Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Accounts Protected Access System Driver' = 'C:\vwfobnodf3\dzdfnmgiqn.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Network Shadow Extender Logon Scheduler] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\Network Shadow Extender Logon Scheduler] 'ImagePath' = 'C:\vwfobnodf3\dzdfnmgiqn.exe'
Изменения в файловой системе:
Создает следующие файлы:
- %WINDIR%\vwfobnodf3\su1ozos
- C:\vwfobnodf3\su1ozos
- C:\vwfobnodf3\jj6dqmx32kwowrqsiwqvfm.exe
- C:\vwfobnodf3\dzdfnmgiqn.exe
- C:\vwfobnodf3\rxbudzoq.exe
- C:\vwfobnodf3\ibhnr4
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\vwfobnodf3\dzdfnmgiqn.exe
- C:\vwfobnodf3\rxbudzoq.exe
Удаляет следующие файлы:
- %WINDIR%\vwfobnodf3\su1ozos
- C:\vwfobnodf3\jj6dqmx32kwowrqsiwqvfm.exe
Подменяет следующие файлы:
- %WINDIR%\vwfobnodf3\su1ozos
Сетевая активность:
Подключается к:
- 'ch######ellecharissa.net':80
- 'ma#####ttaangelina.net':80
- 'ch#####annemaddison.net':80
- 'ma#####ttamaddison.net':80
- 'ch#####annecharissa.net':80
- 'ma#####ttacharissa.net':80
- 'ch#####annevirginia.net':80
- 'ma#####ttavirginia.net':80
- 'ch#####pherangelina.net':80
- 'te#####nceangelina.net':80
- 'ja#####inevirginia.net':80
- 'ch#####anneangelina.net':80
- 'ch#####phermaddison.net':80
- 'te#####ncecharissa.net':80
- 'ch#####phervirginia.net':80
- 'te#####ncevirginia.net':80
- 'mo#####eryangelina.net':80
- 'mo#####erymaddison.net':80
- 'mo#####erycharissa.net':80
- 'mo#####eryvirginia.net':80
- 'al#####reaangelina.net':80
- 'er#####udeangelina.net':80
- 'te#####ncemaddison.net':80
- 'ch#####phercharissa.net':80
- 'ge#####nnavirginia.net':80
- 'ja#####inecharissa.net':80
- 'ge#####nnacharissa.net':80
- 'ch######ellevirginia.net':80
- 'al#####riavirginia.net':80
- 'ki#####eighangelina.net':80
- 'be#####tteangelina.net':80
- 'ki#####eighmaddison.net':80
- 'be#####ttemaddison.net':80
- 'ki#####eighcharissa.net':80
- 'be#####ttecharissa.net':80
- 'ki#####eighvirginia.net':80
- 'be#####ttevirginia.net':80
- 'al#####riacharissa.net':80
- 'ch#####belangelina.net':80
- 'ch#####belmaddison.net':80
- 're#####nnemaddison.net':80
- 'ch#####belcharissa.net':80
- 're#####nnecharissa.net':80
- 'ch#####belvirginia.net':80
- 're#####nnevirginia.net':80
- 'ge#####nnaangelina.net':80
- 'ja#####ineangelina.net':80
- 'ge#####nnamaddison.net':80
- 'ja#####inemaddison.net':80
- 're#####nneangelina.net':80
- 'al#####reamaddison.net':80
- 'er#####udemaddison.net':80
TCP:
Запросы HTTP GET:
- http://ch######ellecharissa.net/index.php
- http://ma#####ttaangelina.net/index.php
- http://ch#####annemaddison.net/index.php
- http://ma#####ttamaddison.net/index.php
- http://ch#####annecharissa.net/index.php
- http://ma#####ttacharissa.net/index.php
- http://ch#####annevirginia.net/index.php
- http://ma#####ttavirginia.net/index.php
- http://ch#####pherangelina.net/index.php
- http://te#####nceangelina.net/index.php
- http://ja#####inevirginia.net/index.php
- http://ch#####anneangelina.net/index.php
- http://ch#####phermaddison.net/index.php
- http://te#####ncecharissa.net/index.php
- http://ch#####phervirginia.net/index.php
- http://te#####ncevirginia.net/index.php
- http://mo#####eryangelina.net/index.php
- http://mo#####erymaddison.net/index.php
- http://mo#####erycharissa.net/index.php
- http://mo#####eryvirginia.net/index.php
- http://al#####reaangelina.net/index.php
- http://er#####udeangelina.net/index.php
- http://te#####ncemaddison.net/index.php
- http://ch#####phercharissa.net/index.php
- http://ge#####nnavirginia.net/index.php
- http://ja#####inecharissa.net/index.php
- http://ge#####nnacharissa.net/index.php
- http://ch######ellevirginia.net/index.php
- http://al#####riavirginia.net/index.php
- http://ki#####eighangelina.net/index.php
- http://be#####tteangelina.net/index.php
- http://ki#####eighmaddison.net/index.php
- http://be#####ttemaddison.net/index.php
- http://ki#####eighcharissa.net/index.php
- http://be#####ttecharissa.net/index.php
- http://ki#####eighvirginia.net/index.php
- http://be#####ttevirginia.net/index.php
- http://al#####riacharissa.net/index.php
- http://ch#####belangelina.net/index.php
- http://ch#####belmaddison.net/index.php
- http://re#####nnemaddison.net/index.php
- http://ch#####belcharissa.net/index.php
- http://re#####nnecharissa.net/index.php
- http://ch#####belvirginia.net/index.php
- http://re#####nnevirginia.net/index.php
- http://ge#####nnaangelina.net/index.php
- http://ja#####ineangelina.net/index.php
- http://ge#####nnamaddison.net/index.php
- http://ja#####inemaddison.net/index.php
- http://re#####nneangelina.net/index.php
- http://al#####reamaddison.net/index.php
- http://er#####udemaddison.net/index.php
UDP:
- DNS ASK ch######ellecharissa.net
- DNS ASK ch#####anneangelina.net
- DNS ASK ma#####ttaangelina.net
- DNS ASK ch#####annemaddison.net
- DNS ASK ma#####ttamaddison.net
- DNS ASK ch#####annecharissa.net
- DNS ASK ma#####ttacharissa.net
- DNS ASK ch#####annevirginia.net
- DNS ASK ma#####ttavirginia.net
- DNS ASK ch#####pherangelina.net
- DNS ASK te#####nceangelina.net
- DNS ASK ch#####phermaddison.net
- DNS ASK te#####ncemaddison.net
- DNS ASK ch#####phercharissa.net
- DNS ASK te#####ncecharissa.net
- DNS ASK ch#####phervirginia.net
- DNS ASK te#####ncevirginia.net
- DNS ASK mo#####eryangelina.net
- DNS ASK mo#####erymaddison.net
- DNS ASK mo#####erycharissa.net
- DNS ASK mo#####eryvirginia.net
- DNS ASK al#####reaangelina.net
- DNS ASK er#####udeangelina.net
- DNS ASK al#####reamaddison.net
- DNS ASK ja#####inevirginia.net
- DNS ASK er#####udemaddison.net
- DNS ASK ge#####nnavirginia.net
- DNS ASK ge#####nnacharissa.net
- DNS ASK al#####riacharissa.net
- DNS ASK ch######ellevirginia.net
- DNS ASK al#####riavirginia.net
- DNS ASK ki#####eighangelina.net
- DNS ASK be#####tteangelina.net
- DNS ASK ki#####eighmaddison.net
- DNS ASK be#####ttemaddison.net
- DNS ASK ki#####eighcharissa.net
- DNS ASK be#####ttecharissa.net
- DNS ASK ki#####eighvirginia.net
- DNS ASK be#####ttevirginia.net
- DNS ASK ch#####belangelina.net
- DNS ASK re#####nneangelina.net
- DNS ASK ch#####belmaddison.net
- DNS ASK re#####nnemaddison.net
- DNS ASK ch#####belcharissa.net
- DNS ASK re#####nnecharissa.net
- DNS ASK ch#####belvirginia.net
- DNS ASK re#####nnevirginia.net
- DNS ASK ge#####nnaangelina.net
- DNS ASK ja#####ineangelina.net
- DNS ASK ge#####nnamaddison.net
- DNS ASK ja#####inemaddison.net
- DNS ASK ja#####inecharissa.net
- DNS ASK al#####reacharissa.net
Другое:
Создает и запускает на исполнение:
- 'C:\vwfobnodf3\jj6dqmx32kwowrqsiwqvfm.exe'
- 'C:\vwfobnodf3\dzdfnmgiqn.exe'
- 'C:\vwfobnodf3\rxbudzoq.exe' "c:\vwfobnodf3\dzdfnmgiqn.exe"
