Техническая информация
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\tphdtznvj.js
- %TEMP%\txxkibz_37601.exe
- %TEMP%\txxkibz_90514.exe
- %TEMP%\txxkibz_8722.exe
- %TEMP%\txxkibz_38955.exe
Сетевая активность
TCP
Запросы HTTP GET
- http://sh###lovers.com/5ZnYzr
- http://ha##tto.com/hyJF4B
- http://pa##ra.com/Eia6nU
- http://is###lstyle.com/VCoDK1
- http://ma###elight.com/zUWcIE
- http://lv#####turedirect.com/4Tl9tO
- http://si####gems.com.au/fz4uAZ
- http://si#####eingtours.com/RzdcH7
- http://ki##s2.com/sNIWPG
- http://el###cadote.com/M5L3Rf
- http://rc###namade.com/lLQxdB
- http://se####tronix.com/wFi1ZP
- http://in####nda.com.br/YxVDaH
- http://me###tcanta.com/aYiftp
- http://tu####citytour.com/LYmCSw
- http://in####nda.com.br/yIWq4O
- http://ma####obilya.com/XB1Tfs
- http://da###arine.com/kEZXlw
- http://ki##s2.com/s6YNkJ
UDP
- DNS ASK yo####tionstore.com
- DNS ASK si#####eingtours.com
- DNS ASK si####gems.com.au
- DNS ASK ir##ems.com
- DNS ASK bw###bler.se
- DNS ASK lv#####turedirect.com
- DNS ASK th#####dothanhly.com
- DNS ASK is###lstyle.com
- DNS ASK me###tcanta.com
- DNS ASK ar###angown.com
- DNS ASK te########dofgiftsandbargains.co.uk
- DNS ASK pa##ra.com
- DNS ASK ha##tto.com
- DNS ASK ki##s2.com
- DNS ASK hh##.#x3webs.com
- DNS ASK el###cadote.com
- DNS ASK ho####tphuvinh.com
- DNS ASK da###arine.com
- DNS ASK rc###namade.com
- DNS ASK re###days.com
- DNS ASK se####tronix.com
- DNS ASK ir#####ganics.com.au
- DNS ASK di#####tbandmerch.com
- DNS ASK ma###s.com.br
- DNS ASK ma###elight.com
- DNS ASK de####hopper.com
- DNS ASK tu####citytour.com
- DNS ASK in####nda.com.br
- DNS ASK cr####ljoias.com.br
- DNS ASK ma####obilya.com
- DNS ASK ra#####chiavon.com.br
- DNS ASK sh###lovers.com
- DNS ASK ca###ecakes.com
- DNS ASK mo####oys.com.br
Другое
Создает и запускает на исполнение
- '<SYSTEM32>\wscript.exe' %TEMP%\TpHDtzNvJ.js
