>\qylgnhxxc.exe
- <SYSTEM32>\thszoezedqdj\rng
- <SYSTEM32>\thszoezedqdj\run
- <SYSTEM32>\thszoezedqdj\cfg
- %WINDIR%\Temp\rfkcsvc396buak.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- <SYSTEM32>\dlazpici.exe
- <SYSTEM32>\qylgnhxxc.exe
Удаляет следующие файлы:
- %TEMP%\rfkcsvc32sauakbwm25q.exe
- <DRIVERS>\etc\hosts
- %WINDIR%\Temp\rfkcsvc396buak.exe
Подменяет файл HOSTS.
Сетевая активность:
Подключается к:
- 'cr#####onaraminta.net':80
- 'le###gain.net':80
- 'ta###pass.net':80
- 'le###ass.net':80
- 'ta###sugar.net':80
- 'le###ugar.net':80
- 'ta###stand.net':80
- 'le###tand.net':80
- 'po###again.net':80
- 'ca###gain.net':80
- 'po###pass.net':80
- 'ca###ass.net':80
- 'po###sugar.net':80
- 'ca###ugar.net':80
- 'po###stand.net':80
- 'no###gain.net':80
- 'yo###aily.net':80
- 'no###ass.net':80
- 'no###ugar.net':80
- 'no###tand.net':80
- 'ri###gain.net':80
- 'fa###again.net':80
- 'ri###ass.net':80
- 'fa###pass.net':80
- 'ri###ugar.net':80
- 'fa###sugar.net':80
- 'ri###tand.net':80
- 'fa###stand.net':80
- 'tr###blood.net':80
- 'yo###lood.net':80
- 'tr###daily.net':80
- 'ta###again.net':80
- 'ca###tand.net':80
- 'we###tand.net':80
- 'fi###sugar.net':80
- 'le###form.net':80
- 'mo###ugust.net':80
- 'mi###hown.net':80
- 'ab###ell.net':80
- 'mo###olor.net':80
- 'pr####tbottom.net':80
- 'ca####nbring.net':80
- 'al###being.net':80
- 'ri###nstorm.net':80
- 'be##lxc.com':80
- 'fi###again.net':80
- 'so###pass.net':80
- 'fi###pass.net':80
- 'so###sugar.net':80
- 'so###stand.net':80
- 'we###ugar.net':80
- 'fi###stand.net':80
- 'th###again.net':80
- 'li###gain.net':80
- 'th###pass.net':80
- 'li###ass.net':80
- 'th###sugar.net':80
- 'li###ugar.net':80
- 'th###stand.net':80
- 'li###tand.net':80
- 'fe###gain.net':80
- 'we###gain.net':80
- 'fe###ass.net':80
- 'we###ass.net':80
- 'fe###ugar.net':80
- 'fe###tand.net':80
- 'tr###lose.net':80
TCP:
Запросы HTTP GET:
- http://cr#####onaraminta.net/index.php
- http://le###gain.net/index.php
- http://ta###pass.net/index.php
- http://le###ass.net/index.php
- http://ta###sugar.net/index.php
- http://le###ugar.net/index.php
- http://ta###stand.net/index.php
- http://le###tand.net/index.php
- http://po###again.net/index.php
- http://ca###gain.net/index.php
- http://po###pass.net/index.php
- http://ca###ass.net/index.php
- http://po###sugar.net/index.php
- http://ca###ugar.net/index.php
- http://po###stand.net/index.php
- http://no###gain.net/index.php
- http://yo###aily.net/index.php
- http://no###ass.net/index.php
- http://no###ugar.net/index.php
- http://no###tand.net/index.php
- http://ri###gain.net/index.php
- http://fa###again.net/index.php
- http://ri###ass.net/index.php
- http://fa###pass.net/index.php
- http://ri###ugar.net/index.php
- http://fa###sugar.net/index.php
- http://ri###tand.net/index.php
- http://fa###stand.net/index.php
- http://tr###blood.net/index.php
- http://yo###lood.net/index.php
- http://tr###daily.net/index.php
- http://ta###again.net/index.php
- http://ca###tand.net/index.php
- http://we###tand.net/index.php
- http://fi###sugar.net/index.php
- http://le###form.net/index.php
- http://mo###ugust.net/index.php
- http://mi###hown.net/index.php
- http://ab###ell.net/index.php
- http://mo###olor.net/index.php
- http://pr####tbottom.net/index.php
- http://ca####nbring.net/index.php
- http://al###being.net/index.php
- http://ri###nstorm.net/index.php
- http://be##lxc.com/index.php
- http://fi###again.net/index.php
- http://so###pass.net/index.php
- http://fi###pass.net/index.php
- http://so###sugar.net/index.php
- http://so###stand.net/index.php
- http://we###ugar.net/index.php
- http://fi###stand.net/index.php
- http://th###again.net/index.php
- http://li###gain.net/index.php
- http://th###pass.net/index.php
- http://li###ass.net/index.php
- http://th###sugar.net/index.php
- http://li###ugar.net/index.php
- http://th###stand.net/index.php
- http://li###tand.net/index.php
- http://fe###gain.net/index.php
- http://we###gain.net/index.php
- http://fe###ass.net/index.php
- http://we###ass.net/index.php
- http://fe###ugar.net/index.php
- http://fe###tand.net/index.php
- http://tr###lose.net/index.php
UDP:
- DNS ASK cr#####onaraminta.net
- DNS ASK le###gain.net
- DNS ASK ta###pass.net
- DNS ASK le###ass.net
- DNS ASK ta###sugar.net
- DNS ASK le###ugar.net
- DNS ASK ta###stand.net
- DNS ASK le###tand.net
- DNS ASK po###again.net
- DNS ASK ca###gain.net
- DNS ASK po###pass.net
- DNS ASK ca###ass.net
- DNS ASK po###sugar.net
- DNS ASK ca###ugar.net
- DNS ASK po###stand.net
- DNS ASK ca###tand.net
- DNS ASK no###gain.net
- DNS ASK no###ass.net
- DNS ASK yo###aily.net
- DNS ASK tr###daily.net
- DNS ASK yo###lood.net
- DNS ASK tr###blood.net
- DNS ASK fa###stand.net
- DNS ASK ri###tand.net
- DNS ASK ri###ugar.net
- DNS ASK fa###sugar.net
- DNS ASK fa###pass.net
- DNS ASK ri###ass.net
- DNS ASK fa###again.net
- DNS ASK ri###gain.net
- DNS ASK no###tand.net
- DNS ASK no###ugar.net
- DNS ASK tr###lose.net
- DNS ASK ta###again.net
- DNS ASK we###tand.net
- DNS ASK li###tand.net
- DNS ASK le###form.net
- DNS ASK mo###ugust.net
- DNS ASK mi###hown.net
- DNS ASK ab###ell.net
- DNS ASK mo###olor.net
- DNS ASK pr####tbottom.net
- DNS ASK ca####nbring.net
- DNS ASK al###being.net
- DNS ASK ri###nstorm.net
- DNS ASK be##lxc.com
- DNS ASK fi###again.net
- DNS ASK so###pass.net
- DNS ASK fi###pass.net
- DNS ASK so###sugar.net
- DNS ASK fe###tand.net
- DNS ASK fi###sugar.net
- DNS ASK fi###stand.net
- DNS ASK fe###ugar.net
- DNS ASK we###ass.net
- DNS ASK fe###ass.net
- DNS ASK we###gain.net
- DNS ASK fe###gain.net
- DNS ASK so###stand.net
- DNS ASK yo###ose.net
- DNS ASK li###ugar.net
- DNS ASK th###sugar.net
- DNS ASK li###ass.net
- DNS ASK th###pass.net
- DNS ASK li###gain.net
- DNS ASK th###again.net
- DNS ASK th###stand.net
- DNS ASK we###ugar.net
- '23#.#55.255.250':1900
Другое:
Создает и запускает на исполнение:
- '%TEMP%\rfkcsvc32sauakbwm25q.exe'
- '<SYSTEM32>\dlazpici.exe'
- '<SYSTEM32>\qylgnhxxc.exe' "<SYSTEM32>\dlazpici.exe"
- '%WINDIR%\Temp\rfkcsvc396buak.exe' -r 21830 tcp
