Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Bluetooth Card Source CardSpace Receiver' = '<SYSTEM32>\brkpsqqr.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Installer Alerts Cryptographic Thread Builder] 'ImagePath' = '<SYSTEM32>\brkpsqqr.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Installer Alerts Cryptographic Thread Builder] 'Start' = '00000002'
Вредоносные функции:
Для затруднения выявления своего присутствия в системе
блокирует:
- Центр обеспечения безопасности (Security Center)
Запускает на исполнение:
- '<SYSTEM32>\bwxbncf.exe' "<SYSTEM32>\brkpsqqr.exe"
- '%WINDIR%\Temp\vswmnwws5let7eic.exe' -r 31202 tcp
- '%TEMP%\vswmnwwn8qdpdeiccxjljlif.exe'
- '<SYSTEM32>\brkpsqqr.exe'
Изменения в файловой системе:
Создает следующие файлы:
- <SYSTEM32>\jvhususebzumbyn\run
- <SYSTEM32>\jvhususebzumbyn\rng
- %WINDIR%\Temp\vswmnwws5let7eic.exe
- <SYSTEM32>\jvhususebzumbyn\cfg
- %TEMP%\vswmnwwn8qdpdeiccxjljlif.exe
- <SYSTEM32>\jvhususebzumbyn\tst
- <SYSTEM32>\bwxbncf.exe
- <SYSTEM32>\brkpsqqr.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- <SYSTEM32>\bwxbncf.exe
- <SYSTEM32>\brkpsqqr.exe
Удаляет следующие файлы:
- %WINDIR%\Temp\vswmnwws5let7eic.exe
- %TEMP%\vswmnwwn8qdpdeiccxjljlif.exe
Сетевая активность:
Подключается к:
- 'lo####thepings.ru':80
- 'so###make.net':80
- 'ri###nstorm.net':80
- '18#.#17.73.77':80
- '18#.#06.120.168':80
TCP:
Запросы HTTP GET:
- http://lo####thepings.ru/index.php
- http://so###make.net/index.php
- http://ri###nstorm.net/index.php
- http://18#.#17.73.77/index.php
- http://18#.#06.120.168/index.php
UDP:
- DNS ASK ri###ifth.net
- DNS ASK ri###ifth.ru
- DNS ASK fa###fifth.net
- DNS ASK fa###shine.net
- DNS ASK ri###hine.net
- DNS ASK no###hine.ru
- DNS ASK no###hine.net
- DNS ASK li###ifth.ru
- DNS ASK no###one.net
- DNS ASK no###new.net
- DNS ASK no##knew.ru
- DNS ASK so###each.ru
- DNS ASK fi###feet.net
- DNS ASK so###each.net
- DNS ASK so####esterday.net
- DNS ASK fi###each.net
- DNS ASK so###feet.net
- DNS ASK fa###done.ru
- DNS ASK ri###one.net
- DNS ASK fa###done.net
- DNS ASK fa###knew.net
- DNS ASK ri###new.net
- DNS ASK no###ifth.net
- DNS ASK le###hine.net
- DNS ASK ta###shine.net
- DNS ASK ta###done.net
- DNS ASK ta###knew.net
- DNS ASK le###one.net
- DNS ASK ta###shine.ru
- DNS ASK fe###new.net
- DNS ASK we###one.net
- DNS ASK we###new.net
- DNS ASK le###ifth.net
- DNS ASK ta###fifth.net
- DNS ASK ca###one.net
- DNS ASK po###done.ru
- DNS ASK po###done.net
- DNS ASK ca###new.net
- DNS ASK po###knew.net
- DNS ASK ca###hine.net
- DNS ASK le###new.net
- DNS ASK le##knew.ru
- DNS ASK po###fifth.net
- DNS ASK po###shine.net
- DNS ASK ca###ifth.net
- DNS ASK ta###wedge.net
- DNS ASK le####sterday.net
- DNS ASK le###edge.net
- DNS ASK po###feet.net
- DNS ASK po###feet.ru
- DNS ASK ta####esterday.net
- DNS ASK le###eet.net
- DNS ASK ta###feet.net
- DNS ASK ta###each.net
- DNS ASK le###ach.net
- DNS ASK le##each.ru
- DNS ASK no###eet.net
- DNS ASK po###wedge.net
- DNS ASK ca###edge.net
- DNS ASK no###ach.net
- DNS ASK no##each.ru
- DNS ASK ca####sterday.net
- DNS ASK po###each.net
- DNS ASK ca###eet.net
- DNS ASK ca###ach.net
- DNS ASK ca####sterday.ru
- DNS ASK po####esterday.net
- DNS ASK we###edge.net
- DNS ASK li###ach.net
- DNS ASK th###each.net
- DNS ASK th####esterday.ru
- DNS ASK li####sterday.net
- DNS ASK th####esterday.net
- DNS ASK li###eet.net
- DNS ASK so###wedge.net
- DNS ASK fi####esterday.net
- DNS ASK fi###wedge.ru
- DNS ASK th###feet.net
- DNS ASK fi###wedge.net
- DNS ASK fe####sterday.net
- DNS ASK we###ach.net
- DNS ASK we####sterday.net
- DNS ASK fe###edge.net
- DNS ASK fe###edge.ru
- DNS ASK fe###ach.net
- DNS ASK li###edge.net
- DNS ASK th###wedge.net
- DNS ASK fe###eet.net
- DNS ASK we###eet.net
- DNS ASK we##feet.ru
- DNS ASK no####sterday.net
- DNS ASK ta###rush.ru
- DNS ASK fe###ush.net
- DNS ASK le###ard.net
- DNS ASK ta###hard.net
- DNS ASK ta###clock.net
- DNS ASK po###hard.net
- DNS ASK le###ake.net
- DNS ASK po###clock.net
- DNS ASK li###ush.net
- DNS ASK fe###ake.net
- DNS ASK ta###rush.net
- DNS ASK le###lock.net
- DNS ASK ta###make.net
- DNS ASK we###ush.net
- DNS ASK po###make.net
- DNS ASK ca###lock.net
- DNS ASK le###ush.net
- DNS ASK fe##make.ru
- DNS ASK le##hard.ru
- DNS ASK fe###ard.net
- DNS ASK we###ard.net
- DNS ASK ca###lock.ru
- DNS ASK we###lock.net
- DNS ASK fi###make.ru
- DNS ASK fi###make.net
- DNS ASK fi###rush.net
- DNS ASK th###hard.net
- DNS ASK so###rush.net
- DNS ASK so###clock.net
- DNS ASK ri###nstorm.net
- DNS ASK we##done.ru
- DNS ASK lo####thepings.ru
- DNS ASK fi###clock.net
- DNS ASK so###make.net
- DNS ASK th###make.net
- DNS ASK ca###ard.net
- DNS ASK th###clock.net
- DNS ASK li###ake.net
- DNS ASK li###lock.net
- DNS ASK li##rush.ru
- DNS ASK li###ard.net
- DNS ASK th###clock.ru
- DNS ASK we###ake.net
- DNS ASK fe###lock.net
- DNS ASK th###rush.net
- DNS ASK th###fifth.net
- DNS ASK fi###knew.net
- DNS ASK li###ifth.net
- DNS ASK li###hine.ru
- DNS ASK th###shine.net
- DNS ASK so###knew.net
- DNS ASK fi###shine.net
- DNS ASK so###shine.net
- DNS ASK so###done.net
- DNS ASK so###knew.ru
- DNS ASK fi###done.net
- DNS ASK we###ifth.net
- DNS ASK fe###ifth.net
- DNS ASK fe###hine.net
- DNS ASK fe###one.net
- DNS ASK we###hine.net
- DNS ASK fe###ifth.ru
- DNS ASK th###done.net
- DNS ASK li###hine.net
- DNS ASK li###one.net
- DNS ASK li###new.net
- DNS ASK th###knew.net
- DNS ASK fi###fifth.net
- DNS ASK li##make.ru
- DNS ASK no###ake.net
- DNS ASK no###ush.net
- DNS ASK no##rush.ru
- DNS ASK we###lock.ru
- DNS ASK no###lock.net
- DNS ASK po###rush.net
- DNS ASK ca###ake.net
- DNS ASK ca###ush.net
- DNS ASK no###ard.net
- DNS ASK no##hard.ru
- DNS ASK ri###ush.net
- DNS ASK fa###make.net
- DNS ASK fa###rush.net
- DNS ASK fi###fifth.ru
- DNS ASK so###fifth.net
- DNS ASK ri###ake.net
- DNS ASK fa###hard.net
- DNS ASK ri###ard.net
- DNS ASK ri###lock.net
- DNS ASK ri##make.ru
- DNS ASK fa###clock.net
- '23#.#55.255.250':1900
