Техническая информация
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\lqgypvk.js
- %TEMP%\baodwsi_57958.exe
- %TEMP%\baodwsi_1440.exe
Сетевая активность
TCP
Запросы HTTP GET
- http://de#.#queezy.ie/3RfEkY
- http://go###zon.com/6WcNjA
- http://ti###fly.com/L5IJDi
- http://be#####irecttohome.com/0xdc4u
- http://da###arine.com/0YEkg2
- http://el###cadote.com/tTEcWD
- http://si####gems.com.au/lczTQ6
- http://ev##ees.com/pEFWns
- http://si#####eingtours.com/gZ0X82
- http://pa##ra.com/2h06OR
- http://ma####obilya.com/1d9qpc
- http://ro##da.com/tw5MeF
- http://se####tronix.com/X3Q5HJ
- http://my###tstore.com/LSGA6M
- http://ta###iti.com/MfZwxQ
- http://ha##tto.com/Syik4D
UDP
- DNS ASK de#.#queezy.ie
- DNS ASK pa##ra.com
- DNS ASK bw###bler.se
- DNS ASK ma####obilya.com
- DNS ASK ro##da.com
- DNS ASK th#####dothanhly.com
- DNS ASK hu######lsuppliesmfg.com
- DNS ASK st##-tex.ru
- DNS ASK di#####tbandmerch.com
- DNS ASK li##uce.com
- DNS ASK sh#######atrizexpress.com.br
- DNS ASK se####tronix.com
- DNS ASK ir#####ganics.com.au
- DNS ASK tr######alsforhotels.com
- DNS ASK my###tstore.com
- DNS ASK kg###obal.com
- DNS ASK ta###iti.com
- DNS ASK ch####utplanet.com
- DNS ASK xn#######hcndlfakh0a9o.xn--p1ai
- DNS ASK bb##aar.us
- DNS ASK yo####tionstore.com
- DNS ASK sp#####undbyjynx.com
- DNS ASK go###zon.com
- DNS ASK 17####public.com
- DNS ASK ti###fly.com
- DNS ASK ma###goods.com
- DNS ASK be#####irecttohome.com
- DNS ASK da###arine.com
- DNS ASK li###orms.com
- DNS ASK ca###ecakes.com
- DNS ASK te########dofgiftsandbargains.co.uk
- DNS ASK es###tyvest.com
- DNS ASK el###cadote.com
- DNS ASK hn###tore.com
- DNS ASK si####gems.com.au
- DNS ASK se###ecarts.com
- DNS ASK ev##ees.com
- DNS ASK si#####eingtours.com
- DNS ASK ha##tto.com
Другое
Создает и запускает на исполнение
- '<SYSTEM32>\wscript.exe' %TEMP%\LQGypvk.js
