Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'engel' = '%APPDATA%\updates\updates.exe'
Создает или изменяет следующие файлы:
- %HOMEPATH%\Start Menu\Programs\Startup\updates.exe
Вредоносные функции:
Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'
Запускает на исполнение:
- <SYSTEM32>\netsh.exe advfirewall firewall add rule name="<Имя вируса>" dir=in action=allow program="<Полный путь к вирусу>"
Изменяет следующие настройки браузера Windows Internet Explorer:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Associations] 'LowRiskFileTypes' = '.exe'
Изменения в файловой системе:
Создает следующие файлы:
- %APPDATA%\engel\updates.exe
Сетевая активность:
Подключается к:
- '41.##.104.62':3128
- '61.#.33.12':3128
- '77.#45.6.90':3128
- '62.##.36.136':3128
- '94.##1.77.157':3128
- '2.##.103.137':3128
- '95.##.113.46':3128
- '84.##0.213.74':3128
- '95.##.172.46':3128
- '31.##.15.251':3128
- '12#.#40.73.192':3128
- '2.##.68.228':3128
- '19#.#13.223.88':3128
- '22#.#75.232.10':3128
- '46.##.106.39':3128
- '81.#0.0.17':3128
- '36.#.85.105':3128
- '41.##9.234.53':3128
- '95.##.231.153':3128
- '18#.#65.149.68':3128
- '95.##.249.116':3128
- '41.##0.246.66':3128
- '60.##4.121.130':3128
- '85.##4.253.12':3128
- '18#.#5.240.32':3128
- '75.##0.133.254':3128
- '18#.#84.30.78':3128
- '19#.#13.19.241':3128
- '2.##.37.70':3128
- '18#.#06.160.177':3128
- '12#.#6.62.33':3128
- '93.##5.69.141':3128
- '24.##7.65.81':3128
- '92.##.248.234':3128
- '19#.#2.210.37':3128
- '20#.#11.67.77':3128
- '2.##.154.232':3128
- '19#.#00.176.60':3128
- '84.##.230.244':3128
- '68.##.208.167':3128
- '75.##0.226.12':3128
- '91.##3.140.96':3128
- '20#.#74.151.115':3128
- '89.##6.219.3':3128
- '12#.#01.222.56':3128
- '98.##6.110.103':3128
- '11#.#8.36.98':3128
- '41.##.161.23':3128
- '18#.#6.210.43':3128
- '12#.#23.49.136':3128
- '22#.#75.2.136':3128
- '95.#8.99.79':3128
- '41.##.17.190':3128
- '85.##.169.141':3128
- '95.##.124.38':3128
- '18#.#22.151.152':3128
- '88.##0.36.219':3128
- '85.##2.209.175':3128
- '19#.#7.134.52':3128
- '89.##5.244.229':3128
- '17#.#22.141.203':3128
- '72.##2.168.108':3128
- '95.##.18.221':3128
- '19#.#03.193.107':3128
- '41.##.155.194':3128
- '41.##3.228.17':3128
- '37.#9.66.96':3128
- '97.#6.66.6':3128
- '17#.#06.237.181':3128
- '80.##.144.146':3128
- '18#.#29.203.130':3128
- '95.#9.2.148':3128
- '19#.#.97.196':3128
- '77.##.142.52':3128
- '41.##.166.113':3128
- '20#.#4.237.189':3128
- '18#.#84.52.174':3128
- '17#.#2.172.221':3128
- '18#.#22.147.167':3128
- '22#.#75.231.27':3128
- '92.##.137.42':3128
- '87.##0.166.58':3128
- '18#.0.20.97':3128
- '20#.#43.101.123':3128
- '19#.#2.54.245':3128
- '18#.#10.234.155':3128
- '18#.#5.26.139':3128
- '19#.#55.209.74':3128
- '19#.#56.30.50':3128
- '18#.#53.219.249':3128
- '64.##.73.202':3128
- '17#.#47.129.134':3128
- '20#.#.145.222':3128
- '2.##.81.65':3128
- '2.##4.5.223':3128
- '18#.#7.42.112':3128
- '79.##7.47.194':3128
- '10#.#72.59.74':3128
- '37.#9.2.236':3128
- '95.##2.197.224':3128
- '77.#45.6.14':3128
- '11#.#41.58.243':3128
- '18#.#53.236.99':3128
- '18#.#16.160.2':3128
- '88.##8.141.91':3128
- '95.##.192.126':3128
- '17#.#2.172.201':3128
- '31.#4.75.22':3128
- '77.##.45.219':3128
- '92.##5.41.62':3128
- '20#.#3.162.99':3128
- '2.##.7.60':3128
- '80.#0.168.1':3128
- '19#.#20.162.3':3128
- '41.##0.37.54':3128
- '95.##1.151.172':3128
- '41.##2.230.45':3128
- '19#.#.115.130':3128
- '18#.#4.243.192':3128
- '41.##.17.192':3128
- '31.##.246.83':3128
- '41.##.76.139':3128
- '19#.#0.214.68':3128
- '41.##1.56.14':3128
- '70.##.129.218':3128
- '17#.#0.73.122':3128
- '41.##3.41.85':3128
- '11#.#5.11.37':3128
- '11#.#06.2.15':3128
- '19#.53.70.6':3128
- '11#.#2.152.137':3128
- '17#.#9.61.122':3128
- '75.##0.76.228':3128
- '64.##0.246.5':3128
- '46.##.223.174':3128
- '18#.#60.166.2':3128
- '21#.#5.122.105':3128
- '80.##.168.127':3128
- '89.##.38.241':3128
- '93.##6.154.250':3128
- '18#.#4.49.33':3128
- '10#.#53.78.130':3128
- '11#.#5.4.172':3128
- '11#.#5.12.55':3128
- '19#.#06.84.130':3128
- '77.##0.213.211':3128
- '81.##.19.171':3128
- '85.##5.238.33':3128
- '19#.#2.3.246':3128
- '46.##.224.85':3128
- '20#.#79.72.122':3128
- '18#.2.89.64':3128
- '19#.#8.247.244':3128
- '82.##0.174.164':3128
- '82.##8.97.240':3128
- '18#.#0.247.49':3128
- '17#.#.170.174':3128
- '17#.#39.117.243':3128
- '41.##.18.145':3128
- '41.##2.62.141':3128
- '18#.#84.125.126':3128
- '2.##.137.201':3128
- '61.##.255.149':3128
- '31.##8.11.139':3128
- '77.##1.18.161':3128
- '19#.#06.81.39':3128
- '41.#6.8.129':3128
- '96.#.160.28':3128
- '20#.#15.211.108':3128
- '22#.#75.231.64':3128
- '46.##9.112.179':3128
- '95.##5.61.62':3128
- '21#.#30.101.74':3128
- '17#.#0.153.31':3128
- '92.##.17.226':3128
- '22#.#75.231.195':3128
- '19#.#7.136.244':3128
- '46.##.236.164':3128
- '94.##.206.168':3128
- '72.##2.237.212':3128
- '41.##3.57.73':3128
- '24.##7.31.181':3128
- '18#.#61.199.18':3128
- '88.##.177.236':3128
- '41.##1.44.108':3128
- '20#.#91.242.241':3128
- '18#.#10.230.239':3128
- '89.##5.106.30':3128
- '17#.#2.171.1':3128
- '41.#7.0.222':3128
- '94.##.33.183':3128
- '18#.#7.18.212':3128
- '92.##.223.223':3128
- '87.##7.61.167':3128
- '11#.55.7.17':3128
- '2.###.195.111':3128
- '21#.#5.49.228':3128
- '95.##.172.22':3128
- '41.#7.39.2':3128
- '19#.#5.88.167':3128
- '17#.#22.180.177':3128
- '95.##.139.10':3128
- '70.##.141.158':3128
- '41.##2.169.170':3128
- '17#.#49.46.218':3128
- '89.##3.98.138':3128
- '61.##5.136.244':3128
- '17#.#75.221.3':3128
- '18#.#13.227.13':3128
- '37.##.108.37':3128
- '41.#6.46.47':3128
- '83.##8.28.136':3128
- '20#.#62.16.205':3128
- '41.##5.50.77':3128
- '21#.#5.79.64':3128
- '10#.#53.115.139':3128
- '11#.#60.141.102':3128
- '41.#6.8.141':3128
- '19#.#0.77.169':3128
- '79.##7.47.195':3128
- '95.##.53.180':3128
- '89.##.222.115':3128
- '17#.#5.67.237':3128
- '41.##.189.112':3128
- '18#.#7.204.79':3128
- '2.###.110.127':3128
- '98.##8.212.151':3128
- '2.###.105.113':3128
- '11#.#2.146.212':3128
- '74.#15.3.67':3128
- '21#.#12.170.65':3128
- '66.##4.111.198':3128
- '19#.#.52.104':3128
- '19#.#4.167.87':3128
- '20#.#14.5.33':3128
- '95.##.109.230':3128
- '78.##.149.250':3128
- '18#.#60.9.90':3128
- '92.##.17.173':3128
- '86.##.120.163':3128
- '2.###.158.126':3128
- '31.##.236.120':3128
- '67.##2.104.30':3128
- '20#.#42.212.32':3128
- '19#.#6.196.3':3128
- '95.##.232.85':3128
- '16#.#67.43.205':3128
- '95.##0.158.185':3128
- '12#.#25.196.143':3128
- '80.##.108.138':3128
- '85.##.176.81':3128
- '19#.#03.250.199':3128
- '85.##0.81.228':3128
- '95.##.48.198':3128
- '11#.#29.196.36':3128
- '18#.#65.140.35':3128
- '22#.#75.228.61':3128
- '89.##9.146.68':3128
- '17#.#0.155.28':3128
- '22#.#14.251.206':3128
- '79.##7.47.199':3128
- '80.##.168.140':3128
- '95.##.141.203':3128
- '10#.#2.16.218':3128
- '21#.96.2.58':3128
- '95.#9.41.45':3128
- '95.##2.184.18':3128
- '18#.#5.179.53':3128
- '37.#9.66.72':3128
- '17#.#21.88.236':3128
- '12#.#05.138.25':3128
Другое:
Ищет следующие окна:
- ClassName: 'Indicator' WindowName: ''
