Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Endpoint Management Connections' = 'C:\wkgremb\dxnqsabnkhoc.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Disk Notification Image Store Copy Peer] 'ImagePath' = 'C:\wkgremb\dxnqsabnkhoc.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Disk Notification Image Store Copy Peer] 'Start' = '00000002'
Вредоносные функции:
Запускает на исполнение:
- 'C:\wkgremb\abmarso.exe' "c:\wkgremb\dxnqsabnkhoc.exe"
- 'C:\wkgremb\dxnqsabnkhoc.exe'
- 'C:\wkgremb\psnzft2vjvhhcjyvixuk.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\wkgremb\dxnqsabnkhoc.exe
- C:\wkgremb\abmarso.exe
- C:\wkgremb\wkqr1w
- %WINDIR%\wkgremb\tmguviuggruw
- C:\wkgremb\tmguviuggruw
- C:\wkgremb\psnzft2vjvhhcjyvixuk.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\wkgremb\abmarso.exe
- C:\wkgremb\dxnqsabnkhoc.exe
Удаляет следующие файлы:
- C:\wkgremb\psnzft2vjvhhcjyvixuk.exe
- %WINDIR%\wkgremb\tmguviuggruw
Подменяет следующие файлы:
- %WINDIR%\wkgremb\tmguviuggruw
Сетевая активность:
Подключается к:
- 'se#####nawashington.net':80
- 'jo#####newashington.net':80
- 'se######awinterbottom.net':80
- 'jo#####nestrickland.net':80
- 'se######abreckenridge.net':80
- 'jo######ebreckenridge.net':80
- 'jo######ewinterbottom.net':80
- 'qu#####laburgundy.net':80
- 'ma#####neburgundy.net':80
- 'qu#####lajaqueline.net':80
- 'qu#####lacherette.net':80
- 'qu#####laelizabeth.net':80
- 'ma#####neelizabeth.net':80
- 'co######rwinterbottom.net':80
- 'se#####erstrickland.net':80
- 'tr#####anstrickland.net':80
- 'ra#####lewashington.net':80
- 'co#####erwashington.net':80
- 'ra######ewinterbottom.net':80
- 'se######rbreckenridge.net':80
- 'se######rwinterbottom.net':80
- 'tr######nwinterbottom.net':80
- 'se#####nastrickland.net':80
- 'tr######nbreckenridge.net':80
- 'se#####erwashington.net':80
- 'tr#####anwashington.net':80
- 'ka#####nejaqueline.net':80
- 'sh#####necherette.net':80
- 'ch#####ascherette.net':80
- 'co#####neburgundy.net':80
- 'ka#####neburgundy.net':80
- 'co#####nejaqueline.net':80
- 'sh#####neelizabeth.net':80
- 'sh#####nejaqueline.net':80
- 'ch#####asjaqueline.net':80
- 'ma#####necherette.net':80
- 'ch#####aselizabeth.net':80
- 'sh#####neburgundy.net':80
- 'ch#####asburgundy.net':80
- 'ra#####feelizabeth.net':80
- 'ro#####ltelizabeth.net':80
- 'ra#####feburgundy.net':80
- 'ma#####nejaqueline.net':80
- 'ra#####fecherette.net':80
- 'ro#####ltcherette.net':80
- 'ro#####ltburgundy.net':80
- 'ka#####necherette.net':80
- 'co#####neelizabeth.net':80
- 'ka#####neelizabeth.net':80
- 'ra#####fejaqueline.net':80
- 'ro#####ltjaqueline.net':80
- 'co#####necherette.net':80
TCP:
Запросы HTTP GET:
- http://se#####nawashington.net/index.php
- http://jo#####newashington.net/index.php
- http://se######awinterbottom.net/index.php
- http://jo#####nestrickland.net/index.php
- http://se######abreckenridge.net/index.php
- http://jo######ebreckenridge.net/index.php
- http://jo######ewinterbottom.net/index.php
- http://qu#####laburgundy.net/index.php
- http://ma#####neburgundy.net/index.php
- http://qu#####lajaqueline.net/index.php
- http://qu#####lacherette.net/index.php
- http://qu#####laelizabeth.net/index.php
- http://ma#####neelizabeth.net/index.php
- http://co######rwinterbottom.net/index.php
- http://se#####erstrickland.net/index.php
- http://tr#####anstrickland.net/index.php
- http://ra#####lewashington.net/index.php
- http://co#####erwashington.net/index.php
- http://ra######ewinterbottom.net/index.php
- http://se######rbreckenridge.net/index.php
- http://se######rwinterbottom.net/index.php
- http://tr######nwinterbottom.net/index.php
- http://se#####nastrickland.net/index.php
- http://tr######nbreckenridge.net/index.php
- http://se#####erwashington.net/index.php
- http://tr#####anwashington.net/index.php
- http://ka#####nejaqueline.net/index.php
- http://sh#####necherette.net/index.php
- http://ch#####ascherette.net/index.php
- http://co#####neburgundy.net/index.php
- http://ka#####neburgundy.net/index.php
- http://co#####nejaqueline.net/index.php
- http://sh#####neelizabeth.net/index.php
- http://sh#####nejaqueline.net/index.php
- http://ch#####asjaqueline.net/index.php
- http://ma#####necherette.net/index.php
- http://ch#####aselizabeth.net/index.php
- http://sh#####neburgundy.net/index.php
- http://ch#####asburgundy.net/index.php
- http://ra#####feelizabeth.net/index.php
- http://ro#####ltelizabeth.net/index.php
- http://ra#####feburgundy.net/index.php
- http://ma#####nejaqueline.net/index.php
- http://ra#####fecherette.net/index.php
- http://ro#####ltcherette.net/index.php
- http://ro#####ltburgundy.net/index.php
- http://ka#####necherette.net/index.php
- http://co#####neelizabeth.net/index.php
- http://ka#####neelizabeth.net/index.php
- http://ra#####fejaqueline.net/index.php
- http://ro#####ltjaqueline.net/index.php
- http://co#####necherette.net/index.php
UDP:
- DNS ASK jo######ebreckenridge.net
- DNS ASK se#####nawashington.net
- DNS ASK jo#####newashington.net
- DNS ASK se#####nastrickland.net
- DNS ASK jo#####nestrickland.net
- DNS ASK se######abreckenridge.net
- DNS ASK se######awinterbottom.net
- DNS ASK ma#####neelizabeth.net
- DNS ASK qu#####laburgundy.net
- DNS ASK ma#####neburgundy.net
- DNS ASK jo######ewinterbottom.net
- DNS ASK qu#####lacherette.net
- DNS ASK qu#####laelizabeth.net
- DNS ASK ra######ewinterbottom.net
- DNS ASK co######rwinterbottom.net
- DNS ASK se#####erstrickland.net
- DNS ASK co######rbreckenridge.net
- DNS ASK ra#####lewashington.net
- DNS ASK co#####erwashington.net
- DNS ASK tr#####anstrickland.net
- DNS ASK tr#####anwashington.net
- DNS ASK se######rwinterbottom.net
- DNS ASK tr######nwinterbottom.net
- DNS ASK se######rbreckenridge.net
- DNS ASK tr######nbreckenridge.net
- DNS ASK se#####erwashington.net
- DNS ASK qu#####lajaqueline.net
- DNS ASK ka#####nejaqueline.net
- DNS ASK sh#####necherette.net
- DNS ASK ch#####ascherette.net
- DNS ASK co#####neburgundy.net
- DNS ASK ka#####neburgundy.net
- DNS ASK co#####nejaqueline.net
- DNS ASK sh#####neelizabeth.net
- DNS ASK sh#####nejaqueline.net
- DNS ASK ch#####asjaqueline.net
- DNS ASK ma#####necherette.net
- DNS ASK ch#####aselizabeth.net
- DNS ASK sh#####neburgundy.net
- DNS ASK ch#####asburgundy.net
- DNS ASK ra#####feelizabeth.net
- DNS ASK ro#####ltelizabeth.net
- DNS ASK ra#####feburgundy.net
- DNS ASK ma#####nejaqueline.net
- DNS ASK ra#####fecherette.net
- DNS ASK ro#####ltcherette.net
- DNS ASK ro#####ltburgundy.net
- DNS ASK ka#####necherette.net
- DNS ASK co#####neelizabeth.net
- DNS ASK ka#####neelizabeth.net
- DNS ASK ra#####fejaqueline.net
- DNS ASK ro#####ltjaqueline.net
- DNS ASK co#####necherette.net
