Technical Information
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'engel' = '%APPDATA%\updates\updates.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'
- <SYSTEM32>\netsh.exe advfirewall firewall add rule name="<Virus name>" dir=in action=allow program="<Full path to virus>"
- %APPDATA%\engel\updates.exe
- '84.#0.89.15':3128
- '20#.#6.142.147':3128
- '59.##.167.130':3128
- '59.##3.53.158':3128
- '11#.#7.54.58':3128
- '59.#13.55.4':3128
- '17#.#8.244.216':3128
- '61.##1.81.114':3128
- '11#.#33.76.148':3128
- '11#.#46.86.131':3128
- '17#.#23.177.173':3128
- '59.##.168.185':3128
- '77.#31.34.6':3128
- '87.##2.151.192':3128
- '19#.#16.29.54':3128
- '19#.#51.53.33':3128
- '89.##1.185.173':3128
- '79.##5.202.24':3128
- '96.##.174.191':3128
- '66.##0.222.78':3128
- '19#.#01.135.118':3128
- '85.##7.57.116':3128
- '13#.#32.68.126':3128
- '99.##4.213.62':3128
- '83.##2.81.217':3128
- '21#.#2.72.73':3128
- '94.##.150.54':3128
- '19#.#49.50.68':3128
- '88.##6.79.53':3128
- '21#.#98.142.157':3128
- '21#.#08.216.5':3128
- '89.##1.177.42':3128
- '11#.#42.31.216':3128
- '12#.#58.94.2':3128
- '41.##1.34.160':3128
- '19#.#1.138.52':3128
- '78.##5.25.139':3128
- '82.##2.103.247':3128
- '22#.#43.176.42':3128
- '58.#.75.96':3128
- '89.##1.183.110':3128
- '10#.#82.92.91':3128
- '19#.#9.98.70':3128
- '93.##3.135.32':3128
- '19#.#01.129.159':3128
- '11#.#00.101.127':3128
- '89.##1.182.198':3128
- '98.##.253.11':3128
- '67.##.137.125':3128
- '24.#.229.177':3128
- '41.##3.57.76':3128
- '22#.#31.127.13':3128
- '18#.#6.154.40':3128
- '21#.#1.189.136':3128
- '88.##1.4.226':3128
- '99.##7.197.172':3128
- '11#.#41.40.117':3128
- '77.#8.7.185':3128
- '22#.#20.38.68':3128
- '11#.#6.159.79':3128
- '11#.#40.8.145':3128
- '19#.#13.166.205':3128
- '12#.#66.238.78':3128
- '11#.#40.22.134':3128
- '11#.#97.218.182':3128
- '89.##1.180.181':3128
- '19#.#6.44.36':3128
- '20#.#34.68.250':3128
- '77.##6.49.132':3128
- '19#.#16.232.31':3128
- '11#.#4.56.143':3128
- '18#.#8.63.12':3128
- '21#.#18.109.158':3128
- '79.##0.239.131':3128
- '79.##.177.209':3128
- '85.##7.165.12':3128
- '18#.#01.110.182':3128
- '85.##7.247.18':3128
- '10#.#82.80.194':3128
- '11#.#33.78.8':3128
- '19#.#1.168.166':3128
- '89.##1.181.167':3128
- '88.##1.207.2':3128
- '83.##3.182.140':3128
- '18#.#2.145.89':3128
- '11#.#42.103.165':3128
- '87.##0.212.102':3128
- '19#.#1.190.12':3128
- '58.##.87.120':3128
- '20#.#1.160.62':3128
- '59.##3.52.16':3128
- '78.##8.25.72':3128
- '11#.#42.18.99':3128
- '21#.#6.47.24':3128
- '10#.#10.2.245':3128
- '11#.#4.105.229':3128
- '95.##.62.191':3128
- '41.##3.57.74':3128
- '77.##.146.193':3128
- '10#.#22.73.66':3128
- '21#.#86.183.4':3128
- '21#.#22.182.79':3128
- '77.##3.126.146':3128
- '19#.#2.203.114':3128
- '89.##1.185.142':3128
- '12#.#21.44.181':3128
- '10#.#82.5.212':3128
- '59.##8.36.157':3128
- '12#.#75.56.143':3128
- '91.##6.191.99':3128
- '11#.#40.81.187':6667
- '10#.110http':0
- 'localhost':2
- '18#.#01.31.127':3128
- '77.###.tsopdhtdhttp':0
- '19#.#49.50.68':6667
- '65.##.167.21':6667
- '22#.#34.142.48':6667
- '96.##.174.191':6667
- '61.##.216.90':6667
- '12#.#20.8.157':6667
- '19#.#06.151.246':3128
- '84.##8.28.40':3128
- '19#.#1.189.199':3128
- '87.##5.201.226':3128
- '12#.#21.252.251':3128
- '12#.#26.26.19':3128
- '84.##4.251.251':3128
- '59.##.181.133':3128
- '19#.#.10.166':3128
- '19#.#13.136.69':3128
- '95.##.215.253':3128
- '12#.#68.4.96':3128
- '62.##0.64.116':3128
- '20#.#10.30.35':3128
- '89.##1.177.175':3128
- '58.##.138.136':3128
- '95.##4.179.107':3128
- '12#.#22.170.2':3128
- '11#.#02.79.61':3128
- '89.##2.83.131':3128
- '77.##5.240.251':3128
- '77.##3.122.107':3128
- '75.##3.44.131':3128
- '20#.#59.217.142':3128
- '21#.#32.113.118':3128
- '11#.#40.75.183':3128
- '19#.#13.199.62':3128
- '89.##1.182.34':3128
- '19#.#17.50.8':3128
- '59.##.186.51':3128
- '19#.#1.171.67':3128
- '21#.#32.145.194':3128
- '46.##.200.147':3128
- '81.##0.205.158':3128
- '21#.#8.204.190':3128
- '59.##.170.183':3128
- '59.##.188.201':3128
- '18#.#9.152.87':3128
- '95.##4.108.194':3128
- '21#.#07.211.28':3128
- '72.##4.185.240':3128
- '46.##7.105.244':3128
- '11#.#40.43.241':3128
- '79.##4.192.229':3128
- '24.#4.6.90':3128
- '20#.#8.248.135':3128
- '91.##.125.35':3128
- '19#.#9.109.128':3128
- '19#.#6.37.249':3128
- '94.##5.115.68':3128
- '96.##.244.101':3128
- '89.##2.153.121':3128
- '85.##8.160.68':3128
- '20#.#7.122.251':3128
- '11#.#35.69.43':3128
- '18#.#21.226.35':3128
- '11#.#24.231.22':3128
- '87.##5.198.218':3128
- '12#.#75.58.78':3128
- '90.##0.157.63':3128
- '14#.#13.244.44':3128
- '78.##2.60.27':3128
- 'localhost':4
- '20#.#38.207.169':3128
- '59.##3.49.115':3128
- '12#.#08.66.123':3128
- '17#.#1.67.82':3128
- '19#.#1.169.44':3128
- '74.#15.5.41':3128
- '11#.#7.108.87':3128
- '83.##.153.57':3128
- '17#.#5.130.127':3128
- '21#.#67.137.166':3128
- '20#.#67.48.141':3128
- '19#.#1.184.104':3128
- '59.##.162.206':3128
- '78.##.46.158':3128
- '88.##8.80.241':3128
- '20#.#9.206.2':3128
- '12#.#40.218.131':3128
- '20#.8.29.35':3128
- '82.##1.137.149':3128
- '11#.#7.54.76':3128
- '19#.#1.129.251':3128
- '21#.#09.162.104':3128
- '19#.#1.83.40':3128
- '41.##0.17.63':3128
- '85.##8.131.153':3128
- '84.##0.94.194':3128
- '11#.#52.104.173':3128
- '19#.#00.146.247':3128
- '18#.#21.230.29':3128
- '77.##.79.191':3128
- '20#.#44.143.172':3128
- '10#.#82.106.134':3128
- '12#.#6.129.71':3128
- '59.##.161.93':3128
- '79.##.182.73':3128
- '58.##.88.134':3128
- '18#.#20.227.88':3128
- '11#.#42.5.40':3128
- '12#.#70.29.233':3128
- '77.##7.90.141':3128
- '11#.#7.115.118':3128
- '19#.#20.60.143':3128
- '79.##0.237.70':3128
- '59.##.182.112':3128
- '59.##.188.170':3128
- '59.##3.52.197':3128
- '59.##8.36.78':3128
- '11#.#7.48.40':3128
- '12#.#68.161.15':3128
- '20#.#64.211.106':3128
- '11#.#1.191.227':3128
- '19#.#04.148.80':3128
- '59.##3.52.107':3128
- '72.##8.40.67':3128
- '94.##1.23.71':3128
- '19#.#1.188.101':3128
- '85.##6.250.116':3128
- '20#.#4.103.163':3128
- '19#.#1.123.74':3128
- '11#.#35.82.18':3128
- '11#.#40.82.164':3128
- '83.##8.139.248':3128
- '85.#38.14.2':3128
- '83.##.91.175':3128
- '79.##0.238.183':3128
- '89.##7.75.85':3128
- '21#.#01.133.103':3128
- '21#.#19.108.210':3128
- '19#.#1.171.229':3128
- '80.#20.10.2':3128
- '19#.#6.38.227':3128
- '61.##1.82.99':3128
- '59.##.182.134':3128
- '11#.#52.8.250':3128
- '76.##9.47.171':3128
- '11#.#42.20.173':3128
- '46.##.132.253':3128
- '79.##.176.231':3128
- '19#.#07.110.169':3128
- '85.##.230.135':3128
- '18#.#01.28.166':3128
- '11#.#97.101.16':3128
- '10#.#7.83.168':3128
- '11#.#35.79.82':3128
- '80.##.231.40':3128
- '79.#.74.206':3128
- '84.##.52.118':3128
- '19#.3.229.6':3128
- '11#.#40.117.241':3128
- '11#.#40.3.171':3128
- '62.##.104.121':3128
- '20#.#2.92.109':3128
- '10#.#85.117.168':3128
- '95.##.153.127':3128
- '89.##6.174.216':3128
- '19#.#6.39.193':3128
- '12#.#30.4.183':3128
- '11#.#6.156.182':3128
- '79.##4.192.239':3128
- '89.#5.5.227':3128
- '20#.#48.139.97':3128
- '21#.#0.253.187':3128
- '12#.#20.8.157':3128
- '11#.#06.112.190':3128
- '18#.#5.169.8':3128
- '22#.#43.62.204':3128
- '11#.#99.118.66':3128
- '10#.#98.121.146':3128
- '19#.#1.167.132':3128
- '19#.#1.184.172':3128
- '88.##1.45.80':3128
- '85.##.114.130':3128
- '11#.#18.139.94':3128
- '89.##3.253.161':3128
- '11#.#40.81.187':3128
- '22#.#42.6.110':3128
- '87.##5.86.122':3128
- '22#.#43.61.253':3128
- '81.##.171.13':3128
- '15#.#3.131.184':3128
- '21#.#33.172.127':3128
- '11#.#7.80.58':3128
- '77.##9.10.86':3128
- '12#.#.41.218':3128
- '19#.#20.227.161':3128
- '84.##.150.52':3128
- '89.##1.177.184':3128
- '85.##6.196.130':3128
- '19#.#7.133.229':3128
- '59.##4.113.155':3128
- '12#.#21.71.228':3128
- '11#.#4.104.80':3128
- '95.##8.182.158':3128
- '19#.#10.234.58':3128
- '92.##.133.91':3128
- '93.##0.71.185':3128
- '19#.#6.38.39':3128
- '82.#5.76.46':3128
- '19#.#1.185.26':3128
- '41.##1.17.216':3128
- '21#.#2.242.130':3128
- '21#.#4.81.66':3128
- '11#.#64.132.173':3128
- '19#.#6.44.75':3128
- '11#.#6.132.226':3128
- '18#.6.73.4':3128
- '<Private IP address>':80
- '11#.#33.202.202':3128
- '12#.#20.97.128':3128
- '10#.#0.143.16':3128
- '78.##.61.144':3128
- '19#.#17.203.6':3128
- '19#.#1.143.12':3128
- '24.##7.157.146':3128
- '74.##.209.166':3128
- '20#.#2.243.1':3128
- '58.##.189.69':3128
- '11#.#84.198.108':3128
- '21#.#38.78.146':3128
- '18#.#27.42.6':3128
- '95.##5.181.217':3128
- '41.##3.57.72':3128
- '15#.#2.169.89':3128
- '11#.#3.120.158':3128
- '85.##8.15.233':3128
- '11#.#04.72.214':3128
- '59.##.181.39':3128
- '81.##.240.197':3128
- '11#.#35.85.79':3128
- DNS ASK 10#.110http
- DNS ASK 77.###.TSOPdhtdhttp
- ClassName: 'Indicator' WindowName: ''