Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Device Profile AutoConnect' = '<SYSTEM32>\uxjhasnm.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Adapter AuthIP Color Peer Human] 'ImagePath' = '<SYSTEM32>\uxjhasnm.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Adapter AuthIP Color Peer Human] 'Start' = '00000002'
Вредоносные функции:
Для затруднения выявления своего присутствия в системе
блокирует:
- Центр обеспечения безопасности (Security Center)
Создает и запускает на исполнение:
- '<SYSTEM32>\aouymnqfyrj.exe' "<SYSTEM32>\uxjhasnm.exe"
- '%WINDIR%\Temp\ivtnlybn3do7inz.exe' -r 37171 tcp
- '%TEMP%\ivtnlybn3945inziwhncq.exe'
- '<SYSTEM32>\uxjhasnm.exe'
Изменения в файловой системе:
Создает следующие файлы:
- <SYSTEM32>\bqgjsywmh\run
- <SYSTEM32>\bqgjsywmh\rng
- %WINDIR%\Temp\ivtnlybn3do7inz.exe
- <SYSTEM32>\bqgjsywmh\cfg
- <SYSTEM32>\aouymnqfyrj.exe
- %TEMP%\ivtnlybn3945inziwhncq.exe
- <SYSTEM32>\bqgjsywmh\tst
- <SYSTEM32>\uxjhasnm.exe
- <SYSTEM32>\bqgjsywmh\etc
Присваивает атрибут 'скрытый' для следующих файлов:
- <SYSTEM32>\aouymnqfyrj.exe
- <SYSTEM32>\uxjhasnm.exe
Удаляет следующие файлы:
- %WINDIR%\Temp\ivtnlybn3do7inz.exe
- <DRIVERS>\etc\hosts
- %TEMP%\ivtnlybn3945inziwhncq.exe
Подменяет файл HOSTS.
Сетевая активность:
Подключается к:
- 'se###fool.net':80
- 'le###fool.net':80
- 'se###goes.net':80
- 'le###goes.net':80
- 'se###gone.net':80
- 'le###gone.net':80
- 'se###light.net':80
- 'le###light.net':80
- 'fi###one.net':80
- 'fi###oes.net':80
- 'pl###fool.net':80
- 'vi###one.net':80
- 'pl###goes.net':80
- 'fi###ight.net':80
- 'pl###gone.net':80
- 'fi###ool.net':80
- 'pl###light.net':80
- 've###ool.net':80
- 'we###ight.net':80
- 've###oes.net':80
- 'we###ool.net':80
- 've###one.net':80
- 'pi###goes.net':80
- 've###ight.net':80
- 'we###one.net':80
- 'we###oes.net':80
- 'to###ool.net':80
- 'fa###ool.net':80
- 'to###oes.net':80
- 'fa###oes.net':80
- 'to###one.net':80
- 'fa###one.net':80
- 'to###ight.net':80
- 'fa###ight.net':80
- 'lr###gone.net':80
- 'mu###asy.net':80
- 'wa###hem.net':80
- 'mu#####siderable.net':80
- 'pi###easy.net':80
- 'ta###est.net':80
- 'wa#####siderable.net':80
- 'ta###hem.net':80
- 'wa###est.net':80
- 'pi#####nsiderable.net':80
- 'be##lxc.com':80
- 'de###lxc.com':80
- 'ri###nstorm.net':80
- 'af###sllc.com':80
- 'pi###best.net':80
- 'mu###est.net':80
- 'pi###them.net':80
- 'mu###hem.net':80
- 'lr###goes.net':80
- 'vi###oes.net':80
- 'tr###gone.net':80
- 'yo###one.net':80
- 'lr###light.net':80
- 'vi###ight.net':80
- 'lr###fool.net':80
- 'vi###ool.net':80
- 'yo###ight.net':80
- 'ta###asy.net':80
- 'tr###goes.net':80
- 'ta#####siderable.net':80
- 'wa###asy.net':80
- 'yo###ool.net':80
- 'tr###light.net':80
- 'yo###oes.net':80
- 'tr###fool.net':80
TCP:
Запросы HTTP GET:
- http://se###fool.net/index.php
- http://le###fool.net/index.php
- http://se###goes.net/index.php
- http://le###goes.net/index.php
- http://se###gone.net/index.php
- http://le###gone.net/index.php
- http://se###light.net/index.php
- http://le###light.net/index.php
- http://fi###one.net/index.php
- http://fi###oes.net/index.php
- http://pl###fool.net/index.php
- http://vi###one.net/index.php
- http://pl###goes.net/index.php
- http://fi###ight.net/index.php
- http://pl###gone.net/index.php
- http://fi###ool.net/index.php
- http://pl###light.net/index.php
- http://ve###ool.net/index.php
- http://we###ight.net/index.php
- http://ve###oes.net/index.php
- http://we###ool.net/index.php
- http://ve###one.net/index.php
- http://pi###goes.net/index.php
- http://ve###ight.net/index.php
- http://we###one.net/index.php
- http://we###oes.net/index.php
- http://to###ool.net/index.php
- http://fa###ool.net/index.php
- http://to###oes.net/index.php
- http://fa###oes.net/index.php
- http://to###one.net/index.php
- http://fa###one.net/index.php
- http://to###ight.net/index.php
- http://fa###ight.net/index.php
- http://lr###gone.net/index.php
- http://mu###asy.net/index.php
- http://wa###hem.net/index.php
- http://mu#####siderable.net/index.php
- http://pi###easy.net/index.php
- http://ta###est.net/index.php
- http://wa#####siderable.net/index.php
- http://ta###hem.net/index.php
- http://wa###est.net/index.php
- http://pi#####nsiderable.net/index.php
- http://be##lxc.com/index.php
- http://de###lxc.com/index.php
- http://ri###nstorm.net/index.php
- http://af###sllc.com/index.php
- http://pi###best.net/index.php
- http://mu###est.net/index.php
- http://pi###them.net/index.php
- http://mu###hem.net/index.php
- http://lr###goes.net/index.php
- http://vi###oes.net/index.php
- http://tr###gone.net/index.php
- http://yo###one.net/index.php
- http://lr###light.net/index.php
- http://vi###ight.net/index.php
- http://lr###fool.net/index.php
- http://vi###ool.net/index.php
- http://yo###ight.net/index.php
- http://ta###asy.net/index.php
- http://tr###goes.net/index.php
- http://ta#####siderable.net/index.php
- http://wa###asy.net/index.php
- http://yo###ool.net/index.php
- http://tr###light.net/index.php
- http://yo###oes.net/index.php
- http://tr###fool.net/index.php
UDP:
- DNS ASK se###fool.net
- DNS ASK le###fool.net
- DNS ASK se###goes.net
- DNS ASK le###goes.net
- DNS ASK se###gone.net
- DNS ASK le###gone.net
- DNS ASK se###light.net
- DNS ASK le###light.net
- DNS ASK fi###one.net
- DNS ASK fi###oes.net
- DNS ASK pl###fool.net
- DNS ASK vi###one.net
- DNS ASK pl###goes.net
- DNS ASK fi###ight.net
- DNS ASK pl###gone.net
- DNS ASK fi###ool.net
- DNS ASK pl###light.net
- DNS ASK to###oes.net
- DNS ASK we###ight.net
- DNS ASK ve###ight.net
- DNS ASK we###ool.net
- DNS ASK ve###ool.net
- DNS ASK pi###goes.net
- DNS ASK mu###oes.net
- DNS ASK we###one.net
- DNS ASK ve###one.net
- DNS ASK ve###oes.net
- DNS ASK fa###ool.net
- DNS ASK to###ight.net
- DNS ASK fa###oes.net
- DNS ASK to###ool.net
- DNS ASK fa###one.net
- DNS ASK we###oes.net
- DNS ASK fa###ight.net
- DNS ASK to###one.net
- DNS ASK lr###gone.net
- DNS ASK mu###asy.net
- DNS ASK wa###hem.net
- DNS ASK mu#####siderable.net
- DNS ASK pi###easy.net
- DNS ASK ta###est.net
- DNS ASK wa#####siderable.net
- DNS ASK ta###hem.net
- DNS ASK wa###est.net
- DNS ASK pi#####nsiderable.net
- DNS ASK be##lxc.com
- DNS ASK de###lxc.com
- DNS ASK ri###nstorm.net
- DNS ASK af###sllc.com
- DNS ASK pi###best.net
- DNS ASK mu###est.net
- DNS ASK pi###them.net
- DNS ASK mu###hem.net
- DNS ASK lr###goes.net
- DNS ASK vi###oes.net
- DNS ASK tr###gone.net
- DNS ASK yo###one.net
- DNS ASK lr###light.net
- DNS ASK vi###ight.net
- DNS ASK lr###fool.net
- DNS ASK vi###ool.net
- DNS ASK yo###ight.net
- DNS ASK ta###asy.net
- DNS ASK tr###goes.net
- DNS ASK ta#####siderable.net
- DNS ASK wa###asy.net
- DNS ASK yo###ool.net
- DNS ASK tr###light.net
- DNS ASK yo###oes.net
- DNS ASK tr###fool.net
- '23#.#55.255.250':1900
