Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Error Device Connections Call' = 'C:\oxfweyewhw\jlntkbdwowve.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Instrumentation Image Interactive] 'ImagePath' = 'C:\oxfweyewhw\jlntkbdwowve.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Instrumentation Image Interactive] 'Start' = '00000002'
Вредоносные функции:
Запускает на исполнение:
- 'C:\oxfweyewhw\li4th9kiiv1a.exe' "c:\oxfweyewhw\jlntkbdwowve.exe"
- 'C:\oxfweyewhw\jlntkbdwowve.exe'
- 'C:\oxfweyewhw\jyvyoia359opfurj3dgbx.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\oxfweyewhw\jlntkbdwowve.exe
- C:\oxfweyewhw\li4th9kiiv1a.exe
- C:\oxfweyewhw\idrcpx
- %WINDIR%\oxfweyewhw\ffrtfzbe
- C:\oxfweyewhw\ffrtfzbe
- C:\oxfweyewhw\jyvyoia359opfurj3dgbx.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\oxfweyewhw\li4th9kiiv1a.exe
- C:\oxfweyewhw\jlntkbdwowve.exe
Удаляет следующие файлы:
- C:\oxfweyewhw\jyvyoia359opfurj3dgbx.exe
- %WINDIR%\oxfweyewhw\ffrtfzbe
Подменяет следующие файлы:
- %WINDIR%\oxfweyewhw\ffrtfzbe
Сетевая активность:
Подключается к:
- 'gr#####lesharleen.net':80
- 'ma#####nesharleen.net':80
- 'gr#####lekimberly.net':80
- 'si#####teboniface.net':80
- 'gr#####lemalandra.net':80
- 'ma#####nemalandra.net':80
- 'ma#####nekimberly.net':80
- 'je#####temalandra.net':80
- 'ki#####eysharleen.net':80
- 'je#####tesharleen.net':80
- 'gr#####leboniface.net':80
- 'ma#####neboniface.net':80
- 'ki#####eymalandra.net':80
- 'st#####iaboniface.net':80
- 'ca#####negriselda.net':80
- 'me#####hergriselda.net':80
- 'ca#####necatherin.net':80
- 'me#####hersunshine.net':80
- 'ca#####newhitaker.net':80
- 'me#####herwhitaker.net':80
- 'me#####hercatherin.net':80
- 'si#####tesharleen.net':80
- 'st#####iakimberly.net':80
- 'si#####tekimberly.net':80
- 'st#####iamalandra.net':80
- 'si#####temalandra.net':80
- 'st#####iasharleen.net':80
- 'ki#####eykimberly.net':80
- 'br#####nnboniface.net':80
- 'ka#####naboniface.net':80
- 'sy#####ermalandra.net':80
- 'ka#####nasharleen.net':80
- 'br#####nnkimberly.net':80
- 'ka#####nakimberly.net':80
- 'wi#####edmalandra.net':80
- 'wi#####edkimberly.net':80
- 'sy#####erboniface.net':80
- 'wi#####edboniface.net':80
- 'sy#####ersharleen.net':80
- 'wi#####edsharleen.net':80
- 'sy#####erkimberly.net':80
- 'br#####nnsharleen.net':80
- 'gw#####ynmalandra.net':80
- 'ha#####temalandra.net':80
- 'gw#####ynsharleen.net':80
- 'je#####tekimberly.net':80
- 'ki#####eyboniface.net':80
- 'je#####teboniface.net':80
- 'ha#####tesharleen.net':80
- 'ha#####teboniface.net':80
- 'br#####nnmalandra.net':80
- 'ka#####namalandra.net':80
- 'gw#####ynkimberly.net':80
- 'ha#####tekimberly.net':80
- 'gw#####ynboniface.net':80
TCP:
Запросы HTTP GET:
- http://gr#####lesharleen.net/index.php
- http://ma#####nesharleen.net/index.php
- http://gr#####lekimberly.net/index.php
- http://si#####teboniface.net/index.php
- http://gr#####lemalandra.net/index.php
- http://ma#####nemalandra.net/index.php
- http://ma#####nekimberly.net/index.php
- http://je#####temalandra.net/index.php
- http://ki#####eysharleen.net/index.php
- http://je#####tesharleen.net/index.php
- http://gr#####leboniface.net/index.php
- http://ma#####neboniface.net/index.php
- http://ki#####eymalandra.net/index.php
- http://st#####iaboniface.net/index.php
- http://ca#####negriselda.net/index.php
- http://me#####hergriselda.net/index.php
- http://ca#####necatherin.net/index.php
- http://me#####hersunshine.net/index.php
- http://ca#####newhitaker.net/index.php
- http://me#####herwhitaker.net/index.php
- http://me#####hercatherin.net/index.php
- http://si#####tesharleen.net/index.php
- http://st#####iakimberly.net/index.php
- http://si#####tekimberly.net/index.php
- http://st#####iamalandra.net/index.php
- http://si#####temalandra.net/index.php
- http://st#####iasharleen.net/index.php
- http://ki#####eykimberly.net/index.php
- http://br#####nnboniface.net/index.php
- http://ka#####naboniface.net/index.php
- http://sy#####ermalandra.net/index.php
- http://ka#####nasharleen.net/index.php
- http://br#####nnkimberly.net/index.php
- http://ka#####nakimberly.net/index.php
- http://wi#####edmalandra.net/index.php
- http://wi#####edkimberly.net/index.php
- http://sy#####erboniface.net/index.php
- http://wi#####edboniface.net/index.php
- http://sy#####ersharleen.net/index.php
- http://wi#####edsharleen.net/index.php
- http://sy#####erkimberly.net/index.php
- http://br#####nnsharleen.net/index.php
- http://gw#####ynmalandra.net/index.php
- http://ha#####temalandra.net/index.php
- http://gw#####ynsharleen.net/index.php
- http://je#####tekimberly.net/index.php
- http://ki#####eyboniface.net/index.php
- http://je#####teboniface.net/index.php
- http://ha#####tesharleen.net/index.php
- http://ha#####teboniface.net/index.php
- http://br#####nnmalandra.net/index.php
- http://ka#####namalandra.net/index.php
- http://gw#####ynkimberly.net/index.php
- http://ha#####tekimberly.net/index.php
- http://gw#####ynboniface.net/index.php
UDP:
- DNS ASK gr#####lesharleen.net
- DNS ASK ma#####nesharleen.net
- DNS ASK gr#####lekimberly.net
- DNS ASK ma#####nemalandra.net
- DNS ASK st#####iaboniface.net
- DNS ASK si#####teboniface.net
- DNS ASK gr#####lemalandra.net
- DNS ASK je#####temalandra.net
- DNS ASK ki#####eysharleen.net
- DNS ASK je#####tesharleen.net
- DNS ASK ki#####eymalandra.net
- DNS ASK ma#####nekimberly.net
- DNS ASK gr#####leboniface.net
- DNS ASK ma#####neboniface.net
- DNS ASK ca#####negriselda.net
- DNS ASK me#####hergriselda.net
- DNS ASK ca#####necatherin.net
- DNS ASK me#####herwhitaker.net
- DNS ASK ca#####nesunshine.net
- DNS ASK me#####hersunshine.net
- DNS ASK ca#####newhitaker.net
- DNS ASK si#####tesharleen.net
- DNS ASK st#####iakimberly.net
- DNS ASK si#####tekimberly.net
- DNS ASK st#####iasharleen.net
- DNS ASK me#####hercatherin.net
- DNS ASK st#####iamalandra.net
- DNS ASK si#####temalandra.net
- DNS ASK br#####nnboniface.net
- DNS ASK ka#####naboniface.net
- DNS ASK sy#####ermalandra.net
- DNS ASK ka#####nakimberly.net
- DNS ASK br#####nnsharleen.net
- DNS ASK ka#####nasharleen.net
- DNS ASK br#####nnkimberly.net
- DNS ASK wi#####edkimberly.net
- DNS ASK sy#####erboniface.net
- DNS ASK wi#####edboniface.net
- DNS ASK sy#####erkimberly.net
- DNS ASK wi#####edmalandra.net
- DNS ASK sy#####ersharleen.net
- DNS ASK wi#####edsharleen.net
- DNS ASK gw#####ynmalandra.net
- DNS ASK ha#####temalandra.net
- DNS ASK gw#####ynsharleen.net
- DNS ASK je#####teboniface.net
- DNS ASK ki#####eykimberly.net
- DNS ASK je#####tekimberly.net
- DNS ASK ki#####eyboniface.net
- DNS ASK ha#####teboniface.net
- DNS ASK br#####nnmalandra.net
- DNS ASK ka#####namalandra.net
- DNS ASK gw#####ynboniface.net
- DNS ASK ha#####tesharleen.net
- DNS ASK gw#####ynkimberly.net
- DNS ASK ha#####tekimberly.net
