Техническая информация
Для обеспечения автозапуска и распространения
Устанавливает следующие настройки сервисов
- [<HKLM>\System\CurrentControlSet\Services\Launcher Source Hardware Call Policy] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\Launcher Source Hardware Call Policy] 'ImagePath' = 'C:\vqmyzthyknuqicg\ncnaeydj.exe'
Создает следующие сервисы
- 'Launcher Source Hardware Call Policy' C:\vqmyzthyknuqicg\ncnaeydj.exe
Изменения в файловой системе
Создает следующие файлы
- %WINDIR%\vqmyzthyknuqicg\vvcrc1f
- C:\vqmyzthyknuqicg\vvcrc1f
- C:\vqmyzthyknuqicg\gyjltn9c3trptlmzakt9y.exe
- C:\vqmyzthyknuqicg\ncnaeydj.exe
- C:\vqmyzthyknuqicg\lhqmdddzzm.exe
- C:\vqmyzthyknuqicg\p2lrchsoq
Присваивает атрибут 'скрытый' для следующих файлов
- C:\vqmyzthyknuqicg\ncnaeydj.exe
- C:\vqmyzthyknuqicg\lhqmdddzzm.exe
Удаляет следующие файлы
- %WINDIR%\vqmyzthyknuqicg\vvcrc1f
- C:\vqmyzthyknuqicg\gyjltn9c3trptlmzakt9y.exe
Подменяет следующие файлы
- %WINDIR%\vqmyzthyknuqicg\vvcrc1f
Сетевая активность
TCP
Запросы HTTP GET
- http://fa###ynorth.net/index.php
- http://ei###rhonor.net/index.php
- http://fa###ytrust.net/index.php
- http://fa####system.net/index.php
- http://fa###yhonor.net/index.php
- http://fi###etrust.net/index.php
- http://fi###ehonor.net/index.php
- http://fo####ntrust.net/index.php
- http://ma####etrust.net/index.php
- http://en####hbranch.net/index.php
- http://ch####enbelieve.net/index.php
- http://pi####ereceive.net/index.php
- http://fi####receive.net/index.php
- http://ma####ebelieve.net/index.php
- http://ex####quarter.net/index.php
- http://en####hinclude.net/index.php
- http://en####htrust.net/index.php
- http://fo####nfriend.net/index.php
UDP
- DNS ASK ch####ennorth.net
- DNS ASK th####neither.net
- DNS ASK fi####system.net
- DNS ASK th####system.net
- DNS ASK fi###etrust.net
- DNS ASK th###htrust.net
- DNS ASK pi####ehonor.net
- DNS ASK ci####ttehonor.net
- DNS ASK ch####ensystem.net
- DNS ASK pi####eneither.net
- DNS ASK pi####esystem.net
- DNS ASK ci####ttesystem.net
- DNS ASK pi####etrust.net
- DNS ASK ci####ttetrust.net
- DNS ASK ch####enhonor.net
- DNS ASK fa###yhonor.net
- DNS ASK ch####enneither.net
- DNS ASK th###hhonor.net
- DNS ASK fi####neither.net
- DNS ASK ci#####teneither.net
- DNS ASK fa####neither.net
- DNS ASK wh####rtrust.net
- DNS ASK ma####etrust.net
- DNS ASK su###nhonor.net
- DNS ASK fo####nhonor.net
- DNS ASK su####neither.net
- DNS ASK fo####nneither.net
- DNS ASK su####system.net
- DNS ASK fo####nsystem.net
- DNS ASK su###ntrust.net
- DNS ASK fo####ntrust.net
- DNS ASK wh####rhonor.net
- DNS ASK ri###honor.net
- DNS ASK wh####rneither.net
- DNS ASK ri####either.net
- DNS ASK wh####rsystem.net
- DNS ASK ri###system.net
- DNS ASK ri###trust.net
- DNS ASK ma####esystem.net
- DNS ASK fi###ehonor.net
- DNS ASK ci#####tebelieve.net
- DNS ASK fa####system.net
- DNS ASK ma####econsider.net
- DNS ASK ma####efriend.net
- DNS ASK su####laughter.net
- DNS ASK fo####nlaughter.net
- DNS ASK su###nfancy.net
- DNS ASK fo####nfancy.net
- DNS ASK su####consider.net
- DNS ASK fo####nconsider.net
- DNS ASK ch####entrust.net
- DNS ASK su####friend.net
- DNS ASK wh####rlaughter.net
- DNS ASK ri####aughter.net
- DNS ASK wh####rfancy.net
- DNS ASK ri###fancy.net
- DNS ASK wh####rconsider.net
- DNS ASK ri####onsider.net
- DNS ASK pe####consider.net
- DNS ASK ma####efancy.net
- DNS ASK pe####friend.net
- DNS ASK pe###nfancy.net
- DNS ASK ma####elaughter.net
- DNS ASK fa###ytrust.net
- DNS ASK en####hhonor.net
- DNS ASK ei####neither.net
- DNS ASK en####hneither.net
- DNS ASK ei####system.net
- DNS ASK en####hsystem.net
- DNS ASK ei###rtrust.net
- DNS ASK pe####system.net
- DNS ASK en####htrust.net
- DNS ASK pe###ntrust.net
- DNS ASK be####elaughter.net
- DNS ASK be####efancy.net
- DNS ASK ex####consider.net
- DNS ASK be####econsider.net
- DNS ASK ex####friend.net
- DNS ASK be####efriend.net
- DNS ASK pe####laughter.net
- DNS ASK ex####laughter.net
- DNS ASK ei###rhonor.net
- DNS ASK ex###tfancy.net
- DNS ASK ma####eneither.net
- DNS ASK pe####neither.net
- DNS ASK ma####ehonor.net
- DNS ASK ma####equarter.net
- DNS ASK su####branch.net
- DNS ASK fo####nbranch.net
- DNS ASK su####believe.net
- DNS ASK fo####nbelieve.net
- DNS ASK su####receive.net
- DNS ASK fo####nreceive.net
- DNS ASK su####quarter.net
- DNS ASK fo####nquarter.net
- DNS ASK wh####rbranch.net
- DNS ASK ri###branch.net
- DNS ASK wh####rbelieve.net
- DNS ASK ri####elieve.net
- DNS ASK wh####rreceive.net
- DNS ASK ri####eceive.net
- DNS ASK pe####receive.net
- DNS ASK pe####believe.net
- DNS ASK pe####quarter.net
- DNS ASK ma####ebelieve.net
- DNS ASK ma####ebranch.net
- DNS ASK ex####branch.net
- DNS ASK ei###rclear.net
- DNS ASK en####hclear.net
- DNS ASK ei####general.net
- DNS ASK en####hgeneral.net
- DNS ASK ei####include.net
- DNS ASK en####hinclude.net
- DNS ASK ei###rnorth.net
- DNS ASK wh####rquarter.net
- DNS ASK wh####rfriend.net
- DNS ASK en####hnorth.net
- DNS ASK ex####believe.net
- DNS ASK be####ebelieve.net
- DNS ASK ex####receive.net
- DNS ASK be####ereceive.net
- DNS ASK ex####quarter.net
- DNS ASK be####equarter.net
- DNS ASK pe####branch.net
- DNS ASK fa###ynorth.net
- DNS ASK be####ebranch.net
- DNS ASK fo####nfriend.net
- DNS ASK ri####uarter.net
- DNS ASK th####believe.net
- DNS ASK ei####believe.net
- DNS ASK en####hbelieve.net
- DNS ASK ei####receive.net
- DNS ASK en####hreceive.net
- DNS ASK ei####quarter.net
- DNS ASK en####hquarter.net
- DNS ASK ma####ereceive.net
- DNS ASK ex###thonor.net
- DNS ASK ex####neither.net
- DNS ASK be####eneither.net
- DNS ASK ex####system.net
- DNS ASK be####esystem.net
- DNS ASK ex###ttrust.net
- DNS ASK be####etrust.net
- DNS ASK pe###nhonor.net
- DNS ASK fa####quarter.net
- DNS ASK be####ehonor.net
- DNS ASK en####hbranch.net
- DNS ASK ei####branch.net
- DNS ASK ch####enquarter.net
- DNS ASK fa####receive.net
- DNS ASK fi####receive.net
- DNS ASK th####receive.net
- DNS ASK fi####quarter.net
- DNS ASK th####quarter.net
- DNS ASK pi####ebranch.net
- DNS ASK ci####ttebranch.net
- DNS ASK fi####branch.net
- DNS ASK pi####ebelieve.net
- DNS ASK th####branch.net
- DNS ASK pi####ereceive.net
- DNS ASK pi####equarter.net
- DNS ASK ci#####tequarter.net
- DNS ASK ch####enbranch.net
- DNS ASK fa####branch.net
- DNS ASK ch####enbelieve.net
- DNS ASK fa####believe.net
- DNS ASK fi####believe.net
- DNS ASK ch####enreceive.net
- DNS ASK ci#####tereceive.net
- DNS ASK ri###friend.net
Другое
Создает и запускает на исполнение
- 'C:\vqmyzthyknuqicg\gyjltn9c3trptlmzakt9y.exe'
- 'C:\vqmyzthyknuqicg\ncnaeydj.exe'
- 'C:\vqmyzthyknuqicg\lhqmdddzzm.exe' "c:\vqmyzthyknuqicg\ncnaeydj.exe"
