Техническая информация
Для обеспечения автозапуска и распространения
Устанавливает следующие настройки сервисов
- [<HKLM>\System\CurrentControlSet\Services\Virtual AutoConnect PNRP ActiveX Socket Detection] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\Virtual AutoConnect PNRP ActiveX Socket Detection] 'ImagePath' = 'C:\edcnzkkke\exmgwhwdvo.exe'
Создает следующие сервисы
- 'Virtual AutoConnect PNRP ActiveX Socket Detection' C:\edcnzkkke\exmgwhwdvo.exe
Изменения в файловой системе
Создает следующие файлы
- %WINDIR%\edcnzkkke\vmaecxlras
- C:\edcnzkkke\vmaecxlras
- C:\edcnzkkke\zzooi5wmnyycfwtajsk.exe
- C:\edcnzkkke\exmgwhwdvo.exe
- C:\edcnzkkke\ylohlpdqwo.exe
Присваивает атрибут 'скрытый' для следующих файлов
- C:\edcnzkkke\exmgwhwdvo.exe
- C:\edcnzkkke\ylohlpdqwo.exe
Удаляет следующие файлы
- %WINDIR%\edcnzkkke\vmaecxlras
- C:\edcnzkkke\zzooi5wmnyycfwtajsk.exe
Подменяет следующие файлы
- %WINDIR%\edcnzkkke\vmaecxlras
Сетевая активность
Подключается к
- 'mo####ggarden.net':80
- 'pr####theart.net':80
- 'th###heart.net':80
- 'am####toward.net':80
- 'ra####pleasure.net':80
- 'mi###ewhite.net':80
- 'mi####toward.net':80
- 'th###white.net':80
- 'th####illion.net':80
- 'cl###report.net':80
- 'cl###market.net':80
- 'th###market.net':80
- 'am####garden.net':80
- 'we####rbeauty.net':80
- 'am####beauty.net':80
- 'we####rreport.net':80
- 'we####rmarket.net':80
- 'am####market.net':80
- 'st####egarden.net':80
- 'hi####ybeauty.net':80
- 'hi####yreport.net':80
- 'st####emarket.net':80
- 'pr####tperfect.net':80
- 'al####erfect.net':80
TCP
Запросы HTTP GET
- http://mo####ggarden.net/index.php
- http://pr####theart.net/index.php
- http://th###heart.net/index.php
- http://am####toward.net/index.php
- http://ra####pleasure.net/index.php
- http://mi###ewhite.net/index.php
- http://mi####toward.net/index.php
- http://th###white.net/index.php
- http://th####illion.net/index.php
- http://cl###market.net/index.php
- http://pr####tperfect.net/index.php
- http://th###market.net/index.php
- http://we####rbeauty.net/index.php
- http://am####beauty.net/index.php
- http://we####rreport.net/index.php
- http://we####rmarket.net/index.php
- http://am####market.net/index.php
- http://st####egarden.net/index.php
- http://hi####ybeauty.net/index.php
- http://hi####yreport.net/index.php
- http://st####emarket.net/index.php
- http://am####garden.net/index.php
- http://al####erfect.net/index.php
UDP
- DNS ASK ra####garden.net
- DNS ASK cl####leasure.net
- DNS ASK cl###toward.net
- DNS ASK we####rwhite.net
- DNS ASK am###twhite.net
- DNS ASK we####rmillion.net
- DNS ASK am####million.net
- DNS ASK we####rpleasure.net
- DNS ASK am####pleasure.net
- DNS ASK we####rtoward.net
- DNS ASK am####toward.net
- DNS ASK hi####ywhite.net
- DNS ASK st####ewhite.net
- DNS ASK hi####ymillion.net
- DNS ASK st####emillion.net
- DNS ASK hi####ypleasure.net
- DNS ASK st####epleasure.net
- DNS ASK hi####ytoward.net
- DNS ASK st####etoward.net
- DNS ASK mo####gwhite.net
- DNS ASK ra###rwhite.net
- DNS ASK mo####gmillion.net
- DNS ASK ra####million.net
- DNS ASK mo####gpleasure.net
- DNS ASK ra####pleasure.net
- DNS ASK mo####gtoward.net
- DNS ASK cl####illion.net
- DNS ASK th###heart.net
- DNS ASK tw####perfect.net
- DNS ASK pr####theart.net
- DNS ASK mi####perfect.net
- DNS ASK tw###eheart.net
- DNS ASK mi###eheart.net
- DNS ASK al###battle.net
- DNS ASK of###battle.net
- DNS ASK al###mayor.net
- DNS ASK of###mayor.net
- DNS ASK al####erfect.net
- DNS ASK of####erfect.net
- DNS ASK al###heart.net
- DNS ASK of###heart.net
- DNS ASK co####ebattle.net
- DNS ASK ch###battle.net
- DNS ASK co####emayor.net
- DNS ASK ch###mayor.net
- DNS ASK co####eperfect.net
- DNS ASK ch####erfect.net
- DNS ASK co####eheart.net
- DNS ASK ch###heart.net
- DNS ASK pr####tbattle.net
- DNS ASK th###battle.net
- DNS ASK pr####tmayor.net
- DNS ASK th###mayor.net
- DNS ASK pr####tperfect.net
- DNS ASK th####erfect.net
- DNS ASK ra####toward.net
- DNS ASK cl###white.net
- DNS ASK tw###ewhite.net
- DNS ASK pr####ttoward.net
- DNS ASK cl###garden.net
- DNS ASK th###garden.net
- DNS ASK cl###beauty.net
- DNS ASK th###beauty.net
- DNS ASK cl###report.net
- DNS ASK th###report.net
- DNS ASK cl###market.net
- DNS ASK th###market.net
- DNS ASK we####rgarden.net
- DNS ASK am####garden.net
- DNS ASK we####rbeauty.net
- DNS ASK am####beauty.net
- DNS ASK we####rreport.net
- DNS ASK am####report.net
- DNS ASK we####rmarket.net
- DNS ASK am####market.net
- DNS ASK hi####ygarden.net
- DNS ASK st####egarden.net
- DNS ASK hi####ybeauty.net
- DNS ASK st####ebeauty.net
- DNS ASK hi####yreport.net
- DNS ASK st####ereport.net
- DNS ASK hi####ymarket.net
- DNS ASK st####emarket.net
- DNS ASK mo####ggarden.net
- DNS ASK th###toward.net
- DNS ASK th####leasure.net
- DNS ASK tw####million.net
- DNS ASK pr####tpleasure.net
- DNS ASK mi####million.net
- DNS ASK tw####pleasure.net
- DNS ASK mi####pleasure.net
- DNS ASK tw####toward.net
- DNS ASK mi####toward.net
- DNS ASK al###white.net
- DNS ASK of###white.net
- DNS ASK al####illion.net
- DNS ASK of####illion.net
- DNS ASK al####leasure.net
- DNS ASK of####leasure.net
- DNS ASK al###toward.net
- DNS ASK of###toward.net
- DNS ASK co####ewhite.net
- DNS ASK ch###white.net
- DNS ASK co####emillion.net
- DNS ASK ch####illion.net
- DNS ASK co####epleasure.net
- DNS ASK ch####leasure.net
- DNS ASK co####etoward.net
- DNS ASK ch###toward.net
- DNS ASK pr####twhite.net
- DNS ASK th###white.net
- DNS ASK pr####tmillion.net
- DNS ASK th####illion.net
- DNS ASK mi###ewhite.net
- DNS ASK mi###emayor.net
Другое
Создает и запускает на исполнение
- 'C:\edcnzkkke\zzooi5wmnyycfwtajsk.exe'
- 'C:\edcnzkkke\exmgwhwdvo.exe'
- 'C:\edcnzkkke\ylohlpdqwo.exe' "c:\edcnzkkke\exmgwhwdvo.exe"
