Техническая информация
Для обеспечения автозапуска и распространения
Устанавливает следующие настройки сервисов
- [<HKLM>\System\CurrentControlSet\Services\Connections AutoConfig Framework TP Solutions] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\Connections AutoConfig Framework TP Solutions] 'ImagePath' = 'C:\uqodcajelu\nbyxjnf.exe'
Создает следующие сервисы
- 'Connections AutoConfig Framework TP Solutions' C:\uqodcajelu\nbyxjnf.exe
Изменения в файловой системе
Создает следующие файлы
- %WINDIR%\uqodcajelu\kfffvoymg
- C:\uqodcajelu\kfffvoymg
- C:\uqodcajelu\mfunot7cvbehtmkqepq.exe
- C:\uqodcajelu\nbyxjnf.exe
- C:\uqodcajelu\hcxmoddzv.exe
- C:\uqodcajelu\mb7jzxpnjp
Присваивает атрибут 'скрытый' для следующих файлов
- C:\uqodcajelu\nbyxjnf.exe
- C:\uqodcajelu\hcxmoddzv.exe
Удаляет следующие файлы
- %WINDIR%\uqodcajelu\kfffvoymg
- C:\uqodcajelu\mfunot7cvbehtmkqepq.exe
Подменяет следующие файлы
- %WINDIR%\uqodcajelu\kfffvoymg
Сетевая активность
Подключается к
- 'ch####artial.net':80
- 'ef####position.net':80
- 'jo####yspread.net':80
- 'wo###spread.net':80
- 'li####market.net':80
- 'li####beauty.net':80
- 'li####garden.net':80
- 'ch###market.net':80
TCP
Запросы HTTP GET
- http://ch####artial.net/index.php
- http://ef####position.net/index.php
- http://jo####yspread.net/index.php
- http://wo###spread.net/index.php
- http://li####market.net/index.php
- http://li####beauty.net/index.php
- http://li####garden.net/index.php
UDP
- DNS ASK de####ystrike.net
- DNS ASK re####erattempt.net
- DNS ASK wo###square.net
- DNS ASK re####ersquare.net
- DNS ASK wo####eighbor.net
- DNS ASK re#####rneighbor.net
- DNS ASK wo###spread.net
- DNS ASK re####erspread.net
- DNS ASK de####yreport.net
- DNS ASK jo####ymarket.net
- DNS ASK jo####yreport.net
- DNS ASK hu####dreport.net
- DNS ASK jo####ybeauty.net
- DNS ASK hu####dbeauty.net
- DNS ASK jo####ygarden.net
- DNS ASK hu####dgarden.net
- DNS ASK de####ymarket.net
- DNS ASK in####sespread.net
- DNS ASK wo####ttempt.net
- DNS ASK hu####dmarket.net
- DNS ASK li####market.net
- DNS ASK fo####neighbor.net
- DNS ASK su####neighbor.net
- DNS ASK wi####spread.net
- DNS ASK su####spread.net
- DNS ASK ef####attempt.net
- DNS ASK th####hattempt.net
- DNS ASK ef####square.net
- DNS ASK th####hsquare.net
- DNS ASK ef####neighbor.net
- DNS ASK th####hneighbor.net
- DNS ASK ef####spread.net
- DNS ASK th####hspread.net
- DNS ASK fo####attempt.net
- DNS ASK in####seattempt.net
- DNS ASK fo####square.net
- DNS ASK in####sesquare.net
- DNS ASK in#####eneighbor.net
- DNS ASK su####square.net
- DNS ASK fo####spread.net
- DNS ASK hu####dattempt.net
- DNS ASK li####report.net
- DNS ASK su####report.net
- DNS ASK su####beauty.net
- DNS ASK wi####garden.net
- DNS ASK su####garden.net
- DNS ASK ef####market.net
- DNS ASK th####hmarket.net
- DNS ASK ef####report.net
- DNS ASK th####hreport.net
- DNS ASK de####ybeauty.net
- DNS ASK ef####beauty.net
- DNS ASK ef####garden.net
- DNS ASK th####hgarden.net
- DNS ASK fo####market.net
- DNS ASK in####semarket.net
- DNS ASK fo####report.net
- DNS ASK in####sereport.net
- DNS ASK wi####report.net
- DNS ASK su####market.net
- DNS ASK wi####beauty.net
- DNS ASK wi####market.net
- DNS ASK th###garden.net
- DNS ASK li####beauty.net
- DNS ASK li####garden.net
- DNS ASK ri####market.net
- DNS ASK be####market.net
- DNS ASK ri####report.net
- DNS ASK be####report.net
- DNS ASK ri####beauty.net
- DNS ASK wi####square.net
- DNS ASK be####beauty.net
- DNS ASK wi####neighbor.net
- DNS ASK be####garden.net
- DNS ASK th###market.net
- DNS ASK ch###report.net
- DNS ASK th###report.net
- DNS ASK ch###beauty.net
- DNS ASK th###beauty.net
- DNS ASK ch###garden.net
- DNS ASK ri####garden.net
- DNS ASK de####ygarden.net
- DNS ASK ch###market.net
- DNS ASK su####attempt.net
- DNS ASK wi####attempt.net
- DNS ASK th###spread.net
- DNS ASK su####strike.net
- DNS ASK wi####partial.net
- DNS ASK su####partial.net
- DNS ASK ef####number.net
- DNS ASK th####hnumber.net
- DNS ASK ef####position.net
- DNS ASK th####hposition.net
- DNS ASK ef####strike.net
- DNS ASK th####hstrike.net
- DNS ASK ef####partial.net
- DNS ASK th####hpartial.net
- DNS ASK fo####number.net
- DNS ASK in####senumber.net
- DNS ASK fo####position.net
- DNS ASK in#####eposition.net
- DNS ASK wi####position.net
- DNS ASK wi####number.net
- DNS ASK wi####strike.net
- DNS ASK su####number.net
- DNS ASK th####artial.net
- DNS ASK ri####partial.net
- DNS ASK de####ypartial.net
- DNS ASK li####partial.net
- DNS ASK ri####number.net
- DNS ASK be####number.net
- DNS ASK ri####position.net
- DNS ASK be####position.net
- DNS ASK ri####strike.net
- DNS ASK fo####strike.net
- DNS ASK fo####beauty.net
- DNS ASK be####strike.net
- DNS ASK ch###number.net
- DNS ASK th###number.net
- DNS ASK ch####osition.net
- DNS ASK th####osition.net
- DNS ASK ch###strike.net
- DNS ASK th###strike.net
- DNS ASK ch####artial.net
- DNS ASK li####strike.net
- DNS ASK be####partial.net
- DNS ASK th####hbeauty.net
- DNS ASK in####sestrike.net
- DNS ASK re####ernumber.net
- DNS ASK ri####attempt.net
- DNS ASK be####attempt.net
- DNS ASK ri####square.net
- DNS ASK be####square.net
- DNS ASK ri####neighbor.net
- DNS ASK be####neighbor.net
- DNS ASK su####position.net
- DNS ASK ri####spread.net
- DNS ASK ch####ttempt.net
- DNS ASK th####ttempt.net
- DNS ASK ch###square.net
- DNS ASK th###square.net
- DNS ASK ch####eighbor.net
- DNS ASK th####eighbor.net
- DNS ASK ch###spread.net
- DNS ASK li####neighbor.net
- DNS ASK be####spread.net
- DNS ASK li####spread.net
- DNS ASK de####yspread.net
- DNS ASK de####yneighbor.net
- DNS ASK li####square.net
- DNS ASK wo####osition.net
- DNS ASK re#####rposition.net
- DNS ASK wo###strike.net
- DNS ASK re####erstrike.net
- DNS ASK wo####artial.net
- DNS ASK re####erpartial.net
- DNS ASK fo####partial.net
- DNS ASK jo####yattempt.net
- DNS ASK in####separtial.net
- DNS ASK jo####ysquare.net
- DNS ASK jo####yneighbor.net
- DNS ASK hu####dneighbor.net
- DNS ASK jo####yspread.net
- DNS ASK hu####dspread.net
- DNS ASK de####yattempt.net
- DNS ASK li####attempt.net
- DNS ASK wo###number.net
- DNS ASK de####ysquare.net
- DNS ASK hu####dsquare.net
- DNS ASK in####sebeauty.net
Другое
Создает и запускает на исполнение
- 'C:\uqodcajelu\mfunot7cvbehtmkqepq.exe'
- 'C:\uqodcajelu\nbyxjnf.exe'
- 'C:\uqodcajelu\hcxmoddzv.exe' "c:\uqodcajelu\nbyxjnf.exe"
