Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Networking Software Power Function Print Host' = 'C:\oumdbmoomagcg\fmwnjwpkwe.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Framework HomeGroup Brightness Search] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\Framework HomeGroup Brightness Search] 'ImagePath' = 'C:\oumdbmoomagcg\fmwnjwpkwe.exe'
Изменения в файловой системе:
Создает следующие файлы:
- %WINDIR%\oumdbmoomagcg\zyzboh
- C:\oumdbmoomagcg\zyzboh
- C:\oumdbmoomagcg\qb5j2qnnbygildvaso.exe
- C:\oumdbmoomagcg\fmwnjwpkwe.exe
- C:\oumdbmoomagcg\uewzfgx.exe
- C:\oumdbmoomagcg\ek5ohrmvgpj
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\oumdbmoomagcg\fmwnjwpkwe.exe
- C:\oumdbmoomagcg\uewzfgx.exe
Удаляет следующие файлы:
- %WINDIR%\oumdbmoomagcg\zyzboh
- C:\oumdbmoomagcg\qb5j2qnnbygildvaso.exe
Подменяет следующие файлы:
- %WINDIR%\oumdbmoomagcg\zyzboh
Сетевая активность:
Подключается к:
- 'pl####ntbicycle.net':80
- 'he###whose.net':80
- 'ge###ewhose.net':80
- 'va####sexcept.net':80
- 're####except.net':80
- 'va####sbridge.net':80
- 're####bridge.net':80
- 'va####sbicycle.net':80
- 're####bicycle.net':80
- 'va####swhose.net':80
- 're###nwhose.net':80
- 'de###ewagon.net':80
- 'fo####dwagon.net':80
- 'de####without.net':80
- 'fo####dwithout.net':80
- 'de####kitchen.net':80
- 'fo####dkitchen.net':80
- 'de####probable.net':80
- 'fo####dprobable.net':80
- 'an###rwagon.net':80
- 'gl###wagon.net':80
- 'an####without.net':80
- 'ge####bicycle.net':80
- 'gl####ithout.net':80
- 'he####icycle.net':80
- 'he###bridge.net':80
- 'ne#####rybicycle.net':80
- 'pl####ntwhose.net':80
- 'ne####arywhose.net':80
- 'or###except.net':80
- 're####eexcept.net':80
- 'or###bridge.net':80
- 're####ebridge.net':80
- 'or####icycle.net':80
- 're####ebicycle.net':80
- 'or###whose.net':80
- 're####ewhose.net':80
- 'le####except.net':80
- 'he####except.net':80
- 'le####bridge.net':80
- 'he####bridge.net':80
- 'le####bicycle.net':80
- 'he####bicycle.net':80
- 'le###rwhose.net':80
- 'he###nwhose.net':80
- 'he###except.net':80
- 'ge####except.net':80
- 'ge####bridge.net':80
- 'an####kitchen.net':80
TCP:
Запросы HTTP GET:
- http://pl####ntbicycle.net/index.php?me########
- http://he###whose.net/index.php?me########
- http://ge###ewhose.net/index.php?me########
- http://va####sexcept.net/index.php?me########
- http://re####except.net/index.php?me########
- http://va####sbridge.net/index.php?me########
- http://re####bridge.net/index.php?me########
- http://va####sbicycle.net/index.php?me########
- http://re####bicycle.net/index.php?me########
- http://va####swhose.net/index.php?me########
- http://re###nwhose.net/index.php?me########
- http://de###ewagon.net/index.php?me########
- http://fo####dwagon.net/index.php?me########
- http://de####without.net/index.php?me########
- http://fo####dwithout.net/index.php?me########
- http://de####kitchen.net/index.php?me########
- http://fo####dkitchen.net/index.php?me########
- http://de####probable.net/index.php?me########
- http://fo####dprobable.net/index.php?me########
- http://an###rwagon.net/index.php?me########
- http://gl###wagon.net/index.php?me########
- http://an####without.net/index.php?me########
- http://ge####bicycle.net/index.php?me########
- http://gl####ithout.net/index.php?me########
- http://he####icycle.net/index.php?me########
- http://he###bridge.net/index.php?me########
- http://ne#####rybicycle.net/index.php?me########
- http://pl####ntwhose.net/index.php?me########
- http://ne####arywhose.net/index.php?me########
- http://or###except.net/index.php?me########
- http://re####eexcept.net/index.php?me########
- http://or###bridge.net/index.php?me########
- http://re####ebridge.net/index.php?me########
- http://or####icycle.net/index.php?me########
- http://re####ebicycle.net/index.php?me########
- http://or###whose.net/index.php?me########
- http://re####ewhose.net/index.php?me########
- http://le####except.net/index.php?me########
- http://he####except.net/index.php?me########
- http://le####bridge.net/index.php?me########
- http://he####bridge.net/index.php?me########
- http://le####bicycle.net/index.php?me########
- http://he####bicycle.net/index.php?me########
- http://le###rwhose.net/index.php?me########
- http://he###nwhose.net/index.php?me########
- http://he###except.net/index.php?me########
- http://ge####except.net/index.php?me########
- http://ge####bridge.net/index.php?me########
- http://an####kitchen.net/index.php?me########
UDP:
- DNS ASK pl####ntbicycle.net
- DNS ASK va####sexcept.net
- DNS ASK re####except.net
- DNS ASK va####sbridge.net
- DNS ASK re####bridge.net
- DNS ASK va####sbicycle.net
- DNS ASK re####bicycle.net
- DNS ASK va####swhose.net
- DNS ASK re###nwhose.net
- DNS ASK de###ewagon.net
- DNS ASK le####except.net
- DNS ASK fo####dwagon.net
- DNS ASK fo####dwithout.net
- DNS ASK de####kitchen.net
- DNS ASK fo####dkitchen.net
- DNS ASK de####probable.net
- DNS ASK fo####dprobable.net
- DNS ASK an###rwagon.net
- DNS ASK gl###wagon.net
- DNS ASK an####without.net
- DNS ASK gl####ithout.net
- DNS ASK he###whose.net
- DNS ASK ge###ewhose.net
- DNS ASK ge####bicycle.net
- DNS ASK he####icycle.net
- DNS ASK ge####bridge.net
- DNS ASK pl####ntwhose.net
- DNS ASK ne####arywhose.net
- DNS ASK or###except.net
- DNS ASK re####eexcept.net
- DNS ASK or###bridge.net
- DNS ASK re####ebridge.net
- DNS ASK or####icycle.net
- DNS ASK re####ebicycle.net
- DNS ASK or###whose.net
- DNS ASK an####kitchen.net
- DNS ASK de####without.net
- DNS ASK re####ewhose.net
- DNS ASK le####bridge.net
- DNS ASK he####bridge.net
- DNS ASK le####bicycle.net
- DNS ASK he####bicycle.net
- DNS ASK le###rwhose.net
- DNS ASK he###nwhose.net
- DNS ASK he###except.net
- DNS ASK ge####except.net
- DNS ASK he###bridge.net
- DNS ASK ne#####rybicycle.net
- DNS ASK he####except.net
- DNS ASK gl####itchen.net
Другое:
Создает и запускает на исполнение:
- 'C:\oumdbmoomagcg\qb5j2qnnbygildvaso.exe'
- 'C:\oumdbmoomagcg\fmwnjwpkwe.exe'
- 'C:\oumdbmoomagcg\uewzfgx.exe' "c:\oumdbmoomagcg\fmwnjwpkwe.exe"
