Техническая информация
Для обеспечения автозапуска и распространения
Устанавливает следующие настройки сервисов
- [<HKLM>\System\CurrentControlSet\Services\Assistant Video Tracking Management] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\Assistant Video Tracking Management] 'ImagePath' = 'C:\opdvysnvifdbsao\pgahqbccmuqv.exe'
Создает следующие сервисы
- 'Assistant Video Tracking Management' C:\opdvysnvifdbsao\pgahqbccmuqv.exe
Изменения в файловой системе
Создает следующие файлы
- %WINDIR%\opdvysnvifdbsao\ntsvcshr
- C:\opdvysnvifdbsao\ntsvcshr
- C:\opdvysnvifdbsao\efukmibsgjghlipmz7ux.exe
- C:\opdvysnvifdbsao\pgahqbccmuqv.exe
- C:\opdvysnvifdbsao\eztnaoin.exe
- C:\opdvysnvifdbsao\sjbbovztvpch
Присваивает атрибут 'скрытый' для следующих файлов
- C:\opdvysnvifdbsao\pgahqbccmuqv.exe
- C:\opdvysnvifdbsao\eztnaoin.exe
Удаляет следующие файлы
- %WINDIR%\opdvysnvifdbsao\ntsvcshr
- C:\opdvysnvifdbsao\efukmibsgjghlipmz7ux.exe
Подменяет следующие файлы
- %WINDIR%\opdvysnvifdbsao\ntsvcshr
Сетевая активность
Подключается к
- 'ma####ebattle.net':80
- 'wh####rheart.net':80
- 'fi###eheart.net':80
- 'ch####enheart.net':80
- 'fa###yheart.net':80
- 'en####hbattle.net':80
- 'do####behind.net':80
- 'do####butter.net':80
- 'st####nderstand.net':80
- 'mo####ntfifteen.net':80
TCP
Запросы HTTP GET
- http://ma####ebattle.net/index.php
- http://wh####rheart.net/index.php
- http://fi###eheart.net/index.php
- http://ch####enheart.net/index.php
- http://fa###yheart.net/index.php
- http://en####hbattle.net/index.php
- http://do####behind.net/index.php
- http://do####butter.net/index.php
- http://st####nderstand.net/index.php
- http://mo####ntfifteen.net/index.php
UDP
- DNS ASK ei####toward.net
- DNS ASK do#####nderstand.net
- DNS ASK pr#####nderstand.net
- DNS ASK do###rbroad.net
- DNS ASK pr###ybroad.net
- DNS ASK do####behind.net
- DNS ASK pr####behind.net
- DNS ASK do####butter.net
- DNS ASK pr####butter.net
- DNS ASK fe#####nderstand.net
- DNS ASK fe###wbroad.net
- DNS ASK do###ebroad.net
- DNS ASK fe####behind.net
- DNS ASK fe####butter.net
- DNS ASK br#####nderstand.net
- DNS ASK re#####nderstand.net
- DNS ASK mi###butter.net
- DNS ASK br###nbroad.net
- DNS ASK st###butter.net
- DNS ASK st###behind.net
- DNS ASK ou####ebehind.net
- DNS ASK mo####ntbutter.net
- DNS ASK ou####ebutter.net
- DNS ASK bu#####gunderstand.net
- DNS ASK ev#####understand.net
- DNS ASK bu####ngbroad.net
- DNS ASK ev####gbroad.net
- DNS ASK bu####ngbehind.net
- DNS ASK ev####gbehind.net
- DNS ASK bu####ngbutter.net
- DNS ASK ev####gbutter.net
- DNS ASK st####nderstand.net
- DNS ASK mi####nderstand.net
- DNS ASK st###broad.net
- DNS ASK mi###broad.net
- DNS ASK mi###behind.net
- DNS ASK mo####ntfifteen.net
- DNS ASK st###angry.net
- DNS ASK re####behind.net
- DNS ASK ou####eangry.net
- DNS ASK mo####ntarticle.net
- DNS ASK ou####earticle.net
- DNS ASK bu####ngdried.net
- DNS ASK ev####gdried.net
- DNS ASK bu####ngfifteen.net
- DNS ASK ev####gfifteen.net
- DNS ASK bu####ngangry.net
- DNS ASK ev####gangry.net
- DNS ASK bu####ngarticle.net
- DNS ASK ev####garticle.net
- DNS ASK st###dried.net
- DNS ASK mi###dried.net
- DNS ASK st####ifteen.net
- DNS ASK mi####ifteen.net
- DNS ASK mo####ntangry.net
- DNS ASK mo####ntbehind.net
- DNS ASK ou####efifteen.net
- DNS ASK ou####edried.net
- DNS ASK br####butter.net
- DNS ASK re####butter.net
- DNS ASK pr#####understand.net
- DNS ASK de#####nderstand.net
- DNS ASK pr####ebroad.net
- DNS ASK de###ebroad.net
- DNS ASK pr####ebehind.net
- DNS ASK de####behind.net
- DNS ASK pr####ebutter.net
- DNS ASK de####butter.net
- DNS ASK st#####hunderstand.net
- DNS ASK st####thbroad.net
- DNS ASK st####thbehind.net
- DNS ASK st####thbutter.net
- DNS ASK mo####ntdried.net
- DNS ASK re###tbroad.net
- DNS ASK br####behind.net
- DNS ASK ou####ebroad.net
- DNS ASK ri###mayor.net
- DNS ASK pe###nmayor.net
- DNS ASK ma####emayor.net
- DNS ASK pe####battle.net
- DNS ASK ma####ebattle.net
- DNS ASK su###nheart.net
- DNS ASK fo####nheart.net
- DNS ASK su####perfect.net
- DNS ASK fo####nperfect.net
- DNS ASK su###nmayor.net
- DNS ASK fo####nmayor.net
- DNS ASK su####battle.net
- DNS ASK fo####nbattle.net
- DNS ASK wh####rheart.net
- DNS ASK ri###heart.net
- DNS ASK wh####rperfect.net
- DNS ASK ma####eperfect.net
- DNS ASK ri####erfect.net
- DNS ASK pe####perfect.net
- DNS ASK pe###nheart.net
- DNS ASK en####htoward.net
- DNS ASK ei####pleasure.net
- DNS ASK en####hpleasure.net
- DNS ASK ei####million.net
- DNS ASK en####hmillion.net
- DNS ASK ei###rwhite.net
- DNS ASK en####hwhite.net
- DNS ASK ex###theart.net
- DNS ASK be####eheart.net
- DNS ASK ex####perfect.net
- DNS ASK be####eperfect.net
- DNS ASK ex###tmayor.net
- DNS ASK be####emayor.net
- DNS ASK ex####battle.net
- DNS ASK be####ebattle.net
- DNS ASK ma####eheart.net
- DNS ASK ci####ttebattle.net
- DNS ASK ou#####understand.net
- DNS ASK wh####rbattle.net
- DNS ASK ch####enperfect.net
- DNS ASK fa####perfect.net
- DNS ASK ch####enmayor.net
- DNS ASK fa###ymayor.net
- DNS ASK ch####enbattle.net
- DNS ASK fa####battle.net
- DNS ASK ei###rheart.net
- DNS ASK en####hheart.net
- DNS ASK ei####perfect.net
- DNS ASK en####hperfect.net
- DNS ASK ei###rmayor.net
- DNS ASK en####hmayor.net
- DNS ASK ei####battle.net
- DNS ASK en####hbattle.net
- DNS ASK mo#####tunderstand.net
- DNS ASK fa###yheart.net
- DNS ASK mo####ntbroad.net
- DNS ASK ch####enheart.net
- DNS ASK pi####ebattle.net
- DNS ASK ri###battle.net
- DNS ASK fi###eheart.net
- DNS ASK th###hheart.net
- DNS ASK fi####perfect.net
- DNS ASK th####perfect.net
- DNS ASK fi###emayor.net
- DNS ASK th###hmayor.net
- DNS ASK fi####battle.net
- DNS ASK th####battle.net
- DNS ASK pi####eheart.net
- DNS ASK ci####tteheart.net
- DNS ASK pi####eperfect.net
- DNS ASK ci#####teperfect.net
- DNS ASK pi####emayor.net
- DNS ASK ci####ttemayor.net
- DNS ASK wh####rmayor.net
- DNS ASK mi###angry.net
Другое
Создает и запускает на исполнение
- 'C:\opdvysnvifdbsao\efukmibsgjghlipmz7ux.exe'
- 'C:\opdvysnvifdbsao\pgahqbccmuqv.exe'
- 'C:\opdvysnvifdbsao\eztnaoin.exe' "c:\opdvysnvifdbsao\pgahqbccmuqv.exe"
