Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'PNRP WMI Isolation Scheduler Mapper' = 'C:\wjeygovi\eombxbvw.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Print Cryptographic Disk BitLocker SNMP Source] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\Print Cryptographic Disk BitLocker SNMP Source] 'ImagePath' = 'C:\wjeygovi\eombxbvw.exe'
Изменения в файловой системе:
Создает следующие файлы:
- %WINDIR%\wjeygovi\d0ssls88p
- C:\wjeygovi\d0ssls88p
- C:\wjeygovi\obfg30i9xcdzszq6ejh.exe
- C:\wjeygovi\eombxbvw.exe
- C:\wjeygovi\leuelzazfh.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\wjeygovi\eombxbvw.exe
- C:\wjeygovi\leuelzazfh.exe
Удаляет следующие файлы:
- %WINDIR%\wjeygovi\d0ssls88p
- C:\wjeygovi\obfg30i9xcdzszq6ejh.exe
Подменяет следующие файлы:
- %WINDIR%\wjeygovi\d0ssls88p
Сетевая активность:
Подключается к:
- 'de####yattempt.net':80
- 'wi####square.net':80
- 'su####square.net':80
- 'wi####neighbor.net':80
- 'su####neighbor.net':80
- 'wi####spread.net':80
- 'su####spread.net':80
- 'ef####attempt.net':80
- 'wi####attempt.net':80
- 'su####attempt.net':80
- 'th####hattempt.net':80
- 'ef####neighbor.net':80
- 'th####hneighbor.net':80
- 'ef####spread.net':80
- 'th####hspread.net':80
- 'fo####attempt.net':80
- 'in####seattempt.net':80
- 'fo####square.net':80
- 'ef####square.net':80
- 'th####hsquare.net':80
- 'th###spread.net':80
- 'ch###spread.net':80
- 'th####eighbor.net':80
- 'li####square.net':80
- 'de####yneighbor.net':80
- 'li####neighbor.net':80
- 'de####yspread.net':80
- 'li####spread.net':80
- 'ri####attempt.net':80
- 'be####attempt.net':80
- 'ri####square.net':80
- 'li####attempt.net':80
- 'be####square.net':80
- 'be####neighbor.net':80
- 'ri####spread.net':80
- 'be####spread.net':80
- 'ch####ttempt.net':80
- 'th####ttempt.net':80
- 'ch###square.net':80
- 'th###square.net':80
- 'ch####eighbor.net':80
- 'ri####neighbor.net':80
- 'in####sesquare.net':80
- 'fo####neighbor.net':80
TCP:
Запросы HTTP GET:
- http://de####yattempt.net/index.php
- http://wi####square.net/index.php
- http://su####square.net/index.php
- http://wi####neighbor.net/index.php
- http://su####neighbor.net/index.php
- http://wi####spread.net/index.php
- http://su####spread.net/index.php
- http://ef####attempt.net/index.php
- http://wi####attempt.net/index.php
- http://su####attempt.net/index.php
- http://th####hattempt.net/index.php
- http://ef####neighbor.net/index.php
- http://th####hneighbor.net/index.php
- http://ef####spread.net/index.php
- http://th####hspread.net/index.php
- http://fo####attempt.net/index.php
- http://in####seattempt.net/index.php
- http://fo####square.net/index.php
- http://ef####square.net/index.php
- http://th####hsquare.net/index.php
- http://th###spread.net/index.php
- http://ch###spread.net/index.php
- http://th####eighbor.net/index.php
- http://li####square.net/index.php
- http://de####yneighbor.net/index.php
- http://li####neighbor.net/index.php
- http://de####yspread.net/index.php
- http://li####spread.net/index.php
- http://ri####attempt.net/index.php
- http://be####attempt.net/index.php
- http://ri####square.net/index.php
- http://li####attempt.net/index.php
- http://be####square.net/index.php
- http://be####neighbor.net/index.php
- http://ri####spread.net/index.php
- http://be####spread.net/index.php
- http://ch####ttempt.net/index.php
- http://th####ttempt.net/index.php
- http://ch###square.net/index.php
- http://th###square.net/index.php
- http://ch####eighbor.net/index.php
- http://ri####neighbor.net/index.php
- http://in####sesquare.net/index.php
- http://fo####neighbor.net/index.php
UDP:
- DNS ASK de####yattempt.net
- DNS ASK wi####attempt.net
- DNS ASK su####attempt.net
- DNS ASK wi####square.net
- DNS ASK su####square.net
- DNS ASK wi####neighbor.net
- DNS ASK su####neighbor.net
- DNS ASK wi####spread.net
- DNS ASK su####spread.net
- DNS ASK ef####attempt.net
- DNS ASK th####hattempt.net
- DNS ASK ef####square.net
- DNS ASK th####hsquare.net
- DNS ASK ef####neighbor.net
- DNS ASK th####hneighbor.net
- DNS ASK ef####spread.net
- DNS ASK th####hspread.net
- DNS ASK fo####attempt.net
- DNS ASK in####seattempt.net
- DNS ASK fo####square.net
- DNS ASK th###spread.net
- DNS ASK in####sesquare.net
- DNS ASK ch###spread.net
- DNS ASK ch####eighbor.net
- DNS ASK li####attempt.net
- DNS ASK de####ysquare.net
- DNS ASK li####square.net
- DNS ASK de####yneighbor.net
- DNS ASK li####neighbor.net
- DNS ASK de####yspread.net
- DNS ASK li####spread.net
- DNS ASK ri####attempt.net
- DNS ASK be####attempt.net
- DNS ASK ri####square.net
- DNS ASK be####square.net
- DNS ASK ri####neighbor.net
- DNS ASK be####neighbor.net
- DNS ASK ri####spread.net
- DNS ASK be####spread.net
- DNS ASK ch####ttempt.net
- DNS ASK th####ttempt.net
- DNS ASK ch###square.net
- DNS ASK th###square.net
- DNS ASK th####eighbor.net
- DNS ASK fo####neighbor.net
Другое:
Создает и запускает на исполнение:
- 'C:\wjeygovi\obfg30i9xcdzszq6ejh.exe'
- 'C:\wjeygovi\eombxbvw.exe'
- 'C:\wjeygovi\leuelzazfh.exe' "c:\wjeygovi\eombxbvw.exe"
