Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Media File AutoConnect Workstation SNMP' = '<SYSTEM32>\lxfmsshcvi.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Program Update Disk Location] 'ImagePath' = '<SYSTEM32>\lxfmsshcvi.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Program Update Disk Location] 'Start' = '00000002'
Вредоносные функции:
Для затруднения выявления своего присутствия в системе
блокирует:
- Центр обеспечения безопасности (Security Center)
Создает и запускает на исполнение:
- '<SYSTEM32>\ssukllpgbd.exe' "<SYSTEM32>\lxfmsshcvi.exe"
- '%WINDIR%\Temp\nql3zeqs3cv4fyw.exe' -r 46643 tcp
- '%TEMP%\nql3zeqs2z1afywbkdnikp.exe'
- '<SYSTEM32>\lxfmsshcvi.exe'
Изменения в файловой системе:
Создает следующие файлы:
- <SYSTEM32>\ncxjaeodszaxmsp\run
- <SYSTEM32>\ncxjaeodszaxmsp\rng
- %WINDIR%\Temp\nql3zeqs3cv4fyw.exe
- <SYSTEM32>\ncxjaeodszaxmsp\cfg
- <SYSTEM32>\ssukllpgbd.exe
- %TEMP%\nql3zeqs2z1afywbkdnikp.exe
- <SYSTEM32>\ncxjaeodszaxmsp\tst
- <SYSTEM32>\lxfmsshcvi.exe
- <SYSTEM32>\ncxjaeodszaxmsp\etc
Присваивает атрибут 'скрытый' для следующих файлов:
- <SYSTEM32>\ssukllpgbd.exe
- <SYSTEM32>\lxfmsshcvi.exe
Удаляет следующие файлы:
- %WINDIR%\Temp\nql3zeqs3cv4fyw.exe
- <DRIVERS>\etc\hosts
- %TEMP%\nql3zeqs2z1afywbkdnikp.exe
Подменяет файл HOSTS.
Сетевая активность:
Подключается к:
- 'pi###plain.net':80
- 'mu###tep.net':80
- 'pi###step.net':80
- 'mu###rown.net':80
- 'pi###grown.net':80
- 'mu###lain.net':80
- 've###lack.net':80
- 've###lain.net':80
- 'we###lain.net':80
- 've###tep.net':80
- 'we###lack.net':80
- 've###rown.net':80
- 'we###rown.net':80
- 'pi###black.net':80
- 'tr###form.net':80
- 'ta###lack.net':80
- 'wa###lack.net':80
- 'yo###gree.net':80
- 'tr###agree.net':80
- 'yo###orm.net':80
- 'ta###rown.net':80
- 'ta###tep.net':80
- 'wa###tep.net':80
- 'mu###lack.net':80
- 'wa###rown.net':80
- 'ta###lain.net':80
- 'wa###lain.net':80
- 'we###tep.net':80
- 'pl###black.net':80
- 'fi###rown.net':80
- 'pl###grown.net':80
- 'le###step.net':80
- 'se###step.net':80
- 'fi###lack.net':80
- 'fi###lain.net':80
- 'be##lxc.com':80
- 'af###sllc.com':80
- 'ri###nstorm.net':80
- 'pl###plain.net':80
- 'fi###tep.net':80
- 'de###lxc.com':80
- 'se###plain.net':80
- 'to###rown.net':80
- 'fa###lain.net':80
- 'to###lain.net':80
- 'fa###lack.net':80
- 'to###lack.net':80
- 'fa###rown.net':80
- 'fa###tep.net':80
- 'le###grown.net':80
- 'se###grown.net':80
- 'le###plain.net':80
- 'to###tep.net':80
- 'le###black.net':80
- 'se###black.net':80
TCP:
Запросы HTTP GET:
- http://pi###plain.net/index.php
- http://mu###tep.net/index.php
- http://pi###step.net/index.php
- http://mu###rown.net/index.php
- http://pi###grown.net/index.php
- http://mu###lain.net/index.php
- http://ve###lack.net/index.php
- http://ve###lain.net/index.php
- http://we###lain.net/index.php
- http://ve###tep.net/index.php
- http://we###lack.net/index.php
- http://ve###rown.net/index.php
- http://we###rown.net/index.php
- http://pi###black.net/index.php
- http://tr###form.net/index.php
- http://ta###lack.net/index.php
- http://wa###lack.net/index.php
- http://yo###gree.net/index.php
- http://tr###agree.net/index.php
- http://yo###orm.net/index.php
- http://ta###rown.net/index.php
- http://ta###tep.net/index.php
- http://wa###tep.net/index.php
- http://mu###lack.net/index.php
- http://wa###rown.net/index.php
- http://ta###lain.net/index.php
- http://wa###lain.net/index.php
- http://we###tep.net/index.php
- http://pl###black.net/index.php
- http://fi###rown.net/index.php
- http://pl###grown.net/index.php
- http://le###step.net/index.php
- http://se###step.net/index.php
- http://fi###lack.net/index.php
- http://fi###lain.net/index.php
- http://be##lxc.com/index.php
- http://af###sllc.com/index.php
- http://ri###nstorm.net/index.php
- http://pl###plain.net/index.php
- http://fi###tep.net/index.php
- http://de###lxc.com/index.php
- http://se###plain.net/index.php
- http://to###rown.net/index.php
- http://fa###lain.net/index.php
- http://to###lain.net/index.php
- http://fa###lack.net/index.php
- http://to###lack.net/index.php
- http://fa###rown.net/index.php
- http://fa###tep.net/index.php
- http://le###grown.net/index.php
- http://se###grown.net/index.php
- http://le###plain.net/index.php
- http://to###tep.net/index.php
- http://le###black.net/index.php
- http://se###black.net/index.php
UDP:
- DNS ASK pi###plain.net
- DNS ASK mu###tep.net
- DNS ASK pi###step.net
- DNS ASK mu###lain.net
- DNS ASK pi###black.net
- DNS ASK mu###rown.net
- DNS ASK pi###grown.net
- DNS ASK ve###lain.net
- DNS ASK we###lain.net
- DNS ASK ve###tep.net
- DNS ASK we###rown.net
- DNS ASK ve###lack.net
- DNS ASK we###lack.net
- DNS ASK ve###rown.net
- DNS ASK tr###form.net
- DNS ASK ta###lack.net
- DNS ASK wa###lack.net
- DNS ASK yo###orm.net
- DNS ASK tr###touch.net
- DNS ASK yo###gree.net
- DNS ASK tr###agree.net
- DNS ASK ta###tep.net
- DNS ASK wa###tep.net
- DNS ASK mu###lack.net
- DNS ASK wa###lain.net
- DNS ASK ta###rown.net
- DNS ASK wa###rown.net
- DNS ASK ta###lain.net
- DNS ASK we###tep.net
- DNS ASK pl###black.net
- DNS ASK fi###rown.net
- DNS ASK pl###grown.net
- DNS ASK le###step.net
- DNS ASK se###step.net
- DNS ASK fi###lack.net
- DNS ASK fi###lain.net
- DNS ASK be##lxc.com
- DNS ASK af###sllc.com
- DNS ASK ri###nstorm.net
- DNS ASK pl###plain.net
- DNS ASK fi###tep.net
- DNS ASK de###lxc.com
- DNS ASK se###plain.net
- DNS ASK to###rown.net
- DNS ASK fa###lain.net
- DNS ASK to###lain.net
- DNS ASK fa###lack.net
- DNS ASK to###lack.net
- DNS ASK fa###rown.net
- DNS ASK fa###tep.net
- DNS ASK le###grown.net
- DNS ASK se###grown.net
- DNS ASK le###plain.net
- DNS ASK to###tep.net
- DNS ASK le###black.net
- DNS ASK se###black.net
- '23#.#55.255.250':1900
