BackDoor.Fleercivet.6

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'ec525f4' = '%APPDATA%\ec525f4.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'ec525f' = 'C:\ec525f4\ec525f4.exe'

Создает или изменяет следующие файлы:

%HOMEPATH%\Start Menu\Programs\Startup\ec525f4.exe

Вредоносные функции:

Для затруднения выявления своего присутствия в системе

блокирует:

Компонент восстановления системы (SR)

Запускает на исполнение:

'<SYSTEM32>\vssadmin.exe' Delete Shadows /All /Quiet
'<SYSTEM32>\svchost.exe' netsvcs
'%WINDIR%\explorer.exe'

Внедряет код в

следующие системные процессы:

<SYSTEM32>\svchost.exe

Изменения в файловой системе:

Создает следующие файлы:

%APPDATA%\ec525f4.exe
C:\ec525f4\ec525f4.exe

Сетевая активность:

Подключается к:

'co####conduct.fi':80
'el########presidentielles-france.fr':80
'ar##el.ro':80
'pr###eamigos.cz':80
'co######ntaire.sante-dz.org':80
'dh##2.com':80
'bi#####resorguiden.se':80
'85.##4.90.210':80
'qu####lbeauty.com':80
'do##film.de':80
'sp#####zdolny.edu.pl':80
'cz####czajka.com':80
'su####tive.com.tr':80
'kr#######rkonsum.uni-koeln.de':80
'el##son.com':80
'ma##ote.com':80
'cq##xx.com':80
'en####h.cadpro.vn':80
'pa###kom.co.id':80
'eu##ut.ro':80
'az####h-azavak.cz':80
'li##co.cc':80
'ad##tam.pt':80
'my####rnalip.com':80
'ip##ddr.es':80
'mu###edia.com':80
'cu###yip.com':80
'co####security.com':80
'th#####itualhealth.com':80
'ma#####artins.com.br':80
'ke#####yurtheeram.com':80
'gl#####reevermont.com':80
'pi####istanbul.com':80
'be####bassador.net':80
'e-###azalar.com':80
'yo#####resigns.co.uk':80

TCP:

Запросы HTTP GET:

http://cu###yip.com/
http://my####rnalip.com/raw
http://ip##ddr.es/

Запросы HTTP POST:

http://pr###eamigos.cz/wp-content/themes/themeboy_football_club_v2.0.8/img2.php?g=#############
http://co####conduct.fi/wp-content/themes/niinanV2/img4.php?u=#############
http://ma##ote.com/blog/wp-content/themes/maptote-com/img5.php?z=#############
http://ar##el.ro/blog/wp-content/themes/Chucky/img5.php?i=#############
http://85.##4.90.210/img1.php?r=#############
http://qu####lbeauty.com/wp-content/themes/template2/img4.php?z=#############
http://el########presidentielles-france.fr/wp-content/themes/theme1917/img5.php?l=#############
http://co######ntaire.sante-dz.org/news/wp-content/themes/sante/img1.php?v=#############
http://do##film.de/handler/img3.php?e=#############
http://sp#####zdolny.edu.pl/wp-content/themes/happykids/img1.php?w=#############
http://cz####czajka.com/wp-content/themes/dt-the7-Theme/img3.php?x=#############
http://su####tive.com.tr/wp-content/themes/pindol/img3.php?d=#############
http://en####h.cadpro.vn/images/img3.php?t=#############
http://el##son.com/wp-content/themes/rttheme18/img1.php?i=#############
http://kr#######rkonsum.uni-koeln.de/wp-content/themes/UltraLight/img4.php?m=#############
http://cq##xx.com/wp-content/themes/cqttxx/img2.php?c=#############
http://dh##2.com/wp-content/themes/lightweight/img4.php?n=#############
http://az####h-azavak.cz/wp-content/themes/pixeled/img1.php?i=#############
http://li##co.cc/img4.php?c=#############
http://pi####istanbul.com/wp-content/themes/camilla/img1.php?v=#############
http://be####bassador.net/news/wp-content/themes/twentythirteen/img2.php?a=#############
http://ad##tam.pt/wp-content/themes/pptitan/img2.php?x=#############
http://mu###edia.com/wp-content/themes/lightweight/img2.php?l=#############
http://pa###kom.co.id/wp-content/themes/satellite_corp/img5.php?o=#############
http://eu##ut.ro/wp-content/uploads/img4.php?g=#############
http://ke#####yurtheeram.com/wp-content/themes/kingsize/img2.php?j=#############
http://co####security.com/wp-content/themes/grizzly/img5.php?d=#############
http://bi#####resorguiden.se/wp-content/themes/chic-bank/img3.php?s=#############
http://ma#####artins.com.br/blog/wp-content/themes/marcelmartins/img1.php?p=#############
http://e-###azalar.com/wp-content/themes/em/img2.php?z=#############
http://yo#####resigns.co.uk/wp-content/themes/twentytwelve/img3.php?v=#############
http://th#####itualhealth.com/wp-content/themes/lightweight/img4.php?w=#############
http://gl#####reevermont.com/wp-content/themes/twentyeleven/img5.php?e=#############