Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Framework Publication Font Call NetBIOS' = 'C:\a6xqwryta\tykquceq.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Presentation Shell Launcher] 'ImagePath' = 'C:\a6xqwryta\tykquceq.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Presentation Shell Launcher] 'Start' = '00000002'
Вредоносные функции:
Запускает на исполнение:
- 'C:\a6xqwryta\tyotvxam9qbda.exe' "c:\a6xqwryta\tykquceq.exe"
- 'C:\a6xqwryta\tykquceq.exe'
- 'C:\a6xqwryta\vszmeyv36ehtrcxd4qu92b.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\a6xqwryta\tykquceq.exe
- C:\a6xqwryta\tyotvxam9qbda.exe
- C:\a6xqwryta\sw5hxecd9
- %WINDIR%\a6xqwryta\xq9lq4ox
- C:\a6xqwryta\xq9lq4ox
- C:\a6xqwryta\vszmeyv36ehtrcxd4qu92b.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\a6xqwryta\tyotvxam9qbda.exe
- C:\a6xqwryta\tykquceq.exe
Удаляет следующие файлы:
- C:\a6xqwryta\vszmeyv36ehtrcxd4qu92b.exe
- %WINDIR%\a6xqwryta\xq9lq4ox
Подменяет следующие файлы:
- %WINDIR%\a6xqwryta\xq9lq4ox
Сетевая активность:
Подключается к:
- 'ge######achamberlain.net':80
- 'ch#####leecclestone.net':80
- 'ch#####leanthonyson.net':80
- 'ge#####naanthonyson.net':80
- 'za#####ahanthonyson.net':80
- 'ar#####ldanthonyson.net':80
- 'ge#####naecclestone.net':80
- 'ge######abrassington.net':80
- 'an######ebrassington.net':80
- 'an#####leanthonyson.net':80
- 'gu######nchamberlain.net':80
- 'gw######ebrassington.net':80
- 'gu#####enanthonyson.net':80
- 'an#####leecclestone.net':80
- 'gu######nbrassington.net':80
- 'an######echamberlain.net':80
- 'gu#####enecclestone.net':80
- 'za######hchamberlain.net':80
- 'sh######ebrassington.net':80
- 'ch######ebrassington.net':80
- 'sh#####leecclestone.net':80
- 'ch#####neecclestone.net':80
- 'ce######echamberlain.net':80
- 'am######echamberlain.net':80
- 'ce#####neanthonyson.net':80
- 'am#####neanthonyson.net':80
- 'ch######echamberlain.net':80
- 'ar#####ldecclestone.net':80
- 'za######hbrassington.net':80
- 'ar######dchamberlain.net':80
- 'za#####ahecclestone.net':80
- 'ch#####neanthonyson.net':80
- 'sh######echamberlain.net':80
- 'ar######dbrassington.net':80
- 'sh#####leanthonyson.net':80
TCP:
Запросы HTTP GET:
- http://ge######achamberlain.net/index.php
- http://ch#####leecclestone.net/index.php
- http://ch#####leanthonyson.net/index.php
- http://ge#####naanthonyson.net/index.php
- http://za#####ahanthonyson.net/index.php
- http://ar#####ldanthonyson.net/index.php
- http://ge#####naecclestone.net/index.php
- http://ge######abrassington.net/index.php
- http://an######ebrassington.net/index.php
- http://an#####leanthonyson.net/index.php
- http://gu######nchamberlain.net/index.php
- http://gw######ebrassington.net/index.php
- http://gu#####enanthonyson.net/index.php
- http://an#####leecclestone.net/index.php
- http://gu######nbrassington.net/index.php
- http://an######echamberlain.net/index.php
- http://gu#####enecclestone.net/index.php
- http://za######hchamberlain.net/index.php
- http://sh######ebrassington.net/index.php
- http://ch######ebrassington.net/index.php
- http://sh#####leecclestone.net/index.php
- http://ch#####neecclestone.net/index.php
- http://ce######echamberlain.net/index.php
- http://am######echamberlain.net/index.php
- http://ce#####neanthonyson.net/index.php
- http://am#####neanthonyson.net/index.php
- http://ch######echamberlain.net/index.php
- http://ar#####ldecclestone.net/index.php
- http://za######hbrassington.net/index.php
- http://ar######dchamberlain.net/index.php
- http://za#####ahecclestone.net/index.php
- http://ch#####neanthonyson.net/index.php
- http://sh######echamberlain.net/index.php
- http://ar######dbrassington.net/index.php
- http://sh#####leanthonyson.net/index.php
UDP:
- DNS ASK ge#####naanthonyson.net
- DNS ASK ge######achamberlain.net
- DNS ASK an######ebrassington.net
- DNS ASK ch#####leanthonyson.net
- DNS ASK ch#####leecclestone.net
- DNS ASK za#####ahanthonyson.net
- DNS ASK ar#####ldanthonyson.net
- DNS ASK ge#####naecclestone.net
- DNS ASK ge######abrassington.net
- DNS ASK gu#####enanthonyson.net
- DNS ASK an#####leanthonyson.net
- DNS ASK ch######nbrassington.net
- DNS ASK gw######ebrassington.net
- DNS ASK gu######nchamberlain.net
- DNS ASK an#####leecclestone.net
- DNS ASK gu######nbrassington.net
- DNS ASK an######echamberlain.net
- DNS ASK gu#####enecclestone.net
- DNS ASK ch#####neecclestone.net
- DNS ASK sh######ebrassington.net
- DNS ASK ch######echamberlain.net
- DNS ASK sh#####leecclestone.net
- DNS ASK ch######ebrassington.net
- DNS ASK ce######echamberlain.net
- DNS ASK am######echamberlain.net
- DNS ASK ce#####neanthonyson.net
- DNS ASK am#####neanthonyson.net
- DNS ASK za#####ahecclestone.net
- DNS ASK ar#####ldecclestone.net
- DNS ASK za######hchamberlain.net
- DNS ASK ar######dchamberlain.net
- DNS ASK za######hbrassington.net
- DNS ASK ch#####neanthonyson.net
- DNS ASK sh######echamberlain.net
- DNS ASK ar######dbrassington.net
- DNS ASK sh#####leanthonyson.net
