Техническая информация
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\ptsacr.js
Сетевая активность
TCP
Запросы HTTP GET
- http://wo###tters.com/4njoCt
- http://dl###curity.com/xCNaXQ
- http://ro####rttrading.com/4EACI8
- http://re###aby.com.br/oysz46
- http://kl###odel.com/HxZ5Ay
- http://ko###gmem.net/bTt1eI
- http://fa###xwigs.com/AYLsw1
- http://st####ersafety.com/wYd63k
- http://pd###gical.com/9KXOlp
- http://bi####dalshop.com/RzYisV
- http://bi####blication.com/7tXlx8
- http://ba###aran.com/Fl9RsP
- http://el###sup.com/kZ0mwu
- http://ga####stickshop.com/BRYyEQ
- http://mm###lhi.com/F1h5LI
- http://ca##oxy.com/7YnKvu
UDP
- DNS ASK wo###tters.com
- DNS ASK mm###lhi.com
- DNS ASK ga####stickshop.com
- DNS ASK on####eprint.com
- DNS ASK el###sup.com
- DNS ASK el####ing-wedge.com
- DNS ASK ba###aran.com
- DNS ASK bi####blication.com
- DNS ASK bi####dalshop.com
- DNS ASK el###woman.es
- DNS ASK pd###gical.com
- DNS ASK st####ersafety.com
- DNS ASK co####caldas.com
- DNS ASK fa###xwigs.com
- DNS ASK ph###tphcm.com
- DNS ASK ko###gmem.net
- DNS ASK wo####in-style.com
- DNS ASK ic####eans.com.br
- DNS ASK re###aby.com.br
- DNS ASK mi###et.com.br
- DNS ASK fl######turabouquet.com.br
- DNS ASK sh####ackers.com
- DNS ASK ll####sstore.com
- DNS ASK la##ven.com
- DNS ASK j2####ing.com.sg
- DNS ASK ro####rttrading.com
- DNS ASK ho###-hanoi.com
- DNS ASK dl###curity.com
- DNS ASK 1n###print.com
- DNS ASK kl###odel.com
- DNS ASK ca##oxy.com
Другое
Создает и запускает на исполнение
- '<SYSTEM32>\wscript.exe' %TEMP%\PTsACR.js
