Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Brightness BitLocker TCP/IP Receiver' = 'C:\zgrbwkzkevv\udvbwcpk.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Search Disk Defender Server Multimedia Filtering] 'ImagePath' = 'C:\zgrbwkzkevv\udvbwcpk.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Search Disk Defender Server Multimedia Filtering] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- 'C:\zgrbwkzkevv\yvrotmbgzio.exe' "c:\zgrbwkzkevv\udvbwcpk.exe"
- 'C:\zgrbwkzkevv\udvbwcpk.exe'
- 'C:\zgrbwkzkevv\fzjvb3dfyllkvvikf.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\zgrbwkzkevv\udvbwcpk.exe
- C:\zgrbwkzkevv\yvrotmbgzio.exe
- C:\zgrbwkzkevv\fzjvb3dfyllkvvikf.exe
- %WINDIR%\zgrbwkzkevv\qcjnihnk
- C:\zgrbwkzkevv\qcjnihnk
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\zgrbwkzkevv\yvrotmbgzio.exe
- C:\zgrbwkzkevv\udvbwcpk.exe
Удаляет следующие файлы:
- C:\zgrbwkzkevv\fzjvb3dfyllkvvikf.exe
- %WINDIR%\zgrbwkzkevv\qcjnihnk
Подменяет следующие файлы:
- %WINDIR%\zgrbwkzkevv\qcjnihnk
Сетевая активность:
Подключается к:
- 'kn####istant.net':80
- 'be####istant.net':80
- 'kn####lothes.net':80
- 'su####health.net':80
- 'cr####eparate.net':80
- 'su####separate.net':80
- 'kn####eparate.net':80
- 'be####eparate.net':80
- 'me####distant.net':80
- 'be####lothes.net':80
- 'kn###health.net':80
- 'be###health.net':80
- 'wa###health.net':80
- 'th####thealth.net':80
- 'wa####eparate.net':80
- 'th####tdistant.net':80
- 'wa####lothes.net':80
- 'th####tclothes.net':80
- 'cr####lothes.net':80
- 'su####clothes.net':80
- 'cr###health.net':80
- 'th####tseparate.net':80
- 'cr####istant.net':80
- 'su####distant.net':80
- 'ex#####ncedistant.net':80
- 'fr####istant.net':80
- 'ex#####nceclothes.net':80
- 'ge####manhealth.net':80
- 'al####yseparate.net':80
- 'ge#####anseparate.net':80
- 'ex#####nceseparate.net':80
- 'fr####eparate.net':80
- 'fi###future.net':80
- 'fr####lothes.net':80
- 'ex#####ncehealth.net':80
- 'fr###health.net':80
- 'me####health.net':80
- 'fo####health.net':80
- 'me####separate.net':80
- 'fo####distant.net':80
- 'me####clothes.net':80
- 'fo####clothes.net':80
- 'al####yclothes.net':80
- 'ge#####anclothes.net':80
- 'al####yhealth.net':80
- 'fo####separate.net':80
- 'al####ydistant.net':80
- 'ge#####andistant.net':80
TCP:
Запросы HTTP GET:
- http://kn####istant.net/index.php
- http://be####istant.net/index.php
- http://kn####lothes.net/index.php
- http://su####health.net/index.php
- http://cr####eparate.net/index.php
- http://su####separate.net/index.php
- http://kn####eparate.net/index.php
- http://be####eparate.net/index.php
- http://me####distant.net/index.php
- http://be####lothes.net/index.php
- http://kn###health.net/index.php
- http://be###health.net/index.php
- http://wa###health.net/index.php
- http://th####thealth.net/index.php
- http://wa####eparate.net/index.php
- http://th####tdistant.net/index.php
- http://wa####lothes.net/index.php
- http://th####tclothes.net/index.php
- http://cr####lothes.net/index.php
- http://su####clothes.net/index.php
- http://cr###health.net/index.php
- http://th####tseparate.net/index.php
- http://cr####istant.net/index.php
- http://su####distant.net/index.php
- http://ex#####ncedistant.net/index.php
- http://fr####istant.net/index.php
- http://ex#####nceclothes.net/index.php
- http://ge####manhealth.net/index.php
- http://al####yseparate.net/index.php
- http://ge#####anseparate.net/index.php
- http://ex#####nceseparate.net/index.php
- http://fr####eparate.net/index.php
- http://fi###future.net/index.php
- http://fr####lothes.net/index.php
- http://ex#####ncehealth.net/index.php
- http://fr###health.net/index.php
- http://me####health.net/index.php
- http://fo####health.net/index.php
- http://me####separate.net/index.php
- http://fo####distant.net/index.php
- http://me####clothes.net/index.php
- http://fo####clothes.net/index.php
- http://al####yclothes.net/index.php
- http://ge#####anclothes.net/index.php
- http://al####yhealth.net/index.php
- http://fo####separate.net/index.php
- http://al####ydistant.net/index.php
- http://ge#####andistant.net/index.php
UDP:
- DNS ASK su####separate.net
- DNS ASK kn####istant.net
- DNS ASK be####istant.net
- DNS ASK cr###health.net
- DNS ASK su####health.net
- DNS ASK cr####eparate.net
- DNS ASK be###health.net
- DNS ASK kn####eparate.net
- DNS ASK be####eparate.net
- DNS ASK kn####lothes.net
- DNS ASK be####lothes.net
- DNS ASK kn###health.net
- DNS ASK th####tclothes.net
- DNS ASK wa###health.net
- DNS ASK th####thealth.net
- DNS ASK wa####istant.net
- DNS ASK th####tdistant.net
- DNS ASK wa####lothes.net
- DNS ASK su####distant.net
- DNS ASK cr####lothes.net
- DNS ASK su####clothes.net
- DNS ASK wa####eparate.net
- DNS ASK th####tseparate.net
- DNS ASK cr####istant.net
- DNS ASK me####distant.net
- DNS ASK ex#####ncedistant.net
- DNS ASK fr####istant.net
- DNS ASK ex#####nceclothes.net
- DNS ASK ge####manhealth.net
- DNS ASK al####yseparate.net
- DNS ASK ge#####anseparate.net
- DNS ASK ex#####nceseparate.net
- DNS ASK fr####eparate.net
- DNS ASK fi###future.net
- DNS ASK fr####lothes.net
- DNS ASK ex#####ncehealth.net
- DNS ASK fr###health.net
- DNS ASK me####health.net
- DNS ASK fo####health.net
- DNS ASK me####separate.net
- DNS ASK fo####distant.net
- DNS ASK me####clothes.net
- DNS ASK fo####clothes.net
- DNS ASK al####yclothes.net
- DNS ASK ge#####anclothes.net
- DNS ASK al####yhealth.net
- DNS ASK fo####separate.net
- DNS ASK al####ydistant.net
- DNS ASK ge#####andistant.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
