Техническая информация
Для обеспечения автозапуска и распространения
Модифицирует следующие ключи реестра
- [HKLM\software\Wow6432Node\microsoft\windows\CurrentVersion\Run] 'winhost' = '<Полный путь к файлу>'
Вредоносные функции
Ищет следующие окна с целью
обнаружения утилит для анализа:
- ClassName: 'OLLYDBG', WindowName: ''
- ClassName: 'GBDYLLO', WindowName: ''
- ClassName: 'pediy06', WindowName: ''
- ClassName: 'FilemonClass', WindowName: ''
- ClassName: '', WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
- ClassName: '', WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'RegmonClass', WindowName: ''
- ClassName: '', WindowName: 'Registry Monitor - Sysinternals: www.sysinternals.com'
Изменения в файловой системе
Создает следующие файлы
- C:\host.ini
- %WINDIR%\iconv.dll
- %WINDIR%\libcurl.dll
- %WINDIR%\libeay32.dll
- %WINDIR%\libiconv-2.dll
- %WINDIR%\libxml2.dll
- %WINDIR%\pcla-0.dll
- %WINDIR%\pcre-0.dll
- %WINDIR%\pcrecpp-0.dll
- %WINDIR%\pcreposix-0.dll
- %WINDIR%\posh.dll
- %WINDIR%\posh-0.dll
- %WINDIR%\riar.dll
- %WINDIR%\exma.dll
- %WINDIR%\exma-1.dll
- %WINDIR%\riar-2.dll
- %WINDIR%\tibe-1.dll
- %WINDIR%\tibe-2.dll
- %WINDIR%\trch.dll
- %WINDIR%\trch-0.dll
- %WINDIR%\trch-1.dll
- %WINDIR%\trfo.dll
- %WINDIR%\trfo-0.dll
- %WINDIR%\trfo-2.dll
- %WINDIR%\tucl.dll
- %WINDIR%\tucl-1.dll
- %WINDIR%\ucl.dll
- %WINDIR%\xdvl-0.dll
- %WINDIR%\ssleay32.dll
- %WINDIR%\tibe.dll
- %WINDIR%\etebcore-2.x86.dll
- %WINDIR%\etebcore-2.x64.dll
- %WINDIR%\eteb-2.dll
- %WINDIR%\x64.dll
- %WINDIR%\s.exe
- %WINDIR%\esteemaudit-2.1.0.fb
- %WINDIR%\esteemaudittouch-2.1.0.fb
- %WINDIR%\eternalblue-2.2.0.fb
- %WINDIR%\eternalchampion-2.0.0.fb
- %WINDIR%\doublepulsar-1.3.1.xml
- %WINDIR%\esteemaudit-2.1.0.xml
- %WINDIR%\esteemaudittouch-2.1.0.xml
- %WINDIR%\eternalblue-2.2.0.xml
- %WINDIR%\eternalchampion-2.0.0.xml
- %WINDIR%\doublepulsar-1.3.1.exe
- %WINDIR%\esteemaudit-2.1.0.exe
- %WINDIR%\x86.dll
- %WINDIR%\esteemaudittouch-2.1.0.exe
- %WINDIR%\eternalchampion-2.0.0.exe
- %WINDIR%\adfw.dll
- %WINDIR%\adfw-2.dll
- %WINDIR%\cnli-0.dll
- %WINDIR%\cnli-1.dll
- %WINDIR%\coli-0.dll
- %WINDIR%\crli-0.dll
- %WINDIR%\dmgd-1.dll
- %WINDIR%\dmgd-4.dll
- %WINDIR%\esco-0.dll
- %WINDIR%\etch-0.dll
- %WINDIR%\etchcore-0.x64.dll
- %WINDIR%\etchcore-0.x86.dll
- %WINDIR%\eternalblue-2.2.0.exe
- %WINDIR%\zibe.dll
- %WINDIR%\zlib1.dll
Сетевая активность
Подключается к
- 'ip.#322.net':80
- 'ip##8.com':80
- 'ip##8.com':443
- 'oc##.#igicert.cn':80
TCP
Запросы HTTP GET
- http://ip.#322.net/
- http://www.ip##8.com/ips138.asp?ip################
- http://oc##.#igicert.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAL34fmCutAJr%2FR9yVdBsvY%3D
- http://oc##.#igicert.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRc9osyRBU0ybHlZFuU293oOS1mlwQUBr2mm2B5UDG%2B1akCSqDQlVOLLzQCEAc39P31YITtxzykTUQHA4M%3D
Другие
- 'ip##8.com':443
UDP
- DNS ASK ip.#322.net
- DNS ASK ip##8.com
- DNS ASK oc##.#igicert.cn
- DNS ASK st###.ppxxmr.org
Другое
Ищет следующие окна
- ClassName: '18467-41' WindowName: ''
- ClassName: '' WindowName: 'apaple.exe'
- ClassName: '' WindowName: '222.exe'
- ClassName: '' WindowName: 'dns.exe'
- ClassName: '' WindowName: 'svshosr.exe'
- ClassName: '' WindowName: 'sys.exe'
- ClassName: '' WindowName: 'stop'
- ClassName: '' WindowName: 'ppxxmr.'
- ClassName: '' WindowName: 'org'
- ClassName: '' WindowName: 'com.exe'
- ClassName: '' WindowName: 'http47478/4534'
- ClassName: '' WindowName: '.org:344/123.exe'
- ClassName: '#32770' WindowName: 'Doublepulsar-1.3.1.exe - Ó¦ÓóÌÐò´ГГЋГі'
- ClassName: '' WindowName: '425366bdfc290'
- ClassName: '' WindowName: 'd2e95526b7881'
- ClassName: '' WindowName: 'http:/'
- ClassName: '' WindowName: 'rili.exe'
- ClassName: '' WindowName: 'ddoss.exe'
