Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Sharing Base Registry Registrar Software' = 'C:\s3xutabwdeq\nvy51f3wz0.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Font Log Ordering Solutions Cache Parental] 'ImagePath' = 'C:\s3xutabwdeq\nvy51f3wz0.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Font Log Ordering Solutions Cache Parental] 'Start' = '00000002'
Вредоносные функции:
Запускает на исполнение:
- 'C:\s3xutabwdeq\m3j2w2cq.exe' "c:\s3xutabwdeq\nvy51f3wz0.exe"
- 'C:\s3xutabwdeq\nvy51f3wz0.exe'
- 'C:\s3xutabwdeq\unqefl7l2rb3decopqrob.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\s3xutabwdeq\nvy51f3wz0.exe
- C:\s3xutabwdeq\m3j2w2cq.exe
- C:\s3xutabwdeq\fskt2ct0
- %WINDIR%\s3xutabwdeq\ofxuggipb
- C:\s3xutabwdeq\ofxuggipb
- C:\s3xutabwdeq\unqefl7l2rb3decopqrob.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\s3xutabwdeq\m3j2w2cq.exe
- C:\s3xutabwdeq\nvy51f3wz0.exe
Удаляет следующие файлы:
- C:\s3xutabwdeq\unqefl7l2rb3decopqrob.exe
- %WINDIR%\s3xutabwdeq\ofxuggipb
Подменяет следующие файлы:
- %WINDIR%\s3xutabwdeq\ofxuggipb
Сетевая активность:
Подключается к:
- 'gr#####orroyceston.net':80
- 'sh#####lesouthgate.net':80
- 'gr#####orsouthgate.net':80
- 'sh#####leroyceston.net':80
- 'br#####iaarkwright.net':80
- 'ga#####lahoneysett.net':80
- 'br#####iahoneysett.net':80
- 'ge#####neroyceston.net':80
- 'he#####taroyceston.net':80
- 'ge#####nesouthgate.net':80
- 'gr#####orhoneysett.net':80
- 'sh#####learkwright.net':80
- 'gr#####orarkwright.net':80
- 'sh#####lehoneysett.net':80
- 'ga#####laarkwright.net':80
- 'ga#####lesouthgate.net':80
- 'an#####lasouthgate.net':80
- 'ga#####learkwright.net':80
- 'an#####laroyceston.net':80
- 'gr#####lesymphony.net':80
- 'si#####ersymphony.net':80
- 'ga#####leroyceston.net':80
- 'br#####iaroyceston.net':80
- 'ga#####lasouthgate.net':80
- 'br#####iasouthgate.net':80
- 'ga#####laroyceston.net':80
- 'an#####laarkwright.net':80
- 'ga#####lehoneysett.net':80
- 'an#####lahoneysett.net':80
- 'ce#####nehoneysett.net':80
- 'th#####nahoneysett.net':80
- 'kr#####leroyceston.net':80
- 'th#####naarkwright.net':80
- 'ce#####nesouthgate.net':80
- 'th#####nasouthgate.net':80
- 'ce#####nearkwright.net':80
- 'he#####onarkwright.net':80
- 'kr#####lehoneysett.net':80
- 'he#####onhoneysett.net':80
- 'kr#####learkwright.net':80
- 'he#####onroyceston.net':80
- 'kr#####lesouthgate.net':80
- 'he#####onsouthgate.net':80
- 'th#####naroyceston.net':80
- 'he#####tahoneysett.net':80
- 'br#####teroyceston.net':80
- 'je#####onroyceston.net':80
- 'ge#####nehoneysett.net':80
- 'he#####tasouthgate.net':80
- 'ge#####nearkwright.net':80
- 'he#####taarkwright.net':80
- 'br#####tehoneysett.net':80
- 'je#####onhoneysett.net':80
- 'ce#####neroyceston.net':80
- 'je#####onarkwright.net':80
- 'br#####tesouthgate.net':80
- 'je#####onsouthgate.net':80
- 'br#####tearkwright.net':80
TCP:
Запросы HTTP GET:
- http://gr#####orroyceston.net/index.php
- http://sh#####lesouthgate.net/index.php
- http://gr#####orsouthgate.net/index.php
- http://sh#####leroyceston.net/index.php
- http://br#####iaarkwright.net/index.php
- http://ga#####lahoneysett.net/index.php
- http://br#####iahoneysett.net/index.php
- http://ge#####neroyceston.net/index.php
- http://he#####taroyceston.net/index.php
- http://ge#####nesouthgate.net/index.php
- http://gr#####orhoneysett.net/index.php
- http://sh#####learkwright.net/index.php
- http://gr#####orarkwright.net/index.php
- http://sh#####lehoneysett.net/index.php
- http://ga#####laarkwright.net/index.php
- http://ga#####lesouthgate.net/index.php
- http://an#####lasouthgate.net/index.php
- http://ga#####learkwright.net/index.php
- http://an#####laroyceston.net/index.php
- http://gr#####lesymphony.net/index.php
- http://si#####ersymphony.net/index.php
- http://ga#####leroyceston.net/index.php
- http://br#####iaroyceston.net/index.php
- http://ga#####lasouthgate.net/index.php
- http://br#####iasouthgate.net/index.php
- http://ga#####laroyceston.net/index.php
- http://an#####laarkwright.net/index.php
- http://ga#####lehoneysett.net/index.php
- http://an#####lahoneysett.net/index.php
- http://ce#####nehoneysett.net/index.php
- http://th#####nahoneysett.net/index.php
- http://kr#####leroyceston.net/index.php
- http://th#####naarkwright.net/index.php
- http://ce#####nesouthgate.net/index.php
- http://th#####nasouthgate.net/index.php
- http://ce#####nearkwright.net/index.php
- http://he#####onarkwright.net/index.php
- http://kr#####lehoneysett.net/index.php
- http://he#####onhoneysett.net/index.php
- http://kr#####learkwright.net/index.php
- http://he#####onroyceston.net/index.php
- http://kr#####lesouthgate.net/index.php
- http://he#####onsouthgate.net/index.php
- http://th#####naroyceston.net/index.php
- http://he#####tahoneysett.net/index.php
- http://br#####teroyceston.net/index.php
- http://je#####onroyceston.net/index.php
- http://ge#####nehoneysett.net/index.php
- http://he#####tasouthgate.net/index.php
- http://ge#####nearkwright.net/index.php
- http://he#####taarkwright.net/index.php
- http://br#####tehoneysett.net/index.php
- http://je#####onhoneysett.net/index.php
- http://ce#####neroyceston.net/index.php
- http://je#####onarkwright.net/index.php
- http://br#####tesouthgate.net/index.php
- http://je#####onsouthgate.net/index.php
- http://br#####tearkwright.net/index.php
UDP:
- DNS ASK sh#####leroyceston.net
- DNS ASK gr#####orroyceston.net
- DNS ASK sh#####lesouthgate.net
- DNS ASK br#####iahoneysett.net
- DNS ASK ga#####laarkwright.net
- DNS ASK br#####iaarkwright.net
- DNS ASK ga#####lahoneysett.net
- DNS ASK gr#####orhoneysett.net
- DNS ASK ge#####neroyceston.net
- DNS ASK he#####taroyceston.net
- DNS ASK sh#####lehoneysett.net
- DNS ASK gr#####orsouthgate.net
- DNS ASK sh#####learkwright.net
- DNS ASK gr#####orarkwright.net
- DNS ASK br#####iasouthgate.net
- DNS ASK an#####laroyceston.net
- DNS ASK ga#####lesouthgate.net
- DNS ASK an#####lasouthgate.net
- DNS ASK ga#####leroyceston.net
- DNS ASK si#####erkiersten.net
- DNS ASK gr#####lesymphony.net
- DNS ASK si#####ersymphony.net
- DNS ASK ga#####laroyceston.net
- DNS ASK br#####iaroyceston.net
- DNS ASK ga#####lasouthgate.net
- DNS ASK an#####lahoneysett.net
- DNS ASK ga#####learkwright.net
- DNS ASK an#####laarkwright.net
- DNS ASK ga#####lehoneysett.net
- DNS ASK ge#####nesouthgate.net
- DNS ASK ce#####nehoneysett.net
- DNS ASK th#####nahoneysett.net
- DNS ASK kr#####leroyceston.net
- DNS ASK th#####naarkwright.net
- DNS ASK ce#####nesouthgate.net
- DNS ASK th#####nasouthgate.net
- DNS ASK ce#####nearkwright.net
- DNS ASK he#####onarkwright.net
- DNS ASK kr#####lehoneysett.net
- DNS ASK he#####onhoneysett.net
- DNS ASK kr#####learkwright.net
- DNS ASK he#####onroyceston.net
- DNS ASK kr#####lesouthgate.net
- DNS ASK he#####onsouthgate.net
- DNS ASK th#####naroyceston.net
- DNS ASK he#####tahoneysett.net
- DNS ASK br#####teroyceston.net
- DNS ASK je#####onroyceston.net
- DNS ASK ge#####nehoneysett.net
- DNS ASK he#####tasouthgate.net
- DNS ASK ge#####nearkwright.net
- DNS ASK he#####taarkwright.net
- DNS ASK br#####tehoneysett.net
- DNS ASK je#####onhoneysett.net
- DNS ASK ce#####neroyceston.net
- DNS ASK je#####onarkwright.net
- DNS ASK br#####tesouthgate.net
- DNS ASK je#####onsouthgate.net
- DNS ASK br#####tearkwright.net
