Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Device AutoConfig Profile Windows' = 'C:\rgigewnkpjojh\gjawyppqp.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Isolation Health Publication] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- 'C:\rgigewnkpjojh\mqbsdquzeoc.exe' "c:\rgigewnkpjojh\gjawyppqp.exe"
- 'C:\rgigewnkpjojh\gjawyppqp.exe'
- 'C:\rgigewnkpjojh\bjoyf3o6obhrmflhates.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\rgigewnkpjojh\gjawyppqp.exe
- C:\rgigewnkpjojh\mqbsdquzeoc.exe
- C:\rgigewnkpjojh\bjoyf3o6obhrmflhates.exe
- %WINDIR%\rgigewnkpjojh\jtnmb1jnm
- C:\rgigewnkpjojh\jtnmb1jnm
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\rgigewnkpjojh\mqbsdquzeoc.exe
- C:\rgigewnkpjojh\gjawyppqp.exe
Удаляет следующие файлы:
- C:\rgigewnkpjojh\bjoyf3o6obhrmflhates.exe
- %WINDIR%\rgigewnkpjojh\jtnmb1jnm
Сетевая активность:
Подключается к:
- 'wo###enough.net':80
- 'sm###needle.net':80
- 'sm###enough.net':80
- 'sm###govern.net':80
- 'wo###govern.net':80
- 'wo###needle.net':80
- 'th####tgovern.net':80
- 'wa###enough.net':80
- 'wa###govern.net':80
- 'sm###nature.net':80
- 'wo###nature.net':80
- 'fi###govern.net':80
- 'pa###govern.net':80
- 'fr####urther.net':80
- 'fr###cover.net':80
- 'ex#####ncefurther.net':80
- 'fi###enough.net':80
- 'fi###nature.net':80
- 'pa###nature.net':80
- 'pa###needle.net':80
- 'pa###enough.net':80
- 'fi###needle.net':80
- 'th####tenough.net':80
- 'kn###enough.net':80
- 'be###enough.net':80
- 'be###govern.net':80
- 'su####nature.net':80
- 'kn###govern.net':80
- 'kn###needle.net':80
- 'me####govern.net':80
- 'fo####govern.net':80
- 'be###nature.net':80
- 'be###needle.net':80
- 'kn###nature.net':80
- 'th####tnature.net':80
- 'cr###govern.net':80
- 'wa###nature.net':80
- 'wa###needle.net':80
- 'th####tneedle.net':80
- 'su####govern.net':80
- 'su####needle.net':80
- 'cr###nature.net':80
- 'cr###needle.net':80
- 'cr###enough.net':80
- 'su####enough.net':80
TCP:
Запросы HTTP GET:
- http://wo###enough.net/index.php
- http://sm###needle.net/index.php
- http://sm###enough.net/index.php
- http://sm###govern.net/index.php
- http://wo###govern.net/index.php
- http://wo###needle.net/index.php
- http://th####tgovern.net/index.php
- http://wa###enough.net/index.php
- http://wa###govern.net/index.php
- http://sm###nature.net/index.php
- http://wo###nature.net/index.php
- http://fi###govern.net/index.php
- http://pa###govern.net/index.php
- http://fr####urther.net/index.php
- http://fr###cover.net/index.php
- http://ex#####ncefurther.net/index.php
- http://fi###enough.net/index.php
- http://fi###nature.net/index.php
- http://pa###nature.net/index.php
- http://pa###needle.net/index.php
- http://pa###enough.net/index.php
- http://fi###needle.net/index.php
- http://th####tenough.net/index.php
- http://kn###enough.net/index.php
- http://be###enough.net/index.php
- http://be###govern.net/index.php
- http://su####nature.net/index.php
- http://kn###govern.net/index.php
- http://kn###needle.net/index.php
- http://me####govern.net/index.php
- http://fo####govern.net/index.php
- http://be###nature.net/index.php
- http://be###needle.net/index.php
- http://kn###nature.net/index.php
- http://th####tnature.net/index.php
- http://cr###govern.net/index.php
- http://wa###nature.net/index.php
- http://wa###needle.net/index.php
- http://th####tneedle.net/index.php
- http://su####govern.net/index.php
- http://su####needle.net/index.php
- http://cr###nature.net/index.php
- http://cr###needle.net/index.php
- http://cr###enough.net/index.php
- http://su####enough.net/index.php
UDP:
- DNS ASK wo###enough.net
- DNS ASK sm###needle.net
- DNS ASK sm###enough.net
- DNS ASK sm###govern.net
- DNS ASK wo###govern.net
- DNS ASK wo###needle.net
- DNS ASK th####tgovern.net
- DNS ASK wa###enough.net
- DNS ASK wa###govern.net
- DNS ASK sm###nature.net
- DNS ASK wo###nature.net
- DNS ASK pa###nature.net
- DNS ASK fr####urther.net
- DNS ASK fi###govern.net
- DNS ASK ex#####ncefurther.net
- DNS ASK ex####encecover.net
- DNS ASK fr###cover.net
- DNS ASK pa###govern.net
- DNS ASK pa###needle.net
- DNS ASK fi###nature.net
- DNS ASK fi###needle.net
- DNS ASK fi###enough.net
- DNS ASK pa###enough.net
- DNS ASK kn###enough.net
- DNS ASK be###enough.net
- DNS ASK be###govern.net
- DNS ASK su####nature.net
- DNS ASK kn###govern.net
- DNS ASK kn###needle.net
- DNS ASK me####govern.net
- DNS ASK fo####govern.net
- DNS ASK be###nature.net
- DNS ASK be###needle.net
- DNS ASK kn###nature.net
- DNS ASK cr###nature.net
- DNS ASK wa###nature.net
- DNS ASK th####tnature.net
- DNS ASK th####tneedle.net
- DNS ASK th####tenough.net
- DNS ASK wa###needle.net
- DNS ASK cr###govern.net
- DNS ASK cr###needle.net
- DNS ASK su####needle.net
- DNS ASK su####enough.net
- DNS ASK su####govern.net
- DNS ASK cr###enough.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
