Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Sharing Debugger Internet Netlogon Print PC Font' = 'C:\oqjndxof\u6tdjkvoa.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Intelligent Session Routing Defragmenter] 'ImagePath' = 'C:\oqjndxof\u6tdjkvoa.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Intelligent Session Routing Defragmenter] 'Start' = '00000002'
Вредоносные функции:
Запускает на исполнение:
- 'C:\oqjndxof\kadhxi1etpjh.exe' "c:\oqjndxof\u6tdjkvoa.exe"
- 'C:\oqjndxof\u6tdjkvoa.exe'
- 'C:\oqjndxof\anwqk72zervfhwigilgnb.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\oqjndxof\u6tdjkvoa.exe
- C:\oqjndxof\kadhxi1etpjh.exe
- C:\oqjndxof\jddzsh
- %WINDIR%\oqjndxof\ysdv69var
- C:\oqjndxof\ysdv69var
- C:\oqjndxof\anwqk72zervfhwigilgnb.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\oqjndxof\kadhxi1etpjh.exe
- C:\oqjndxof\u6tdjkvoa.exe
Удаляет следующие файлы:
- C:\oqjndxof\anwqk72zervfhwigilgnb.exe
- %WINDIR%\oqjndxof\ysdv69var
Подменяет следующие файлы:
- %WINDIR%\oqjndxof\ysdv69var
Сетевая активность:
Подключается к:
- 'ma#####ttamargaret.net':80
- 'ch#####annemargaret.net':80
- 'ja#####inesullivan.net':80
- 'ch#####annearabella.net':80
- 'ma#####ttacherokee.net':80
- 'ch#####annecherokee.net':80
- 'ja#####inecherokee.net':80
- 'ge#####nnacherokee.net':80
- 'ja#####inemargaret.net':80
- 'ge#####nnasullivan.net':80
- 'ja#####inearabella.net':80
- 'ge#####nnaarabella.net':80
- 'ma#####ttaarabella.net':80
- 'ch#####phersullivan.net':80
- 'te#####ncearabella.net':80
- 'ch#####pherarabella.net':80
- 'mo#####erycherokee.net':80
- 'mo#####erymargaret.net':80
- 'te#####ncesullivan.net':80
- 'ch#####phermargaret.net':80
- 'ma#####ttasullivan.net':80
- 'ch#####annesullivan.net':80
- 'te#####ncecherokee.net':80
- 'ch#####phercherokee.net':80
- 'te#####ncemargaret.net':80
- 'ki#####eighmargaret.net':80
- 'al#####riasullivan.net':80
- 'ch######ellesullivan.net':80
- 'be#####ttecherokee.net':80
- 'ki#####eighcherokee.net':80
- 'be#####ttemargaret.net':80
- 'ch######ellecherokee.net':80
- 'al#####riamargaret.net':80
- 'ch######ellemargaret.net':80
- 'al#####riaarabella.net':80
- 'ch######ellearabella.net':80
- 'al#####riacherokee.net':80
- 'ki#####eigharabella.net':80
- 're#####nnearabella.net':80
- 'ch#####belarabella.net':80
- 're#####nnecherokee.net':80
- 'ge#####nnamargaret.net':80
- 're#####nnesullivan.net':80
- 'ch#####belsullivan.net':80
- 'be#####ttesullivan.net':80
- 'ki#####eighsullivan.net':80
- 'be#####ttearabella.net':80
- 'ch#####belcherokee.net':80
- 're#####nnemargaret.net':80
- 'ch#####belmargaret.net':80
TCP:
Запросы HTTP GET:
- http://ma#####ttamargaret.net/index.php
- http://ch#####annemargaret.net/index.php
- http://ja#####inesullivan.net/index.php
- http://ch#####annearabella.net/index.php
- http://ma#####ttacherokee.net/index.php
- http://ch#####annecherokee.net/index.php
- http://ja#####inecherokee.net/index.php
- http://ge#####nnacherokee.net/index.php
- http://ja#####inemargaret.net/index.php
- http://ge#####nnasullivan.net/index.php
- http://ja#####inearabella.net/index.php
- http://ge#####nnaarabella.net/index.php
- http://ma#####ttaarabella.net/index.php
- http://ch#####phersullivan.net/index.php
- http://te#####ncearabella.net/index.php
- http://ch#####pherarabella.net/index.php
- http://mo#####erycherokee.net/index.php
- http://mo#####erymargaret.net/index.php
- http://te#####ncesullivan.net/index.php
- http://ch#####phermargaret.net/index.php
- http://ma#####ttasullivan.net/index.php
- http://ch#####annesullivan.net/index.php
- http://te#####ncecherokee.net/index.php
- http://ch#####phercherokee.net/index.php
- http://te#####ncemargaret.net/index.php
- http://ki#####eighmargaret.net/index.php
- http://al#####riasullivan.net/index.php
- http://ch######ellesullivan.net/index.php
- http://be#####ttecherokee.net/index.php
- http://ki#####eighcherokee.net/index.php
- http://be#####ttemargaret.net/index.php
- http://ch######ellecherokee.net/index.php
- http://al#####riamargaret.net/index.php
- http://ch######ellemargaret.net/index.php
- http://al#####riaarabella.net/index.php
- http://ch######ellearabella.net/index.php
- http://al#####riacherokee.net/index.php
- http://ki#####eigharabella.net/index.php
- http://re#####nnearabella.net/index.php
- http://ch#####belarabella.net/index.php
- http://re#####nnecherokee.net/index.php
- http://ge#####nnamargaret.net/index.php
- http://re#####nnesullivan.net/index.php
- http://ch#####belsullivan.net/index.php
- http://be#####ttesullivan.net/index.php
- http://ki#####eighsullivan.net/index.php
- http://be#####ttearabella.net/index.php
- http://ch#####belcherokee.net/index.php
- http://re#####nnemargaret.net/index.php
- http://ch#####belmargaret.net/index.php
UDP:
- DNS ASK ch#####annecherokee.net
- DNS ASK ma#####ttamargaret.net
- DNS ASK ch#####annemargaret.net
- DNS ASK ma#####ttaarabella.net
- DNS ASK ch#####annearabella.net
- DNS ASK ma#####ttacherokee.net
- DNS ASK ge#####nnaarabella.net
- DNS ASK ja#####inecherokee.net
- DNS ASK ge#####nnacherokee.net
- DNS ASK ja#####inesullivan.net
- DNS ASK ge#####nnasullivan.net
- DNS ASK ja#####inearabella.net
- DNS ASK ch#####annesullivan.net
- DNS ASK te#####ncesullivan.net
- DNS ASK ch#####phersullivan.net
- DNS ASK te#####ncearabella.net
- DNS ASK mo#####eryarabella.net
- DNS ASK mo#####erycherokee.net
- DNS ASK mo#####erymargaret.net
- DNS ASK te#####ncemargaret.net
- DNS ASK ch#####phermargaret.net
- DNS ASK ma#####ttasullivan.net
- DNS ASK ch#####pherarabella.net
- DNS ASK te#####ncecherokee.net
- DNS ASK ch#####phercherokee.net
- DNS ASK ja#####inemargaret.net
- DNS ASK ki#####eighmargaret.net
- DNS ASK al#####riasullivan.net
- DNS ASK ch######ellesullivan.net
- DNS ASK be#####ttecherokee.net
- DNS ASK ki#####eighcherokee.net
- DNS ASK be#####ttemargaret.net
- DNS ASK ch######ellecherokee.net
- DNS ASK al#####riamargaret.net
- DNS ASK ch######ellemargaret.net
- DNS ASK al#####riaarabella.net
- DNS ASK ch######ellearabella.net
- DNS ASK al#####riacherokee.net
- DNS ASK ki#####eigharabella.net
- DNS ASK re#####nnearabella.net
- DNS ASK ch#####belarabella.net
- DNS ASK re#####nnecherokee.net
- DNS ASK ge#####nnamargaret.net
- DNS ASK re#####nnesullivan.net
- DNS ASK ch#####belsullivan.net
- DNS ASK be#####ttesullivan.net
- DNS ASK ki#####eighsullivan.net
- DNS ASK be#####ttearabella.net
- DNS ASK ch#####belcherokee.net
- DNS ASK re#####nnemargaret.net
- DNS ASK ch#####belmargaret.net
