Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'CNG Controls Image Interface Firewall' = '<SYSTEM32>\vebhyoqlkok.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Copy Agent Shadow Interactive BranchCache] 'ImagePath' = '<SYSTEM32>\vebhyoqlkok.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Copy Agent Shadow Interactive BranchCache] 'Start' = '00000002'
Вредоносные функции:
Для затруднения выявления своего присутствия в системе
блокирует:
- Центр обеспечения безопасности (Security Center)
Создает и запускает на исполнение:
- '<SYSTEM32>\ossjfgz.exe' "<SYSTEM32>\vebhyoqlkok.exe"
- '%WINDIR%\Temp\hyhw2a2yggxdfq.exe' -r 42806 tcp
- '%TEMP%\hyhw2a2r6qxdfqgsn8nun.exe'
- '<SYSTEM32>\vebhyoqlkok.exe'
Изменения в файловой системе:
Создает следующие файлы:
- <SYSTEM32>\elmteyv\run
- <SYSTEM32>\elmteyv\rng
- %WINDIR%\Temp\hyhw2a2yggxdfq.exe
- <SYSTEM32>\elmteyv\cfg
- <SYSTEM32>\ossjfgz.exe
- %TEMP%\hyhw2a2r6qxdfqgsn8nun.exe
- <SYSTEM32>\elmteyv\tst
- <SYSTEM32>\vebhyoqlkok.exe
- <SYSTEM32>\elmteyv\etc
Присваивает атрибут 'скрытый' для следующих файлов:
- <SYSTEM32>\ossjfgz.exe
- <SYSTEM32>\vebhyoqlkok.exe
Удаляет следующие файлы:
- %WINDIR%\Temp\hyhw2a2yggxdfq.exe
- <DRIVERS>\etc\hosts
- %TEMP%\hyhw2a2r6qxdfqgsn8nun.exe
Подменяет файл HOSTS.
Сетевая активность:
Подключается к:
- 'we###even.net':80
- 'fe###oday.net':80
- 'we###ome.net':80
- 'fe###even.net':80
- 'we###uch.net':80
- 'ta###some.net':80
- 'we###oday.net':80
- 'fe###uch.net':80
- 'li###even.net':80
- 'th###today.net':80
- 'li###ome.net':80
- 'th###seven.net':80
- 'li###uch.net':80
- 'fe###ome.net':80
- 'li###oday.net':80
- 'th###such.net':80
- 'ca###even.net':80
- 'po###today.net':80
- 'ca###ome.net':80
- 'po###seven.net':80
- 'ca###uch.net':80
- 'no###ome.net':80
- 'ca###oday.net':80
- 'po###such.net':80
- 'le###even.net':80
- 'ta###today.net':80
- 'le###ome.net':80
- 'ta###seven.net':80
- 'le###uch.net':80
- 'po###some.net':80
- 'le###oday.net':80
- 'ta###such.net':80
- 'be##lxc.com':80
- 'we###ood.net':80
- 'al###being.net':80
- 'ri###nstorm.net':80
- 'no###eet.net':80
- 'ri###eck.net':80
- 'no###ood.net':80
- 'we###eet.net':80
- 'mo###ugust.net':80
- 'mi###hown.net':80
- 'cr#####onaraminta.net':80
- 'le###form.net':80
- 'pr####tbottom.net':80
- 'ca####nbring.net':80
- 'ab###ell.net':80
- 'mo###olor.net':80
- 'fi###seven.net':80
- 'so###today.net':80
- 'fi###some.net':80
- 'so###seven.net':80
- 'fi###such.net':80
- 'th###some.net':80
- 'fi###today.net':80
- 'so###such.net':80
- 'fa###shown.net':80
- 'ri###ood.net':80
- 'fa###neck.net':80
- 'ri###hown.net':80
- 'fa###meet.net':80
- 'so###some.net':80
- 'fa###food.net':80
- 'ri###eet.net':80
TCP:
Запросы HTTP GET:
- http://we###even.net/index.php
- http://fe###oday.net/index.php
- http://we###ome.net/index.php
- http://fe###even.net/index.php
- http://we###uch.net/index.php
- http://ta###some.net/index.php
- http://we###oday.net/index.php
- http://fe###uch.net/index.php
- http://li###even.net/index.php
- http://th###today.net/index.php
- http://li###ome.net/index.php
- http://th###seven.net/index.php
- http://li###uch.net/index.php
- http://fe###ome.net/index.php
- http://li###oday.net/index.php
- http://th###such.net/index.php
- http://ca###even.net/index.php
- http://po###today.net/index.php
- http://ca###ome.net/index.php
- http://po###seven.net/index.php
- http://ca###uch.net/index.php
- http://no###ome.net/index.php
- http://ca###oday.net/index.php
- http://po###such.net/index.php
- http://le###even.net/index.php
- http://ta###today.net/index.php
- http://le###ome.net/index.php
- http://ta###seven.net/index.php
- http://le###uch.net/index.php
- http://po###some.net/index.php
- http://le###oday.net/index.php
- http://ta###such.net/index.php
- http://be##lxc.com/index.php
- http://we###ood.net/index.php
- http://al###being.net/index.php
- http://ri###nstorm.net/index.php
- http://no###eet.net/index.php
- http://ri###eck.net/index.php
- http://no###ood.net/index.php
- http://we###eet.net/index.php
- http://mo###ugust.net/index.php
- http://mi###hown.net/index.php
- http://cr#####onaraminta.net/index.php
- http://le###form.net/index.php
- http://pr####tbottom.net/index.php
- http://ca####nbring.net/index.php
- http://ab###ell.net/index.php
- http://mo###olor.net/index.php
- http://fi###seven.net/index.php
- http://so###today.net/index.php
- http://fi###some.net/index.php
- http://so###seven.net/index.php
- http://fi###such.net/index.php
- http://th###some.net/index.php
- http://fi###today.net/index.php
- http://so###such.net/index.php
- http://fa###shown.net/index.php
- http://ri###ood.net/index.php
- http://fa###neck.net/index.php
- http://ri###hown.net/index.php
- http://fa###meet.net/index.php
- http://so###some.net/index.php
- http://fa###food.net/index.php
- http://ri###eet.net/index.php
UDP:
- DNS ASK we###even.net
- DNS ASK fe###oday.net
- DNS ASK we###ome.net
- DNS ASK fe###even.net
- DNS ASK we###uch.net
- DNS ASK ta###some.net
- DNS ASK we###oday.net
- DNS ASK fe###uch.net
- DNS ASK li###even.net
- DNS ASK th###today.net
- DNS ASK li###ome.net
- DNS ASK th###seven.net
- DNS ASK li###uch.net
- DNS ASK fe###ome.net
- DNS ASK li###oday.net
- DNS ASK th###such.net
- DNS ASK le###ome.net
- DNS ASK po###today.net
- DNS ASK ca###oday.net
- DNS ASK po###seven.net
- DNS ASK ca###even.net
- DNS ASK no###ome.net
- DNS ASK no###even.net
- DNS ASK po###such.net
- DNS ASK ca###uch.net
- DNS ASK ta###today.net
- DNS ASK le###oday.net
- DNS ASK ta###seven.net
- DNS ASK le###even.net
- DNS ASK po###some.net
- DNS ASK ca###ome.net
- DNS ASK ta###such.net
- DNS ASK le###uch.net
- DNS ASK be##lxc.com
- DNS ASK we###ood.net
- DNS ASK al###being.net
- DNS ASK ri###nstorm.net
- DNS ASK no###eet.net
- DNS ASK ri###eck.net
- DNS ASK no###ood.net
- DNS ASK we###eet.net
- DNS ASK mo###ugust.net
- DNS ASK mi###hown.net
- DNS ASK cr#####onaraminta.net
- DNS ASK le###form.net
- DNS ASK pr####tbottom.net
- DNS ASK ca####nbring.net
- DNS ASK ab###ell.net
- DNS ASK mo###olor.net
- DNS ASK fi###seven.net
- DNS ASK so###today.net
- DNS ASK fi###some.net
- DNS ASK so###seven.net
- DNS ASK fi###such.net
- DNS ASK th###some.net
- DNS ASK fi###today.net
- DNS ASK so###such.net
- DNS ASK fa###shown.net
- DNS ASK ri###ood.net
- DNS ASK fa###neck.net
- DNS ASK ri###hown.net
- DNS ASK fa###meet.net
- DNS ASK so###some.net
- DNS ASK fa###food.net
- DNS ASK ri###eet.net
- '23#.#55.255.250':1900
