Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Layer Transfer Propagation Reports Reporting' = 'C:\vfwlevshff\hcoktaxjwum.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\AuthIP UserMode Engine Gateway Machine WebClient] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\AuthIP UserMode Engine Gateway Machine WebClient] 'ImagePath' = 'C:\vfwlevshff\hcoktaxjwum.exe'
Изменения в файловой системе:
Создает следующие файлы:
- %WINDIR%\vfwlevshff\it4we5zulnlo
- C:\vfwlevshff\it4we5zulnlo
- C:\vfwlevshff\bgks2z7tpty8rmjplqkx.exe
- C:\vfwlevshff\hcoktaxjwum.exe
- C:\vfwlevshff\sshdnkiktcrf.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\vfwlevshff\hcoktaxjwum.exe
- C:\vfwlevshff\sshdnkiktcrf.exe
Удаляет следующие файлы:
- %WINDIR%\vfwlevshff\it4we5zulnlo
- C:\vfwlevshff\bgks2z7tpty8rmjplqkx.exe
Подменяет следующие файлы:
- %WINDIR%\vfwlevshff\it4we5zulnlo
Сетевая активность:
Подключается к:
- 'le####another.net':80
- 'fo####dbright.net':80
- 'de####inside.net':80
- 'fo####dinside.net':80
- 'an####instead.net':80
- 'gl####nstead.net':80
- 'an####explain.net':80
- 'gl####xplain.net':80
- 'an####bright.net':80
- 'gl###bright.net':80
- 'an####inside.net':80
- 'di#####ltinstead.net':80
- 'ne#####ryexplain.net':80
- 'he####nstead.net':80
- 'di#####ltexplain.net':80
- 'he####xplain.net':80
- 'di####ultbright.net':80
- 'he###bright.net':80
- 'di####ultinside.net':80
- 'he###inside.net':80
- 'pl####ntinstead.net':80
- 'ne#####ryinstead.net':80
- 'pl####ntexplain.net':80
- 'de####bright.net':80
- 'gl###inside.net':80
- 'fo####dexplain.net':80
- 'ge####business.net':80
- 'he####another.net':80
- 'le####business.net':80
- 'he####business.net':80
- 'le####appear.net':80
- 'he####appear.net':80
- 'he###manner.net':80
- 'ge####manner.net':80
- 'he####nother.net':80
- 'ge####another.net':80
- 'he####usiness.net':80
- 'he###appear.net':80
- 'fo####dinstead.net':80
- 'ge####appear.net':80
- 'va####smanner.net':80
- 're####manner.net':80
- 'va####sanother.net':80
- 're####another.net':80
- 'va####sbusiness.net':80
- 're####business.net':80
- 'va####sappear.net':80
- 're####appear.net':80
- 'de####instead.net':80
- 'de####explain.net':80
- 'pl####ntbright.net':80
TCP:
Запросы HTTP GET:
- http://le####another.net/index.php
- http://fo####dbright.net/index.php
- http://de####inside.net/index.php
- http://fo####dinside.net/index.php
- http://an####instead.net/index.php
- http://gl####nstead.net/index.php
- http://an####explain.net/index.php
- http://gl####xplain.net/index.php
- http://an####bright.net/index.php
- http://gl###bright.net/index.php
- http://an####inside.net/index.php
- http://di#####ltinstead.net/index.php
- http://ne#####ryexplain.net/index.php
- http://he####nstead.net/index.php
- http://di#####ltexplain.net/index.php
- http://he####xplain.net/index.php
- http://di####ultbright.net/index.php
- http://he###bright.net/index.php
- http://di####ultinside.net/index.php
- http://he###inside.net/index.php
- http://pl####ntinstead.net/index.php
- http://ne#####ryinstead.net/index.php
- http://pl####ntexplain.net/index.php
- http://de####bright.net/index.php
- http://gl###inside.net/index.php
- http://fo####dexplain.net/index.php
- http://ge####business.net/index.php
- http://he####another.net/index.php
- http://le####business.net/index.php
- http://he####business.net/index.php
- http://le####appear.net/index.php
- http://he####appear.net/index.php
- http://he###manner.net/index.php
- http://ge####manner.net/index.php
- http://he####nother.net/index.php
- http://ge####another.net/index.php
- http://he####usiness.net/index.php
- http://he###appear.net/index.php
- http://fo####dinstead.net/index.php
- http://ge####appear.net/index.php
- http://va####smanner.net/index.php
- http://re####manner.net/index.php
- http://va####sanother.net/index.php
- http://re####another.net/index.php
- http://va####sbusiness.net/index.php
- http://re####business.net/index.php
- http://va####sappear.net/index.php
- http://re####appear.net/index.php
- http://de####instead.net/index.php
- http://de####explain.net/index.php
- http://pl####ntbright.net/index.php
UDP:
- DNS ASK le####another.net
- DNS ASK fo####dinside.net
- DNS ASK an####instead.net
- DNS ASK gl####nstead.net
- DNS ASK an####explain.net
- DNS ASK gl####xplain.net
- DNS ASK an####bright.net
- DNS ASK gl###bright.net
- DNS ASK an####inside.net
- DNS ASK gl###inside.net
- DNS ASK fo####dbright.net
- DNS ASK de####inside.net
- DNS ASK di#####ltinstead.net
- DNS ASK he####xplain.net
- DNS ASK di####ultbright.net
- DNS ASK he###bright.net
- DNS ASK di####ultinside.net
- DNS ASK he###inside.net
- DNS ASK pl####ntinstead.net
- DNS ASK ne#####ryinstead.net
- DNS ASK pl####ntexplain.net
- DNS ASK ne#####ryexplain.net
- DNS ASK he####nstead.net
- DNS ASK di#####ltexplain.net
- DNS ASK de####bright.net
- DNS ASK fo####dexplain.net
- DNS ASK de####explain.net
- DNS ASK le####business.net
- DNS ASK he####business.net
- DNS ASK le####appear.net
- DNS ASK he####appear.net
- DNS ASK he###manner.net
- DNS ASK ge####manner.net
- DNS ASK he####nother.net
- DNS ASK ge####another.net
- DNS ASK he####usiness.net
- DNS ASK ge####business.net
- DNS ASK he####another.net
- DNS ASK he###appear.net
- DNS ASK va####smanner.net
- DNS ASK re####manner.net
- DNS ASK va####sanother.net
- DNS ASK re####another.net
- DNS ASK va####sbusiness.net
- DNS ASK re####business.net
- DNS ASK va####sappear.net
- DNS ASK re####appear.net
- DNS ASK de####instead.net
- DNS ASK fo####dinstead.net
- DNS ASK ge####appear.net
- DNS ASK pl####ntbright.net
- DNS ASK ne####arybright.net
Другое:
Создает и запускает на исполнение:
- 'C:\vfwlevshff\bgks2z7tpty8rmjplqkx.exe'
- 'C:\vfwlevshff\hcoktaxjwum.exe'
- 'C:\vfwlevshff\sshdnkiktcrf.exe' "c:\vfwlevshff\hcoktaxjwum.exe"
