Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Offline Smart Networking Update Receiver Secondary' = 'C:\huejujbby\fkvinhaauayd.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\NGEN Visual Task Layer Block NetBIOS Shell] 'ImagePath' = 'C:\huejujbby\fkvinhaauayd.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\NGEN Visual Task Layer Block NetBIOS Shell] 'Start' = '00000002'
Вредоносные функции:
Запускает на исполнение:
- 'C:\huejujbby\cz9ujsltmuoq.exe' "c:\huejujbby\fkvinhaauayd.exe"
- 'C:\huejujbby\fkvinhaauayd.exe'
- 'C:\huejujbby\kaqirulc32axdlpcuw5tnt.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\huejujbby\fkvinhaauayd.exe
- C:\huejujbby\cz9ujsltmuoq.exe
- C:\huejujbby\gbbsqrrxo
- %WINDIR%\huejujbby\zksfhdtfeptb
- C:\huejujbby\zksfhdtfeptb
- C:\huejujbby\kaqirulc32axdlpcuw5tnt.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\huejujbby\cz9ujsltmuoq.exe
- C:\huejujbby\fkvinhaauayd.exe
Удаляет следующие файлы:
- C:\huejujbby\kaqirulc32axdlpcuw5tnt.exe
- %WINDIR%\huejujbby\zksfhdtfeptb
Подменяет следующие файлы:
- %WINDIR%\huejujbby\zksfhdtfeptb
Сетевая активность:
Подключается к:
- 'al#####riatennyson.net':80
- 'ch######elletennyson.net':80
- 'al#####riamillicent.net':80
- 'ki#####eighchastity.net':80
- 'be#####tteernestine.net':80
- 'ki######ighernestine.net':80
- 'al#####riaernestine.net':80
- 'ch######elleernestine.net':80
- 'st#####iachancellor.net':80
- 'ch######ellemillicent.net':80
- 'al#####riachastity.net':80
- 'ch######ellechastity.net':80
- 're#####nnechastity.net':80
- 'ch#####belchastity.net':80
- 're#####nneernestine.net':80
- 'ch#####beltennyson.net':80
- 're#####nnemillicent.net':80
- 'ch#####belmillicent.net':80
- 'be#####ttemillicent.net':80
- 'ki######ighmillicent.net':80
- 'be#####ttechastity.net':80
- 'ch#####belernestine.net':80
- 'be#####ttetennyson.net':80
- 'ki#####eightennyson.net':80
- 'si#####techancellor.net':80
- 'je#####techancellor.net':80
- 'ki######yblackbourne.net':80
- 'je######eblackbourne.net':80
- 'gr######ebenjaminson.net':80
- 'ma######ebenjaminson.net':80
- 'ki#####eychancellor.net':80
- 'je######ebenjaminson.net':80
- 'gw#####ynchancellor.net':80
- 'ha#####techancellor.net':80
- 'ki#####eycartwright.net':80
- 'je#####tecartwright.net':80
- 'ki######ybenjaminson.net':80
- 'si#####tecartwright.net':80
- 'st######abenjaminson.net':80
- 'si######ebenjaminson.net':80
- 'st######ablackbourne.net':80
- 'si######eblackbourne.net':80
- 'st#####iacartwright.net':80
- 'ma######eblackbourne.net':80
- 'gr#####lecartwright.net':80
- 'ma#####necartwright.net':80
- 'gr#####lechancellor.net':80
- 'ma#####nechancellor.net':80
- 'gr######eblackbourne.net':80
TCP:
Запросы HTTP GET:
- http://al#####riatennyson.net/index.php
- http://ch######elletennyson.net/index.php
- http://al#####riamillicent.net/index.php
- http://ki#####eighchastity.net/index.php
- http://be#####tteernestine.net/index.php
- http://ki######ighernestine.net/index.php
- http://al#####riaernestine.net/index.php
- http://ch######elleernestine.net/index.php
- http://st#####iachancellor.net/index.php
- http://ch######ellemillicent.net/index.php
- http://al#####riachastity.net/index.php
- http://ch######ellechastity.net/index.php
- http://re#####nnechastity.net/index.php
- http://ch#####belchastity.net/index.php
- http://re#####nneernestine.net/index.php
- http://ch#####beltennyson.net/index.php
- http://re#####nnemillicent.net/index.php
- http://ch#####belmillicent.net/index.php
- http://be#####ttemillicent.net/index.php
- http://ki######ighmillicent.net/index.php
- http://be#####ttechastity.net/index.php
- http://ch#####belernestine.net/index.php
- http://be#####ttetennyson.net/index.php
- http://ki#####eightennyson.net/index.php
- http://si#####techancellor.net/index.php
- http://je#####techancellor.net/index.php
- http://ki######yblackbourne.net/index.php
- http://je######eblackbourne.net/index.php
- http://gr######ebenjaminson.net/index.php
- http://ma######ebenjaminson.net/index.php
- http://ki#####eychancellor.net/index.php
- http://je######ebenjaminson.net/index.php
- http://gw#####ynchancellor.net/index.php
- http://ha#####techancellor.net/index.php
- http://ki#####eycartwright.net/index.php
- http://je#####tecartwright.net/index.php
- http://ki######ybenjaminson.net/index.php
- http://si#####tecartwright.net/index.php
- http://st######abenjaminson.net/index.php
- http://si######ebenjaminson.net/index.php
- http://st######ablackbourne.net/index.php
- http://si######eblackbourne.net/index.php
- http://st#####iacartwright.net/index.php
- http://ma######eblackbourne.net/index.php
- http://gr#####lecartwright.net/index.php
- http://ma#####necartwright.net/index.php
- http://gr#####lechancellor.net/index.php
- http://ma#####nechancellor.net/index.php
- http://gr######eblackbourne.net/index.php
UDP:
- DNS ASK al#####riatennyson.net
- DNS ASK ch######elletennyson.net
- DNS ASK al#####riamillicent.net
- DNS ASK ki#####eighchastity.net
- DNS ASK be#####tteernestine.net
- DNS ASK ki######ighernestine.net
- DNS ASK al#####riaernestine.net
- DNS ASK ch######elleernestine.net
- DNS ASK st#####iachancellor.net
- DNS ASK ch######ellemillicent.net
- DNS ASK al#####riachastity.net
- DNS ASK ch######ellechastity.net
- DNS ASK be#####ttechastity.net
- DNS ASK ch#####belmillicent.net
- DNS ASK re#####nnechastity.net
- DNS ASK ch#####belchastity.net
- DNS ASK re#####nnetennyson.net
- DNS ASK ch#####beltennyson.net
- DNS ASK re#####nnemillicent.net
- DNS ASK ki#####eightennyson.net
- DNS ASK be#####ttemillicent.net
- DNS ASK ki######ighmillicent.net
- DNS ASK re#####nneernestine.net
- DNS ASK ch#####belernestine.net
- DNS ASK be#####ttetennyson.net
- DNS ASK je#####techancellor.net
- DNS ASK ki######yblackbourne.net
- DNS ASK je######eblackbourne.net
- DNS ASK gr######ebenjaminson.net
- DNS ASK ma######ebenjaminson.net
- DNS ASK ki#####eychancellor.net
- DNS ASK je######ebenjaminson.net
- DNS ASK gw#####ynchancellor.net
- DNS ASK ha#####techancellor.net
- DNS ASK ki#####eycartwright.net
- DNS ASK je#####tecartwright.net
- DNS ASK ki######ybenjaminson.net
- DNS ASK ma#####necartwright.net
- DNS ASK st#####iacartwright.net
- DNS ASK si#####tecartwright.net
- DNS ASK st######abenjaminson.net
- DNS ASK si#####techancellor.net
- DNS ASK st######ablackbourne.net
- DNS ASK si######eblackbourne.net
- DNS ASK gr######eblackbourne.net
- DNS ASK ma######eblackbourne.net
- DNS ASK gr#####lecartwright.net
- DNS ASK si######ebenjaminson.net
- DNS ASK gr#####lechancellor.net
- DNS ASK ma#####nechancellor.net
