Техническая информация
Для обеспечения автозапуска и распространения
Устанавливает следующие настройки сервисов
- [<HKLM>\System\CurrentControlSet\Services\Enumerator DNS Player Extensible CardSpace] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\Enumerator DNS Player Extensible CardSpace] 'ImagePath' = 'C:\gagbeszlsuwyj\ucukcwbzukd.exe'
Создает следующие сервисы
- 'Enumerator DNS Player Extensible CardSpace' C:\gagbeszlsuwyj\ucukcwbzukd.exe
Изменения в файловой системе
Создает следующие файлы
- %WINDIR%\gagbeszlsuwyj\pnhzet1qt
- C:\gagbeszlsuwyj\pnhzet1qt
- C:\gagbeszlsuwyj\hq9ov2vekkkpsa8zr.exe
- C:\gagbeszlsuwyj\ucukcwbzukd.exe
- C:\gagbeszlsuwyj\lavvsamedoxb.exe
- C:\gagbeszlsuwyj\fgv5ya
Присваивает атрибут 'скрытый' для следующих файлов
- C:\gagbeszlsuwyj\ucukcwbzukd.exe
- C:\gagbeszlsuwyj\lavvsamedoxb.exe
Удаляет следующие файлы
- %WINDIR%\gagbeszlsuwyj\pnhzet1qt
- C:\gagbeszlsuwyj\hq9ov2vekkkpsa8zr.exe
Подменяет следующие файлы
- %WINDIR%\gagbeszlsuwyj\pnhzet1qt
Сетевая активность
Подключается к
- 'ou####esmell.net':80
- 'st###safety.net':80
- 'do####future.net':80
- 'do###eearly.net':80
- 'st####thfuture.net':80
- 'ou####ehealth.net':80
- 'do####health.net':80
- 'fe####health.net':80
- 'st####thhealth.net':80
- 'st###eearly.net':80
- 'do###rdress.net':80
- 'pr###ydress.net':80
- 'fe###wdress.net':80
TCP
Запросы HTTP GET
- http://ou####esmell.net/index.php
- http://st###safety.net/index.php
- http://do####future.net/index.php
- http://do###eearly.net/index.php
- http://st####thfuture.net/index.php
- http://ou####ehealth.net/index.php
- http://do####health.net/index.php
- http://fe####health.net/index.php
- http://st####thhealth.net/index.php
- http://st###eearly.net/index.php
- http://do###rdress.net/index.php
- http://pr###ydress.net/index.php
- http://fe###wdress.net/index.php
UDP
- DNS ASK mo####ntsmell.net
- DNS ASK br####health.net
- DNS ASK re####health.net
- DNS ASK br####clothes.net
- DNS ASK re####clothes.net
- DNS ASK br####distant.net
- DNS ASK re####distant.net
- DNS ASK pr####eseparate.net
- DNS ASK de####separate.net
- DNS ASK pr####ehealth.net
- DNS ASK de####health.net
- DNS ASK pr####eclothes.net
- DNS ASK de####clothes.net
- DNS ASK pr####edistant.net
- DNS ASK de####distant.net
- DNS ASK st#####hseparate.net
- DNS ASK re####separate.net
- DNS ASK st####thhealth.net
- DNS ASK br####separate.net
- DNS ASK fe####clothes.net
- DNS ASK mi###health.net
- DNS ASK st####lothes.net
- DNS ASK mi####lothes.net
- DNS ASK st####istant.net
- DNS ASK mi####istant.net
- DNS ASK do####separate.net
- DNS ASK pr####separate.net
- DNS ASK do####health.net
- DNS ASK pr####health.net
- DNS ASK do####clothes.net
- DNS ASK pr####clothes.net
- DNS ASK do####distant.net
- DNS ASK pr####distant.net
- DNS ASK fe####separate.net
- DNS ASK fe####health.net
- DNS ASK fe####distant.net
- DNS ASK mi###catch.net
- DNS ASK fe###wdress.net
- DNS ASK mo####ntcatch.net
- DNS ASK st###public.net
- DNS ASK mi###public.net
- DNS ASK st###dress.net
- DNS ASK mi###dress.net
- DNS ASK do###rcatch.net
- DNS ASK pr###ycatch.net
- DNS ASK do####eearly.net
- DNS ASK do####public.net
- DNS ASK pr####public.net
- DNS ASK do###rdress.net
- DNS ASK pr###ydress.net
- DNS ASK fe###wcatch.net
- DNS ASK do###ecatch.net
- DNS ASK fe####eearly.net
- DNS ASK fe####public.net
- DNS ASK mi###eearly.net
- DNS ASK st###health.net
- DNS ASK st###eearly.net
- DNS ASK st###catch.net
- DNS ASK ou####ecatch.net
- DNS ASK mo####nteearly.net
- DNS ASK ou####eeearly.net
- DNS ASK mo####ntpublic.net
- DNS ASK ou####epublic.net
- DNS ASK mo####ntdress.net
- DNS ASK ou####edress.net
- DNS ASK bu####ngcatch.net
- DNS ASK ev####gcatch.net
- DNS ASK bu####ngeearly.net
- DNS ASK ev####geearly.net
- DNS ASK bu####ngpublic.net
- DNS ASK ev####gpublic.net
- DNS ASK bu####ngdress.net
- DNS ASK ev####gdress.net
- DNS ASK st####thclothes.net
- DNS ASK st####thdistant.net
- DNS ASK mi####eparate.net
- DNS ASK fe####future.net
- DNS ASK st###safety.net
- DNS ASK mi###safety.net
- DNS ASK st###future.net
- DNS ASK mi###future.net
- DNS ASK do###rsmell.net
- DNS ASK pr###ysmell.net
- DNS ASK do###rearly.net
- DNS ASK pr###yearly.net
- DNS ASK do####safety.net
- DNS ASK pr####safety.net
- DNS ASK do####future.net
- DNS ASK pr####future.net
- DNS ASK fe###wsmell.net
- DNS ASK do###esmell.net
- DNS ASK fe###wearly.net
- DNS ASK mi###early.net
- DNS ASK do###eearly.net
- DNS ASK st###early.net
- DNS ASK st###smell.net
- DNS ASK ou####esmell.net
- DNS ASK mo####ntearly.net
- DNS ASK ou####eearly.net
- DNS ASK mo####ntsafety.net
- DNS ASK ou####esafety.net
- DNS ASK mo####ntfuture.net
- DNS ASK ou####efuture.net
- DNS ASK bu####ngsmell.net
- DNS ASK ev####gsmell.net
- DNS ASK bu####ngearly.net
- DNS ASK ev####gearly.net
- DNS ASK bu####ngsafety.net
- DNS ASK ev####gsafety.net
- DNS ASK bu####ngfuture.net
- DNS ASK ev####gfuture.net
- DNS ASK mi###smell.net
- DNS ASK st####thearly.net
- DNS ASK ev####gdistant.net
- DNS ASK br###nsmell.net
- DNS ASK mo#####tseparate.net
- DNS ASK ou####eseparate.net
- DNS ASK mo####nthealth.net
- DNS ASK ou####ehealth.net
- DNS ASK mo####ntclothes.net
- DNS ASK ou####eclothes.net
- DNS ASK mo####ntdistant.net
- DNS ASK ou####edistant.net
- DNS ASK bu#####gseparate.net
- DNS ASK ev####gseparate.net
- DNS ASK bu####nghealth.net
- DNS ASK ev####ghealth.net
- DNS ASK bu####ngclothes.net
- DNS ASK ev####gclothes.net
- DNS ASK bu####ngdistant.net
- DNS ASK st####thfuture.net
- DNS ASK st####eparate.net
- DNS ASK st####thsafety.net
- DNS ASK st####thsmell.net
- DNS ASK re###tsmell.net
- DNS ASK br###nearly.net
- DNS ASK re###tearly.net
- DNS ASK br####safety.net
- DNS ASK re####safety.net
- DNS ASK br####future.net
- DNS ASK re####future.net
- DNS ASK pr####esmell.net
- DNS ASK de###esmell.net
- DNS ASK pr####eearly.net
- DNS ASK de###eearly.net
- DNS ASK pr####esafety.net
- DNS ASK de####safety.net
- DNS ASK pr####efuture.net
- DNS ASK de####future.net
- DNS ASK fe####safety.net
- DNS ASK do###edress.net
Другое
Создает и запускает на исполнение
- 'C:\gagbeszlsuwyj\hq9ov2vekkkpsa8zr.exe'
- 'C:\gagbeszlsuwyj\ucukcwbzukd.exe'
- 'C:\gagbeszlsuwyj\lavvsamedoxb.exe' "c:\gagbeszlsuwyj\ucukcwbzukd.exe"
