Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Keying WebClient VC Machine Media Play Logon' = 'C:\shesgx6\nidox3jqbfk.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Class Log Cryptographic Driver] 'ImagePath' = 'C:\shesgx6\nidox3jqbfk.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Class Log Cryptographic Driver] 'Start' = '00000002'
Вредоносные функции:
Запускает на исполнение:
- 'C:\shesgx6\feqqljmz.exe' "c:\shesgx6\nidox3jqbfk.exe"
- 'C:\shesgx6\nidox3jqbfk.exe'
- 'C:\shesgx6\qgiijp2y4bxju4hsvxfwqa.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\shesgx6\nidox3jqbfk.exe
- C:\shesgx6\feqqljmz.exe
- C:\shesgx6\hki2eqs
- %WINDIR%\shesgx6\yklqfuplnqyq
- C:\shesgx6\yklqfuplnqyq
- C:\shesgx6\qgiijp2y4bxju4hsvxfwqa.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\shesgx6\feqqljmz.exe
- C:\shesgx6\nidox3jqbfk.exe
Удаляет следующие файлы:
- C:\shesgx6\qgiijp2y4bxju4hsvxfwqa.exe
- %WINDIR%\shesgx6\yklqfuplnqyq
Подменяет следующие файлы:
- %WINDIR%\shesgx6\yklqfuplnqyq
Сетевая активность:
Подключается к:
- 'ma#####naterrence.net':80
- 'al#####rajohnathon.net':80
- 'al#####raterrence.net':80
- 'al#####rakatherine.net':80
- 'ma#####nakatherine.net':80
- 'ma#####najohnathon.net':80
- 'ka#####nekatherine.net':80
- 'al#####erterrence.net':80
- 'al#####erkatherine.net':80
- 'al#####erbethanie.net':80
- 'ka#####nebethanie.net':80
- 'ce#####nekatherine.net':80
- 'am#####nekatherine.net':80
- 'am#####nebethanie.net':80
- 'ch#####nejohnathon.net':80
- 'ce#####nebethanie.net':80
- 'ce#####neterrence.net':80
- 'al#####rabethanie.net':80
- 'ma#####nabethanie.net':80
- 'am#####nejohnathon.net':80
- 'am#####neterrence.net':80
- 'ce#####nejohnathon.net':80
- 'an######ewitherspoon.net':80
- 'gu#####entollemache.net':80
- 'gu######nwitherspoon.net':80
- 'gu#####enauttenberg.net':80
- 'an#####leauttenberg.net':80
- 'an#####letollemache.net':80
- 'ge#####naauttenberg.net':80
- 'ch######ewitherspoon.net':80
- 'ch#####leauttenberg.net':80
- 'gu######ndwerryhouse.net':80
- 'an######edwerryhouse.net':80
- 'ch#####anauttenberg.net':80
- 'gw#####reauttenberg.net':80
- 'ka#####nejohnathon.net':80
- 'ka#####neterrence.net':80
- 'al#####erjohnathon.net':80
- 'ch######nwitherspoon.net':80
- 'ch######ndwerryhouse.net':80
- 'gw######edwerryhouse.net':80
- 'gw#####retollemache.net':80
- 'gw######ewitherspoon.net':80
- 'ch#####antollemache.net':80
TCP:
Запросы HTTP GET:
- http://ma#####naterrence.net/index.php
- http://al#####rajohnathon.net/index.php
- http://al#####raterrence.net/index.php
- http://al#####rakatherine.net/index.php
- http://ma#####nakatherine.net/index.php
- http://ma#####najohnathon.net/index.php
- http://ka#####nekatherine.net/index.php
- http://al#####erterrence.net/index.php
- http://al#####erkatherine.net/index.php
- http://al#####erbethanie.net/index.php
- http://ka#####nebethanie.net/index.php
- http://ce#####nekatherine.net/index.php
- http://am#####nekatherine.net/index.php
- http://am#####nebethanie.net/index.php
- http://ch#####nejohnathon.net/index.php
- http://ce#####nebethanie.net/index.php
- http://ce#####neterrence.net/index.php
- http://al#####rabethanie.net/index.php
- http://ma#####nabethanie.net/index.php
- http://am#####nejohnathon.net/index.php
- http://am#####neterrence.net/index.php
- http://ce#####nejohnathon.net/index.php
- http://an######ewitherspoon.net/index.php
- http://gu#####entollemache.net/index.php
- http://gu######nwitherspoon.net/index.php
- http://gu#####enauttenberg.net/index.php
- http://an#####leauttenberg.net/index.php
- http://an#####letollemache.net/index.php
- http://ge#####naauttenberg.net/index.php
- http://ch######ewitherspoon.net/index.php
- http://ch#####leauttenberg.net/index.php
- http://gu######ndwerryhouse.net/index.php
- http://an######edwerryhouse.net/index.php
- http://ch#####anauttenberg.net/index.php
- http://gw#####reauttenberg.net/index.php
- http://ka#####nejohnathon.net/index.php
- http://ka#####neterrence.net/index.php
- http://al#####erjohnathon.net/index.php
- http://ch######nwitherspoon.net/index.php
- http://ch######ndwerryhouse.net/index.php
- http://gw######edwerryhouse.net/index.php
- http://gw#####retollemache.net/index.php
- http://gw######ewitherspoon.net/index.php
- http://ch#####antollemache.net/index.php
UDP:
- DNS ASK al#####raterrence.net
- DNS ASK ma#####naterrence.net
- DNS ASK ma#####nakatherine.net
- DNS ASK ma#####nabethanie.net
- DNS ASK al#####rakatherine.net
- DNS ASK al#####rajohnathon.net
- DNS ASK al#####erkatherine.net
- DNS ASK ka#####nekatherine.net
- DNS ASK ka#####nebethanie.net
- DNS ASK ma#####najohnathon.net
- DNS ASK al#####erbethanie.net
- DNS ASK am#####nebethanie.net
- DNS ASK ce#####nekatherine.net
- DNS ASK ce#####nebethanie.net
- DNS ASK sh#####lejohnathon.net
- DNS ASK ch#####nejohnathon.net
- DNS ASK am#####nekatherine.net
- DNS ASK am#####nejohnathon.net
- DNS ASK al#####rabethanie.net
- DNS ASK ce#####nejohnathon.net
- DNS ASK ce#####neterrence.net
- DNS ASK am#####neterrence.net
- DNS ASK al#####erterrence.net
- DNS ASK an######ewitherspoon.net
- DNS ASK gu#####entollemache.net
- DNS ASK gu######nwitherspoon.net
- DNS ASK gu#####enauttenberg.net
- DNS ASK an#####leauttenberg.net
- DNS ASK an#####letollemache.net
- DNS ASK ge#####naauttenberg.net
- DNS ASK ch######ewitherspoon.net
- DNS ASK ch#####leauttenberg.net
- DNS ASK gu######ndwerryhouse.net
- DNS ASK an######edwerryhouse.net
- DNS ASK ch#####anauttenberg.net
- DNS ASK gw#####reauttenberg.net
- DNS ASK ka#####nejohnathon.net
- DNS ASK ka#####neterrence.net
- DNS ASK al#####erjohnathon.net
- DNS ASK ch######nwitherspoon.net
- DNS ASK ch######ndwerryhouse.net
- DNS ASK gw######edwerryhouse.net
- DNS ASK gw#####retollemache.net
- DNS ASK gw######ewitherspoon.net
- DNS ASK ch#####antollemache.net
