Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'AutoConfig DCOM Multimedia Registry' = 'C:\afomttxk\sfiyreckki.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Windows Publication Remote Transaction CNG] 'ImagePath' = 'C:\afomttxk\sfiyreckki.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Windows Publication Remote Transaction CNG] 'Start' = '00000002'
Вредоносные функции:
Запускает на исполнение:
- 'C:\afomttxk\bfbgmvoir3.exe' "c:\afomttxk\sfiyreckki.exe"
- 'C:\afomttxk\sfiyreckki.exe'
- 'C:\afomttxk\zkiitvt37hjusflhrqy.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\afomttxk\sfiyreckki.exe
- C:\afomttxk\bfbgmvoir3.exe
- C:\afomttxk\kqkxke7xgtux
- %WINDIR%\afomttxk\vhwcpaid
- C:\afomttxk\vhwcpaid
- C:\afomttxk\zkiitvt37hjusflhrqy.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\afomttxk\bfbgmvoir3.exe
- C:\afomttxk\sfiyreckki.exe
Удаляет следующие файлы:
- C:\afomttxk\zkiitvt37hjusflhrqy.exe
- %WINDIR%\afomttxk\vhwcpaid
Подменяет следующие файлы:
- %WINDIR%\afomttxk\vhwcpaid
Сетевая активность:
Подключается к:
- 'sy#####ercartwright.net':80
- 'wi#####edcartwright.net':80
- 'sy######rbenjaminson.net':80
- 'wi######dblackbourne.net':80
- 'sy#####erchancellor.net':80
- 'wi#####edchancellor.net':80
- 'sy######rblackbourne.net':80
- 'ma######neblackbourne.net':80
- 'jo#####necartwright.net':80
- 'ma######necartwright.net':80
- 'jo######eblackbourne.net':80
- 'wi######dbenjaminson.net':80
- 'jo#####nechancellor.net':80
- 'ma######nechancellor.net':80
- 'gw######nbenjaminson.net':80
- 'ha######ebenjaminson.net':80
- 'br#####nnchancellor.net':80
- 'ha#####tecartwright.net':80
- 'gw######nblackbourne.net':80
- 'ha######eblackbourne.net':80
- 'gw#####yncartwright.net':80
- 'ka#####nacartwright.net':80
- 'br######nbenjaminson.net':80
- 'ka######abenjaminson.net':80
- 'br#####nncartwright.net':80
- 'ka#####nachancellor.net':80
- 'br######nblackbourne.net':80
- 'ka######ablackbourne.net':80
- 'jo######ebenjaminson.net':80
- 'ma#####nestrickland.net':80
- 'gr######ebreckenridge.net':80
- 'ma######ebreckenridge.net':80
- 'gr#####lestrickland.net':80
- 'si#####tewashington.net':80
- 'st######awinterbottom.net':80
- 'si######ewinterbottom.net':80
- 'ki#####eystrickland.net':80
- 'je#####testrickland.net':80
- 'ki######ybreckenridge.net':80
- 'ma######ewinterbottom.net':80
- 'gr#####lewashington.net':80
- 'ma#####newashington.net':80
- 'gr######ewinterbottom.net':80
- 'me######erblackbourne.net':80
- 'ca#####necartwright.net':80
- 'me######ercartwright.net':80
- 'ca######eblackbourne.net':80
- 'ma######nebenjaminson.net':80
- 'ca#####nechancellor.net':80
- 'me######erchancellor.net':80
- 'st######abreckenridge.net':80
- 'si######ebreckenridge.net':80
- 'st#####iawashington.net':80
- 'si#####testrickland.net':80
- 'ca######ebenjaminson.net':80
- 'me######erbenjaminson.net':80
- 'st#####iastrickland.net':80
TCP:
Запросы HTTP GET:
- http://sy#####ercartwright.net/index.php
- http://wi#####edcartwright.net/index.php
- http://sy######rbenjaminson.net/index.php
- http://wi######dblackbourne.net/index.php
- http://sy#####erchancellor.net/index.php
- http://wi#####edchancellor.net/index.php
- http://sy######rblackbourne.net/index.php
- http://ma######neblackbourne.net/index.php
- http://jo#####necartwright.net/index.php
- http://ma######necartwright.net/index.php
- http://jo######eblackbourne.net/index.php
- http://wi######dbenjaminson.net/index.php
- http://jo#####nechancellor.net/index.php
- http://ma######nechancellor.net/index.php
- http://gw######nbenjaminson.net/index.php
- http://ha######ebenjaminson.net/index.php
- http://br#####nnchancellor.net/index.php
- http://ha#####tecartwright.net/index.php
- http://gw######nblackbourne.net/index.php
- http://ha######eblackbourne.net/index.php
- http://gw#####yncartwright.net/index.php
- http://ka#####nacartwright.net/index.php
- http://br######nbenjaminson.net/index.php
- http://ka######abenjaminson.net/index.php
- http://br#####nncartwright.net/index.php
- http://ka#####nachancellor.net/index.php
- http://br######nblackbourne.net/index.php
- http://ka######ablackbourne.net/index.php
- http://jo######ebenjaminson.net/index.php
- http://ma#####nestrickland.net/index.php
- http://gr######ebreckenridge.net/index.php
- http://ma######ebreckenridge.net/index.php
- http://gr#####lestrickland.net/index.php
- http://si#####tewashington.net/index.php
- http://st######awinterbottom.net/index.php
- http://si######ewinterbottom.net/index.php
- http://ki#####eystrickland.net/index.php
- http://je#####testrickland.net/index.php
- http://ki######ybreckenridge.net/index.php
- http://ma######ewinterbottom.net/index.php
- http://gr#####lewashington.net/index.php
- http://ma#####newashington.net/index.php
- http://gr######ewinterbottom.net/index.php
- http://me######erblackbourne.net/index.php
- http://ca#####necartwright.net/index.php
- http://me######ercartwright.net/index.php
- http://ca######eblackbourne.net/index.php
- http://ma######nebenjaminson.net/index.php
- http://ca#####nechancellor.net/index.php
- http://me######erchancellor.net/index.php
- http://st######abreckenridge.net/index.php
- http://si######ebreckenridge.net/index.php
- http://st#####iawashington.net/index.php
- http://si#####testrickland.net/index.php
- http://ca######ebenjaminson.net/index.php
- http://me######erbenjaminson.net/index.php
- http://st#####iastrickland.net/index.php
UDP:
- DNS ASK sy#####ercartwright.net
- DNS ASK wi#####edcartwright.net
- DNS ASK sy######rbenjaminson.net
- DNS ASK wi######dblackbourne.net
- DNS ASK sy#####erchancellor.net
- DNS ASK wi#####edchancellor.net
- DNS ASK sy######rblackbourne.net
- DNS ASK ma######neblackbourne.net
- DNS ASK jo#####necartwright.net
- DNS ASK ma######necartwright.net
- DNS ASK jo######eblackbourne.net
- DNS ASK wi######dbenjaminson.net
- DNS ASK jo#####nechancellor.net
- DNS ASK ma######nechancellor.net
- DNS ASK ka######abenjaminson.net
- DNS ASK ha#####tecartwright.net
- DNS ASK gw######nbenjaminson.net
- DNS ASK ha######ebenjaminson.net
- DNS ASK gw#####yncartwright.net
- DNS ASK ha#####techancellor.net
- DNS ASK gw######nblackbourne.net
- DNS ASK ha######eblackbourne.net
- DNS ASK br#####nncartwright.net
- DNS ASK ka#####nacartwright.net
- DNS ASK br######nbenjaminson.net
- DNS ASK ka######ablackbourne.net
- DNS ASK br#####nnchancellor.net
- DNS ASK ka#####nachancellor.net
- DNS ASK br######nblackbourne.net
- DNS ASK ma#####nestrickland.net
- DNS ASK gr######ebreckenridge.net
- DNS ASK ma######ebreckenridge.net
- DNS ASK gr#####lestrickland.net
- DNS ASK si#####tewashington.net
- DNS ASK st######awinterbottom.net
- DNS ASK si######ewinterbottom.net
- DNS ASK ki#####eystrickland.net
- DNS ASK je#####testrickland.net
- DNS ASK ki######ybreckenridge.net
- DNS ASK ma######ewinterbottom.net
- DNS ASK gr#####lewashington.net
- DNS ASK ma#####newashington.net
- DNS ASK gr######ewinterbottom.net
- DNS ASK st#####iawashington.net
- DNS ASK ca######eblackbourne.net
- DNS ASK me######erblackbourne.net
- DNS ASK ca#####necartwright.net
- DNS ASK me######erchancellor.net
- DNS ASK jo######ebenjaminson.net
- DNS ASK ma######nebenjaminson.net
- DNS ASK ca#####nechancellor.net
- DNS ASK si#####testrickland.net
- DNS ASK st######abreckenridge.net
- DNS ASK si######ebreckenridge.net
- DNS ASK st#####iastrickland.net
- DNS ASK me######ercartwright.net
- DNS ASK ca######ebenjaminson.net
- DNS ASK me######erbenjaminson.net
