Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Solutions Tunneling Function Class' = 'C:\kt1oxyzgpaoku\lzmmn1nl6e.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Protected Telephony Bus COM Key Office] 'ImagePath' = 'C:\kt1oxyzgpaoku\lzmmn1nl6e.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Protected Telephony Bus COM Key Office] 'Start' = '00000002'
Вредоносные функции:
Запускает на исполнение:
- 'C:\kt1oxyzgpaoku\rmoiahebn.exe' "c:\kt1oxyzgpaoku\lzmmn1nl6e.exe"
- 'C:\kt1oxyzgpaoku\lzmmn1nl6e.exe'
- 'C:\kt1oxyzgpaoku\konrxynx2t5xi6pv8pcvg.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\kt1oxyzgpaoku\lzmmn1nl6e.exe
- C:\kt1oxyzgpaoku\rmoiahebn.exe
- C:\kt1oxyzgpaoku\edeaulw
- %WINDIR%\kt1oxyzgpaoku\dzuayyfuciwp
- C:\kt1oxyzgpaoku\dzuayyfuciwp
- C:\kt1oxyzgpaoku\konrxynx2t5xi6pv8pcvg.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\kt1oxyzgpaoku\rmoiahebn.exe
- C:\kt1oxyzgpaoku\lzmmn1nl6e.exe
Удаляет следующие файлы:
- C:\kt1oxyzgpaoku\konrxynx2t5xi6pv8pcvg.exe
- %WINDIR%\kt1oxyzgpaoku\dzuayyfuciwp
Подменяет следующие файлы:
- %WINDIR%\kt1oxyzgpaoku\dzuayyfuciwp
Сетевая активность:
Подключается к:
- 'ch#####asatterberry.net':80
- 'sh#####neatterberry.net':80
- 'ch#####asrichardson.net':80
- 'sh#####nerichardson.net':80
- 'ka#####nepatrickson.net':80
- 'co#####nepatrickson.net':80
- 'ch#####asunderwood.net':80
- 'sh#####neunderwood.net':80
- 'co#####usatterberry.net':80
- 'ma#####neatterberry.net':80
- 'co#####usrichardson.net':80
- 'ma#####nerichardson.net':80
- 'ch#####aspatrickson.net':80
- 'sh#####nepatrickson.net':80
- 'co#####usunderwood.net':80
- 'ma#####neunderwood.net':80
- 'ro#####ltatterberry.net':80
- 'ra#####featterberry.net':80
- 'ro#####ltrichardson.net':80
- 'ra#####ferichardson.net':80
- 'qu#####lapatrickson.net':80
- 'qu#####larichardson.net':80
- 'ro#####ltunderwood.net':80
- 'ra#####feunderwood.net':80
- 'ka#####neatterberry.net':80
- 'co#####neatterberry.net':80
- 'ka#####nerichardson.net':80
- 'co#####nerichardson.net':80
- 'ro#####ltpatrickson.net':80
- 'ra#####fepatrickson.net':80
- 'ka#####neunderwood.net':80
- 'co#####neunderwood.net':80
- 'jo#####neatterberry.net':80
- 'se#####naatterberry.net':80
- 'jo#####nerichardson.net':80
- 'se#####narichardson.net':80
- 'tr#####anpatrickson.net':80
- 'se#####erpatrickson.net':80
- 'jo#####neunderwood.net':80
- 'se#####naunderwood.net':80
- 'ma######eshakesheave.net':80
- 'qu######ashakesheave.net':80
- 'ma#####netimberlake.net':80
- 'qu#####latimberlake.net':80
- 'jo#####nepatrickson.net':80
- 'se#####napatrickson.net':80
- 'ma#####nechristians.net':80
- 'qu#####lachristians.net':80
- 'co#####eratterberry.net':80
- 'ra#####leatterberry.net':80
- 'co#####errichardson.net':80
- 'ra#####lerichardson.net':80
- 'co#####uspatrickson.net':80
- 'ma#####nepatrickson.net':80
- 'co#####erunderwood.net':80
- 'ra#####leunderwood.net':80
- 'tr#####anatterberry.net':80
- 'se#####eratterberry.net':80
- 'tr#####anrichardson.net':80
- 'se#####errichardson.net':80
- 'co#####erpatrickson.net':80
- 'ra#####lepatrickson.net':80
- 'tr#####anunderwood.net':80
- 'se#####erunderwood.net':80
TCP:
Запросы HTTP GET:
- http://ch#####asatterberry.net/index.php
- http://sh#####neatterberry.net/index.php
- http://ch#####asrichardson.net/index.php
- http://sh#####nerichardson.net/index.php
- http://ka#####nepatrickson.net/index.php
- http://co#####nepatrickson.net/index.php
- http://ch#####asunderwood.net/index.php
- http://sh#####neunderwood.net/index.php
- http://co#####usatterberry.net/index.php
- http://ma#####neatterberry.net/index.php
- http://co#####usrichardson.net/index.php
- http://ma#####nerichardson.net/index.php
- http://ch#####aspatrickson.net/index.php
- http://sh#####nepatrickson.net/index.php
- http://co#####usunderwood.net/index.php
- http://ma#####neunderwood.net/index.php
- http://ro#####ltatterberry.net/index.php
- http://ra#####featterberry.net/index.php
- http://ro#####ltrichardson.net/index.php
- http://ra#####ferichardson.net/index.php
- http://qu#####lapatrickson.net/index.php
- http://qu#####larichardson.net/index.php
- http://ro#####ltunderwood.net/index.php
- http://ra#####feunderwood.net/index.php
- http://ka#####neatterberry.net/index.php
- http://co#####neatterberry.net/index.php
- http://ka#####nerichardson.net/index.php
- http://co#####nerichardson.net/index.php
- http://ro#####ltpatrickson.net/index.php
- http://ra#####fepatrickson.net/index.php
- http://ka#####neunderwood.net/index.php
- http://co#####neunderwood.net/index.php
- http://jo#####neatterberry.net/index.php
- http://se#####naatterberry.net/index.php
- http://jo#####nerichardson.net/index.php
- http://se#####narichardson.net/index.php
- http://tr#####anpatrickson.net/index.php
- http://se#####erpatrickson.net/index.php
- http://jo#####neunderwood.net/index.php
- http://se#####naunderwood.net/index.php
- http://ma######eshakesheave.net/index.php
- http://qu######ashakesheave.net/index.php
- http://ma#####netimberlake.net/index.php
- http://qu#####latimberlake.net/index.php
- http://jo#####nepatrickson.net/index.php
- http://se#####napatrickson.net/index.php
- http://ma#####nechristians.net/index.php
- http://qu#####lachristians.net/index.php
- http://co#####eratterberry.net/index.php
- http://ra#####leatterberry.net/index.php
- http://co#####errichardson.net/index.php
- http://ra#####lerichardson.net/index.php
- http://co#####uspatrickson.net/index.php
- http://ma#####nepatrickson.net/index.php
- http://co#####erunderwood.net/index.php
- http://ra#####leunderwood.net/index.php
- http://tr#####anatterberry.net/index.php
- http://se#####eratterberry.net/index.php
- http://tr#####anrichardson.net/index.php
- http://se#####errichardson.net/index.php
- http://co#####erpatrickson.net/index.php
- http://ra#####lepatrickson.net/index.php
- http://tr#####anunderwood.net/index.php
- http://se#####erunderwood.net/index.php
UDP:
- DNS ASK sh#####neatterberry.net
- DNS ASK ch#####asunderwood.net
- DNS ASK sh#####nerichardson.net
- DNS ASK ch#####asatterberry.net
- DNS ASK co#####nepatrickson.net
- DNS ASK ka#####nerichardson.net
- DNS ASK sh#####neunderwood.net
- DNS ASK ka#####nepatrickson.net
- DNS ASK ma#####neatterberry.net
- DNS ASK co#####usunderwood.net
- DNS ASK ma#####nerichardson.net
- DNS ASK co#####usatterberry.net
- DNS ASK sh#####nepatrickson.net
- DNS ASK ch#####asrichardson.net
- DNS ASK ma#####neunderwood.net
- DNS ASK ch#####aspatrickson.net
- DNS ASK ra#####featterberry.net
- DNS ASK ro#####ltunderwood.net
- DNS ASK ra#####ferichardson.net
- DNS ASK ro#####ltatterberry.net
- DNS ASK qu#####larichardson.net
- DNS ASK qu#####laatterberry.net
- DNS ASK ra#####feunderwood.net
- DNS ASK qu#####lapatrickson.net
- DNS ASK co#####neatterberry.net
- DNS ASK ka#####neunderwood.net
- DNS ASK co#####nerichardson.net
- DNS ASK ka#####neatterberry.net
- DNS ASK ra#####fepatrickson.net
- DNS ASK ro#####ltrichardson.net
- DNS ASK co#####neunderwood.net
- DNS ASK ro#####ltpatrickson.net
- DNS ASK co#####usrichardson.net
- DNS ASK jo#####neatterberry.net
- DNS ASK se#####naatterberry.net
- DNS ASK jo#####nerichardson.net
- DNS ASK se#####narichardson.net
- DNS ASK tr#####anpatrickson.net
- DNS ASK se#####erpatrickson.net
- DNS ASK jo#####neunderwood.net
- DNS ASK se#####naunderwood.net
- DNS ASK ma######eshakesheave.net
- DNS ASK qu######ashakesheave.net
- DNS ASK ma#####netimberlake.net
- DNS ASK qu#####latimberlake.net
- DNS ASK jo#####nepatrickson.net
- DNS ASK se#####napatrickson.net
- DNS ASK ma#####nechristians.net
- DNS ASK qu#####lachristians.net
- DNS ASK co#####eratterberry.net
- DNS ASK ra#####leatterberry.net
- DNS ASK co#####errichardson.net
- DNS ASK ra#####lerichardson.net
- DNS ASK co#####uspatrickson.net
- DNS ASK ma#####nepatrickson.net
- DNS ASK co#####erunderwood.net
- DNS ASK ra#####leunderwood.net
- DNS ASK tr#####anatterberry.net
- DNS ASK se#####eratterberry.net
- DNS ASK tr#####anrichardson.net
- DNS ASK se#####errichardson.net
- DNS ASK co#####erpatrickson.net
- DNS ASK ra#####lepatrickson.net
- DNS ASK tr#####anunderwood.net
- DNS ASK se#####erunderwood.net
