Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'engel' = '%APPDATA%\updates\updates.exe'
Создает или изменяет следующие файлы:
- %HOMEPATH%\Start Menu\Programs\Startup\updates.exe
Вредоносные функции:
Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'
Запускает на исполнение:
- <SYSTEM32>\netsh.exe advfirewall firewall add rule name="<Имя вируса>" dir=in action=allow program="<Полный путь к вирусу>"
Изменяет следующие настройки браузера Windows Internet Explorer:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Associations] 'LowRiskFileTypes' = '.exe'
Изменения в файловой системе:
Создает следующие файлы:
- %APPDATA%\engel\updates.exe
Сетевая активность:
Подключается к:
- '95.#5.36.51':3128
- '62.##.36.136':3128
- '89.##9.146.68':3128
- '2.##4.5.223':3128
- '61.##.57.175':3128
- '66.##4.111.198':3128
- '18#.#6.230.116':3128
- '12#.#05.138.25':3128
- '2.###.195.111':3128
- '18#.#84.52.174':3128
- '22#.#75.231.237':3128
- '88.##8.141.91':3128
- '17#.#9.79.29':3128
- '41.##2.169.170':3128
- '74.#15.3.63':3128
- '11#.#8.38.163':3128
- '19#.#.52.104':3128
- '70.##.208.173':3128
- '67.##2.104.30':3128
- '41.##.125.134':3128
- '18#.#44.87.50':3128
- '95.##.249.116':3128
- '11#.#2.146.212':3128
- '46.##.106.39':3128
- '11#.#5.4.172':3128
- '91.##5.9.247':3128
- '95.##.135.68':3128
- '92.##.137.42':3128
- '46.##9.114.170':3128
- '94.##1.71.43':3128
- '80.##.108.138':3128
- '95.##2.197.224':3128
- '41.#7.0.222':3128
- '12#.#6.62.33':3128
- '95.##.232.85':3128
- '74.#15.3.67':3128
- '17#.#22.180.177':3128
- '94.##.206.168':3128
- '77.#45.6.14':3128
- '95.##0.158.185':3128
- '82.##8.97.240':3128
- '17#.#9.61.122':3128
- '16#.#67.212.235':3128
- '41.##3.57.74':3128
- '12#.#9.243.193':3128
- '19#.#00.176.60':3128
- '41.##.46.235':3128
- '11#.#2.152.137':3128
- '92.##5.41.62':3128
- '2.##.137.201':3128
- '95.##.109.230':3128
- '75.##0.238.235':3128
- '41.#6.8.129':3128
- '22#.#75.231.64':3128
- '41.##0.246.66':3128
- '17#.#47.129.134':3128
- '91.##5.9.231':3128
- '2.###.158.126':3128
- '20#.#42.212.32':3128
- '18#.#6.210.43':3128
- '41.##0.37.54':3128
- '11#.#41.58.243':3128
- '17#.#75.221.3':3128
- '18#.#5.240.32':3128
- '18#.#53.236.99':3128
- '19#.#0.214.68':3128
- '95.##.192.126':3128
- '94.##1.77.157':3128
- '18#.#10.225.167':3128
- '95.##0.130.166':3128
- '41.##3.41.85':3128
- '36.#.85.105':3128
- '95.##.104.199':3128
- '17#.#21.88.236':3128
- '85.##.151.80':3128
- '24.##7.65.81':3128
- '37.#9.66.96':3128
- '91.##3.140.96':3128
- '18#.#.218.239':3128
- '41.##.17.192':3128
- '12#.#25.196.143':3128
- '19#.#55.209.74':3128
- '41.##5.83.146':3128
- '18#.#84.30.78':3128
- '77.##2.230.85':3128
- '46.##.236.164':3128
- '11#.#52.191.187':3128
- '37.##.67.126':3128
- '46.##.221.46':3128
- '95.##.53.180':3128
- '61.#.33.12':3128
- '95.#9.2.148':3128
- '19#.#.218.213':3128
- '2.##.68.92':3128
- '18#.#10.230.164':3128
- '41.##.189.112':3128
- '21#.#5.49.228':3128
- '36.#.125.120':3128
- '17#.#0.153.31':3128
- '18#.#22.147.167':3128
- '22#.#75.231.110':3128
- '98.##7.248.135':3128
- '41.##.18.145':3128
- '77.##.45.219':3128
- '95.##.231.153':3128
- '2.##.68.228':3128
- '31.##.15.251':3128
- '19#.#2.54.245':3128
- '61.##.255.149':3128
- '77.##1.18.161':3128
- '19#.#03.193.107':3128
- '41.##5.50.77':3128
- '18#.#4.54.64':3128
- '10#.#3.231.154':3128
- '62.##.37.130':3128
- '41.##1.44.108':3128
- '89.##9.73.254':3128
- '86.##.120.163':3128
- '22#.#75.231.32':3128
- '19#.#13.223.88':3128
- '20#.#2.204.4':3128
- '98.##5.118.194':3128
- '19#.#1.173.15':3128
- '11#.#8.36.98':3128
- '41.##3.57.72':3128
- '41.##9.234.53':3128
- '72.##2.168.108':3128
- '17#.#2.172.201':3128
- '87.##7.61.167':3128
- '41.##.166.113':3128
- '19#.#7.134.52':3128
- '21#.#5.122.105':3128
- '19#.#01.203.152':3128
- '41.##3.57.75':3128
- '19#.#2.3.246':3128
- '12#.#01.222.56':3128
- '46.##.223.174':3128
- '85.##.169.141':3128
- '18#.#13.227.13':3128
- '92.##.223.223':3128
- '80.#0.168.1':3128
- '64.##.73.202':3128
- '77.##1.18.248':3128
- '10#.#2.16.218':3128
- '10#.#72.59.74':3128
- '41.##.161.23':3128
- '98.##8.212.151':3128
- '68.##.208.167':3128
- '19#.53.70.6':3128
- '46.##9.112.179':3128
- '19#.#7.136.244':3128
- '19#.#04.141.211':3128
- '95.##1.151.172':3128
- '17#.#06.237.181':3128
- '95.##.140.17':3128
- '84.##.242.177':3128
- '12#.#40.73.192':3128
- '85.##4.253.12':3128
- '19#.#06.84.130':3128
- '20#.#43.151.93':3128
- '77.##0.213.211':3128
- '11#.#8.0.224':3128
- '37.#9.67.55':3128
- '18#.#22.145.46':3128
- '17#.#0.155.28':3128
- '11#.#60.141.102':3128
- '89.##.38.241':3128
- '81.##.19.171':3128
- '95.##.106.75':3128
- '19#.#4.167.87':3128
- '41.##2.130.167':3128
- '91.##5.50.110':3128
- '18#.#29.203.130':3128
- '18#.#24.199.65':3128
- '41.##3.57.73':3128
- '21#.#6.79.18':3128
- '18#.#65.140.35':3128
- '83.#.53.203':3128
- '19#.#0.77.169':3128
- '20#.#43.101.123':3128
- '2.###.19.208':3128
- '41.##.172.252':3128
- '41.#6.8.141':3128
- '18#.#7.42.112':3128
- '95.##.139.10':3128
- '88.##0.36.219':3128
- '24.##7.31.181':3128
- '21#.#5.79.64':3128
- '95.##2.109.119':3128
- '22#.#14.251.206':3128
- '2.##.37.70':3128
- '10#.#53.115.139':3128
- '11#.#5.11.37':3128
- '60.##4.121.130':3128
- '19#.#56.30.50':3128
- '95.##.124.38':3128
- '85.##0.81.228':3128
- '19#.#2.210.37':3128
- '85.##.176.81':3128
- '17#.#5.67.237':3128
- '41.##.155.194':3128
- '18#.#61.199.18':3128
- '37.##.108.37':3128
- '41.##2.230.45':3128
- '18#.#5.26.139':3128
- '87.##0.166.58':3128
- '17#.#47.135.124':3128
- '10#.#53.78.130':3128
- '22#.#75.228.61':3128
- '93.##6.154.250':3128
- '77.#45.6.90':3128
- '21#.#47.131.236':3128
- '22#.#75.2.136':3128
- '95.##.131.31':3128
- '18#.#16.160.2':3128
- '2.###.138.40':3128
Другое:
Ищет следующие окна:
- ClassName: 'Indicator' WindowName: ''
