Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Store Debugger Office CNG Filtering SPP IKE' = 'C:\rwgoagdhdshv\xfuwpahxgn.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Port Access Tools Bluetooth] 'ImagePath' = 'C:\rwgoagdhdshv\xfuwpahxgn.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Port Access Tools Bluetooth] 'Start' = '00000002'
Изменения в файловой системе:
Создает следующие файлы:
- C:\rwgoagdhdshv\xfuwpahxgn.exe
- C:\rwgoagdhdshv\pbpkcqmz.exe
- C:\rwgoagdhdshv\hg3kk30sow4ucqbxanct.exe
- %WINDIR%\rwgoagdhdshv\pv5gtqw
- C:\rwgoagdhdshv\pv5gtqw
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\rwgoagdhdshv\pbpkcqmz.exe
- C:\rwgoagdhdshv\xfuwpahxgn.exe
Удаляет следующие файлы:
- C:\rwgoagdhdshv\hg3kk30sow4ucqbxanct.exe
- %WINDIR%\rwgoagdhdshv\pv5gtqw
Подменяет следующие файлы:
- %WINDIR%\rwgoagdhdshv\pv5gtqw
Сетевая активность:
Подключается к:
- 'am####father.net':80
- 'hi####ycarry.net':80
- 'st####ecarry.net':80
- 'we####rapple.net':80
- 'am###tapple.net':80
- 'we####rfather.net':80
- 'st####eapple.net':80
- 'hi####yfather.net':80
- 'st####efather.net':80
- 'hi####ybuilt.net':80
- 'st####ebuilt.net':80
- 'hi####yapple.net':80
- 'am###tbuilt.net':80
- 'cl###built.net':80
- 'th###built.net':80
- 'cl###apple.net':80
- 'th####easure.net':80
- 'cl###carry.net':80
- 'th###carry.net':80
- 'we####rcarry.net':80
- 'am###tcarry.net':80
- 'we####rbuilt.net':80
- 'th###apple.net':80
- 'cl###father.net':80
- 'th###father.net':80
- 'al###carry.net':80
- 'of###carry.net':80
- 'al###built.net':80
- 'mi###eapple.net':80
- 'tw####father.net':80
- 'mi####father.net':80
- 'al###father.net':80
- 'of###father.net':80
- 'co####ecarry.net':80
- 'of###built.net':80
- 'al###apple.net':80
- 'of###apple.net':80
- 'tw###eapple.net':80
- 'ra###rbuilt.net':80
- 'mo####gapple.net':80
- 'ra###rapple.net':80
- 'mo####gcarry.net':80
- 'ra###rcarry.net':80
- 'mo####gbuilt.net':80
- 'mi###ecarry.net':80
- 'tw###ebuilt.net':80
- 'mi###ebuilt.net':80
- 'mo####gfather.net':80
- 'ra####father.net':80
- 'tw###ecarry.net':80
TCP:
Запросы HTTP GET:
- http://am####father.net/index.php
- http://hi####ycarry.net/index.php
- http://st####ecarry.net/index.php
- http://we####rapple.net/index.php
- http://am###tapple.net/index.php
- http://we####rfather.net/index.php
- http://st####eapple.net/index.php
- http://hi####yfather.net/index.php
- http://st####efather.net/index.php
- http://hi####ybuilt.net/index.php
- http://st####ebuilt.net/index.php
- http://hi####yapple.net/index.php
- http://am###tbuilt.net/index.php
- http://cl###built.net/index.php
- http://th###built.net/index.php
- http://cl###apple.net/index.php
- http://th####easure.net/index.php
- http://cl###carry.net/index.php
- http://th###carry.net/index.php
- http://we####rcarry.net/index.php
- http://am###tcarry.net/index.php
- http://we####rbuilt.net/index.php
- http://th###apple.net/index.php
- http://cl###father.net/index.php
- http://th###father.net/index.php
- http://al###carry.net/index.php
- http://of###carry.net/index.php
- http://al###built.net/index.php
- http://mi###eapple.net/index.php
- http://tw####father.net/index.php
- http://mi####father.net/index.php
- http://al###father.net/index.php
- http://of###father.net/index.php
- http://co####ecarry.net/index.php
- http://of###built.net/index.php
- http://al###apple.net/index.php
- http://of###apple.net/index.php
- http://tw###eapple.net/index.php
- http://ra###rbuilt.net/index.php
- http://mo####gapple.net/index.php
- http://ra###rapple.net/index.php
- http://mo####gcarry.net/index.php
- http://ra###rcarry.net/index.php
- http://mo####gbuilt.net/index.php
- http://mi###ecarry.net/index.php
- http://tw###ebuilt.net/index.php
- http://mi###ebuilt.net/index.php
- http://mo####gfather.net/index.php
- http://ra####father.net/index.php
- http://tw###ecarry.net/index.php
UDP:
- DNS ASK we####rfather.net
- DNS ASK am####father.net
- DNS ASK hi####ycarry.net
- DNS ASK am###tbuilt.net
- DNS ASK we####rapple.net
- DNS ASK am###tapple.net
- DNS ASK hi####yapple.net
- DNS ASK st####eapple.net
- DNS ASK hi####yfather.net
- DNS ASK st####ecarry.net
- DNS ASK hi####ybuilt.net
- DNS ASK st####ebuilt.net
- DNS ASK we####rbuilt.net
- DNS ASK th###carry.net
- DNS ASK cl###built.net
- DNS ASK th###built.net
- DNS ASK pr####tmeasure.net
- DNS ASK th####easure.net
- DNS ASK cl###carry.net
- DNS ASK th###father.net
- DNS ASK we####rcarry.net
- DNS ASK am###tcarry.net
- DNS ASK cl###apple.net
- DNS ASK th###apple.net
- DNS ASK cl###father.net
- DNS ASK st####efather.net
- DNS ASK al###carry.net
- DNS ASK of###carry.net
- DNS ASK al###built.net
- DNS ASK mi###eapple.net
- DNS ASK tw####father.net
- DNS ASK mi####father.net
- DNS ASK al###father.net
- DNS ASK of###father.net
- DNS ASK co####ecarry.net
- DNS ASK of###built.net
- DNS ASK al###apple.net
- DNS ASK of###apple.net
- DNS ASK tw###eapple.net
- DNS ASK ra###rbuilt.net
- DNS ASK mo####gapple.net
- DNS ASK ra###rapple.net
- DNS ASK mo####gcarry.net
- DNS ASK ra###rcarry.net
- DNS ASK mo####gbuilt.net
- DNS ASK mi###ecarry.net
- DNS ASK tw###ebuilt.net
- DNS ASK mi###ebuilt.net
- DNS ASK mo####gfather.net
- DNS ASK ra####father.net
- DNS ASK tw###ecarry.net
Другое:
Создает и запускает на исполнение:
- 'C:\rwgoagdhdshv\pbpkcqmz.exe' "c:\rwgoagdhdshv\xfuwpahxgn.exe"
- 'C:\rwgoagdhdshv\xfuwpahxgn.exe'
- 'C:\rwgoagdhdshv\hg3kk30sow4ucqbxanct.exe'
