Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Name Procedure Offline File PNRP' = '<SYSTEM32>\nsbzmqn.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Certificate Awareness Human Proxy] 'ImagePath' = '<SYSTEM32>\nsbzmqn.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Certificate Awareness Human Proxy] 'Start' = '00000002'
Вредоносные функции:
Для затруднения выявления своего присутствия в системе
блокирует:
- Центр обеспечения безопасности (Security Center)
Запускает на исполнение:
- '<SYSTEM32>\lxrbrdqonb.exe' "<SYSTEM32>\nsbzmqn.exe"
- '%WINDIR%\Temp\bmswrachglztppqaiq2.exe' -r 34442 tcp
- '%TEMP%\bmswrachp1axlwqaiq2bhocpcr.exe'
- '<SYSTEM32>\nsbzmqn.exe'
Изменения в файловой системе:
Создает следующие файлы:
- <SYSTEM32>\mfsaxruln\run
- <SYSTEM32>\mfsaxruln\rng
- %WINDIR%\Temp\bmswrachglztppqaiq2.exe
- <SYSTEM32>\mfsaxruln\cfg
- %TEMP%\bmswrachp1axlwqaiq2bhocpcr.exe
- <SYSTEM32>\mfsaxruln\tst
- <SYSTEM32>\lxrbrdqonb.exe
- <SYSTEM32>\nsbzmqn.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- <SYSTEM32>\lxrbrdqonb.exe
- <SYSTEM32>\nsbzmqn.exe
Удаляет следующие файлы:
- %WINDIR%\Temp\bmswrachglztppqaiq2.exe
- %TEMP%\bmswrachp1axlwqaiq2bhocpcr.exe
Сетевая активность:
Подключается к:
- 'pl###been.net':80
- 'se###cook.ru':80
- 'fi###een.net':80
- 'se###tall.net':80
- 'se###next.net':80
- 'se###been.net':80
- 'se###cook.net':80
- 'le###cook.net':80
- 'le###tall.net':80
- '18#.#06.120.168':80
- 'wi###bout.net':80
- '13#.#2.139.16':80
- '17#.#36.150.135':8080
- 'er#####udesymphony.net':80
- 'lo####thepings.ru':80
- 're####needle.net':80
- 'ri###nstorm.net':80
TCP:
Запросы HTTP GET:
- http://pl###been.net/index.php
- http://se###cook.ru/index.php
- http://fi###een.net/index.php
- http://se###tall.net/index.php
- http://se###next.net/index.php
- http://se###been.net/index.php
- http://se###cook.net/index.php
- http://le###cook.net/index.php
- http://wi###bout.net/index.php
- http://re####needle.net/index.php
- http://13#.#2.139.16/index.php
- http://18#.#06.120.168/index.php
- http://lo####thepings.ru/index.php
- http://le###tall.net/index.php
- http://ri###nstorm.net/index.php
- http://er#####udesymphony.net/index.php
UDP:
- DNS ASK fi###tand.net
- DNS ASK se###again.net
- DNS ASK le###again.net
- DNS ASK pl###stand.net
- DNS ASK pl###sugar.net
- DNS ASK fi###ugar.net
- DNS ASK pl###stand.ru
- DNS ASK se###pass.net
- DNS ASK se###stand.net
- DNS ASK le###stand.net
- DNS ASK to###gain.ru
- DNS ASK le###sugar.net
- DNS ASK le###pass.ru
- DNS ASK le###pass.net
- DNS ASK se###sugar.net
- DNS ASK fi###ass.net
- DNS ASK vi###gain.net
- DNS ASK vi###ass.net
- DNS ASK lr###sugar.ru
- DNS ASK lr###pass.net
- DNS ASK yo###tand.ru
- DNS ASK yo###tand.net
- DNS ASK lr###again.net
- DNS ASK lr###sugar.net
- DNS ASK fi###gain.ru
- DNS ASK fi###gain.net
- DNS ASK pl###pass.net
- DNS ASK pl###again.net
- DNS ASK vi###ugar.net
- DNS ASK vi###tand.net
- DNS ASK lr###stand.net
- DNS ASK to###gain.net
- DNS ASK pi###pass.net
- DNS ASK mu###ass.net
- DNS ASK pi###sugar.ru
- DNS ASK mu###gain.net
- DNS ASK ve###tand.ru
- DNS ASK ve###tand.net
- DNS ASK pi###again.net
- DNS ASK pi###sugar.net
- DNS ASK ta###gain.ru
- DNS ASK ta###gain.net
- DNS ASK wa###ass.net
- DNS ASK wa###gain.net
- DNS ASK mu###ugar.net
- DNS ASK pi###stand.net
- DNS ASK mu###tand.net
- DNS ASK we###tand.net
- DNS ASK fa###ugar.ru
- DNS ASK fa###ugar.net
- DNS ASK to###tand.net
- DNS ASK to###ugar.net
- DNS ASK fa###gain.net
- DNS ASK to###ass.net
- DNS ASK fa###ass.net
- DNS ASK fa###tand.net
- DNS ASK ve###ass.net
- DNS ASK we###ugar.net
- DNS ASK ve###ugar.net
- DNS ASK we###ass.net
- DNS ASK we###gain.net
- DNS ASK ve###gain.net
- DNS ASK we##pass.ru
- DNS ASK ta###ass.net
- DNS ASK ve###een.net
- DNS ASK fa###ook.net
- DNS ASK mu###all.net
- DNS ASK pi###next.net
- DNS ASK we###een.net
- DNS ASK le###been.ru
- DNS ASK mu###een.net
- DNS ASK to###ook.net
- DNS ASK to###all.net
- DNS ASK fa###all.net
- DNS ASK we##been.ru
- DNS ASK fa###een.net
- DNS ASK we###ook.net
- DNS ASK ve###ext.net
- DNS ASK to###een.net
- DNS ASK se###been.net
- DNS ASK er#####udesymphony.net
- DNS ASK lo####thepings.ru
- DNS ASK le###tall.net
- DNS ASK ri###nstorm.net
- DNS ASK tr###stand.net
- DNS ASK wi###bout.net
- DNS ASK re####needle.net
- DNS ASK fi###een.net
- DNS ASK le###cook.net
- DNS ASK se###next.net
- DNS ASK le###next.net
- DNS ASK se###cook.net
- DNS ASK se###tall.net
- DNS ASK pl###been.net
- DNS ASK se###cook.ru
- DNS ASK to##next.ru
- DNS ASK ta##next.ru
- DNS ASK ta###ext.net
- DNS ASK wa###een.net
- DNS ASK wa###ext.net
- DNS ASK ta###all.net
- DNS ASK wa###ook.net
- DNS ASK ta###ook.net
- DNS ASK ta###een.net
- DNS ASK yo###ass.net
- DNS ASK tr###sugar.net
- DNS ASK yo###ugar.net
- DNS ASK tr###pass.net
- DNS ASK tr###again.net
- DNS ASK yo###gain.net
- DNS ASK tr###pass.ru
- DNS ASK wa###all.net
- DNS ASK mu##cook.ru
- DNS ASK ve###ook.net
- DNS ASK mu###ext.net
- DNS ASK we###all.net
- DNS ASK ve###all.net
- DNS ASK we###ext.net
- DNS ASK pi###tall.net
- DNS ASK fa###ext.net
- DNS ASK pi###cook.net
- DNS ASK to###ext.net
- DNS ASK wa##tall.ru
- DNS ASK ve##tall.ru
- DNS ASK pi###been.net
- DNS ASK le###been.net
- DNS ASK mu###ook.net
- '23#.#55.255.250':1900
