Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'TCP/IP Location WinHTTP Protection' = 'C:\dm5c7hlm\cjdvv4iq.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Media Web Networking Framework Health Isolation] 'ImagePath' = 'C:\dm5c7hlm\cjdvv4iq.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Media Web Networking Framework Health Isolation] 'Start' = '00000002'
Вредоносные функции:
Запускает на исполнение:
- 'C:\dm5c7hlm\kh5jbf9z.exe' "c:\dm5c7hlm\cjdvv4iq.exe"
- 'C:\dm5c7hlm\cjdvv4iq.exe'
- 'C:\dm5c7hlm\eoi8zgl300gjzsebbwxow.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\dm5c7hlm\cjdvv4iq.exe
- C:\dm5c7hlm\kh5jbf9z.exe
- C:\dm5c7hlm\gctobfp
- %WINDIR%\dm5c7hlm\ht0uiviqmv
- C:\dm5c7hlm\ht0uiviqmv
- C:\dm5c7hlm\eoi8zgl300gjzsebbwxow.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\dm5c7hlm\kh5jbf9z.exe
- C:\dm5c7hlm\cjdvv4iq.exe
Удаляет следующие файлы:
- C:\dm5c7hlm\eoi8zgl300gjzsebbwxow.exe
- %WINDIR%\dm5c7hlm\ht0uiviqmv
Подменяет следующие файлы:
- %WINDIR%\dm5c7hlm\ht0uiviqmv
Сетевая активность:
Подключается к:
- 'ma######tachancellor.net':80
- 'ch######nnechancellor.net':80
- 'ma######tablackbourne.net':80
- 'ch######hercartwright.net':80
- 'te######cebenjaminson.net':80
- 'ch######herbenjaminson.net':80
- 'ch######nneblackbourne.net':80
- 'ch######nnebenjaminson.net':80
- 'ja######nechancellor.net':80
- 'ge######nachancellor.net':80
- 'ma######tacartwright.net':80
- 'ch######nnecartwright.net':80
- 'ma######tabenjaminson.net':80
- 'te######cecartwright.net':80
- 'er######debenjaminson.net':80
- 'al######eabenjaminson.net':80
- 'mo######rychancellor.net':80
- 'al######eablackbourne.net':80
- 'er######decartwright.net':80
- 'al######eacartwright.net':80
- 'mo######ryblackbourne.net':80
- 'ch######herchancellor.net':80
- 'te######ceblackbourne.net':80
- 'ch######herblackbourne.net':80
- 'mo######rycartwright.net':80
- 'mo######rybenjaminson.net':80
- 'te######cechancellor.net':80
- 'ki######ighblackbourne.net':80
- 'be######tecartwright.net':80
- 'ki######ighcartwright.net':80
- 'be######techancellor.net':80
- 'ki######ighchancellor.net':80
- 'be######teblackbourne.net':80
- 'be######tebenjaminson.net':80
- 'al######iablackbourne.net':80
- 'ch######elleblackbourne.net':80
- 'al######iacartwright.net':80
- 'ki######ighbenjaminson.net':80
- 'al######iachancellor.net':80
- 'ch######ellechancellor.net':80
- 'ch######elbenjaminson.net':80
- 'ge######nacartwright.net':80
- 'ja######nebenjaminson.net':80
- 'ge######nabenjaminson.net':80
- 'ja######neblackbourne.net':80
- 'ge######nablackbourne.net':80
- 'ja######necartwright.net':80
- 're######nechancellor.net':80
- 're######necartwright.net':80
- 'ch######elcartwright.net':80
- 're######nebenjaminson.net':80
- 'ch######elchancellor.net':80
- 're######neblackbourne.net':80
- 'ch######elblackbourne.net':80
TCP:
Запросы HTTP GET:
- http://ma######tachancellor.net/index.php
- http://ch######nnechancellor.net/index.php
- http://ma######tablackbourne.net/index.php
- http://ch######hercartwright.net/index.php
- http://te######cebenjaminson.net/index.php
- http://ch######herbenjaminson.net/index.php
- http://ch######nneblackbourne.net/index.php
- http://ch######nnebenjaminson.net/index.php
- http://ja######nechancellor.net/index.php
- http://ge######nachancellor.net/index.php
- http://ma######tacartwright.net/index.php
- http://ch######nnecartwright.net/index.php
- http://ma######tabenjaminson.net/index.php
- http://te######cecartwright.net/index.php
- http://er######debenjaminson.net/index.php
- http://al######eabenjaminson.net/index.php
- http://mo######rychancellor.net/index.php
- http://al######eablackbourne.net/index.php
- http://er######decartwright.net/index.php
- http://al######eacartwright.net/index.php
- http://mo######ryblackbourne.net/index.php
- http://ch######herchancellor.net/index.php
- http://te######ceblackbourne.net/index.php
- http://ch######herblackbourne.net/index.php
- http://mo######rycartwright.net/index.php
- http://mo######rybenjaminson.net/index.php
- http://te######cechancellor.net/index.php
- http://ki######ighblackbourne.net/index.php
- http://be######tecartwright.net/index.php
- http://ki######ighcartwright.net/index.php
- http://be######techancellor.net/index.php
- http://ki######ighchancellor.net/index.php
- http://be######teblackbourne.net/index.php
- http://be######tebenjaminson.net/index.php
- http://al######iablackbourne.net/index.php
- http://ch######elleblackbourne.net/index.php
- http://al######iacartwright.net/index.php
- http://ki######ighbenjaminson.net/index.php
- http://al######iachancellor.net/index.php
- http://ch######ellechancellor.net/index.php
- http://ch######elbenjaminson.net/index.php
- http://ge######nacartwright.net/index.php
- http://ja######nebenjaminson.net/index.php
- http://ge######nabenjaminson.net/index.php
- http://ja######neblackbourne.net/index.php
- http://ge######nablackbourne.net/index.php
- http://ja######necartwright.net/index.php
- http://re######nechancellor.net/index.php
- http://re######necartwright.net/index.php
- http://ch######elcartwright.net/index.php
- http://re######nebenjaminson.net/index.php
- http://ch######elchancellor.net/index.php
- http://re######neblackbourne.net/index.php
- http://ch######elblackbourne.net/index.php
UDP:
- DNS ASK ch######herbenjaminson.net
- DNS ASK ma######tachancellor.net
- DNS ASK ch######nnechancellor.net
- DNS ASK te######cecartwright.net
- DNS ASK ch######hercartwright.net
- DNS ASK te######cebenjaminson.net
- DNS ASK ma######tablackbourne.net
- DNS ASK ma######tabenjaminson.net
- DNS ASK ch######nnebenjaminson.net
- DNS ASK ja######nechancellor.net
- DNS ASK ch######nneblackbourne.net
- DNS ASK ma######tacartwright.net
- DNS ASK ch######nnecartwright.net
- DNS ASK ch######herblackbourne.net
- DNS ASK al######eacartwright.net
- DNS ASK er######debenjaminson.net
- DNS ASK al######eabenjaminson.net
- DNS ASK er######deblackbourne.net
- DNS ASK al######eablackbourne.net
- DNS ASK er######decartwright.net
- DNS ASK mo######rychancellor.net
- DNS ASK te######cechancellor.net
- DNS ASK ch######herchancellor.net
- DNS ASK te######ceblackbourne.net
- DNS ASK mo######ryblackbourne.net
- DNS ASK mo######rycartwright.net
- DNS ASK mo######rybenjaminson.net
- DNS ASK ge######nachancellor.net
- DNS ASK ki######ighblackbourne.net
- DNS ASK be######tecartwright.net
- DNS ASK ki######ighcartwright.net
- DNS ASK be######techancellor.net
- DNS ASK ki######ighchancellor.net
- DNS ASK be######teblackbourne.net
- DNS ASK be######tebenjaminson.net
- DNS ASK al######iablackbourne.net
- DNS ASK ch######elleblackbourne.net
- DNS ASK al######iacartwright.net
- DNS ASK ki######ighbenjaminson.net
- DNS ASK al######iachancellor.net
- DNS ASK ch######ellechancellor.net
- DNS ASK ch######elbenjaminson.net
- DNS ASK ge######nacartwright.net
- DNS ASK ja######nebenjaminson.net
- DNS ASK ge######nabenjaminson.net
- DNS ASK ja######neblackbourne.net
- DNS ASK ge######nablackbourne.net
- DNS ASK ja######necartwright.net
- DNS ASK re######nechancellor.net
- DNS ASK re######necartwright.net
- DNS ASK ch######elcartwright.net
- DNS ASK re######nebenjaminson.net
- DNS ASK ch######elchancellor.net
- DNS ASK re######neblackbourne.net
- DNS ASK ch######elblackbourne.net
