Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '1e6f17d9' = '%APPDATA%\1e6f17d9.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '1e6f17d' = 'C:\1e6f17d9\1e6f17d9.exe'
Создает или изменяет следующие файлы:
- %HOMEPATH%\Start Menu\Programs\Startup\1e6f17d9.exe
Вредоносные функции:
Для затруднения выявления своего присутствия в системе
блокирует:
- Компонент восстановления системы (SR)
Запускает на исполнение:
- '<SYSTEM32>\vssadmin.exe' Delete Shadows /All /Quiet
- '<SYSTEM32>\svchost.exe' netsvcs
- '%WINDIR%\explorer.exe'
Внедряет код в
следующие системные процессы:
- <SYSTEM32>\svchost.exe
Изменения в файловой системе:
Создает следующие файлы:
- %APPDATA%\1e6f17d9.exe
- C:\1e6f17d9\1e6f17d9.exe
Сетевая активность:
Подключается к:
- 'wa####pers-hd.us':80
- 'bi##el.com':80
- 'ex######olaresdilosport.com':80
- 'wa#####mgespokane.us':80
- 'ge####llardart.com':80
- 'hi###gyou.us':80
- 'fu#####rerowstores.com':80
- 'su####.geringer.eu':80
- 'ag##gh.com':80
- 'gj#####icambridge.com':80
- 'vi###riaro.com':80
- 'de####telymale.com':80
- 'de####illo.com.mx':80
- 'he#####airmasters.com':80
- 'le###ertabi.net':80
- 'gu#####esportsteam.com':80
- 'pi##s.nl':80
- 'vi###riaro.ru':80
- 'co####ntenerife.com':80
- 'di####dvideo.com':80
- 'me##shop.ru':80
- 'an######ikzeminkaplama.com':80
- 'le#####hiptrifecta.com':80
- 'el####asonsmith.com':80
- 'ja####eagher.com':80
- 'li#######araimprimirdinero.com':80
- 'my####rnalip.com':80
- 'ip##ddr.es':80
- 'cu###yip.com':80
- 'al####anbakery.com':80
- 'fo##be.ru':80
- 'bd###ndia.com':80
- 'by###rders.com':80
- 'cl######.#utorepuestopalacios.com':80
- 'me###msatun.com':80
- 'pc#####gkeyboards.com':80
- 'da####ollmusic.com':80
- 'en###cade.org':80
- 'hu###kusagi.com':80
- 'ka####eservat.com':80
- 'gl#####reecafegirl.com':80
- 'ma########alianzasestrategicas.com':80
TCP:
Запросы HTTP GET:
- http://cu###yip.com/
- http://my####rnalip.com/raw
- http://ip##ddr.es/
Запросы HTTP POST:
- http://ge####llardart.com/wp-admin/network/3.php?w=###############
- http://ex######olaresdilosport.com/wp-includes/SimplePie/Decode/HTML/3.php?k=###############
- http://vi###riaro.com/wp-content/themes/hueman/option-tree/assets/js/vendor/jquery/4.php?y=###############
- http://wa#####mgespokane.us/wp-content/cache/supercache/waterdamgespokane.us/2014/08/1.php?n=###############
- http://wa####pers-hd.us/wp-content/plugins/wordpress-seo/vendor/xrstf/composer-php52/lib/xrstf/4.php?p=###############
- http://gj#####icambridge.com/OLD%20FILES/new-site/images/3.php?f=###############
- http://su####.geringer.eu/wp-includes/js/tinymce/themes/advanced/skins/o2k7/img/5.php?o=###############
- http://bi##el.com/media/media/css/1.php?q=###############
- http://ag##gh.com/wos/js/1.php?b=###############
- http://vi###riaro.ru/wp-content/plugins/tubepress/src/main/web/js/jscolor/4.php?h=###############
- http://he#####airmasters.com/Demo_Preliminar_helths/wc-logs/3.php?c=###############
- http://de####telymale.com/wp-content/cache/supercache/definitelymale.com/2.php?u=###############
- http://le###ertabi.net/site/components/com_user/3.php?w=###############
- http://gu#####esportsteam.com/wp-content2/plugins/backupbuddy/views/settings/3.php?l=###############
- http://de####illo.com.mx/himnofjr/2.php?y=###############
- http://co####ntenerife.com/wp-content/plugins/post-ratings/templates/2.php?g=###############
- http://pi##s.nl/test/wp-content/plugins/userpro/addons/redirects/admin/scripts/5.php?o=###############
- http://di####dvideo.com/wp-admin/network/2.php?r=###############
- http://me##shop.ru/news/5.php?p=###############
- http://hi###gyou.us/wp-content/plugins/js_composer/assets/lib/nivoslider/themes/light/4.php?w=###############
- http://ja####eagher.com/nextgen-gallery/products/photocrati_nextgen/modules/wpcli/3.php?h=###############
- http://li#######araimprimirdinero.com/magaly/wp-admin/css/3.php?a=###############
- http://hu###kusagi.com/wp-includes/SimplePie/Net/3.php?a=###############
- http://bd###ndia.com/wp-includes/Text/Diff/Engine/1.php?n=###############
- http://el####asonsmith.com/wp-content/plugins/wp-hide-post/2.php?g=###############
- http://al####anbakery.com/wiki/dll/1.php?g=###############
- http://fo##be.ru/wp-content/plugins/wp-super-popup/tiny_mce/themes/advanced/skins/o2k7/4.php?r=###############
- http://an######ikzeminkaplama.com/wp-includes/theme-compat/1.php?k=###############
- http://le#####hiptrifecta.com/3.php?q=###############
- http://en###cade.org/documentos/2014/05/3.php?a=###############
- http://da####ollmusic.com/.f622361ee0b4be53991dffe21b5a361f/b/a/2.php?c=###############
- http://me###msatun.com/wp-includes/SimplePie/Net/3.php?k=###############
- http://fu#####rerowstores.com/wp-content/plugins/backupbuddy/backupbuddy/views/settings/3.php?u=###############
- http://pc#####gkeyboards.com/wp-content/plugins/wordpress-seo/vendor/composer/installers/tests/Composer/5.php?g=###############
- http://by###rders.com/2.php?c=###############
- http://ma########alianzasestrategicas.com/wp-admin/user/3.php?y=###############
- http://ka####eservat.com/wp-content/plugins/js_composer/assets/lib/vcIconPicker/themes/grey-theme/5.php?g=###############
- http://cl######.#utorepuestopalacios.com/images/articulos/2.php?c=###############
- http://gl#####reecafegirl.com/wp-admin/user/3.php?h=###############
UDP:
- DNS ASK wa####pers-hd.us
- DNS ASK bi##el.com
- DNS ASK ex######olaresdilosport.com
- DNS ASK wa#####mgespokane.us
- DNS ASK ge####llardart.com
- DNS ASK hi###gyou.us
- DNS ASK fu#####rerowstores.com
- DNS ASK su####.geringer.eu
- DNS ASK ag##gh.com
- DNS ASK gj#####icambridge.com
- DNS ASK vi###riaro.com
- DNS ASK de####telymale.com
- DNS ASK de####illo.com.mx
- DNS ASK he#####airmasters.com
- DNS ASK le###ertabi.net
- DNS ASK gu#####esportsteam.com
- DNS ASK pi##s.nl
- DNS ASK vi###riaro.ru
- DNS ASK co####ntenerife.com
- DNS ASK di####dvideo.com
- DNS ASK me##shop.ru
- DNS ASK an######ikzeminkaplama.com
- DNS ASK le#####hiptrifecta.com
- DNS ASK el####asonsmith.com
- DNS ASK ja####eagher.com
- DNS ASK li#######araimprimirdinero.com
- DNS ASK my####rnalip.com
- DNS ASK ip##ddr.es
- DNS ASK cu###yip.com
- DNS ASK al####anbakery.com
- DNS ASK fo##be.ru
- DNS ASK bd###ndia.com
- DNS ASK by###rders.com
- DNS ASK cl######.#utorepuestopalacios.com
- DNS ASK me###msatun.com
- DNS ASK pc#####gkeyboards.com
- DNS ASK da####ollmusic.com
- DNS ASK en###cade.org
- DNS ASK hu###kusagi.com
- DNS ASK ka####eservat.com
- DNS ASK gl#####reecafegirl.com
- DNS ASK ma########alianzasestrategicas.com
Другое:
Ищет следующие окна:
- ClassName: 'Indicator' WindowName: ''
