BackDoor.Andromeda.1434

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '1e6f17d9' = '%APPDATA%\1e6f17d9.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '1e6f17d' = 'C:\1e6f17d9\1e6f17d9.exe'

Создает или изменяет следующие файлы:

%HOMEPATH%\Start Menu\Programs\Startup\1e6f17d9.exe

Вредоносные функции:

Для затруднения выявления своего присутствия в системе

блокирует:

Компонент восстановления системы (SR)

удаляет теневые копии разделов.

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' netsvcs
'%WINDIR%\explorer.exe'

Внедряет код в

следующие системные процессы:

<SYSTEM32>\svchost.exe

Изменения в файловой системе:

Создает следующие файлы:

%APPDATA%\1e6f17d9.exe
C:\1e6f17d9\1e6f17d9.exe

Сетевая активность:

Подключается к:

'os##tec.com':80
'el###hmias.com':80
'fo###cegypt.com':80
'pa####lane.co.id':80
'fe###alnirs.com':80
'co####zzachile.com':80
'gs###kansas.com':80
'mo###deep.com':80
'ke##uk.cz':80
'ca###apan.com':80
'ch####scrosson.com':80
'co#####-into-cash.com':80
'ch####ndermagic.com':80
'co####zzabrasil.com':80
'ed###ntage.com':80
'ma######guehomerepair.com':80
'gr###oup.co.il':80
'ge##th.com':80
'mo###coffee.com':80
'fa#####people.com.br':80
'br###fross.com':80
'gl###zona.com':80
'bi####okerage.com':80
'sh###dtoyou.com':80
'co#####zauruguay.com':80
'my####rnalip.com':80
'ip##ddr.es':80
'cu###yip.com':80
'im##au24.de':80
'ca####midwifery.com':80
'kw#####proci.mazury.pl':80
'ei###hai.net':80
'id##-lab.kz':80
'co######yneuroclinic.com':80
'co###ctao.com':80
'ja####azonia.com':80
'co#####onakeychain.com':80
'ho####yle1974.com':80
'mi#######nationalthailand.com':80
'co#######deramaquillarse.com':80

TCP:

Запросы HTTP GET:

http://cu###yip.com/
http://my####rnalip.com/raw
http://ip##ddr.es/

Запросы HTTP POST:

http://fe###alnirs.com/wp-content/plugins/revslider/temp/c.php?z=##############
http://fo###cegypt.com/blog/wp-content/themes/twentyfourteen/rrr.php?h=##############
http://gr###oup.co.il/wp-content/plugins/revslider/temp/cccc.php?e=##############
http://pa####lane.co.id/site/ccccc.php?e=##############
http://os##tec.com/board/cccc.php?w=##############
http://ca###apan.com/wp-content/plugins/bwp-recent-comments/ccc.php?f=##############
http://mo###deep.com/wp-content/uploads/rrr.php?p=##############
http://el###hmias.com/wp-content/uploads/r.php?d=##############
http://ke##uk.cz/wp-content/uploads/rrrr.php?o=##############
http://ch####ndermagic.com/wp-content/plugins/wp-quick-contact-us/cc.php?x=##############
http://ch####scrosson.com/wp-content/plugins/woodojo/ccccc.php?c=##############
http://co####zzabrasil.com/wp-content/plugins/revision-control/ccc.php?s=##############
http://ed###ntage.com/wp-content/uploads/rrrr.php?e=##############
http://co#####-into-cash.com/wp-content/plugins/pretty-link/cc.php?q=##############
http://ge##th.com/ckfinder/cc.php?s=##############
http://ma######guehomerepair.com/wp-content/uploads/rrrr.php?o=##############
http://mo###coffee.com/wp-content/uploads/cc.php?r=##############
http://fa#####people.com.br/wp-content/themes/mazine/rrrrr.php?s=##############
http://co####zzachile.com/wp-content/plugins/gravityforms/ccc.php?t=##############
http://sh###dtoyou.com/download/cc.php?w=##############
http://co#####zauruguay.com/wp-content/wp-content/themes/twentythirteen/cccc.php?a=##############
http://ja####azonia.com/wp-content/uploads/r.php?u=##############
http://co#####onakeychain.com/wp-content/plugins/wp-smushit/ccc.php?j=##############
http://bi####okerage.com/wp-content/plugins/wp-antibot-standart/rrr.php?f=##############
http://im##au24.de/templates/atomic/rr.php?t=##############
http://ca####midwifery.com/wp-content/plugins/ultimate-branding/c.php?g=##############
http://br###fross.com/wp-content/themes/twentyeleven/ccccc.php?c=##############
http://gl###zona.com/plugins/system/plg_system_rewrite/rr.php?n=##############
http://co###ctao.com/wp-content/themes/twentyeleven/cc.php?i=##############
http://id##-lab.kz/wp-content/uploads/rrr.php?x=##############
http://gs###kansas.com/wp-content/plugins/wp-antibot-standart/rrrr.php?c=##############
http://co######yneuroclinic.com/wp-content/themes/twentytwelve/cccc.php?v=##############
http://kw#####proci.mazury.pl/images/ccccc.php?r=##############
http://co#######deramaquillarse.com/wp-content/themes/twentyten/c.php?y=##############
http://ho####yle1974.com/wp-content/uploads/rrr.php?c=##############
http://ei###hai.net/wp-content/themes/twentytwelve/rr.php?r=##############
http://mi#######nationalthailand.com/wp-content/cccc.php?v=##############