Technical Information
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'engel' = '%APPDATA%\updates\updates.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'
- <SYSTEM32>\netsh.exe advfirewall firewall add rule name="<Virus name>" dir=in action=allow program="<Full path to virus>"
- %APPDATA%\engel\updates.exe
- '12#.#23.206.116':3128
- '22#.#75.240.21':3128
- '17#.#25.121.115':3128
- '92.##.153.42':3128
- '22#.#75.239.204':3128
- '31.##4.216.126':3128
- '93.##3.85.250':3128
- '12#.#23.195.218':3128
- '95.##4.66.62':3128
- '22#.#75.234.130':3128
- '17#.#0.81.55':3128
- '20#.#1.160.62':3128
- '12#.#01.79.94':3128
- '11#.#53.132.195':3128
- '11#.#3.232.211':3128
- '20#.#.173.14':3128
- '22#.#75.240.214':3128
- '85.##0.81.228':3128
- '11#.#8.4.198':3128
- '19#.#0.32.97':3128
- '41.##3.57.74':3128
- '22#.#75.242.95':3128
- '80.##6.0.109':3128
- '87.##0.166.58':3128
- '21#.#1.188.117':3128
- '42.##1.183.135':3128
- '18#.#11.188.13':3128
- '10#.#01.171.149':3128
- '60.##.20.152':3128
- '95.##4.68.253':3128
- '21#.#7.94.67':3128
- '11#.#59.45.214':3128
- '19#.#05.90.105':3128
- '86.##1.54.123':3128
- '92.##.221.92':3128
- '19#.#38.105.187':3128
- '11#.#00.48.220':3128
- '22#.#75.242.88':3128
- '21#.#48.61.203':3128
- '22#.#75.235.125':3128
- '19#.#38.105.206':3128
- '98.##8.42.32':3128
- '22#.#75.239.177':3128
- '85.##.100.224':3128
- '93.##8.250.214':3128
- '11#.88.5.9':3128
- '41.##8.187.23':3128
- '20#.#32.236.189':3128
- '19#.#3.52.97':3128
- '18#.#41.110.139':3128
- '11#.#.35.189':3128
- '22#.#75.234.133':3128
- '16#.9.22.72':3128
- '61.#9.33.9':3128
- '12#.#17.210.67':3128
- '92.##.47.249':3128
- '18#.#86.25.181':3128
- '22#.#75.233.146':3128
- '22#.#75.240.7':3128
- '81.#0.0.17':3128
- '10#.#2.97.20':3128
- '46.##5.244.190':3128
- '19#.#3.74.233':3128
- '95.#8.1.40':3128
- '22#.#75.226.185':3128
- '22#.#75.233.32':3128
- '60.##0.66.130':3128
- '11#.#42.141.121':3128
- '22#.#75.240.36':3128
- '46.##5.148.144':3128
- '11#.#45.111.225':3128
- '79.##7.47.199':3128
- '21#.#72.250.98':3128
- '11#.#96.234.207':3128
- '22#.#75.239.225':3128
- '95.##.202.209':3128
- '22#.#75.233.20':3128
- '22#.#75.239.129':3128
- '10#.#7.61.207':3128
- '77.##1.80.23':3128
- '92.##.227.33':3128
- '22#.#75.228.186':3128
- '22#.#75.236.17':3128
- '22#.#75.240.110':3128
- '22#.#75.239.74':3128
- '22#.#75.234.216':3128
- '22#.#75.237.255':3128
- '19#.#5.254.100':3128
- '59.##3.24.219':3128
- '20#.#04.237.129':3128
- '59.##.197.104':3128
- '72.##2.234.165':3128
- '58.##.121.201':3128
- '22#.#75.234.213':3128
- '59.##1.87.202':3128
- '82.##3.6.177':3128
- '77.##.45.219':3128
- '62.##3.177.150':3128
- '12#.#86.208.238':3128
- '91.##4.216.172':3128
- '18#.#43.116.6':3128
- '12#.#6.12.34':3128
- '22#.#75.240.111':3128
- '19#.#1.62.120':3128
- '11#.#05.32.64':3128
- '22#.#75.233.217':3128
- '20#.#08.96.127':3128
- '20#.#52.194.217':3128
- '95.##.166.15':3128
- '20#.#2.221.161':3128
- '12#.#38.23.214':3128
- '11#.#54.150.197':3128
- '22#.#75.239.86':3128
- '22#.#75.239.189':3128
- '11#.#1.152.217':3128
- '22#.#75.235.148':3128
- '22#.#75.234.172':3128
- '22#.#75.231.218':3128
- '22#.#75.235.91':3128
- '22#.#24.125.99':3128
- '22#.#76.207.14':3128
- '12#.#62.46.114':3128
- '22#.#75.240.247':3128
- '22#.#25.176.153':3128
- '22#.#75.239.251':3128
- '22#.#75.239.211':3128
- '17#.95.6.50':3128
- '21#.#96.68.187':3128
- '22#.#75.242.106':3128
- '11#.#98.128.114':3128
- '22#.#75.240.163':3128
- '22#.#75.233.211':3128
- '22#.#75.234.12':3128
- '93.##0.179.87':3128
- '46.##8.55.212':3128
- '11#.#03.131.166':3128
- '17#.#4.10.24':3128
- '11#.#54.118.65':3128
- '22#.#75.235.86':3128
- '20#.#8.166.210':3128
- '10#.#2.117.119':3128
- '95.##.149.249':3128
- '22#.#75.239.133':3128
- '22#.#75.240.180':3128
- '21#.#70.246.170':3128
- '11#.#84.213.161':3128
- '12#.#05.13.184':3128
- '22#.#75.232.56':3128
- '22#.#75.239.35':3128
- '22#.#75.239.24':3128
- '11#.#0.170.134':3128
- '82.##8.97.240':3128
- '22#.#75.226.196':3128
- '22#.#75.240.136':3128
- '22#.#75.234.91':3128
- '18#.#94.102.11':3128
- '22#.#75.242.233':3128
- '11#.#54.180.61':3128
- '22#.#75.242.14':3128
- '17#.#25.167.1':3128
- '22#.#76.207.56':3128
- '18#.#78.118.86':3128
- '11#.#54.16.202':3128
- '84.##0.24.50':3128
- '22#.#75.240.137':3128
- '11#.#8.35.98':3128
- '11#.#96.236.184':3128
- '12#.#43.186.150':3128
- '76.##.217.119':3128
- '18#.#5.81.114':3128
- '2.##1.89.41':3128
- '22#.#75.240.14':3128
- '59.##.208.145':3128
- '86.##6.40.27':3128
- '22#.#75.234.48':3128
- '21#.#27.80.61':3128
- '22#.#75.228.133':3128
- '11#.#8.49.34':3128
- '46.##.231.108':3128
- '92.##.118.51':3128
- '79.##5.138.210':3128
- '20#.#08.125.236':3128
- '22#.#75.242.98':3128
- '11#.#54.182.174':3128
- '11#.88.3.93':3128
- '22#.#75.240.207':3128
- '22#.#75.239.59':3128
- '11#.#3.59.162':3128
- '22#.#75.233.4':3128
- '22#.#75.240.222':3128
- '78.##.222.97':3128
- '11#.88.8.52':3128
- '21#.#12.170.65':3128
- '11#.#9.243.10':3128
- '61.##3.193.110':3128
- '19#.#.35.154':3128
- '89.##6.240.124':3128
- '19#.#4.114.167':3128
- '77.##.56.121':3128
- '11#.#52.241.216':3128
- '41.##0.101.6':3128
- '22#.#75.239.168':3128
- '22#.#75.241.149':3128
- '17#.#9.143.77':3128
- '22#.#75.228.50':3128
- '22#.#75.240.41':3128
- '18#.#3.246.240':3128
- '19#.#11.243.97':3128
- '93.##0.233.186':3128
- '22#.#75.234.154':3128
- '11#.#1.212.72':3128
- '12#.#40.36.95':3128
- '85.##5.68.100':3128
- '18#.#29.162.82':3128
- '18#.#77.149.72':3128
- '59.##.175.208':3128
- '93.#78.7.2':3128
- '19#.#55.209.74':3128
- '22#.#17.164.228':3128
- '59.##3.25.109':3128
- '22#.#75.235.74':3128
- '12#.#0.99.58':3128
- '82.##0.130.62':3128
- '20#.#52.194.250':3128
- '22#.#75.237.156':3128
- '11#.#9.226.139':3128
- '11#.#54.131.100':3128
- '2.###.97.187':3128
- '59.##3.24.205':3128
- '22#.#75.240.69':3128
- '11#.#54.70.41':3128
- '80.#5.11.16':3128
- '77.##1.200.20':3128
- '89.##.42.156':3128
- '11#.#03.120.211':3128
- '87.##1.19.76':3128
- '79.##3.126.156':3128
- '95.##2.109.119':3128
- '93.##8.220.251':3128
- '22#.#75.242.67':3128
- '22#.#75.241.12':3128
- '79.##0.104.63':3128
- '22#.#75.239.85':3128
- '22#.#75.233.94':3128
- '22#.#75.241.9':3128
- '17#.#26.244.164':3128
- '77.##4.33.119':3128
- '22#.#75.233.247':3128
- '22#.#75.225.118':3128
- '22#.#75.239.39':3128
- '22#.#75.234.174':3128
- '11#.#54.38.224':3128
- '22#.#75.228.100':3128
- '22#.#75.240.51':3128
- '18#.#41.124.9':3128
- '61.##.186.155':3128
- '22#.#75.239.90':3128
- '22#.#75.233.30':3128
- '22#.#75.238.32':3128
- '22#.#55.226.149':3128
- '62.##5.131.92':3128
- '60.#5.47.23':3128
- '22#.#75.228.16':3128
- '22#.#75.242.140':3128
- '22#.#75.240.25':3128
- '11#.#10.139.169':3128
- '21#.#12.108.253':3128
- '11#.#99.25.117':3128
- '22#.#75.235.51':3128
- '20#.#34.12.11':3128
- '74.#15.3.63':3128
- '20#.#32.202.135':3128
- '22#.#75.239.237':3128
- '22#.#75.233.249':3128
- '20#.#28.26.240':3128
- '60.##0.168.163':3128
- '93.##.189.183':3128
- '22#.#75.234.228':3128
- '22#.#75.240.16':3128
- '86.##2.85.62':3128
- '22#.#35.71.169':3128
- '22#.#75.233.40':3128
- '21#.#55.193.230':3128
- '22#.#75.227.31':3128
- '11#.#52.44.201':3128
- '93.#4.9.45':3128
- '77.#35.4.45':3128
- '22#.#75.241.208':3128
- '22#.#66.232.32':3128
- '89.##.58.133':3128
- '87.##7.56.128':3128
- '19#.#38.107.15':3128
- '94.##4.41.159':3128
- '18#.#77.45.78':3128
- '22#.#75.240.253':3128
- '11#.#04.67.41':3128
- '18#.#41.29.146':3128
- '22#.#75.240.206':3128
- '92.##5.113.212':3128
- '89.##6.70.158':3128
- '95.##.248.161':3128
- '18#.#20.202.125':3128
- '88.##6.165.219':3128
- '20#.#65.150.217':3128
- '59.##.211.180':3128
- '20#.#3.37.81':3128
- '46.##8.141.100':3128
- '89.##2.29.186':3128
- '89.##5.244.229':3128
- '89.##6.246.117':3128
- '21#.#2.200.158':3128
- '11#.#99.60.149':3128
- '95.##.241.79':3128
- '79.##7.47.194':3128
- '22#.#75.240.61':3128
- '92.##.42.231':3128
- '11#.88.35.6':3128
- '22#.#75.242.206':3128
- '18#.#5.17.162':3128
- '12#.#25.249.223':3128
- '22#.#75.239.157':3128
- '22#.#75.240.8':3128
- '19#.#00.38.34':3128
- '31.##.209.79':3128
- '12#.#40.101.70':3128
- '22#.#75.240.198':3128
- '95.##.30.154':3128
- '62.#8.36.93':3128
- '78.##.242.233':3128
- '22#.#75.241.159':3128
- '11#.#41.96.161':3128
- '31.##.159.131':3128
- '21#.#47.190.65':3128
- '22#.#75.227.122':3128
- '22#.#75.227.232':3128
- '41.##3.57.72':3128
- '79.##4.73.203':3128
- '77.##1.241.91':3128
- '22#.#75.239.198':3128
- '14.##2.137.127':3128
- '22#.#75.227.42':3128
- '22#.#75.240.170':3128
- '19#.48.7.85':3128
- '22#.#75.234.247':3128
- '11#.#54.61.230':3128
- '10#.#51.117.101':3128
- '11#.#54.68.132':3128
- '93.##6.96.102':3128
- '11#.#54.54.192':3128
- '22#.#75.242.128':3128
- '41.##2.117.211':3128
- '22#.#75.227.88':3128
- '11#.#8.49.135':3128
- '11#.#8.11.132':3128
- '18#.#0.219.155':3128
- '22#.#75.240.124':3128
- '21#.#5.88.163':3128
- '11#.#9.135.241':3128
- '11#.#40.211.178':3128
- '11#.#6.157.83':3128
- '11#.#04.79.19':3128
- '41.#01.50.0':3128
- '22#.#75.240.42':3128
- '22#.#75.239.50':3128
- '46.##.89.134':3128
- '82.##2.103.247':3128
- '18#.#.19.183':3128
- '18#.#15.194.238':3128
- '22#.#75.239.152':3128
- '41.##3.57.76':3128
- '11#.#55.113.253':3128
- '18#.#13.130.42':3128
- '31.##.77.243':3128
- '11#.#52.105.162':3128
- '46.##7.220.58':3128
- '22#.#75.239.16':3128
- '89.##3.98.138':3128
- '22#.#75.233.190':3128
- '87.##1.11.113':3128
- '78.##9.136.88':3128
- '94.#3.69.3':3128
- '17#.#27.56.6':3128
- '79.##7.47.197':3128
- '22#.#75.240.179':3128
- '19#.#6.196.3':3128
- '19#.#0.161.143':3128
- '41.##5.8.190':3128
- '11#.#54.151.231':3128
- '18#.#78.187.136':3128
- '95.##.161.67':3128
- '18#.#34.91.138':3128
- '77.##7.173.225':3128
- '19#.#13.228.206':3128
- '94.##6.202.176':3128
- '22#.#75.240.90':3128
- '11#.#54.181.128':3128
- '95.##.88.244':3128
- '22#.#55.225.75':3128
- '77.##3.164.190':3128
- '22#.#75.240.197':3128
- '22#.#75.233.143':3128
- '19#.#88.83.73':3128
- '22#.#75.233.53':3128
- '59.##3.24.245':3128
- '46.##.183.178':3128
- '93.##6.154.250':3128
- '77.##1.214.126':3128
- '11#.#54.56.6':3128
- '17#.#20.155.188':3128
- '22#.#75.242.182':3128
- '21#.#.71.148':3128
- '18#.#2.152.60':3128
- '22#.#75.234.38':3128
- '17#.#22.83.233':3128
- '93.#3.8.191':3128
- '22#.#75.233.116':3128
- '61.#63.14.5':3128
- ClassName: 'Indicator' WindowName: ''