Техническая информация
Для обеспечения автозапуска и распространения
Создает или изменяет следующие файлы
- %APPDATA%\microsoft\windows\start menu\programs\startup\svchostsw.exe
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\s.bat
- %TEMP%\<Имя файла>.exe.pid
Сетевая активность
TCP
Запросы HTTP GET
- http://19#.##.167.130:8081/bots/chkVersion?cu####################
- http://19#.##.167.130:8081/project/active
- http://19#.##.167.130:8081/bots/knock?wo######################################
- http://19#.##.167.130:8081/gw?wo###############
- http://19#.##.167.130:8081/gw?wo#######################
- http://19#.##.167.130:8081/gw?wo#####################
- http://ad###.myedate.com/index.php?r=############
UDP
- DNS ASK ad###.myedate.com
- DNS ASK ad###.smp72.su
- DNS ASK ad###.#napfireworks.com
- DNS ASK ad###.sobol-mex.ru
- DNS ASK ad###.#ocialcanal.com
- DNS ASK ad###.sohacoin.vn
- DNS ASK ad###.solvari.nl
- DNS ASK no####fireworks.com
- DNS ASK ad###.sommerskov.se
- DNS ASK ad###.#ortcentre.com
- DNS ASK ad###.#os-swim.co.uk
- DNS ASK ad###.##ulstarclothing.com
- DNS ASK ad###.soundstore.nl
- DNS ASK ad###.sparmaxx.de
- DNS ASK ad###.##orthaus-gehrmann.de
- DNS ASK ad###.#lijpexpert.nl
- DNS ASK ad###.smartgate.vn
- DNS ASK ad###.#kogstadsport.no
- DNS ASK ad###.###lvkansla.sommerskov.se
- DNS ASK ad###.simuwelt.de
- DNS ASK ad###.##olservice-shop.dk
- DNS ASK ad###.#oppyshop.org.uk
- DNS ASK ad###.##actice-studio74.ru
- DNS ASK ad###.pradam.com
- DNS ASK ad###.#repaid24.co.za
- DNS ASK ad###.#rezentokracja.pl
- DNS ASK ad###.#tag.admon.com.vn
- DNS ASK ad###.#ortcenter.com
- DNS ASK ad###.#rimetime-kids.ru
- DNS ASK ad###.prizle.com
- DNS ASK ad###.##eger-trophaeen.com
- DNS ASK ad###.##eger-trophaeen.de
- DNS ASK ad###.##eger-trophaen.com
- DNS ASK ad###.##eger-trophaen.de
- DNS ASK ad###.silkn.co.il
- DNS ASK ad###.pokerguild.jp
- DNS ASK ad###.##imetime-russia.ru
- DNS ASK ad###.##andard-schmuck.de
- DNS ASK ad###.stargreen.com
- DNS ASK ad###.starshop.com
- DNS ASK ad###.symbol.ua
- DNS ASK ad###.#zkolka-smolin.pl
- DNS ASK ad###.#-mobilepr.com
- DNS ASK ad###.#abinaka.co.jp
- DNS ASK ad###.###ticalgeartrade.co.uk
- DNS ASK ad###.##cticalgeartrade.com
- DNS ASK ad###.#alkthisway.de
- DNS ASK ad###.###akaautopecas.com.br
- DNS ASK ad###.#okale-kaufen.de
- DNS ASK ad###.tbac.co.za
- DNS ASK ad###.##amsportfabriek.nl
- DNS ASK ad###.teamv20.com
- DNS ASK ad###.teds.com.au
- DNS ASK ad###.teleguru.pl
- DNS ASK ad###.telestar.bg
- DNS ASK ad###.testjezelf.nu
- DNS ASK ad###.#wopperexperte.de
- DNS ASK ad###.#tudioceizer.com
- DNS ASK ad###.##opper-experten.de
- DNS ASK ad###.#tructionsite.com
- DNS ASK ad###.stasgroup.jp
- DNS ASK ad###.##einperlenwelt.de
- DNS ASK ad###.#tev-b.markita.nl
- DNS ASK ad###.stilnest.com
- DNS ASK ad###.####e.chrisyoungcountry.com
- DNS ASK ad###.###re.passionspirits.com
- DNS ASK ad###.#toryonline.co.il
- DNS ASK ad###.#ettau-shop.de
- DNS ASK ad###.#usiefaulks.co.uk
- DNS ASK ad###.studyapt.com
- DNS ASK ad###.success.com
- DNS ASK ad###.suppastore.de
- DNS ASK ad###.#uppliesnow.com
- DNS ASK ad###.#upplychimp.com
- DNS ASK ad###.#urplus-shop.de
- DNS ASK ad###.####nreglin.infinitusbiz.com
- DNS ASK ad###.##apoforniture.com
- DNS ASK ad###.tally-ho.nl
- DNS ASK ad###.#okal-kaufen.de
- DNS ASK ad###.#hilippelebac.cn
- DNS ASK ad###.novamobler.dk
- DNS ASK ad###.nrastore.com
- DNS ASK ad###.nrpsport.no
- DNS ASK ad###.#utritrimkit.com
- DNS ASK ad###.##kotopia-verlag.at
- DNS ASK ad###.##kotopia-verlag.ch
- DNS ASK ad###.#artywarszawa.pl
- DNS ASK ad###.##kotopia-verlag.de
- DNS ASK ad###.ogrodnicy.net
- DNS ASK ad###.##gediertewinkel.be
- DNS ASK ad###.##gediertewinkel.nl
- DNS ASK ad###.##linekabelshop.nl
- DNS ASK ad###.op-clogs.de
- DNS ASK ad###.opshopapp.com
- DNS ASK ad###.##namefireworks.com
- DNS ASK ad###.nongline.com
- DNS ASK ad###.nlotv.com
- DNS ASK ad###.#inatorina.com
- DNS ASK ad###.#ikkibradford.com
- DNS ASK ad###.##pferdefutter.com
- DNS ASK ad###.#ypferdefutter.de
- DNS ASK ad###.##riadmycology.com
- DNS ASK ad###.mytyent.com
- DNS ASK ad###.#ahtmaterial.info
- DNS ASK ad###.#akedwardrobe.com
- DNS ASK ad###.orangenews.hk
- DNS ASK ad###.ofnvrsk.ru
- DNS ASK ad###.#apcosecurity.com
- DNS ASK ad###.neerus.com
- DNS ASK ad###.netmoroz.ru
- DNS ASK ad###.#etpages.co.za
- DNS ASK ad###.netsso.cn
- DNS ASK ad###.newbalance.ua
- DNS ASK ad###.#ewbeing.org.hk
- DNS ASK ad###.##merchantdata.com
- DNS ASK ad###.###urahealthproducts.com
- DNS ASK ad###.##igineelkadootje.com
- DNS ASK ad###.ostelife.ru
- DNS ASK ad###.ouipetit.com
- DNS ASK ad###.####onalisedchampagne.london
- DNS ASK ad###.perwood.de
- DNS ASK ad###.#etspremium.de
- DNS ASK ad###.#flege-depot.de
- DNS ASK ad###.pflmma.com
- DNS ASK ad###.pharao24.de
- DNS ASK ad###.#harmaklik.com
- DNS ASK ad###.###newater.mytyent.com
- DNS ASK ad###.plugwise.jp
- DNS ASK ad###.#honecase24.de
- DNS ASK ad###.piccola.co.uk
- DNS ASK ad###.piest.nl
- DNS ASK ad###.pinospa.com
- DNS ASK ad###.#ivotalgear.com
- DNS ASK ad###.nord24.ru
- DNS ASK ad###.#laybacknow.com
- DNS ASK ad###.#erfumetrader.de
- DNS ASK ad###.parcl.com
- DNS ASK ad###.pelushop.com
- DNS ASK ad###.##rapeluqueros.com
- DNS ASK ad###.#utletkids.co.uk
- DNS ASK ad###.#wensdiy.co.uk
- DNS ASK ad###.p2b.finance
- DNS ASK ad###.#acklinq.co.uk
- DNS ASK ad###.###mettostatearmory.com
- DNS ASK ad###.#andjtrading.com
- DNS ASK ad###.#aradisowinkel.nl
- DNS ASK ad###.#lotterexpress.de
- DNS ASK ad###.payke.co.jp
- DNS ASK ad###.#arfumswinkel.nl
- DNS ASK ad###.paricop.com
- DNS ASK ad###.##rker-anderson.org
- DNS ASK ad###.partydeko.de
- DNS ASK ad###.##rtytentenoutlet.nl
- DNS ASK ad###.##ssionspirits.com
- DNS ASK ad###.###netradiooffers.co.uk
- DNS ASK ad###.###epairsruncorn.co.uk
- DNS ASK ad###.#hatspersonal.com
Другое
Создает и запускает на исполнение
- '%WINDIR%\syswow64\cmd.exe' /Q /C <LS_APPDATA>\Temp/s.bat' (со скрытым окном)
Запускает на исполнение
- '%WINDIR%\syswow64\cmd.exe' /Q /C <LS_APPDATA>\Temp/s.bat
