Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'engel' = '%APPDATA%\updates\updates.exe'
Вредоносные функции:
Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'
Запускает на исполнение:
- <SYSTEM32>\netsh.exe advfirewall firewall add rule name="<Имя вируса>" dir=in action=allow program="<Полный путь к вирусу>"
Изменения в файловой системе:
Создает следующие файлы:
- %APPDATA%\engel\updates.exe
Сетевая активность:
Подключается к:
- '60.##3.48.164':3128
- '21#.#18.211.13':3128
- '11#.#5.98.175':3128
- '94.##9.184.52':3128
- '85.##8.128.101':3128
- '18#.#46.40.179':3128
- '20#.#32.61.93':3128
- '85.##8.177.127':3128
- '61.##.170.173':3128
- '77.##7.159.108':3128
- '18#.#8.140.81':3128
- '81.##.183.22':3128
- '22#.#43.63.38':3128
- '11#.#52.227.43':3128
- '20#.#54.63.147':3128
- '59.##3.55.171':3128
- '89.##3.69.41':3128
- '12#.#27.64.187':3128
- '46.##7.254.73':3128
- '22#.#43.177.113':3128
- '21#.#4.182.146':3128
- '21#.85.15.2':3128
- '95.##.139.86':3128
- '58.##.164.228':3128
- '11#.#40.64.198':3128
- '84.#.230.196':3128
- '84.##0.158.61':3128
- '19#.#73.77.192':3128
- '95.##.214.37':3128
- '11#.#54.127.193':3128
- '11#.#54.131.100':3128
- '59.##3.172.14':3128
- '11#.#42.68.244':3128
- '11#.#1.51.16':3128
- '79.##8.29.228':3128
- '59.##3.55.162':3128
- '20#.#43.5.17':3128
- '19#.#5.166.58':3128
- '95.##.213.231':3128
- '95.##1.231.1':3128
- '61.##8.150.103':3128
- '11#.#2.218.64':3128
- '87.##6.203.32':3128
- '58.#.104.15':3128
- '11#.#5.98.226':3128
- '62.##3.174.192':3128
- '11#.#17.22.210':3128
- '61.##.254.222':3128
- '11#.#13.187.131':3128
- '22#.#43.63.199':3128
- '17#.#3.150.205':3128
- '11#.#8.244.148':3128
- '10#.#91.165.33':3128
- '22#.#20.31.34':3128
- '21#.#10.16.184':3128
- '19#.#84.8.104':3128
- '20#.#0.110.96':3128
- '78.##.242.233':3128
- '89.##6.178.211':3128
- '79.##9.209.44':3128
- '11#.#54.117.245':3128
- '94.##9.19.22':3128
- '85.##0.81.228':3128
- '10#.#53.168.117':3128
- '61.##.191.248':3128
- '21#.#45.152.202':3128
- '77.##7.159.191':3128
- '61.##.190.141':3128
- '11#.#2.142.174':3128
- '21#.#4.183.155':3128
- '12#.#9.25.66':3128
- '18#.#96.21.33':3128
- '61.#.70.29':3128
- '21#.#43.103.17':3128
- '21#.#4.182.87':3128
- '11#.#5.7.210':3128
- '1.##.16.143':3128
- '12#.#92.3.66':3128
- '75.##9.23.242':3128
- '92.##3.223.122':3128
- '41.##8.57.64':3128
- '19#.#6.196.3':3128
- '77.##.122.125':3128
- '19#.#99.164.253':3128
- '41.##3.57.74':3128
- '85.##.106.150':3128
- '18#.#92.161.17':3128
- '20#.43.33.8':3128
- '61.##.190.24':3128
- '61.#2.56.17':3128
- '11#.#1.65.205':3128
- '12#.#8.95.39':3128
- '58.##.82.245':3128
- '22#.#1.243.218':3128
- '46.##9.129.108':3128
- '61.#4.180.6':3128
- '76.##2.236.102':3128
- '18#.#92.136.235':3128
- '12#.#.41.218':3128
- '18#.#4.204.229':3128
- '66.#4.145.7':3128
- '18#.#58.73.129':3128
- '19#.#2.156.101':3128
- '79.##9.208.181':3128
- '19#.#18.62.162':3128
- '11#.#42.247.189':3128
- '41.##3.57.76':3128
- '21#.#4.104.102':3128
- '60.##0.147.209':3128
- '18#.#9.61.203':3128
- '10#.#4.204.28':3128
- '62.##9.196.203':3128
- '21#.#5.13.65':3128
- '83.##5.185.244':3128
- '59.#0.166.8':3128
- '11#.#9.138.247':3128
- '82.##4.163.132':3128
- '19#.#2.243.146':3128
- '17#.#00.149.128':3128
- '77.##.182.158':3128
- '12#.#27.67.140':3128
- '93.#4.69.29':3128
- '19#.#07.110.169':3128
- '93.##3.200.30':3128
- '12#.#32.78.181':3128
- '71.#0.209.2':3128
- '11#.#9.141.242':3128
- '68.#10.86.3':3128
- '11#.#38.207.174':3128
- '94.##.159.128':3128
- '71.##.19.129':3128
- '11#.#54.132.137':3128
- '60.##4.78.62':3128
- '61.##.254.162':3128
- '61.##.255.216':3128
- '11#.#5.97.127':3128
- '12#.#04.116.12':3128
- '21#.#4.181.134':3128
- '2.##.7.30':3128
- '94.##.177.90':3128
- '77.##4.85.146':3128
- '22#.#6.108.221':3128
- '77.##7.159.76':3128
- '20#.#50.162.170':3128
- '11#.#98.92.96':3128
- '95.##.44.254':3128
- '61.##.56.232':3128
- '12#.#27.64.66':3128
- '94.##.95.151':3128
- '17#.#65.19.33':3128
- '84.##0.185.51':3128
- '12#.#18.153.19':3128
- '92.##5.96.201':3128
- '77.##4.235.124':3128
- '21#.#4.250.155':3128
- '12#.#4.106.193':3128
- '61.##.57.146':3128
- '12#.#27.65.174':3128
- '76.##9.223.49':3128
- '20#.#1.99.77':3128
- '16#.9.22.67':3128
- '62.##.41.110':3128
- '61.##.160.22':3128
- '11#.#7.93.59':3128
- '11#.#2.218.78':3128
- '59.##3.52.85':3128
- '11#.#2.218.83':3128
- '92.##5.174.196':3128
- '41.##3.57.72':3128
- '81.##.215.203':3128
- '11#.#6.46.204':3128
- '82.##2.103.247':3128
- '21#.#4.251.9':3128
- '79.##3.23.66':3128
- '20#.#7.240.150':3128
- '19#.#8.140.122':3128
- '62.##3.159.36':3128
- '94.##6.144.28':3128
- '21#.#32.0.199':3128
- '21#.#2.200.158':3128
- '92.##.164.203':3128
- '79.##9.170.65':3128
- '11#.#7.182.22':3128
- '10#.#4.160.195':3128
- '67.##3.9.225':3128
- '61.##.254.130':3128
- '77.##0.161.40':3128
- '12#.#65.113.205':3128
- '77.##6.130.118':3128
- '21#.#4.181.225':3128
- '10#.#05.30.72':3128
- '11#.#54.137.171':3128
- '11#.#6.12.94':3128
- '13#.#29.42.211':3128
- '95.##.229.178':3128
- '92.##.140.241':3128
- '21#.#67.192.66':3128
- '18#.#80.106.13':3128
- '11#.#05.103.72':3128
- '77.##.184.97':3128
- '21#.#94.2.198':3128
- '20#.#87.228.5':3128
- '20#.#13.101.154':3128
- '61.##.188.157':3128
- '18#.#7.178.209':3128
- '85.##6.139.142':3128
- '11#.#84.38.78':3128
- '18#.#92.174.6':3128
- '89.##7.75.85':3128
- '77.##7.117.160':3128
- '17#.#37.6.110':3128
UDP:
- DNS ASK 79.##P.htmhttp
Другое:
Ищет следующие окна:
- ClassName: 'Indicator' WindowName: ''
