Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Config Peer Web iSCSI Background' = 'C:\tvbbkz3qi\m9ogbuvely.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Scheduler Profile Topology ActiveX] 'ImagePath' = 'C:\tvbbkz3qi\m9ogbuvely.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Scheduler Profile Topology ActiveX] 'Start' = '00000002'
Вредоносные функции:
Запускает на исполнение:
- 'C:\tvbbkz3qi\ffxyvbdaedhz.exe' "c:\tvbbkz3qi\m9ogbuvely.exe"
- 'C:\tvbbkz3qi\m9ogbuvely.exe'
- 'C:\tvbbkz3qi\nwhhvh30z6adi7aaw1oavbl.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\tvbbkz3qi\m9ogbuvely.exe
- C:\tvbbkz3qi\ffxyvbdaedhz.exe
- C:\tvbbkz3qi\v4xiuumbbll
- %WINDIR%\tvbbkz3qi\dis9wwg
- C:\tvbbkz3qi\dis9wwg
- C:\tvbbkz3qi\nwhhvh30z6adi7aaw1oavbl.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\tvbbkz3qi\ffxyvbdaedhz.exe
- C:\tvbbkz3qi\m9ogbuvely.exe
Удаляет следующие файлы:
- C:\tvbbkz3qi\nwhhvh30z6adi7aaw1oavbl.exe
- %WINDIR%\tvbbkz3qi\dis9wwg
Подменяет следующие файлы:
- %WINDIR%\tvbbkz3qi\dis9wwg
Сетевая активность:
Подключается к:
- 'al#####rinachastity.net':80
- 'ma#####llaernestine.net':80
- 'al######inaernestine.net':80
- 'ma#####llamillicent.net':80
- 'al######inamillicent.net':80
- 'ma#####llachastity.net':80
- 'ma#####kechancellor.net':80
- 'ma#####kecartwright.net':80
- 'ze#####ahcartwright.net':80
- 'ma######ebenjaminson.net':80
- 'ze#####ahchancellor.net':80
- 'ma######eblackbourne.net':80
- 'ze######hblackbourne.net':80
- 'wi#####hbytennyson.net':80
- 'ba#####omewtennyson.net':80
- 'wi#####hbymillicent.net':80
- 'ch#####anachastity.net':80
- 'du#####llaernestine.net':80
- 'ch#####anaernestine.net':80
- 'ba######mewmillicent.net':80
- 'ba######mewernestine.net':80
- 'ma#####llatennyson.net':80
- 'al#####rinatennyson.net':80
- 'wi#####hbychastity.net':80
- 'ba#####omewchastity.net':80
- 'wi#####hbyernestine.net':80
- 'ze######hbenjaminson.net':80
- 'st#####iechancellor.net':80
- 'ch#####techancellor.net':80
- 'st######eblackbourne.net':80
- 'ki#####yncartwright.net':80
- 'gl######ebenjaminson.net':80
- 'ki######nbenjaminson.net':80
- 'ch######eblackbourne.net':80
- 'ch######ebenjaminson.net':80
- 'ma#####nechancellor.net':80
- 'an#####techancellor.net':80
- 'st#####iecartwright.net':80
- 'ch#####tecartwright.net':80
- 'st######ebenjaminson.net':80
- 'je######eblackbourne.net':80
- 'ge#####vecartwright.net':80
- 'je#####necartwright.net':80
- 'ge#####vechancellor.net':80
- 'je#####nechancellor.net':80
- 'ge######eblackbourne.net':80
- 'ge######ebenjaminson.net':80
- 'gl######eblackbourne.net':80
- 'ki######nblackbourne.net':80
- 'gl#####lecartwright.net':80
- 'je######ebenjaminson.net':80
- 'gl#####lechancellor.net':80
- 'ki#####ynchancellor.net':80
TCP:
Запросы HTTP GET:
- http://al#####rinachastity.net/index.php
- http://ma#####llaernestine.net/index.php
- http://al######inaernestine.net/index.php
- http://ma#####llamillicent.net/index.php
- http://al######inamillicent.net/index.php
- http://ma#####llachastity.net/index.php
- http://ma#####kechancellor.net/index.php
- http://ma#####kecartwright.net/index.php
- http://ze#####ahcartwright.net/index.php
- http://ma######ebenjaminson.net/index.php
- http://ze#####ahchancellor.net/index.php
- http://ma######eblackbourne.net/index.php
- http://ze######hblackbourne.net/index.php
- http://wi#####hbytennyson.net/index.php
- http://ba#####omewtennyson.net/index.php
- http://wi#####hbymillicent.net/index.php
- http://ch#####anachastity.net/index.php
- http://du#####llaernestine.net/index.php
- http://ch#####anaernestine.net/index.php
- http://ba######mewmillicent.net/index.php
- http://ba######mewernestine.net/index.php
- http://ma#####llatennyson.net/index.php
- http://al#####rinatennyson.net/index.php
- http://wi#####hbychastity.net/index.php
- http://ba#####omewchastity.net/index.php
- http://wi#####hbyernestine.net/index.php
- http://ze######hbenjaminson.net/index.php
- http://st#####iechancellor.net/index.php
- http://ch#####techancellor.net/index.php
- http://st######eblackbourne.net/index.php
- http://ki#####yncartwright.net/index.php
- http://gl######ebenjaminson.net/index.php
- http://ki######nbenjaminson.net/index.php
- http://ch######eblackbourne.net/index.php
- http://ch######ebenjaminson.net/index.php
- http://ma#####nechancellor.net/index.php
- http://an#####techancellor.net/index.php
- http://st#####iecartwright.net/index.php
- http://ch#####tecartwright.net/index.php
- http://st######ebenjaminson.net/index.php
- http://je######eblackbourne.net/index.php
- http://ge#####vecartwright.net/index.php
- http://je#####necartwright.net/index.php
- http://ge#####vechancellor.net/index.php
- http://je#####nechancellor.net/index.php
- http://ge######eblackbourne.net/index.php
- http://ge######ebenjaminson.net/index.php
- http://gl######eblackbourne.net/index.php
- http://ki######nblackbourne.net/index.php
- http://gl#####lecartwright.net/index.php
- http://je######ebenjaminson.net/index.php
- http://gl#####lechancellor.net/index.php
- http://ki#####ynchancellor.net/index.php
UDP:
- DNS ASK al#####rinachastity.net
- DNS ASK ma#####llaernestine.net
- DNS ASK al######inaernestine.net
- DNS ASK ma#####llamillicent.net
- DNS ASK al######inamillicent.net
- DNS ASK ma#####llachastity.net
- DNS ASK ma#####kechancellor.net
- DNS ASK ma#####kecartwright.net
- DNS ASK ze#####ahcartwright.net
- DNS ASK ma######ebenjaminson.net
- DNS ASK ze#####ahchancellor.net
- DNS ASK ma######eblackbourne.net
- DNS ASK ze######hblackbourne.net
- DNS ASK al#####rinatennyson.net
- DNS ASK ch#####anaernestine.net
- DNS ASK wi#####hbytennyson.net
- DNS ASK ba#####omewtennyson.net
- DNS ASK du#####llachastity.net
- DNS ASK ch#####anachastity.net
- DNS ASK du#####llaernestine.net
- DNS ASK wi#####hbymillicent.net
- DNS ASK wi#####hbyernestine.net
- DNS ASK ba######mewernestine.net
- DNS ASK ma#####llatennyson.net
- DNS ASK ba######mewmillicent.net
- DNS ASK wi#####hbychastity.net
- DNS ASK ba#####omewchastity.net
- DNS ASK st#####iechancellor.net
- DNS ASK ch#####techancellor.net
- DNS ASK st######eblackbourne.net
- DNS ASK ki#####yncartwright.net
- DNS ASK gl######ebenjaminson.net
- DNS ASK ki######nbenjaminson.net
- DNS ASK ch######eblackbourne.net
- DNS ASK ch######ebenjaminson.net
- DNS ASK ma#####nechancellor.net
- DNS ASK an#####techancellor.net
- DNS ASK st#####iecartwright.net
- DNS ASK ch#####tecartwright.net
- DNS ASK st######ebenjaminson.net
- DNS ASK gl#####lecartwright.net
- DNS ASK ge######eblackbourne.net
- DNS ASK je######eblackbourne.net
- DNS ASK ge#####vecartwright.net
- DNS ASK ze######hbenjaminson.net
- DNS ASK ge#####vechancellor.net
- DNS ASK je#####nechancellor.net
- DNS ASK je#####necartwright.net
- DNS ASK ki#####ynchancellor.net
- DNS ASK gl######eblackbourne.net
- DNS ASK ki######nblackbourne.net
- DNS ASK ge######ebenjaminson.net
- DNS ASK je######ebenjaminson.net
- DNS ASK gl#####lechancellor.net
