Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '87338114' = '%WINDIR%\87338114\svchsot.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '3FB9296B' = '%WINDIR%\3FB9296B\svchsot.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Hal2' = 'c:\sott2.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '23A1C2AD' = '%WINDIR%\23A1C2AD\svchsot.exe'
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\At48.job
- %WINDIR%\Tasks\At49.job
- %WINDIR%\Tasks\At46.job
- %WINDIR%\Tasks\At47.job
- %WINDIR%\Tasks\At50.job
- %WINDIR%\Tasks\At53.job
- %WINDIR%\Tasks\At54.job
- %WINDIR%\Tasks\At51.job
- %WINDIR%\Tasks\At52.job
- %WINDIR%\Tasks\At39.job
- %WINDIR%\Tasks\At40.job
- %WINDIR%\Tasks\At37.job
- %WINDIR%\Tasks\At38.job
- %WINDIR%\Tasks\At41.job
- %WINDIR%\Tasks\At44.job
- %WINDIR%\Tasks\At45.job
- %WINDIR%\Tasks\At42.job
- %WINDIR%\Tasks\At43.job
- %WINDIR%\Tasks\At66.job
- %WINDIR%\Tasks\At67.job
- %WINDIR%\Tasks\At64.job
- %WINDIR%\Tasks\At65.job
- %WINDIR%\Tasks\At68.job
- %WINDIR%\Tasks\At71.job
- %WINDIR%\Tasks\At72.job
- %WINDIR%\Tasks\At69.job
- %WINDIR%\Tasks\At70.job
- %WINDIR%\Tasks\At57.job
- %WINDIR%\Tasks\At58.job
- %WINDIR%\Tasks\At55.job
- %WINDIR%\Tasks\At56.job
- %WINDIR%\Tasks\At59.job
- %WINDIR%\Tasks\At62.job
- %WINDIR%\Tasks\At63.job
- %WINDIR%\Tasks\At60.job
- %WINDIR%\Tasks\At61.job
- %WINDIR%\Tasks\At12.job
- %WINDIR%\Tasks\At13.job
- %WINDIR%\Tasks\At10.job
- %WINDIR%\Tasks\At11.job
- %WINDIR%\Tasks\At14.job
- %WINDIR%\Tasks\At17.job
- %WINDIR%\Tasks\At18.job
- %WINDIR%\Tasks\At15.job
- %WINDIR%\Tasks\At16.job
- %WINDIR%\Tasks\At3.job
- %WINDIR%\Tasks\At4.job
- %WINDIR%\Tasks\At1.job
- %WINDIR%\Tasks\At2.job
- %WINDIR%\Tasks\At5.job
- %WINDIR%\Tasks\At8.job
- %WINDIR%\Tasks\At9.job
- %WINDIR%\Tasks\At6.job
- %WINDIR%\Tasks\At7.job
- %WINDIR%\Tasks\At30.job
- %WINDIR%\Tasks\At31.job
- %WINDIR%\Tasks\At28.job
- %WINDIR%\Tasks\At29.job
- %WINDIR%\Tasks\At32.job
- %WINDIR%\Tasks\At35.job
- %WINDIR%\Tasks\At36.job
- %WINDIR%\Tasks\At33.job
- %WINDIR%\Tasks\At34.job
- %WINDIR%\Tasks\At21.job
- %WINDIR%\Tasks\At22.job
- %WINDIR%\Tasks\At19.job
- %WINDIR%\Tasks\At20.job
- %WINDIR%\Tasks\At23.job
- %WINDIR%\Tasks\At26.job
- %WINDIR%\Tasks\At27.job
- %WINDIR%\Tasks\At24.job
- %WINDIR%\Tasks\At25.job
Вредоносные функции:
Создает и запускает на исполнение:
- 'C:\leiii.EXE'
- 'C:\leii.EXE'
- 'C:\lei.EXE'
Запускает на исполнение:
- '<SYSTEM32>\wbem\wmiadap.exe' /R /T
- '<SYSTEM32>\net1.exe' start "Task Scheduler"
Изменения в файловой системе:
Создает следующие файлы:
- %WINDIR%\23A1C2AD\svchsot.exe
- %WINDIR%\87338114\svchsot.exe
- %WINDIR%\3FB9296B\svchsot.exe
- C:\leiii.EXE
- C:\sott2.exe
- C:\lei.EXE
- C:\leii.EXE
Удаляет следующие файлы:
- <SYSTEM32>\PerfStringBackup.TMP
- <SYSTEM32>\wbem\Performance\WmiApRpl.ini
Сетевая активность:
Подключается к:
- 'www.dk###777.com':2017
UDP:
- DNS ASK www.dk###999.com
- DNS ASK www.dk###888.com
- DNS ASK www.dk###777.com
Другое:
Ищет следующие окна:
- ClassName: '' WindowName: 'ИрРЗіМРтЙэј¶ЦР'
- ClassName: '' WindowName: '??????????????'
