Техническая информация
Для обеспечения автозапуска и распространения
Устанавливает следующие настройки сервисов
- [<HKLM>\System\CurrentControlSet\Services\Routing Secondary Themes Encrypting] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\Routing Secondary Themes Encrypting] 'ImagePath' = 'C:\lccdrlq\tajsnbqjwsfl.exe'
Создает следующие сервисы
- 'Routing Secondary Themes Encrypting' C:\lccdrlq\tajsnbqjwsfl.exe
Изменения в файловой системе
Создает следующие файлы
- %WINDIR%\lccdrlq\qnqoinf
- C:\lccdrlq\qnqoinf
- C:\lccdrlq\qfgp5l6iuvg2aa3e.exe
- C:\lccdrlq\tajsnbqjwsfl.exe
- C:\lccdrlq\dmnkuzbxs.exe
- C:\lccdrlq\ejd7zydy2yn
Присваивает атрибут 'скрытый' для следующих файлов
- C:\lccdrlq\tajsnbqjwsfl.exe
- C:\lccdrlq\dmnkuzbxs.exe
Удаляет следующие файлы
- %WINDIR%\lccdrlq\qnqoinf
- C:\lccdrlq\qfgp5l6iuvg2aa3e.exe
Подменяет следующие файлы
- %WINDIR%\lccdrlq\qnqoinf
Сетевая активность
Подключается к
- 'pa###bridge.net':80
- 'fr####itchen.net':80
- 'su####kitchen.net':80
- 'wa###wagon.net':80
- 'wa####ithout.net':80
- 'sm###wagon.net':80
- 'sm####itchen.net':80
- 'pa####itchen.net':80
- 'fo####welcome.net':80
- 'cr###around.net':80
- 'wa####omplete.net':80
- 'wo###around.net':80
TCP
Запросы HTTP GET
- http://pa###bridge.net/index.php
- http://fr####itchen.net/index.php
- http://su####kitchen.net/index.php
- http://wa###wagon.net/index.php
- http://wa####ithout.net/index.php
- http://sm###wagon.net/index.php
- http://sm####itchen.net/index.php
- http://pa####itchen.net/index.php
- http://fo####welcome.net/index.php
- http://cr###around.net/index.php
- http://wa####omplete.net/index.php
- http://wo###around.net/index.php
UDP
- DNS ASK th####twhose.net
- DNS ASK fo####around.net
- DNS ASK me####welcome.net
- DNS ASK fo####welcome.net
- DNS ASK al####ycomplete.net
- DNS ASK ge#####ancomplete.net
- DNS ASK al####yproud.net
- DNS ASK ge####manproud.net
- DNS ASK al####yaround.net
- DNS ASK ge####manaround.net
- DNS ASK al####ywelcome.net
- DNS ASK ge#####anwelcome.net
- DNS ASK ex#####ncecomplete.net
- DNS ASK fr####omplete.net
- DNS ASK ex####enceproud.net
- DNS ASK sm####ithout.net
- DNS ASK fr###proud.net
- DNS ASK fr###around.net
- DNS ASK ex#####ncewelcome.net
- DNS ASK fr####elcome.net
- DNS ASK fi####robable.net
- DNS ASK pa####robable.net
- DNS ASK fi####itchen.net
- DNS ASK pa####itchen.net
- DNS ASK fi####ithout.net
- DNS ASK pa####ithout.net
- DNS ASK fi###wagon.net
- DNS ASK pa###wagon.net
- DNS ASK sm####robable.net
- DNS ASK wo####robable.net
- DNS ASK sm####itchen.net
- DNS ASK ex#####ncearound.net
- DNS ASK wo####itchen.net
- DNS ASK me####around.net
- DNS ASK su###rproud.net
- DNS ASK su####complete.net
- DNS ASK cr####omplete.net
- DNS ASK th####twelcome.net
- DNS ASK wa####elcome.net
- DNS ASK th####taround.net
- DNS ASK wa###around.net
- DNS ASK wa###proud.net
- DNS ASK be###wagon.net
- DNS ASK th####tcomplete.net
- DNS ASK wa####omplete.net
- DNS ASK wo####elcome.net
- DNS ASK sm####elcome.net
- DNS ASK wo###around.net
- DNS ASK sm###around.net
- DNS ASK me###rproud.net
- DNS ASK fo###wproud.net
- DNS ASK cr###around.net
- DNS ASK su####around.net
- DNS ASK cr####elcome.net
- DNS ASK su####welcome.net
- DNS ASK kn####omplete.net
- DNS ASK be####omplete.net
- DNS ASK kn###proud.net
- DNS ASK be###proud.net
- DNS ASK kn###around.net
- DNS ASK be###around.net
- DNS ASK kn####elcome.net
- DNS ASK be####elcome.net
- DNS ASK me####complete.net
- DNS ASK fo####complete.net
- DNS ASK cr###proud.net
- DNS ASK wo####ithout.net
- DNS ASK sm###wagon.net
- DNS ASK wo###wagon.net
- DNS ASK al####ywithout.net
- DNS ASK ge#####anwithout.net
- DNS ASK al####ywagon.net
- DNS ASK ge####manwagon.net
- DNS ASK ex#####nceprobable.net
- DNS ASK fr####robable.net
- DNS ASK ex#####ncekitchen.net
- DNS ASK fr####itchen.net
- DNS ASK ex#####ncewithout.net
- DNS ASK fr####ithout.net
- DNS ASK ex####encewagon.net
- DNS ASK fr###wagon.net
- DNS ASK fi###whose.net
- DNS ASK al####ykitchen.net
- DNS ASK pa###whose.net
- DNS ASK pa####icycle.net
- DNS ASK fi###bridge.net
- DNS ASK pa###bridge.net
- DNS ASK fi###except.net
- DNS ASK pa###except.net
- DNS ASK sm###whose.net
- DNS ASK wo###whose.net
- DNS ASK sm####icycle.net
- DNS ASK wo####icycle.net
- DNS ASK sm###bridge.net
- DNS ASK wo###bridge.net
- DNS ASK sm###except.net
- DNS ASK wo###except.net
- DNS ASK wa###whose.net
- DNS ASK fi####icycle.net
- DNS ASK ge#####anprobable.net
- DNS ASK ge#####ankitchen.net
- DNS ASK al####yprobable.net
- DNS ASK wa####robable.net
- DNS ASK su###rwagon.net
- DNS ASK th####tprobable.net
- DNS ASK wa####itchen.net
- DNS ASK th####tkitchen.net
- DNS ASK wa####ithout.net
- DNS ASK th####twithout.net
- DNS ASK wa###wagon.net
- DNS ASK th####twagon.net
- DNS ASK cr####robable.net
- DNS ASK su####probable.net
- DNS ASK cr####itchen.net
- DNS ASK su####kitchen.net
- DNS ASK cr####ithout.net
- DNS ASK su####without.net
- DNS ASK cr###wagon.net
- DNS ASK kn####robable.net
- DNS ASK fo###wwagon.net
- DNS ASK be####robable.net
- DNS ASK kn####itchen.net
- DNS ASK be####itchen.net
- DNS ASK kn####ithout.net
- DNS ASK be####ithout.net
- DNS ASK kn###wagon.net
- DNS ASK th####tproud.net
- DNS ASK me####probable.net
- DNS ASK fo####probable.net
- DNS ASK me####kitchen.net
- DNS ASK fo####kitchen.net
- DNS ASK me####without.net
- DNS ASK fo####without.net
- DNS ASK me###rwagon.net
- DNS ASK wo###proud.net
- DNS ASK sm###proud.net
Другое
Создает и запускает на исполнение
- 'C:\lccdrlq\qfgp5l6iuvg2aa3e.exe'
- 'C:\lccdrlq\tajsnbqjwsfl.exe'
- 'C:\lccdrlq\dmnkuzbxs.exe' "c:\lccdrlq\tajsnbqjwsfl.exe"
