Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Security DLL Access Background Offline Machine' = 'C:\sgmcliehbknj\wrjfagclyzfb.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Cryptographic Logs Files Auto Reporting Smart] 'ImagePath' = 'C:\sgmcliehbknj\wrjfagclyzfb.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Cryptographic Logs Files Auto Reporting Smart] 'Start' = '00000002'
Вредоносные функции:
Запускает на исполнение:
- 'C:\sgmcliehbknj\notbnwvtr.exe' "c:\sgmcliehbknj\wrjfagclyzfb.exe"
- 'C:\sgmcliehbknj\wrjfagclyzfb.exe'
- 'C:\sgmcliehbknj\o1pt32jlxfokvem9.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\sgmcliehbknj\wrjfagclyzfb.exe
- C:\sgmcliehbknj\notbnwvtr.exe
- C:\sgmcliehbknj\qhtuvx
- %WINDIR%\sgmcliehbknj\phlrxv
- C:\sgmcliehbknj\phlrxv
- C:\sgmcliehbknj\o1pt32jlxfokvem9.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\sgmcliehbknj\notbnwvtr.exe
- C:\sgmcliehbknj\wrjfagclyzfb.exe
Удаляет следующие файлы:
- C:\sgmcliehbknj\o1pt32jlxfokvem9.exe
- %WINDIR%\sgmcliehbknj\phlrxv
Подменяет следующие файлы:
- %WINDIR%\sgmcliehbknj\phlrxv
Сетевая активность:
Подключается к:
- 'pl####ntcompany.net':80
- 'ne####arybecome.net':80
- 'ne#####rycompany.net':80
- 're####efurther.net':80
- 'or####urther.net':80
- 'ne#####ryfurther.net':80
- 'pl####ntfurther.net':80
- 'pl####ntcover.net':80
- 'pl####ntbecome.net':80
- 'ne####arycover.net':80
- 'or###cover.net':80
- 'he####further.net':80
- 'le####further.net':80
- 'le###rcover.net':80
- 'le####become.net':80
- 'he###ncover.net':80
- 'or###become.net':80
- 're####ecover.net':80
- 're####ebecome.net':80
- 're####ecompany.net':80
- 'or####ompany.net':80
- 'gl####urther.net':80
- 'an####further.net':80
- 'an###rcover.net':80
- 'an####become.net':80
- 'gl###cover.net':80
- 'de####become.net':80
- 'fo####dcover.net':80
- 'fo####dbecome.net':80
- 'fo####dcompany.net':80
- 'de####company.net':80
- 'gl###become.net':80
- 'di####ultbecome.net':80
- 'he###cover.net':80
- 'he###become.net':80
- 'he####ompany.net':80
- 'di#####ltcompany.net':80
- 'gl####ompany.net':80
- 'an####company.net':80
- 'di#####ltfurther.net':80
- 'di####ultcover.net':80
- 'he####urther.net':80
TCP:
Запросы HTTP GET:
- http://pl####ntcompany.net/index.php
- http://ne####arybecome.net/index.php
- http://ne#####rycompany.net/index.php
- http://re####efurther.net/index.php
- http://or####urther.net/index.php
- http://ne#####ryfurther.net/index.php
- http://pl####ntfurther.net/index.php
- http://pl####ntcover.net/index.php
- http://pl####ntbecome.net/index.php
- http://ne####arycover.net/index.php
- http://or###cover.net/index.php
- http://he####further.net/index.php
- http://le####further.net/index.php
- http://le###rcover.net/index.php
- http://le####become.net/index.php
- http://he###ncover.net/index.php
- http://or###become.net/index.php
- http://re####ecover.net/index.php
- http://re####ebecome.net/index.php
- http://re####ecompany.net/index.php
- http://or####ompany.net/index.php
- http://gl####urther.net/index.php
- http://an####further.net/index.php
- http://an###rcover.net/index.php
- http://an####become.net/index.php
- http://gl###cover.net/index.php
- http://de####become.net/index.php
- http://fo####dcover.net/index.php
- http://fo####dbecome.net/index.php
- http://fo####dcompany.net/index.php
- http://de####company.net/index.php
- http://gl###become.net/index.php
- http://di####ultbecome.net/index.php
- http://he###cover.net/index.php
- http://he###become.net/index.php
- http://he####ompany.net/index.php
- http://di#####ltcompany.net/index.php
- http://gl####ompany.net/index.php
- http://an####company.net/index.php
- http://di#####ltfurther.net/index.php
- http://di####ultcover.net/index.php
- http://he####urther.net/index.php
UDP:
- DNS ASK pl####ntcompany.net
- DNS ASK ne####arybecome.net
- DNS ASK ne#####rycompany.net
- DNS ASK re####efurther.net
- DNS ASK or####urther.net
- DNS ASK ne#####ryfurther.net
- DNS ASK pl####ntfurther.net
- DNS ASK pl####ntcover.net
- DNS ASK pl####ntbecome.net
- DNS ASK ne####arycover.net
- DNS ASK or###cover.net
- DNS ASK he####further.net
- DNS ASK le####further.net
- DNS ASK le###rcover.net
- DNS ASK le####become.net
- DNS ASK he###ncover.net
- DNS ASK or###become.net
- DNS ASK re####ecover.net
- DNS ASK re####ebecome.net
- DNS ASK re####ecompany.net
- DNS ASK or####ompany.net
- DNS ASK gl####urther.net
- DNS ASK an####further.net
- DNS ASK an###rcover.net
- DNS ASK an####become.net
- DNS ASK gl###cover.net
- DNS ASK de####become.net
- DNS ASK fo####dcover.net
- DNS ASK fo####dbecome.net
- DNS ASK fo####dcompany.net
- DNS ASK de####company.net
- DNS ASK gl###become.net
- DNS ASK di####ultbecome.net
- DNS ASK he###cover.net
- DNS ASK he###become.net
- DNS ASK he####ompany.net
- DNS ASK di#####ltcompany.net
- DNS ASK gl####ompany.net
- DNS ASK an####company.net
- DNS ASK di#####ltfurther.net
- DNS ASK di####ultcover.net
- DNS ASK he####urther.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
