Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Office Font Call AutoConfig VC' = 'C:\rxzsw9z\ahz3xz5gcm.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Transfer PnP-X Files Center Controls] 'ImagePath' = 'C:\rxzsw9z\ahz3xz5gcm.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Transfer PnP-X Files Center Controls] 'Start' = '00000002'
Вредоносные функции:
Запускает на исполнение:
- 'C:\rxzsw9z\yzq0bskyqdwy.exe' "c:\rxzsw9z\ahz3xz5gcm.exe"
- 'C:\rxzsw9z\ahz3xz5gcm.exe'
- 'C:\rxzsw9z\qst5xosn2uylzgyjkv2c5ze.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\rxzsw9z\ahz3xz5gcm.exe
- C:\rxzsw9z\yzq0bskyqdwy.exe
- C:\rxzsw9z\xairvz
- %WINDIR%\rxzsw9z\zcgow8efm32
- C:\rxzsw9z\zcgow8efm32
- C:\rxzsw9z\qst5xosn2uylzgyjkv2c5ze.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\rxzsw9z\yzq0bskyqdwy.exe
- C:\rxzsw9z\ahz3xz5gcm.exe
Удаляет следующие файлы:
- C:\rxzsw9z\qst5xosn2uylzgyjkv2c5ze.exe
- %WINDIR%\rxzsw9z\zcgow8efm32
Подменяет следующие файлы:
- %WINDIR%\rxzsw9z\zcgow8efm32
Сетевая активность:
Подключается к:
- 'ch#####leshaniqua.net':80
- 'ge#####nashaniqua.net':80
- 'ch#####leharmonie.net':80
- 'ge#####naveronica.net':80
- 'ch#####leanjelica.net':80
- 'ge#####naanjelica.net':80
- 'ge#####naharmonie.net':80
- 'ar#####ldanjelica.net':80
- 'za#####ahshaniqua.net':80
- 'ar#####ldshaniqua.net':80
- 'za#####ahveronica.net':80
- 'ar#####ldveronica.net':80
- 'za#####ahanjelica.net':80
- 'ch#####leveronica.net':80
- 'ch#####anharmonie.net':80
- 'gw#####reharmonie.net':80
- 'gu#####enveronica.net':80
- 'gw#####reanjelica.net':80
- 'ch#####anshaniqua.net':80
- 'gw#####reshaniqua.net':80
- 'an#####leveronica.net':80
- 'an#####leshaniqua.net':80
- 'gu#####enharmonie.net':80
- 'an#####leharmonie.net':80
- 'gu#####enanjelica.net':80
- 'an#####leanjelica.net':80
- 'gu#####enshaniqua.net':80
- 'am#####neharmonie.net':80
- 'al#####raveronica.net':80
- 'ma#####naveronica.net':80
- 'ce#####neshaniqua.net':80
- 'am#####neshaniqua.net':80
- 'ce#####neharmonie.net':80
- 'al#####raanjelica.net':80
- 'al#####raharmonie.net':80
- 'ma#####naharmonie.net':80
- 'al#####erveronica.net':80
- 'ma#####naanjelica.net':80
- 'al#####rashaniqua.net':80
- 'ma#####nashaniqua.net':80
- 'am#####neanjelica.net':80
- 'ch#####neveronica.net':80
- 'sh#####leanjelica.net':80
- 'ch#####neanjelica.net':80
- 'za#####ahharmonie.net':80
- 'ar#####ldharmonie.net':80
- 'sh#####leveronica.net':80
- 'sh#####leshaniqua.net':80
- 'ce#####neveronica.net':80
- 'am#####neveronica.net':80
- 'ce#####neanjelica.net':80
- 'ch#####neshaniqua.net':80
- 'sh#####leharmonie.net':80
- 'ch#####neharmonie.net':80
TCP:
Запросы HTTP GET:
- http://ch#####leshaniqua.net/index.php
- http://ge#####nashaniqua.net/index.php
- http://ch#####leharmonie.net/index.php
- http://ge#####naveronica.net/index.php
- http://ch#####leanjelica.net/index.php
- http://ge#####naanjelica.net/index.php
- http://ge#####naharmonie.net/index.php
- http://ar#####ldanjelica.net/index.php
- http://za#####ahshaniqua.net/index.php
- http://ar#####ldshaniqua.net/index.php
- http://za#####ahveronica.net/index.php
- http://ar#####ldveronica.net/index.php
- http://za#####ahanjelica.net/index.php
- http://ch#####leveronica.net/index.php
- http://ch#####anharmonie.net/index.php
- http://gw#####reharmonie.net/index.php
- http://gu#####enveronica.net/index.php
- http://gw#####reanjelica.net/index.php
- http://ch#####anshaniqua.net/index.php
- http://gw#####reshaniqua.net/index.php
- http://an#####leveronica.net/index.php
- http://an#####leshaniqua.net/index.php
- http://gu#####enharmonie.net/index.php
- http://an#####leharmonie.net/index.php
- http://gu#####enanjelica.net/index.php
- http://an#####leanjelica.net/index.php
- http://gu#####enshaniqua.net/index.php
- http://am#####neharmonie.net/index.php
- http://al#####raveronica.net/index.php
- http://ma#####naveronica.net/index.php
- http://ce#####neshaniqua.net/index.php
- http://am#####neshaniqua.net/index.php
- http://ce#####neharmonie.net/index.php
- http://al#####raanjelica.net/index.php
- http://al#####raharmonie.net/index.php
- http://ma#####naharmonie.net/index.php
- http://al#####erveronica.net/index.php
- http://ma#####naanjelica.net/index.php
- http://al#####rashaniqua.net/index.php
- http://ma#####nashaniqua.net/index.php
- http://am#####neanjelica.net/index.php
- http://ch#####neveronica.net/index.php
- http://sh#####leanjelica.net/index.php
- http://ch#####neanjelica.net/index.php
- http://za#####ahharmonie.net/index.php
- http://ar#####ldharmonie.net/index.php
- http://sh#####leveronica.net/index.php
- http://sh#####leshaniqua.net/index.php
- http://ce#####neveronica.net/index.php
- http://am#####neveronica.net/index.php
- http://ce#####neanjelica.net/index.php
- http://ch#####neshaniqua.net/index.php
- http://sh#####leharmonie.net/index.php
- http://ch#####neharmonie.net/index.php
UDP:
- DNS ASK ge#####naanjelica.net
- DNS ASK ch#####leshaniqua.net
- DNS ASK ge#####nashaniqua.net
- DNS ASK ch#####leveronica.net
- DNS ASK ge#####naveronica.net
- DNS ASK ch#####leanjelica.net
- DNS ASK ch#####leharmonie.net
- DNS ASK za#####ahanjelica.net
- DNS ASK ar#####ldanjelica.net
- DNS ASK za#####ahshaniqua.net
- DNS ASK ge#####naharmonie.net
- DNS ASK za#####ahveronica.net
- DNS ASK ar#####ldveronica.net
- DNS ASK an#####leharmonie.net
- DNS ASK gw#####reshaniqua.net
- DNS ASK ch#####anharmonie.net
- DNS ASK gw#####reharmonie.net
- DNS ASK ch#####ananjelica.net
- DNS ASK gw#####reanjelica.net
- DNS ASK ch#####anshaniqua.net
- DNS ASK gu#####enveronica.net
- DNS ASK gu#####enshaniqua.net
- DNS ASK an#####leshaniqua.net
- DNS ASK gu#####enharmonie.net
- DNS ASK an#####leveronica.net
- DNS ASK gu#####enanjelica.net
- DNS ASK an#####leanjelica.net
- DNS ASK ar#####ldshaniqua.net
- DNS ASK am#####neharmonie.net
- DNS ASK al#####raveronica.net
- DNS ASK ma#####naveronica.net
- DNS ASK ce#####neshaniqua.net
- DNS ASK am#####neshaniqua.net
- DNS ASK ce#####neharmonie.net
- DNS ASK al#####raanjelica.net
- DNS ASK al#####raharmonie.net
- DNS ASK ma#####naharmonie.net
- DNS ASK al#####erveronica.net
- DNS ASK ma#####naanjelica.net
- DNS ASK al#####rashaniqua.net
- DNS ASK ma#####nashaniqua.net
- DNS ASK am#####neanjelica.net
- DNS ASK ch#####neveronica.net
- DNS ASK sh#####leanjelica.net
- DNS ASK ch#####neanjelica.net
- DNS ASK za#####ahharmonie.net
- DNS ASK ar#####ldharmonie.net
- DNS ASK sh#####leveronica.net
- DNS ASK sh#####leshaniqua.net
- DNS ASK ce#####neveronica.net
- DNS ASK am#####neveronica.net
- DNS ASK ce#####neanjelica.net
- DNS ASK ch#####neshaniqua.net
- DNS ASK sh#####leharmonie.net
- DNS ASK ch#####neharmonie.net
