Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'NGEN Level Spooler TPM Storage Launcher RPC' = 'C:\w4lrwdklpsae\vqbpxqi7f.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Shell VC AutoConnect Encrypting DLL] 'ImagePath' = 'C:\w4lrwdklpsae\vqbpxqi7f.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Shell VC AutoConnect Encrypting DLL] 'Start' = '00000002'
Вредоносные функции:
Запускает на исполнение:
- 'C:\w4lrwdklpsae\po4xhapfgh.exe' "c:\w4lrwdklpsae\vqbpxqi7f.exe"
- 'C:\w4lrwdklpsae\vqbpxqi7f.exe'
- 'C:\w4lrwdklpsae\cmnnqo2muhocrdhskaj.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\w4lrwdklpsae\vqbpxqi7f.exe
- C:\w4lrwdklpsae\po4xhapfgh.exe
- C:\w4lrwdklpsae\ljylilyith
- %WINDIR%\w4lrwdklpsae\uxnaza5xz
- C:\w4lrwdklpsae\uxnaza5xz
- C:\w4lrwdklpsae\cmnnqo2muhocrdhskaj.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\w4lrwdklpsae\po4xhapfgh.exe
- C:\w4lrwdklpsae\vqbpxqi7f.exe
Удаляет следующие файлы:
- C:\w4lrwdklpsae\cmnnqo2muhocrdhskaj.exe
- %WINDIR%\w4lrwdklpsae\uxnaza5xz
Подменяет следующие файлы:
- %WINDIR%\w4lrwdklpsae\uxnaza5xz
Сетевая активность:
Подключается к:
- 'ce#####nephilomena.net':80
- 'am#####nefrederick.net':80
- 'al#####rakristina.net':80
- 'am#####nephilomena.net':80
- 'ce#####negallagher.net':80
- 'am#####nekristina.net':80
- 'ce#####nefrederick.net':80
- 'am#####negallagher.net':80
- 'al#####raphilomena.net':80
- 'ma#####nafrederick.net':80
- 'al#####erkristina.net':80
- 'ma#####naphilomena.net':80
- 'al#####ragallagher.net':80
- 'ma#####nakristina.net':80
- 'al#####rafrederick.net':80
- 'ma#####nagallagher.net':80
- 'za#####ahphilomena.net':80
- 'ar#####ldfrederick.net':80
- 'sh#####lekristina.net':80
- 'ar#####ldphilomena.net':80
- 'za#####ahgallagher.net':80
- 'ar#####ldkristina.net':80
- 'za#####ahfrederick.net':80
- 'ar#####ldgallagher.net':80
- 'sh#####lephilomena.net':80
- 'ch#####nefrederick.net':80
- 'ce#####nekristina.net':80
- 'ch#####nephilomena.net':80
- 'sh#####legallagher.net':80
- 'ch#####nekristina.net':80
- 'sh#####lefrederick.net':80
- 'ch#####negallagher.net':80
- 'ka#####nekristina.net':80
- 'an######eoutterridge.net':80
- 'gu######noutterridge.net':80
- 'ge#####namurgatroyd.net':80
- 'ch#####lemurgatroyd.net':80
- 'an######ecristiansen.net':80
- 'gu######ncristiansen.net':80
- 'an#####lematthewson.net':80
- 'gu#####enmatthewson.net':80
- 'ge######aoutterridge.net':80
- 'ch######eoutterridge.net':80
- 'ar#####ldmurgatroyd.net':80
- 'za#####ahmurgatroyd.net':80
- 'ge######acristiansen.net':80
- 'ch######ecristiansen.net':80
- 'ge#####namatthewson.net':80
- 'ch#####lematthewson.net':80
- 'ka#####nephilomena.net':80
- 'al#####erphilomena.net':80
- 'gw#####remurgatroyd.net':80
- 'ch#####anmurgatroyd.net':80
- 'ka#####negallagher.net':80
- 'al#####ergallagher.net':80
- 'ka#####nefrederick.net':80
- 'al#####erfrederick.net':80
- 'gw######eoutterridge.net':80
- 'ch######noutterridge.net':80
- 'an#####lemurgatroyd.net':80
- 'gu#####enmurgatroyd.net':80
- 'gw######ecristiansen.net':80
- 'ch######ncristiansen.net':80
- 'gw#####rematthewson.net':80
- 'ch#####anmatthewson.net':80
TCP:
Запросы HTTP GET:
- http://ce#####nephilomena.net/index.php
- http://am#####nefrederick.net/index.php
- http://al#####rakristina.net/index.php
- http://am#####nephilomena.net/index.php
- http://ce#####negallagher.net/index.php
- http://am#####nekristina.net/index.php
- http://ce#####nefrederick.net/index.php
- http://am#####negallagher.net/index.php
- http://al#####raphilomena.net/index.php
- http://ma#####nafrederick.net/index.php
- http://al#####erkristina.net/index.php
- http://ma#####naphilomena.net/index.php
- http://al#####ragallagher.net/index.php
- http://ma#####nakristina.net/index.php
- http://al#####rafrederick.net/index.php
- http://ma#####nagallagher.net/index.php
- http://za#####ahphilomena.net/index.php
- http://ar#####ldfrederick.net/index.php
- http://sh#####lekristina.net/index.php
- http://ar#####ldphilomena.net/index.php
- http://za#####ahgallagher.net/index.php
- http://ar#####ldkristina.net/index.php
- http://za#####ahfrederick.net/index.php
- http://ar#####ldgallagher.net/index.php
- http://sh#####lephilomena.net/index.php
- http://ch#####nefrederick.net/index.php
- http://ce#####nekristina.net/index.php
- http://ch#####nephilomena.net/index.php
- http://sh#####legallagher.net/index.php
- http://ch#####nekristina.net/index.php
- http://sh#####lefrederick.net/index.php
- http://ch#####negallagher.net/index.php
- http://ka#####nekristina.net/index.php
- http://an######eoutterridge.net/index.php
- http://gu######noutterridge.net/index.php
- http://ge#####namurgatroyd.net/index.php
- http://ch#####lemurgatroyd.net/index.php
- http://an######ecristiansen.net/index.php
- http://gu######ncristiansen.net/index.php
- http://an#####lematthewson.net/index.php
- http://gu#####enmatthewson.net/index.php
- http://ge######aoutterridge.net/index.php
- http://ch######eoutterridge.net/index.php
- http://ar#####ldmurgatroyd.net/index.php
- http://za#####ahmurgatroyd.net/index.php
- http://ge######acristiansen.net/index.php
- http://ch######ecristiansen.net/index.php
- http://ge#####namatthewson.net/index.php
- http://ch#####lematthewson.net/index.php
- http://ka#####nephilomena.net/index.php
- http://al#####erphilomena.net/index.php
- http://gw#####remurgatroyd.net/index.php
- http://ch#####anmurgatroyd.net/index.php
- http://ka#####negallagher.net/index.php
- http://al#####ergallagher.net/index.php
- http://ka#####nefrederick.net/index.php
- http://al#####erfrederick.net/index.php
- http://gw######eoutterridge.net/index.php
- http://ch######noutterridge.net/index.php
- http://an#####lemurgatroyd.net/index.php
- http://gu#####enmurgatroyd.net/index.php
- http://gw######ecristiansen.net/index.php
- http://ch######ncristiansen.net/index.php
- http://gw#####rematthewson.net/index.php
- http://ch#####anmatthewson.net/index.php
UDP:
- DNS ASK ce#####nephilomena.net
- DNS ASK am#####nefrederick.net
- DNS ASK al#####rakristina.net
- DNS ASK am#####nephilomena.net
- DNS ASK ce#####negallagher.net
- DNS ASK am#####nekristina.net
- DNS ASK ce#####nefrederick.net
- DNS ASK am#####negallagher.net
- DNS ASK al#####raphilomena.net
- DNS ASK ma#####nafrederick.net
- DNS ASK al#####erkristina.net
- DNS ASK ma#####naphilomena.net
- DNS ASK al#####ragallagher.net
- DNS ASK ma#####nakristina.net
- DNS ASK al#####rafrederick.net
- DNS ASK ma#####nagallagher.net
- DNS ASK ce#####nekristina.net
- DNS ASK ar#####ldfrederick.net
- DNS ASK za#####ahfrederick.net
- DNS ASK ar#####ldphilomena.net
- DNS ASK za#####ahphilomena.net
- DNS ASK ar#####ldkristina.net
- DNS ASK za#####ahkristina.net
- DNS ASK ar#####ldgallagher.net
- DNS ASK za#####ahgallagher.net
- DNS ASK ch#####nefrederick.net
- DNS ASK sh#####lefrederick.net
- DNS ASK ch#####nephilomena.net
- DNS ASK sh#####lephilomena.net
- DNS ASK ch#####nekristina.net
- DNS ASK sh#####lekristina.net
- DNS ASK ch#####negallagher.net
- DNS ASK sh#####legallagher.net
- DNS ASK an######eoutterridge.net
- DNS ASK gu######noutterridge.net
- DNS ASK ge#####namurgatroyd.net
- DNS ASK ch#####lemurgatroyd.net
- DNS ASK an######ecristiansen.net
- DNS ASK gu######ncristiansen.net
- DNS ASK an#####lematthewson.net
- DNS ASK gu#####enmatthewson.net
- DNS ASK ge######aoutterridge.net
- DNS ASK ch######eoutterridge.net
- DNS ASK ar#####ldmurgatroyd.net
- DNS ASK za#####ahmurgatroyd.net
- DNS ASK ge######acristiansen.net
- DNS ASK ch######ecristiansen.net
- DNS ASK ge#####namatthewson.net
- DNS ASK ch#####lematthewson.net
- DNS ASK an#####lemurgatroyd.net
- DNS ASK al#####erphilomena.net
- DNS ASK ka#####nefrederick.net
- DNS ASK ch#####anmurgatroyd.net
- DNS ASK ka#####nephilomena.net
- DNS ASK al#####ergallagher.net
- DNS ASK ka#####nekristina.net
- DNS ASK al#####erfrederick.net
- DNS ASK ka#####negallagher.net
- DNS ASK ch######noutterridge.net
- DNS ASK gw#####rematthewson.net
- DNS ASK gu#####enmurgatroyd.net
- DNS ASK gw######eoutterridge.net
- DNS ASK ch######ncristiansen.net
- DNS ASK gw#####remurgatroyd.net
- DNS ASK ch#####anmatthewson.net
- DNS ASK gw######ecristiansen.net
