Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'User-mode Registry Interface Management' = 'C:\jknolpznhrisa\jzwlfictw4f.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Spooler SNMP AutoConfig Trap] 'ImagePath' = 'C:\jknolpznhrisa\jzwlfictw4f.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Spooler SNMP AutoConfig Trap] 'Start' = '00000002'
Вредоносные функции:
Запускает на исполнение:
- 'C:\jknolpznhrisa\lxzvkowcanav.exe' "c:\jknolpznhrisa\jzwlfictw4f.exe"
- 'C:\jknolpznhrisa\jzwlfictw4f.exe'
- 'C:\jknolpznhrisa\eiyphsy2q80piltxsgihhr.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\jknolpznhrisa\jzwlfictw4f.exe
- C:\jknolpznhrisa\lxzvkowcanav.exe
- C:\jknolpznhrisa\j7huhut
- %WINDIR%\jknolpznhrisa\eblbwcpo
- C:\jknolpznhrisa\eblbwcpo
- C:\jknolpznhrisa\eiyphsy2q80piltxsgihhr.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\jknolpznhrisa\lxzvkowcanav.exe
- C:\jknolpznhrisa\jzwlfictw4f.exe
Удаляет следующие файлы:
- C:\jknolpznhrisa\eiyphsy2q80piltxsgihhr.exe
- %WINDIR%\jknolpznhrisa\eblbwcpo
Подменяет следующие файлы:
- %WINDIR%\jknolpznhrisa\eblbwcpo
Сетевая активность:
Подключается к:
- 'ch#####taatterberry.net':80
- 'ka#####rarichardson.net':80
- 'ka#####raatterberry.net':80
- 'ka#####raunderwood.net':80
- 'ch#####taunderwood.net':80
- 'co#####ceunderwood.net':80
- 'ha#####taunderwood.net':80
- 'ch#####tapatrickson.net':80
- 'ch#####tarichardson.net':80
- 'ka#####rapatrickson.net':80
- 'ma#####anpatrickson.net':80
- 'pr#####launderwood.net':80
- 'ma#####anunderwood.net':80
- 'de#####stpatrickson.net':80
- 'de#####strichardson.net':80
- 'la#####iapatrickson.net':80
- 'ma#####anrichardson.net':80
- 'pr#####lapatrickson.net':80
- 'pr#####larichardson.net':80
- 'pr#####laatterberry.net':80
- 'ma#####anatterberry.net':80
- 'ja#####ynunderwood.net':80
- 'cr#####onunderwood.net':80
- 'ro#####nepatrickson.net':80
- 'ro#####nerichardson.net':80
- 'ja#####tapatrickson.net':80
- 'cr#####onrichardson.net':80
- 'ja#####ynpatrickson.net':80
- 'ja#####ynrichardson.net':80
- 'ja#####ynatterberry.net':80
- 'cr#####onatterberry.net':80
- 'ja#####tarichardson.net':80
- 'ha#####tarichardson.net':80
- 'co#####cepatrickson.net':80
- 'co#####cerichardson.net':80
- 'co#####ceatterberry.net':80
- 'ha#####taatterberry.net':80
- 'ja#####taatterberry.net':80
- 'ro#####neatterberry.net':80
- 'ro#####neunderwood.net':80
- 'ha#####tapatrickson.net':80
- 'ja#####taunderwood.net':80
TCP:
Запросы HTTP GET:
- http://ch#####taatterberry.net/index.php
- http://ka#####rarichardson.net/index.php
- http://ka#####raatterberry.net/index.php
- http://ka#####raunderwood.net/index.php
- http://ch#####taunderwood.net/index.php
- http://co#####ceunderwood.net/index.php
- http://ha#####taunderwood.net/index.php
- http://ch#####tapatrickson.net/index.php
- http://ch#####tarichardson.net/index.php
- http://ka#####rapatrickson.net/index.php
- http://ma#####anpatrickson.net/index.php
- http://pr#####launderwood.net/index.php
- http://ma#####anunderwood.net/index.php
- http://de#####stpatrickson.net/index.php
- http://de#####strichardson.net/index.php
- http://la#####iapatrickson.net/index.php
- http://ma#####anrichardson.net/index.php
- http://pr#####lapatrickson.net/index.php
- http://pr#####larichardson.net/index.php
- http://pr#####laatterberry.net/index.php
- http://ma#####anatterberry.net/index.php
- http://ja#####ynunderwood.net/index.php
- http://cr#####onunderwood.net/index.php
- http://ro#####nepatrickson.net/index.php
- http://ro#####nerichardson.net/index.php
- http://ja#####tapatrickson.net/index.php
- http://cr#####onrichardson.net/index.php
- http://ja#####ynpatrickson.net/index.php
- http://ja#####ynrichardson.net/index.php
- http://ja#####ynatterberry.net/index.php
- http://cr#####onatterberry.net/index.php
- http://ja#####tarichardson.net/index.php
- http://ha#####tarichardson.net/index.php
- http://co#####cepatrickson.net/index.php
- http://co#####cerichardson.net/index.php
- http://co#####ceatterberry.net/index.php
- http://ha#####taatterberry.net/index.php
- http://ja#####taatterberry.net/index.php
- http://ro#####neatterberry.net/index.php
- http://ro#####neunderwood.net/index.php
- http://ha#####tapatrickson.net/index.php
- http://ja#####taunderwood.net/index.php
UDP:
- DNS ASK ka#####raatterberry.net
- DNS ASK ch#####taatterberry.net
- DNS ASK ch#####taunderwood.net
- DNS ASK ma#####anpatrickson.net
- DNS ASK ka#####raunderwood.net
- DNS ASK ch#####tapatrickson.net
- DNS ASK co#####ceunderwood.net
- DNS ASK ka#####rapatrickson.net
- DNS ASK ka#####rarichardson.net
- DNS ASK ch#####tarichardson.net
- DNS ASK pr#####lapatrickson.net
- DNS ASK de#####stpatrickson.net
- DNS ASK pr#####launderwood.net
- DNS ASK la#####iapatrickson.net
- DNS ASK la#####iarichardson.net
- DNS ASK de#####strichardson.net
- DNS ASK pr#####larichardson.net
- DNS ASK ma#####anrichardson.net
- DNS ASK ma#####anatterberry.net
- DNS ASK ma#####anunderwood.net
- DNS ASK pr#####laatterberry.net
- DNS ASK ha#####taunderwood.net
- DNS ASK ja#####ynunderwood.net
- DNS ASK cr#####onunderwood.net
- DNS ASK ro#####nepatrickson.net
- DNS ASK ro#####nerichardson.net
- DNS ASK ja#####tapatrickson.net
- DNS ASK cr#####onrichardson.net
- DNS ASK ja#####ynpatrickson.net
- DNS ASK ja#####ynrichardson.net
- DNS ASK ja#####ynatterberry.net
- DNS ASK cr#####onatterberry.net
- DNS ASK ja#####tarichardson.net
- DNS ASK ha#####tarichardson.net
- DNS ASK co#####cepatrickson.net
- DNS ASK co#####cerichardson.net
- DNS ASK co#####ceatterberry.net
- DNS ASK ha#####taatterberry.net
- DNS ASK ja#####taatterberry.net
- DNS ASK ro#####neatterberry.net
- DNS ASK ro#####neunderwood.net
- DNS ASK ha#####tapatrickson.net
- DNS ASK ja#####taunderwood.net
