Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Policy Adapter DHCP Tablet Input Key' = 'C:\nhmljhvwprkfvs\woqehatz.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Volume Trap BitLocker Collector IPsec User] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- 'C:\nhmljhvwprkfvs\komykxtcpuii.exe' "c:\nhmljhvwprkfvs\woqehatz.exe"
- 'C:\nhmljhvwprkfvs\woqehatz.exe'
- 'C:\nhmljhvwprkfvs\kje2opcltbnhzxwxshcg.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\nhmljhvwprkfvs\woqehatz.exe
- C:\nhmljhvwprkfvs\komykxtcpuii.exe
- C:\nhmljhvwprkfvs\u46nwjzyk
- %WINDIR%\nhmljhvwprkfvs\tjxrfkn9puzj
- C:\nhmljhvwprkfvs\tjxrfkn9puzj
- C:\nhmljhvwprkfvs\kje2opcltbnhzxwxshcg.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\nhmljhvwprkfvs\komykxtcpuii.exe
- C:\nhmljhvwprkfvs\woqehatz.exe
Удаляет следующие файлы:
- C:\nhmljhvwprkfvs\kje2opcltbnhzxwxshcg.exe
- %WINDIR%\nhmljhvwprkfvs\tjxrfkn9puzj
Сетевая активность:
Подключается к:
- 'wa###broad.net':80
- 'th####tbroad.net':80
- 'wa####nderstand.net':80
- 'th####tbehind.net':80
- 'wa###butter.net':80
- 'th####tbutter.net':80
- 'wa###behind.net':80
- 'th#####understand.net':80
- 'cr###broad.net':80
- 'su###rbroad.net':80
- 'cr####nderstand.net':80
- 'su####behind.net':80
- 'cr###butter.net':80
- 'su####butter.net':80
- 'cr###behind.net':80
- 'pa###broad.net':80
- 'fi####nderstand.net':80
- 'pa####nderstand.net':80
- 'fi###broad.net':80
- 'pa###butter.net':80
- 'fi###behind.net':80
- 'pa###behind.net':80
- 'sm###butter.net':80
- 'wo###broad.net':80
- 'sm####nderstand.net':80
- 'wo####nderstand.net':80
- 'sm###broad.net':80
- 'wo###butter.net':80
- 'sm###behind.net':80
- 'wo###behind.net':80
- 'su#####nderstand.net':80
- 'ge####manbehind.net':80
- 'al####ybroad.net':80
- 'ge####manbroad.net':80
- 'al####ybehind.net':80
- 'fo#####nderstand.net':80
- 'al####ybutter.net':80
- 'ge####manbutter.net':80
- 'al#####understand.net':80
- 'fr###behind.net':80
- 'ex####encebroad.net':80
- 'fr###broad.net':80
- 'ex#####ncebehind.net':80
- 'ge#####anunderstand.net':80
- 'ex#####ncebutter.net':80
- 'fr###butter.net':80
- 'kn###broad.net':80
- 'be###broad.net':80
- 'kn####nderstand.net':80
- 'be###behind.net':80
- 'kn###butter.net':80
- 'be###butter.net':80
- 'kn###behind.net':80
- 'be####nderstand.net':80
- 'me###rbroad.net':80
- 'fo###wbroad.net':80
- 'me#####nderstand.net':80
- 'fo####behind.net':80
- 'me####butter.net':80
- 'fo####butter.net':80
- 'me####behind.net':80
TCP:
Запросы HTTP GET:
- http://wa###broad.net/index.php?me########
- http://th####tbroad.net/index.php?me########
- http://wa####nderstand.net/index.php?me########
- http://th####tbehind.net/index.php?me########
- http://wa###butter.net/index.php?me########
- http://th####tbutter.net/index.php?me########
- http://wa###behind.net/index.php?me########
- http://th#####understand.net/index.php?me########
- http://cr###broad.net/index.php?me########
- http://su###rbroad.net/index.php?me########
- http://cr####nderstand.net/index.php?me########
- http://su####behind.net/index.php?me########
- http://cr###butter.net/index.php?me########
- http://su####butter.net/index.php?me########
- http://cr###behind.net/index.php?me########
- http://pa###broad.net/index.php?me########
- http://fi####nderstand.net/index.php?me########
- http://pa####nderstand.net/index.php?me########
- http://fi###broad.net/index.php?me########
- http://pa###butter.net/index.php?me########
- http://fi###behind.net/index.php?me########
- http://pa###behind.net/index.php?me########
- http://sm###butter.net/index.php?me########
- http://wo###broad.net/index.php?me########
- http://sm####nderstand.net/index.php?me########
- http://wo####nderstand.net/index.php?me########
- http://sm###broad.net/index.php?me########
- http://wo###butter.net/index.php?me########
- http://sm###behind.net/index.php?me########
- http://wo###behind.net/index.php?me########
- http://su#####nderstand.net/index.php?me########
- http://ge####manbehind.net/index.php?me########
- http://al####ybroad.net/index.php?me########
- http://ge####manbroad.net/index.php?me########
- http://al####ybehind.net/index.php?me########
- http://fo#####nderstand.net/index.php?me########
- http://al####ybutter.net/index.php?me########
- http://ge####manbutter.net/index.php?me########
- http://al#####understand.net/index.php?me########
- http://fr###behind.net/index.php?me########
- http://ex####encebroad.net/index.php?me########
- http://fr###broad.net/index.php?me########
- http://ex#####ncebehind.net/index.php?me########
- http://ge#####anunderstand.net/index.php?me########
- http://ex#####ncebutter.net/index.php?me########
- http://fr###butter.net/index.php?me########
- http://kn###broad.net/index.php?me########
- http://be###broad.net/index.php?me########
- http://kn####nderstand.net/index.php?me########
- http://be###behind.net/index.php?me########
- http://kn###butter.net/index.php?me########
- http://be###butter.net/index.php?me########
- http://kn###behind.net/index.php?me########
- http://be####nderstand.net/index.php?me########
- http://me###rbroad.net/index.php?me########
- http://fo###wbroad.net/index.php?me########
- http://me#####nderstand.net/index.php?me########
- http://fo####behind.net/index.php?me########
- http://me####butter.net/index.php?me########
- http://fo####butter.net/index.php?me########
- http://me####behind.net/index.php?me########
UDP:
- DNS ASK wa###broad.net
- DNS ASK th####tbroad.net
- DNS ASK wa####nderstand.net
- DNS ASK th####tbehind.net
- DNS ASK wa###butter.net
- DNS ASK th####tbutter.net
- DNS ASK wa###behind.net
- DNS ASK th#####understand.net
- DNS ASK cr###broad.net
- DNS ASK su###rbroad.net
- DNS ASK cr####nderstand.net
- DNS ASK su####behind.net
- DNS ASK cr###butter.net
- DNS ASK su####butter.net
- DNS ASK cr###behind.net
- DNS ASK pa###broad.net
- DNS ASK fi####nderstand.net
- DNS ASK pa####nderstand.net
- DNS ASK fi###broad.net
- DNS ASK pa###butter.net
- DNS ASK fi###behind.net
- DNS ASK pa###behind.net
- DNS ASK sm###butter.net
- DNS ASK wo###broad.net
- DNS ASK sm####nderstand.net
- DNS ASK wo####nderstand.net
- DNS ASK sm###broad.net
- DNS ASK wo###butter.net
- DNS ASK sm###behind.net
- DNS ASK wo###behind.net
- DNS ASK su#####nderstand.net
- DNS ASK ge####manbehind.net
- DNS ASK al####ybroad.net
- DNS ASK ge####manbroad.net
- DNS ASK al####ybehind.net
- DNS ASK fo#####nderstand.net
- DNS ASK al####ybutter.net
- DNS ASK ge####manbutter.net
- DNS ASK al#####understand.net
- DNS ASK fr###behind.net
- DNS ASK ex####encebroad.net
- DNS ASK fr###broad.net
- DNS ASK ex#####ncebehind.net
- DNS ASK ge#####anunderstand.net
- DNS ASK ex#####ncebutter.net
- DNS ASK fr###butter.net
- DNS ASK kn###broad.net
- DNS ASK be###broad.net
- DNS ASK kn####nderstand.net
- DNS ASK be###behind.net
- DNS ASK kn###butter.net
- DNS ASK be###butter.net
- DNS ASK kn###behind.net
- DNS ASK be####nderstand.net
- DNS ASK me###rbroad.net
- DNS ASK fo###wbroad.net
- DNS ASK me#####nderstand.net
- DNS ASK fo####behind.net
- DNS ASK me####butter.net
- DNS ASK fo####butter.net
- DNS ASK me####behind.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
