Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Interface Problem Location Server' = 'C:\ve4wvwsr\stieibl7xgp.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Transfer System Framework DNS] 'ImagePath' = 'C:\ve4wvwsr\stieibl7xgp.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Transfer System Framework DNS] 'Start' = '00000002'
Вредоносные функции:
Запускает на исполнение:
- 'C:\ve4wvwsr\lschwiomqrea.exe' "c:\ve4wvwsr\stieibl7xgp.exe"
- 'C:\ve4wvwsr\stieibl7xgp.exe'
- 'C:\ve4wvwsr\fcqdxvxc2q39disgfficp9ote.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\ve4wvwsr\stieibl7xgp.exe
- C:\ve4wvwsr\lschwiomqrea.exe
- C:\ve4wvwsr\womrzk
- %WINDIR%\ve4wvwsr\hinztv
- C:\ve4wvwsr\hinztv
- C:\ve4wvwsr\fcqdxvxc2q39disgfficp9ote.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\ve4wvwsr\lschwiomqrea.exe
- C:\ve4wvwsr\stieibl7xgp.exe
Удаляет следующие файлы:
- C:\ve4wvwsr\fcqdxvxc2q39disgfficp9ote.exe
- %WINDIR%\ve4wvwsr\hinztv
Подменяет следующие файлы:
- %WINDIR%\ve4wvwsr\hinztv
Сетевая активность:
Подключается к:
- 'si#####errowbottom.net':80
- 'gr#####lerowbottom.net':80
- 'si#####ercarpenter.net':80
- 'gr#####lecarpenter.net':80
- 'he#####ongranville.net':80
- 'kr#####lerupertson.net':80
- 'he#####oncarpenter.net':80
- 'kr#####legranville.net':80
- 'he#####onrupertson.net':80
- 'gr#####lerupertson.net':80
- 'an#####latittensor.net':80
- 'ga#####letittensor.net':80
- 'an#####lalongstaff.net':80
- 'ga#####lelongstaff.net':80
- 'an#####lacotterill.net':80
- 'gr#####legranville.net':80
- 'si#####errupertson.net':80
- 'ga#####lecotterill.net':80
- 'si#####ergranville.net':80
- 'br#####tegranville.net':80
- 'je#####onrupertson.net':80
- 'ce#####nerowbottom.net':80
- 'je#####ongranville.net':80
- 'br#####terupertson.net':80
- 'je#####onrowbottom.net':80
- 'br#####terowbottom.net':80
- 'je#####oncarpenter.net':80
- 'br#####tecarpenter.net':80
- 'th#####narowbottom.net':80
- 'kr#####lerowbottom.net':80
- 'th#####nagranville.net':80
- 'kr#####lecarpenter.net':80
- 'he#####onrowbottom.net':80
- 'ce#####negranville.net':80
- 'th#####nacarpenter.net':80
- 'ce#####necarpenter.net':80
- 'th#####narupertson.net':80
- 'ce#####nerupertson.net':80
- 'he#####tamillhouse.net':80
- 'ge#####nemillhouse.net':80
- 'je#####oncotterill.net':80
- 'br#####tecotterill.net':80
- 'he#####talongstaff.net':80
- 'ge#####netittensor.net':80
- 'he#####tacotterill.net':80
- 'ge#####nelongstaff.net':80
- 'he#####tatittensor.net':80
- 'br#####tetittensor.net':80
- 'th#####nacotterill.net':80
- 'ce#####necotterill.net':80
- 'th#####natittensor.net':80
- 'ce#####netittensor.net':80
- 'je#####onmillhouse.net':80
- 'br#####telongstaff.net':80
- 'je#####ontittensor.net':80
- 'br#####temillhouse.net':80
- 'je#####onlongstaff.net':80
- 'ga#####lalongstaff.net':80
- 'br#####iatittensor.net':80
- 'ga#####lamillhouse.net':80
- 'br#####ialongstaff.net':80
- 'ga#####latittensor.net':80
- 'an#####lamillhouse.net':80
- 'ga#####lemillhouse.net':80
- 'br#####iacotterill.net':80
- 'ga#####lacotterill.net':80
- 'br#####iamillhouse.net':80
- 'sh#####lemillhouse.net':80
- 'gr#####orlongstaff.net':80
- 'ge#####necotterill.net':80
- 'gr#####ormillhouse.net':80
- 'sh#####lelongstaff.net':80
- 'gr#####orcotterill.net':80
- 'sh#####lecotterill.net':80
- 'gr#####ortittensor.net':80
- 'sh#####letittensor.net':80
TCP:
Запросы HTTP GET:
- http://si#####errowbottom.net/index.php
- http://gr#####lerowbottom.net/index.php
- http://si#####ercarpenter.net/index.php
- http://gr#####lecarpenter.net/index.php
- http://he#####ongranville.net/index.php
- http://kr#####lerupertson.net/index.php
- http://he#####oncarpenter.net/index.php
- http://kr#####legranville.net/index.php
- http://he#####onrupertson.net/index.php
- http://gr#####lerupertson.net/index.php
- http://an#####latittensor.net/index.php
- http://ga#####letittensor.net/index.php
- http://an#####lalongstaff.net/index.php
- http://ga#####lelongstaff.net/index.php
- http://an#####lacotterill.net/index.php
- http://gr#####legranville.net/index.php
- http://si#####errupertson.net/index.php
- http://ga#####lecotterill.net/index.php
- http://si#####ergranville.net/index.php
- http://br#####tegranville.net/index.php
- http://je#####onrupertson.net/index.php
- http://ce#####nerowbottom.net/index.php
- http://je#####ongranville.net/index.php
- http://br#####terupertson.net/index.php
- http://je#####onrowbottom.net/index.php
- http://br#####terowbottom.net/index.php
- http://je#####oncarpenter.net/index.php
- http://br#####tecarpenter.net/index.php
- http://th#####narowbottom.net/index.php
- http://kr#####lerowbottom.net/index.php
- http://th#####nagranville.net/index.php
- http://kr#####lecarpenter.net/index.php
- http://he#####onrowbottom.net/index.php
- http://ce#####negranville.net/index.php
- http://th#####nacarpenter.net/index.php
- http://ce#####necarpenter.net/index.php
- http://th#####narupertson.net/index.php
- http://ce#####nerupertson.net/index.php
- http://he#####tamillhouse.net/index.php
- http://ge#####nemillhouse.net/index.php
- http://je#####oncotterill.net/index.php
- http://br#####tecotterill.net/index.php
- http://he#####talongstaff.net/index.php
- http://ge#####netittensor.net/index.php
- http://he#####tacotterill.net/index.php
- http://ge#####nelongstaff.net/index.php
- http://he#####tatittensor.net/index.php
- http://br#####tetittensor.net/index.php
- http://th#####nacotterill.net/index.php
- http://ce#####necotterill.net/index.php
- http://th#####natittensor.net/index.php
- http://ce#####netittensor.net/index.php
- http://je#####onmillhouse.net/index.php
- http://br#####telongstaff.net/index.php
- http://je#####ontittensor.net/index.php
- http://br#####temillhouse.net/index.php
- http://je#####onlongstaff.net/index.php
- http://ga#####lalongstaff.net/index.php
- http://br#####iatittensor.net/index.php
- http://ga#####lamillhouse.net/index.php
- http://br#####ialongstaff.net/index.php
- http://ga#####latittensor.net/index.php
- http://an#####lamillhouse.net/index.php
- http://ga#####lemillhouse.net/index.php
- http://br#####iacotterill.net/index.php
- http://ga#####lacotterill.net/index.php
- http://br#####iamillhouse.net/index.php
- http://sh#####lemillhouse.net/index.php
- http://gr#####orlongstaff.net/index.php
- http://ge#####necotterill.net/index.php
- http://gr#####ormillhouse.net/index.php
- http://sh#####lelongstaff.net/index.php
- http://gr#####orcotterill.net/index.php
- http://sh#####lecotterill.net/index.php
- http://gr#####ortittensor.net/index.php
- http://sh#####letittensor.net/index.php
UDP:
- DNS ASK gr#####lerowbottom.net
- DNS ASK he#####ongranville.net
- DNS ASK gr#####lecarpenter.net
- DNS ASK si#####errowbottom.net
- DNS ASK kr#####legranville.net
- DNS ASK he#####oncarpenter.net
- DNS ASK kr#####lecarpenter.net
- DNS ASK he#####onrupertson.net
- DNS ASK kr#####lerupertson.net
- DNS ASK si#####ercarpenter.net
- DNS ASK ga#####letittensor.net
- DNS ASK an#####lacotterill.net
- DNS ASK ga#####lelongstaff.net
- DNS ASK an#####latittensor.net
- DNS ASK ga#####lecotterill.net
- DNS ASK si#####errupertson.net
- DNS ASK gr#####lerupertson.net
- DNS ASK si#####ergranville.net
- DNS ASK gr#####legranville.net
- DNS ASK je#####onrupertson.net
- DNS ASK br#####terupertson.net
- DNS ASK je#####ongranville.net
- DNS ASK br#####tegranville.net
- DNS ASK je#####oncarpenter.net
- DNS ASK br#####terowbottom.net
- DNS ASK he#####tagranville.net
- DNS ASK br#####tecarpenter.net
- DNS ASK je#####onrowbottom.net
- DNS ASK ce#####nerowbottom.net
- DNS ASK th#####nagranville.net
- DNS ASK ce#####negranville.net
- DNS ASK he#####onrowbottom.net
- DNS ASK kr#####lerowbottom.net
- DNS ASK th#####narupertson.net
- DNS ASK ce#####necarpenter.net
- DNS ASK th#####narowbottom.net
- DNS ASK ce#####nerupertson.net
- DNS ASK th#####nacarpenter.net
- DNS ASK an#####lalongstaff.net
- DNS ASK he#####tamillhouse.net
- DNS ASK ge#####nemillhouse.net
- DNS ASK je#####oncotterill.net
- DNS ASK br#####tecotterill.net
- DNS ASK he#####talongstaff.net
- DNS ASK ge#####netittensor.net
- DNS ASK he#####tacotterill.net
- DNS ASK ge#####nelongstaff.net
- DNS ASK he#####tatittensor.net
- DNS ASK br#####tetittensor.net
- DNS ASK th#####nacotterill.net
- DNS ASK ce#####necotterill.net
- DNS ASK th#####natittensor.net
- DNS ASK ce#####netittensor.net
- DNS ASK je#####onmillhouse.net
- DNS ASK br#####telongstaff.net
- DNS ASK je#####ontittensor.net
- DNS ASK br#####temillhouse.net
- DNS ASK je#####onlongstaff.net
- DNS ASK ga#####lalongstaff.net
- DNS ASK br#####iatittensor.net
- DNS ASK ga#####lamillhouse.net
- DNS ASK br#####ialongstaff.net
- DNS ASK ga#####latittensor.net
- DNS ASK an#####lamillhouse.net
- DNS ASK ga#####lemillhouse.net
- DNS ASK br#####iacotterill.net
- DNS ASK ga#####lacotterill.net
- DNS ASK br#####iamillhouse.net
- DNS ASK sh#####lemillhouse.net
- DNS ASK gr#####orlongstaff.net
- DNS ASK ge#####necotterill.net
- DNS ASK gr#####ormillhouse.net
- DNS ASK sh#####lelongstaff.net
- DNS ASK gr#####orcotterill.net
- DNS ASK sh#####lecotterill.net
- DNS ASK gr#####ortittensor.net
- DNS ASK sh#####letittensor.net
