Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'NetBIOS Network Desktop' = 'C:\uci0r5ujxn3\wwspmbojo.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Engine IKE Error Mapper Font Video] 'ImagePath' = 'C:\uci0r5ujxn3\wwspmbojo.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Engine IKE Error Mapper Font Video] 'Start' = '00000002'
Вредоносные функции:
Запускает на исполнение:
- 'C:\uci0r5ujxn3\zzthoj1.exe' "c:\uci0r5ujxn3\wwspmbojo.exe"
- 'C:\uci0r5ujxn3\wwspmbojo.exe'
- 'C:\uci0r5ujxn3\cocewhc2ts2uxeqbtqkoxcx.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\uci0r5ujxn3\wwspmbojo.exe
- C:\uci0r5ujxn3\zzthoj1.exe
- C:\uci0r5ujxn3\biaivtnk
- %WINDIR%\uci0r5ujxn3\uwhhymafhrw
- C:\uci0r5ujxn3\uwhhymafhrw
- C:\uci0r5ujxn3\cocewhc2ts2uxeqbtqkoxcx.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\uci0r5ujxn3\zzthoj1.exe
- C:\uci0r5ujxn3\wwspmbojo.exe
Удаляет следующие файлы:
- C:\uci0r5ujxn3\cocewhc2ts2uxeqbtqkoxcx.exe
- %WINDIR%\uci0r5ujxn3\uwhhymafhrw
Подменяет следующие файлы:
- %WINDIR%\uci0r5ujxn3\uwhhymafhrw
Сетевая активность:
Подключается к:
- 'br#####iasouthgate.net':80
- 'ga#####laarkwright.net':80
- 'br#####iaroyceston.net':80
- 'ga#####lasouthgate.net':80
- 'br#####iahoneysett.net':80
- 'sh#####leroyceston.net':80
- 'br#####iaarkwright.net':80
- 'ga#####lahoneysett.net':80
- 'an#####lasouthgate.net':80
- 'ga#####learkwright.net':80
- 'an#####laroyceston.net':80
- 'ga#####lesouthgate.net':80
- 'an#####lahoneysett.net':80
- 'ga#####laroyceston.net':80
- 'an#####laarkwright.net':80
- 'ga#####lehoneysett.net':80
- 'gr#####orroyceston.net':80
- 'ge#####nearkwright.net':80
- 'he#####taarkwright.net':80
- 'ge#####nesouthgate.net':80
- 'he#####tasouthgate.net':80
- 'br#####teroyceston.net':80
- 'je#####onroyceston.net':80
- 'ge#####nehoneysett.net':80
- 'he#####tahoneysett.net':80
- 'sh#####learkwright.net':80
- 'gr#####orarkwright.net':80
- 'sh#####lesouthgate.net':80
- 'gr#####orsouthgate.net':80
- 'ge#####neroyceston.net':80
- 'he#####taroyceston.net':80
- 'sh#####lehoneysett.net':80
- 'gr#####orhoneysett.net':80
TCP:
Запросы HTTP GET:
- http://br#####iasouthgate.net/index.php
- http://ga#####laarkwright.net/index.php
- http://br#####iaroyceston.net/index.php
- http://ga#####lasouthgate.net/index.php
- http://br#####iahoneysett.net/index.php
- http://sh#####leroyceston.net/index.php
- http://br#####iaarkwright.net/index.php
- http://ga#####lahoneysett.net/index.php
- http://an#####lasouthgate.net/index.php
- http://ga#####learkwright.net/index.php
- http://an#####laroyceston.net/index.php
- http://ga#####lesouthgate.net/index.php
- http://an#####lahoneysett.net/index.php
- http://ga#####laroyceston.net/index.php
- http://an#####laarkwright.net/index.php
- http://ga#####lehoneysett.net/index.php
- http://gr#####orroyceston.net/index.php
- http://ge#####nearkwright.net/index.php
- http://he#####taarkwright.net/index.php
- http://ge#####nesouthgate.net/index.php
- http://he#####tasouthgate.net/index.php
- http://br#####teroyceston.net/index.php
- http://je#####onroyceston.net/index.php
- http://ge#####nehoneysett.net/index.php
- http://he#####tahoneysett.net/index.php
- http://sh#####learkwright.net/index.php
- http://gr#####orarkwright.net/index.php
- http://sh#####lesouthgate.net/index.php
- http://gr#####orsouthgate.net/index.php
- http://ge#####neroyceston.net/index.php
- http://he#####taroyceston.net/index.php
- http://sh#####lehoneysett.net/index.php
- http://gr#####orhoneysett.net/index.php
UDP:
- DNS ASK br#####iasouthgate.net
- DNS ASK ga#####laarkwright.net
- DNS ASK br#####iaroyceston.net
- DNS ASK ga#####lasouthgate.net
- DNS ASK br#####iahoneysett.net
- DNS ASK sh#####leroyceston.net
- DNS ASK br#####iaarkwright.net
- DNS ASK ga#####lahoneysett.net
- DNS ASK ga#####laroyceston.net
- DNS ASK ga#####lesouthgate.net
- DNS ASK an#####lasouthgate.net
- DNS ASK ga#####leroyceston.net
- DNS ASK an#####laroyceston.net
- DNS ASK ga#####lehoneysett.net
- DNS ASK an#####lahoneysett.net
- DNS ASK ga#####learkwright.net
- DNS ASK an#####laarkwright.net
- DNS ASK ge#####nearkwright.net
- DNS ASK he#####taarkwright.net
- DNS ASK ge#####nesouthgate.net
- DNS ASK he#####tasouthgate.net
- DNS ASK br#####teroyceston.net
- DNS ASK je#####onroyceston.net
- DNS ASK ge#####nehoneysett.net
- DNS ASK he#####tahoneysett.net
- DNS ASK he#####taroyceston.net
- DNS ASK gr#####orsouthgate.net
- DNS ASK sh#####learkwright.net
- DNS ASK gr#####orroyceston.net
- DNS ASK sh#####lesouthgate.net
- DNS ASK gr#####orhoneysett.net
- DNS ASK ge#####neroyceston.net
- DNS ASK gr#####orarkwright.net
- DNS ASK sh#####lehoneysett.net
