Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'List Print File Services DLL VC Office' = '<SYSTEM32>\cmwkmcbammj.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Defender CardSpace Spooler] 'Start' = '00000002'
Вредоносные функции:
Для затруднения выявления своего присутствия в системе
блокирует:
- Центр обеспечения безопасности (Security Center)
Создает и запускает на исполнение:
- '<SYSTEM32>\fmuqtsbr.exe' "<SYSTEM32>\cmwkmcbammj.exe"
- '%WINDIR%\Temp\nlk9mx6x3m6mif.exe' -r 32922 tcp
- '%TEMP%\nlk9mx6x3bi3ifoqvi0hf.exe'
- '<SYSTEM32>\cmwkmcbammj.exe'
Изменения в файловой системе:
Создает следующие файлы:
- <SYSTEM32>\mbzxgjjywg\run
- <SYSTEM32>\mbzxgjjywg\rng
- %WINDIR%\Temp\nlk9mx6x3m6mif.exe
- <SYSTEM32>\mbzxgjjywg\cfg
- <SYSTEM32>\fmuqtsbr.exe
- %TEMP%\nlk9mx6x3bi3ifoqvi0hf.exe
- <SYSTEM32>\mbzxgjjywg\tst
- <SYSTEM32>\cmwkmcbammj.exe
- <SYSTEM32>\mbzxgjjywg\etc
Присваивает атрибут 'скрытый' для следующих файлов:
- <SYSTEM32>\fmuqtsbr.exe
- <SYSTEM32>\cmwkmcbammj.exe
Удаляет следующие файлы:
- %WINDIR%\Temp\nlk9mx6x3m6mif.exe
- <DRIVERS>\etc\hosts
- %TEMP%\nlk9mx6x3bi3ifoqvi0hf.exe
Подменяет файл HOSTS.
Сетевая активность:
Подключается к:
- 'pi###uch.net':80
- 'so###oday.net':80
- 'so###uch.net':80
- 'si###ome.net':80
- 'ro###ome.net':80
- 'so###ome.net':80
- 'pi###ome.net':80
- 'pi###even.net':80
- 'pi###oday.net':80
- 'so###even.net':80
- 'mo###ome.net':80
- 'si###uch.net':80
- 'ju###ome.net':80
- 'ju###even.net':80
- 'mo###even.net':80
- 'si###even.net':80
- 'ro###even.net':80
- 'ro###oday.net':80
- 'ro###uch.net':80
- 'si###oday.net':80
- 'dr###shown.net':80
- 'wi###eck.net':80
- 'wi###hown.net':80
- 'wi###ood.net':80
- 'dr###food.net':80
- 'af###sllc.com':80
- 'ri###nstorm.net':80
- 'be##lxc.com':80
- 'dr###neck.net':80
- 'de###lxc.com':80
- 'kn###oday.net':80
- 'ab###even.net':80
- 'ab###oday.net':80
- 'ab###uch.net':80
- 'kn###uch.net':80
- 'wi###eet.net':80
- 'dr###meet.net':80
- 'kn###ome.net':80
- 'kn###even.net':80
- 'ab###ome.net':80
TCP:
Запросы HTTP GET:
- http://pi###uch.net/index.php
- http://so###oday.net/index.php
- http://so###uch.net/index.php
- http://si###ome.net/index.php
- http://ro###ome.net/index.php
- http://so###ome.net/index.php
- http://pi###ome.net/index.php
- http://pi###even.net/index.php
- http://pi###oday.net/index.php
- http://so###even.net/index.php
- http://mo###ome.net/index.php
- http://si###uch.net/index.php
- http://ju###ome.net/index.php
- http://ju###even.net/index.php
- http://mo###even.net/index.php
- http://si###even.net/index.php
- http://ro###even.net/index.php
- http://ro###oday.net/index.php
- http://ro###uch.net/index.php
- http://si###oday.net/index.php
- http://dr###shown.net/index.php
- http://wi###eck.net/index.php
- http://wi###hown.net/index.php
- http://wi###ood.net/index.php
- http://dr###food.net/index.php
- http://af###sllc.com/index.php
- http://ri###nstorm.net/index.php
- http://be##lxc.com/index.php
- http://dr###neck.net/index.php
- http://de###lxc.com/index.php
- http://kn###oday.net/index.php
- http://ab###even.net/index.php
- http://ab###oday.net/index.php
- http://ab###uch.net/index.php
- http://kn###uch.net/index.php
- http://wi###eet.net/index.php
- http://dr###meet.net/index.php
- http://kn###ome.net/index.php
- http://kn###even.net/index.php
- http://ab###ome.net/index.php
UDP:
- DNS ASK pi###uch.net
- DNS ASK so###oday.net
- DNS ASK so###uch.net
- DNS ASK si###ome.net
- DNS ASK ro###ome.net
- DNS ASK so###ome.net
- DNS ASK pi###ome.net
- DNS ASK pi###even.net
- DNS ASK pi###oday.net
- DNS ASK so###even.net
- DNS ASK mo###ome.net
- DNS ASK si###uch.net
- DNS ASK ju###ome.net
- DNS ASK ju###even.net
- DNS ASK mo###even.net
- DNS ASK si###even.net
- DNS ASK ro###even.net
- DNS ASK ro###oday.net
- DNS ASK ro###uch.net
- DNS ASK si###oday.net
- DNS ASK ab###uch.net
- DNS ASK dr###shown.net
- DNS ASK wi###eck.net
- DNS ASK dr###food.net
- DNS ASK wi###hown.net
- DNS ASK dr###neck.net
- DNS ASK af###sllc.com
- DNS ASK ri###nstorm.net
- DNS ASK de###lxc.com
- DNS ASK be##lxc.com
- DNS ASK wi###ood.net
- DNS ASK kn###oday.net
- DNS ASK ab###even.net
- DNS ASK kn###uch.net
- DNS ASK ab###oday.net
- DNS ASK kn###even.net
- DNS ASK wi###eet.net
- DNS ASK dr###meet.net
- DNS ASK ab###ome.net
- DNS ASK kn###ome.net
- '23#.#55.255.250':1900
