Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Firewall Shell Assistant File Connections Peer' = 'C:\fpt2v6w\edxdioonkei.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\SSDP Proxy UPnP Client Spooler] 'ImagePath' = 'C:\fpt2v6w\edxdioonkei.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\SSDP Proxy UPnP Client Spooler] 'Start' = '00000002'
Изменения в файловой системе:
Создает следующие файлы:
- C:\fpt2v6w\edxdioonkei.exe
- C:\fpt2v6w\ghdpp15.exe
- C:\fpt2v6w\mwn1vw
- %WINDIR%\fpt2v6w\ucgilmtjrr
- C:\fpt2v6w\ucgilmtjrr
- C:\fpt2v6w\nq4smb03myepmwkcobd.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\fpt2v6w\ghdpp15.exe
- C:\fpt2v6w\edxdioonkei.exe
Удаляет следующие файлы:
- C:\fpt2v6w\nq4smb03myepmwkcobd.exe
- %WINDIR%\fpt2v6w\ucgilmtjrr
Подменяет следующие файлы:
- %WINDIR%\fpt2v6w\ucgilmtjrr
Сетевая активность:
Подключается к:
- 'ma#####iantallulah.net':80
- 'ki#####eecathleen.net':80
- 'ma#####iancathleen.net':80
- 'ki#####eetallulah.net':80
- 'ca#####namarianna.net':80
- 'ki#####eecharleen.net':80
- 'ma#####iancharleen.net':80
- 'ca#####ratallulah.net':80
- 'kr#####hertallulah.net':80
- 'ca#####racathleen.net':80
- 'kr#####hercharleen.net':80
- 'ki#####eemarianna.net':80
- 'ma#####ianmarianna.net':80
- 'ca#####racharleen.net':80
- 'an#####tecathleen.net':80
- 'ma#####nemarianna.net':80
- 'an#####temarianna.net':80
- 'ma#####necathleen.net':80
- 'an#####techarleen.net':80
- 'ma#####netallulah.net':80
- 'an#####tetallulah.net':80
- 'ca#####necathleen.net':80
- 'ca#####nacathleen.net':80
- 'ca#####nemarianna.net':80
- 'ca#####natallulah.net':80
- 'ca#####necharleen.net':80
- 'ca#####nacharleen.net':80
- 'ca#####netallulah.net':80
- 'kr#####hercathleen.net':80
- 'gl#####lejessamyn.net':80
- 'ki#####ynjessamyn.net':80
- 'gl#####lekatheryn.net':80
- 'je#####nejessalyn.net':80
- 'ge#####vecalleigh.net':80
- 'je#####necalleigh.net':80
- 'ge#####vejessalyn.net':80
- 'ki#####ynjessalyn.net':80
- 'st#####iejessamyn.net':80
- 'ch#####tejessamyn.net':80
- 'gl#####lejessalyn.net':80
- 'ki#####ynkatheryn.net':80
- 'gl#####lecalleigh.net':80
- 'ki#####yncalleigh.net':80
- 'ma#####kekatheryn.net':80
- 'ze#####ahkatheryn.net':80
- 'ma#####kecalleigh.net':80
- 'ze#####ahjessamyn.net':80
- 'ca#####ramarianna.net':80
- 'kr#####hermarianna.net':80
- 'ma#####kejessamyn.net':80
- 'je#####nejessamyn.net':80
- 'ge#####vekatheryn.net':80
- 'je#####nekatheryn.net':80
- 'ge#####vejessamyn.net':80
- 'ze#####ahcalleigh.net':80
- 'ma#####kejessalyn.net':80
- 'ze#####ahjessalyn.net':80
TCP:
Запросы HTTP GET:
- http://ma#####iantallulah.net/index.php
- http://ki#####eecathleen.net/index.php
- http://ma#####iancathleen.net/index.php
- http://ki#####eetallulah.net/index.php
- http://ca#####namarianna.net/index.php
- http://ki#####eecharleen.net/index.php
- http://ma#####iancharleen.net/index.php
- http://ca#####ratallulah.net/index.php
- http://kr#####hertallulah.net/index.php
- http://ca#####racathleen.net/index.php
- http://kr#####hercharleen.net/index.php
- http://ki#####eemarianna.net/index.php
- http://ma#####ianmarianna.net/index.php
- http://ca#####racharleen.net/index.php
- http://an#####tecathleen.net/index.php
- http://ma#####nemarianna.net/index.php
- http://an#####temarianna.net/index.php
- http://ma#####necathleen.net/index.php
- http://an#####techarleen.net/index.php
- http://ma#####netallulah.net/index.php
- http://an#####tetallulah.net/index.php
- http://ca#####necathleen.net/index.php
- http://ca#####nacathleen.net/index.php
- http://ca#####nemarianna.net/index.php
- http://ca#####natallulah.net/index.php
- http://ca#####necharleen.net/index.php
- http://ca#####nacharleen.net/index.php
- http://ca#####netallulah.net/index.php
- http://kr#####hercathleen.net/index.php
- http://gl#####lejessamyn.net/index.php
- http://ki#####ynjessamyn.net/index.php
- http://gl#####lekatheryn.net/index.php
- http://je#####nejessalyn.net/index.php
- http://ge#####vecalleigh.net/index.php
- http://je#####necalleigh.net/index.php
- http://ge#####vejessalyn.net/index.php
- http://ki#####ynjessalyn.net/index.php
- http://st#####iejessamyn.net/index.php
- http://ch#####tejessamyn.net/index.php
- http://gl#####lejessalyn.net/index.php
- http://ki#####ynkatheryn.net/index.php
- http://gl#####lecalleigh.net/index.php
- http://ki#####yncalleigh.net/index.php
- http://ma#####kekatheryn.net/index.php
- http://ze#####ahkatheryn.net/index.php
- http://ma#####kecalleigh.net/index.php
- http://ze#####ahjessamyn.net/index.php
- http://ca#####ramarianna.net/index.php
- http://kr#####hermarianna.net/index.php
- http://ma#####kejessamyn.net/index.php
- http://je#####nejessamyn.net/index.php
- http://ge#####vekatheryn.net/index.php
- http://je#####nekatheryn.net/index.php
- http://ge#####vejessamyn.net/index.php
- http://ze#####ahcalleigh.net/index.php
- http://ma#####kejessalyn.net/index.php
- http://ze#####ahjessalyn.net/index.php
UDP:
- DNS ASK ma#####iantallulah.net
- DNS ASK ki#####eecathleen.net
- DNS ASK ma#####iancathleen.net
- DNS ASK ki#####eetallulah.net
- DNS ASK ca#####namarianna.net
- DNS ASK ki#####eecharleen.net
- DNS ASK ma#####iancharleen.net
- DNS ASK ca#####ratallulah.net
- DNS ASK kr#####hertallulah.net
- DNS ASK ca#####racathleen.net
- DNS ASK kr#####hercharleen.net
- DNS ASK ki#####eemarianna.net
- DNS ASK ma#####ianmarianna.net
- DNS ASK ca#####racharleen.net
- DNS ASK ca#####nemarianna.net
- DNS ASK ma#####necathleen.net
- DNS ASK an#####tecathleen.net
- DNS ASK ma#####nemarianna.net
- DNS ASK an#####tetallulah.net
- DNS ASK ma#####necharleen.net
- DNS ASK an#####techarleen.net
- DNS ASK ma#####netallulah.net
- DNS ASK ca#####natallulah.net
- DNS ASK ca#####necathleen.net
- DNS ASK ca#####nacathleen.net
- DNS ASK ca#####netallulah.net
- DNS ASK an#####temarianna.net
- DNS ASK ca#####necharleen.net
- DNS ASK ca#####nacharleen.net
- DNS ASK gl#####lejessamyn.net
- DNS ASK ki#####ynjessamyn.net
- DNS ASK gl#####lekatheryn.net
- DNS ASK je#####nejessalyn.net
- DNS ASK ge#####vecalleigh.net
- DNS ASK je#####necalleigh.net
- DNS ASK ge#####vejessalyn.net
- DNS ASK ki#####ynjessalyn.net
- DNS ASK st#####iejessamyn.net
- DNS ASK ch#####tejessamyn.net
- DNS ASK gl#####lejessalyn.net
- DNS ASK ki#####ynkatheryn.net
- DNS ASK gl#####lecalleigh.net
- DNS ASK ki#####yncalleigh.net
- DNS ASK je#####nekatheryn.net
- DNS ASK ze#####ahjessamyn.net
- DNS ASK ma#####kekatheryn.net
- DNS ASK ze#####ahkatheryn.net
- DNS ASK ma#####kejessamyn.net
- DNS ASK kr#####hercathleen.net
- DNS ASK ca#####ramarianna.net
- DNS ASK kr#####hermarianna.net
- DNS ASK ge#####vejessamyn.net
- DNS ASK je#####nejessamyn.net
- DNS ASK ge#####vekatheryn.net
- DNS ASK ze#####ahjessalyn.net
- DNS ASK ma#####kecalleigh.net
- DNS ASK ze#####ahcalleigh.net
- DNS ASK ma#####kejessalyn.net
Другое:
Создает и запускает на исполнение:
- 'C:\fpt2v6w\ghdpp15.exe' "c:\fpt2v6w\edxdioonkei.exe"
- 'C:\fpt2v6w\edxdioonkei.exe'
- 'C:\fpt2v6w\nq4smb03myepmwkcobd.exe'
