Техническая информация
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\frcjbb.js
- %TEMP%\82236.47728007083.exe
- %TEMP%\69019.2371194349.exe
Сетевая активность
TCP
Запросы HTTP GET
- http://ga####stickshop.com/BRYyEQ
- http://st#######ndstonesjewelry.com/iJX0w5
- http://hk##sh.com/F4Q1l6
- http://an###store.com/QURZh9
- http://to###main.io/KT1sSc
- http://sm####ownfarm.com/USmcHe
- http://no####rothers.com/tbjMPd
- http://ta###ciadam.com/NhLUBj
- http://re###aby.com.br/oysz46
- http://ru##way.com/4kbUpq
- http://lo###ty.co.uk/iPJuB8
- http://eu###trands.com/EcoSIG
- http://gi###dream.com/5GJcXK
- http://sp####haicafe.com/4I9bwO
- http://mm###lhi.com/F1h5LI
- http://or####tags.co.uk/BRgn0x
- http://mo#####tika-shop.com/6tjHz8
UDP
- DNS ASK ra####suit.com.au
- DNS ASK th####neleasing.sg
- DNS ASK fa####nkumbh.com
- DNS ASK la####everyone.com
- DNS ASK mi###et.com.br
- DNS ASK br####icial.com.br
- DNS ASK in####jules.co.uk
- DNS ASK ec##ers.com
- DNS ASK bo####lewes.co.uk
- DNS ASK ma##ey.com
- DNS ASK to###main.io
- DNS ASK an###store.com
- DNS ASK hk##sh.com
- DNS ASK fl###rio.com.br
- DNS ASK re###mlane.com
- DNS ASK st#######ndstonesjewelry.com
- DNS ASK ta###ciadam.com
- DNS ASK at###ross.com
- DNS ASK hu#####etrtrainer.com
- DNS ASK sm####ownfarm.com
- DNS ASK lo###ty.co.uk
- DNS ASK ga####stickshop.com
- DNS ASK mm###lhi.com
- DNS ASK sp####haicafe.com
- DNS ASK in####t-logic.com
- DNS ASK gi###dream.com
- DNS ASK eu###trands.com
- DNS ASK ph###tphcm.com
- DNS ASK me###ashion.com
- DNS ASK no####rothers.com
- DNS ASK ru##way.com
- DNS ASK by##t.in
- DNS ASK po###chi.com
- DNS ASK pe#####buyutuculer.com
- DNS ASK or####tags.co.uk
- DNS ASK re###aby.com.br
- DNS ASK 1n###print.com
- DNS ASK di#####tershop.co.uk
- DNS ASK mo#####tika-shop.com
Другое
Создает и запускает на исполнение
- '<SYSTEM32>\wscript.exe' %TEMP%\frcJBb.js
