Техническая информация
Для обеспечения автозапуска и распространения
Устанавливает следующие настройки сервисов
- [<HKLM>\System\CurrentControlSet\Services\Brightness Event CardSpace Now PNRP] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\Brightness Event CardSpace Now PNRP] 'ImagePath' = 'C:\hjqslahmlwujw\rvlpmrucldb.exe'
Создает следующие сервисы
- 'Brightness Event CardSpace Now PNRP' C:\hjqslahmlwujw\rvlpmrucldb.exe
Изменения в файловой системе
Создает следующие файлы
- %WINDIR%\hjqslahmlwujw\wtiogzu
- C:\hjqslahmlwujw\wtiogzu
- C:\hjqslahmlwujw\eazcmw0wqjbihnxritj.exe
- C:\hjqslahmlwujw\rvlpmrucldb.exe
- C:\hjqslahmlwujw\hdrzwcqw.exe
Присваивает атрибут 'скрытый' для следующих файлов
- C:\hjqslahmlwujw\rvlpmrucldb.exe
- C:\hjqslahmlwujw\hdrzwcqw.exe
Удаляет следующие файлы
- %WINDIR%\hjqslahmlwujw\wtiogzu
- C:\hjqslahmlwujw\eazcmw0wqjbihnxritj.exe
Подменяет следующие файлы
- %WINDIR%\hjqslahmlwujw\wtiogzu
Сетевая активность
Подключается к
- 'wa####elieve.net':80
- 'wo####elieve.net':80
- 'ex#####ncesystem.net':80
- 'me####system.net':80
- 'me###rtrust.net':80
- 'cr###trust.net':80
- 'th####tsystem.net':80
- 'wa###system.net':80
- 'wa###trust.net':80
- 'fr###fancy.net':80
- 'fr####onsider.net':80
- 'fo####friend.net':80
- 'be###fancy.net':80
- 'be####onsider.net':80
TCP
Запросы HTTP GET
- http://wa####elieve.net/index.php
- http://wo####elieve.net/index.php
- http://ex#####ncesystem.net/index.php
- http://me####system.net/index.php
- http://me###rtrust.net/index.php
- http://cr###trust.net/index.php
- http://th####tsystem.net/index.php
- http://wa###system.net/index.php
- http://wa###trust.net/index.php
- http://fr###fancy.net/index.php
- http://fr####onsider.net/index.php
- http://fo####friend.net/index.php
- http://be###fancy.net/index.php
UDP
- DNS ASK cr####uarter.net
- DNS ASK pa###system.net
- DNS ASK fi####either.net
- DNS ASK pa####either.net
- DNS ASK fi###honor.net
- DNS ASK pa###honor.net
- DNS ASK sm###trust.net
- DNS ASK wo###trust.net
- DNS ASK sm###system.net
- DNS ASK wo###system.net
- DNS ASK sm####either.net
- DNS ASK wo####either.net
- DNS ASK sm###honor.net
- DNS ASK wa###trust.net
- DNS ASK pa###trust.net
- DNS ASK th####ttrust.net
- DNS ASK wa###system.net
- DNS ASK th####tsystem.net
- DNS ASK wa####either.net
- DNS ASK th####tneither.net
- DNS ASK wa###honor.net
- DNS ASK th####thonor.net
- DNS ASK cr###trust.net
- DNS ASK su###rtrust.net
- DNS ASK cr###system.net
- DNS ASK su####system.net
- DNS ASK wo###honor.net
- DNS ASK fo####neither.net
- DNS ASK fi###trust.net
- DNS ASK be###fancy.net
- DNS ASK kn####aughter.net
- DNS ASK be####aughter.net
- DNS ASK me####friend.net
- DNS ASK fo####friend.net
- DNS ASK me####consider.net
- DNS ASK fo####consider.net
- DNS ASK me###rfancy.net
- DNS ASK fo###wfancy.net
- DNS ASK me####laughter.net
- DNS ASK fo####laughter.net
- DNS ASK al####yfriend.net
- DNS ASK cr####either.net
- DNS ASK fi###system.net
- DNS ASK ge#####anconsider.net
- DNS ASK al####yfancy.net
- DNS ASK ge####manfancy.net
- DNS ASK al####ylaughter.net
- DNS ASK ge#####anlaughter.net
- DNS ASK ex#####ncefriend.net
- DNS ASK fr###friend.net
- DNS ASK ex#####nceconsider.net
- DNS ASK fr####onsider.net
- DNS ASK ex####encefancy.net
- DNS ASK fr###fancy.net
- DNS ASK ex#####ncelaughter.net
- DNS ASK al####yconsider.net
- DNS ASK fr####aughter.net
- DNS ASK su####neither.net
- DNS ASK cr###honor.net
- DNS ASK su###rhonor.net
- DNS ASK wo####eceive.net
- DNS ASK fr###honor.net
- DNS ASK fi####uarter.net
- DNS ASK pa####uarter.net
- DNS ASK fi####eceive.net
- DNS ASK pa####eceive.net
- DNS ASK fi####elieve.net
- DNS ASK pa####elieve.net
- DNS ASK fi###branch.net
- DNS ASK pa###branch.net
- DNS ASK sm####uarter.net
- DNS ASK wo####uarter.net
- DNS ASK kn###fancy.net
- DNS ASK fr####either.net
- DNS ASK sm####elieve.net
- DNS ASK wo####elieve.net
- DNS ASK sm###branch.net
- DNS ASK wo###branch.net
- DNS ASK wa####uarter.net
- DNS ASK th####tquarter.net
- DNS ASK wa####eceive.net
- DNS ASK th####treceive.net
- DNS ASK wa####elieve.net
- DNS ASK th####tbelieve.net
- DNS ASK wa###branch.net
- DNS ASK th####tbranch.net
- DNS ASK sm####eceive.net
- DNS ASK ge####manfriend.net
- DNS ASK ex#####nceneither.net
- DNS ASK fr###trust.net
- DNS ASK fr###system.net
- DNS ASK kn###trust.net
- DNS ASK be###trust.net
- DNS ASK kn###system.net
- DNS ASK be###system.net
- DNS ASK kn####either.net
- DNS ASK be####either.net
- DNS ASK kn###honor.net
- DNS ASK be###honor.net
- DNS ASK me###rtrust.net
- DNS ASK fo###wtrust.net
- DNS ASK me####system.net
- DNS ASK ex#####ncesystem.net
- DNS ASK fo####system.net
- DNS ASK ex####encehonor.net
- DNS ASK me###rhonor.net
- DNS ASK fo###whonor.net
- DNS ASK al####ytrust.net
- DNS ASK ge####mantrust.net
- DNS ASK al####ysystem.net
- DNS ASK ge####mansystem.net
- DNS ASK al####yneither.net
- DNS ASK ge#####anneither.net
- DNS ASK al####yhonor.net
- DNS ASK ge####manhonor.net
- DNS ASK ex####encetrust.net
- DNS ASK me####neither.net
- DNS ASK be####onsider.net
Другое
Создает и запускает на исполнение
- 'C:\hjqslahmlwujw\eazcmw0wqjbihnxritj.exe'
- 'C:\hjqslahmlwujw\rvlpmrucldb.exe'
- 'C:\hjqslahmlwujw\hdrzwcqw.exe' "c:\hjqslahmlwujw\rvlpmrucldb.exe"
