Техническая информация
Для обеспечения автозапуска и распространения
Создает следующие сервисы
- [<HKLM>\System\CurrentControlSet\Services\Performance Auto-Discovery Quality Server] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\Performance Auto-Discovery Quality Server] 'ImagePath' = 'C:\idcjungnqyotqks\rytngzilbkwb.exe'
Изменения в файловой системе
Создает следующие файлы
- %WINDIR%\idcjungnqyotqks\pttc3o
- C:\idcjungnqyotqks\pttc3o
- C:\idcjungnqyotqks\bqfepw9lsyentlsbjid.exe
- C:\idcjungnqyotqks\rytngzilbkwb.exe
- C:\idcjungnqyotqks\unshvuxqjuq.exe
- C:\idcjungnqyotqks\spmdxxrq2
Присваивает атрибут 'скрытый' для следующих файлов
- C:\idcjungnqyotqks\rytngzilbkwb.exe
- C:\idcjungnqyotqks\unshvuxqjuq.exe
Удаляет следующие файлы
- %WINDIR%\idcjungnqyotqks\pttc3o
- C:\idcjungnqyotqks\bqfepw9lsyentlsbjid.exe
Подменяет следующие файлы
- %WINDIR%\idcjungnqyotqks\pttc3o
Сетевая активность
Подключается к
- 'le####office.net':80
TCP
Запросы HTTP GET
- http://di####ultshort.net/index.php
- http://ge####should.net/index.php
- http://fo####dsupply.net/index.php
- http://de####distance.net/index.php
- http://gl###office.net/index.php
- http://re####earrive.net/index.php
UDP
- DNS ASK th####hstraight.net
- DNS ASK an####distance.net
- DNS ASK gl###supply.net
- DNS ASK an####supply.net
- DNS ASK fo####darrive.net
- DNS ASK de####arrive.net
- DNS ASK fo####doffice.net
- DNS ASK de####office.net
- DNS ASK fo####ddistance.net
- DNS ASK de####distance.net
- DNS ASK fo####dsupply.net
- DNS ASK de####supply.net
- DNS ASK re####promise.net
- DNS ASK va####spromise.net
- DNS ASK va####sopinion.net
- DNS ASK an####office.net
- DNS ASK re###nshort.net
- DNS ASK va####sshort.net
- DNS ASK re####should.net
- DNS ASK va####sshould.net
- DNS ASK ge####promise.net
- DNS ASK ge####opinion.net
- DNS ASK ge###eshort.net
- DNS ASK ge####should.net
- DNS ASK he####promise.net
- DNS ASK le####promise.net
- DNS ASK he####opinion.net
- DNS ASK le####opinion.net
- DNS ASK re####opinion.net
- DNS ASK ne####aryshould.net
- DNS ASK gl###office.net
- DNS ASK le####distance.net
- DNS ASK he####supply.net
- DNS ASK le####supply.net
- DNS ASK re####earrive.net
- DNS ASK or###arrive.net
- DNS ASK re####eoffice.net
- DNS ASK or###office.net
- DNS ASK re####edistance.net
- DNS ASK or####istance.net
- DNS ASK re####esupply.net
- DNS ASK or###supply.net
- DNS ASK ne####aryarrive.net
- DNS ASK pl####ntarrive.net
- DNS ASK he###nshort.net
- DNS ASK gl####istance.net
- DNS ASK ne#####rydistance.net
- DNS ASK pl#####tdistance.net
- DNS ASK ne####arysupply.net
- DNS ASK pl####ntsupply.net
- DNS ASK he###arrive.net
- DNS ASK di####ultarrive.net
- DNS ASK he###office.net
- DNS ASK di####ultoffice.net
- DNS ASK he####istance.net
- DNS ASK di#####ltdistance.net
- DNS ASK he###supply.net
- DNS ASK di####ultsupply.net
- DNS ASK gl###arrive.net
- DNS ASK pl####ntoffice.net
- DNS ASK an####arrive.net
- DNS ASK le###rshort.net
- DNS ASK he####should.net
- DNS ASK le####should.net
- DNS ASK re#####rairplane.net
- DNS ASK de####promise.net
- DNS ASK fo####dopinion.net
- DNS ASK de####opinion.net
- DNS ASK fo####dshort.net
- DNS ASK de###eshort.net
- DNS ASK fo####dshould.net
- DNS ASK de####should.net
- DNS ASK re####erfence.net
- DNS ASK wo###fence.net
- DNS ASK re####erguard.net
- DNS ASK wo###guard.net
- DNS ASK re#####rstraight.net
- DNS ASK he####distance.net
- DNS ASK an####should.net
- DNS ASK wo####irplane.net
- DNS ASK in####sefence.net
- DNS ASK fo###tfence.net
- DNS ASK in####seguard.net
- DNS ASK fo###tguard.net
- DNS ASK in#####estraight.net
- DNS ASK fo####straight.net
- DNS ASK in#####eairplane.net
- DNS ASK fo####airplane.net
- DNS ASK th####hfence.net
- DNS ASK ef###tfence.net
- DNS ASK th####hguard.net
- DNS ASK ef###tguard.net
- DNS ASK wo####traight.net
- DNS ASK ne####aryoffice.net
- DNS ASK gl###should.net
- DNS ASK an####opinion.net
- DNS ASK an###rshort.net
- DNS ASK re####epromise.net
- DNS ASK or####romise.net
- DNS ASK re####eopinion.net
- DNS ASK or####pinion.net
- DNS ASK re####eshort.net
- DNS ASK or###short.net
- DNS ASK re####eshould.net
- DNS ASK or###should.net
- DNS ASK ne#####rypromise.net
- DNS ASK pl####ntpromise.net
- DNS ASK ne#####ryopinion.net
- DNS ASK pl####ntopinion.net
- DNS ASK gl###short.net
- DNS ASK ne####aryshort.net
- DNS ASK fo####dpromise.net
- DNS ASK pl####ntshould.net
- DNS ASK he####romise.net
- DNS ASK di#####ltpromise.net
- DNS ASK he####pinion.net
- DNS ASK di#####ltopinion.net
- DNS ASK he###short.net
- DNS ASK di####ultshort.net
- DNS ASK he###should.net
- DNS ASK di####ultshould.net
- DNS ASK gl####romise.net
- DNS ASK an####promise.net
- DNS ASK gl####pinion.net
- DNS ASK pl####ntshort.net
- DNS ASK le####office.net
Другое
Создает и запускает на исполнение
- 'C:\idcjungnqyotqks\bqfepw9lsyentlsbjid.exe'
- 'C:\idcjungnqyotqks\rytngzilbkwb.exe'
- 'C:\idcjungnqyotqks\unshvuxqjuq.exe' "c:\idcjungnqyotqks\rytngzilbkwb.exe"
