Техническая информация
Для обеспечения автозапуска и распространения
Устанавливает следующие настройки сервисов
- [<HKLM>\System\CurrentControlSet\Services\Logs HomeGroup Volume Internet Solutions] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\Logs HomeGroup Volume Internet Solutions] 'ImagePath' = 'C:\beimoeapr\fhehlqyd.exe'
Создает следующие сервисы
- 'Logs HomeGroup Volume Internet Solutions' C:\beimoeapr\fhehlqyd.exe
Изменения в файловой системе
Создает следующие файлы
- %WINDIR%\beimoeapr\omocand
- C:\beimoeapr\omocand
- C:\beimoeapr\vziwlt6nbn8op0kk1twdk.exe
- C:\beimoeapr\fhehlqyd.exe
- C:\beimoeapr\ajbpikcck.exe
Присваивает атрибут 'скрытый' для следующих файлов
- C:\beimoeapr\fhehlqyd.exe
- C:\beimoeapr\ajbpikcck.exe
Удаляет следующие файлы
- %WINDIR%\beimoeapr\omocand
- C:\beimoeapr\vziwlt6nbn8op0kk1twdk.exe
Подменяет следующие файлы
- %WINDIR%\beimoeapr\omocand
Сетевая активность
Подключается к
- 'jo####ybeyond.net':80
- 'li###ebeing.net':80
- 'ch####orever.net':80
- 'li####flower.net':80
- 'li####corner.net':80
TCP
Запросы HTTP GET
- http://jo####ybeyond.net/index.php
- http://li###ebeing.net/index.php
- http://ch####orever.net/index.php
- http://li####flower.net/index.php
- http://li####corner.net/index.php
UDP
- DNS ASK re###nabove.net
- DNS ASK ef####flower.net
- DNS ASK th####hflower.net
- DNS ASK ef####minute.net
- DNS ASK th####hminute.net
- DNS ASK ef####special.net
- DNS ASK th####hspecial.net
- DNS ASK ef####corner.net
- DNS ASK re####erflower.net
- DNS ASK th####hcorner.net
- DNS ASK in####seflower.net
- DNS ASK fo####minute.net
- DNS ASK in####seminute.net
- DNS ASK fo####special.net
- DNS ASK in####sespecial.net
- DNS ASK fo####corner.net
- DNS ASK in####secorner.net
- DNS ASK wi####corner.net
- DNS ASK su####corner.net
- DNS ASK fo####flower.net
- DNS ASK wo###flower.net
- DNS ASK su####minute.net
- DNS ASK ri####special.net
- DNS ASK be####special.net
- DNS ASK ri####corner.net
- DNS ASK be####corner.net
- DNS ASK ch###flower.net
- DNS ASK th###flower.net
- DNS ASK ch###minute.net
- DNS ASK th###minute.net
- DNS ASK ch####pecial.net
- DNS ASK th####pecial.net
- DNS ASK ch###corner.net
- DNS ASK th###corner.net
- DNS ASK wi####flower.net
- DNS ASK su####flower.net
- DNS ASK wi####minute.net
- DNS ASK wi####special.net
- DNS ASK ri####minute.net
- DNS ASK su####special.net
- DNS ASK fo####beyond.net
- DNS ASK wo###minute.net
- DNS ASK ri####stranger.net
- DNS ASK ri####goodbye.net
- DNS ASK be####goodbye.net
- DNS ASK ri####fortieth.net
- DNS ASK be####fortieth.net
- DNS ASK ch####dvance.net
- DNS ASK th####dvance.net
- DNS ASK ch####tranger.net
- DNS ASK re####erminute.net
- DNS ASK th####tranger.net
- DNS ASK th####oodbye.net
- DNS ASK ch####ortieth.net
- DNS ASK th####ortieth.net
- DNS ASK wi####advance.net
- DNS ASK su####advance.net
- DNS ASK wi####stranger.net
- DNS ASK be####advance.net
- DNS ASK ri####advance.net
- DNS ASK be####stranger.net
- DNS ASK li####fortieth.net
- DNS ASK de####yfortieth.net
- DNS ASK wo####pecial.net
- DNS ASK wo###corner.net
- DNS ASK re####ercorner.net
- DNS ASK jo####yadvance.net
- DNS ASK hu####dadvance.net
- DNS ASK jo####ystranger.net
- DNS ASK hu####dstranger.net
- DNS ASK be####flower.net
- DNS ASK jo####ygoodbye.net
- DNS ASK be####minute.net
- DNS ASK jo####yfortieth.net
- DNS ASK de####yadvance.net
- DNS ASK li####advance.net
- DNS ASK de####ystranger.net
- DNS ASK li####stranger.net
- DNS ASK de####ygoodbye.net
- DNS ASK li####goodbye.net
- DNS ASK hu####dgoodbye.net
- DNS ASK re####erspecial.net
- DNS ASK hu####dfortieth.net
- DNS ASK ri####flower.net
- DNS ASK li####corner.net
- DNS ASK de####ycorner.net
- DNS ASK ri####forever.net
- DNS ASK be####forever.net
- DNS ASK ri####bottom.net
- DNS ASK be####bottom.net
- DNS ASK ch###beyond.net
- DNS ASK th###beyond.net
- DNS ASK ch###being.net
- DNS ASK th###being.net
- DNS ASK ch####orever.net
- DNS ASK th####orever.net
- DNS ASK ch###bottom.net
- DNS ASK th###bottom.net
- DNS ASK wi####beyond.net
- DNS ASK su####beyond.net
- DNS ASK wi###nbeing.net
- DNS ASK be####beyond.net
- DNS ASK li####bottom.net
- DNS ASK be###gbeing.net
- DNS ASK ri####beyond.net
- DNS ASK de####ybottom.net
- DNS ASK hu####dforever.net
- DNS ASK re####shoulder.net
- DNS ASK va####sfinger.net
- DNS ASK re####finger.net
- DNS ASK jo####ybeyond.net
- DNS ASK hu####dbeyond.net
- DNS ASK jo####ybeing.net
- DNS ASK hu####dbeing.net
- DNS ASK su###rbeing.net
- DNS ASK su####stranger.net
- DNS ASK jo####yforever.net
- DNS ASK hu####dbottom.net
- DNS ASK de####ybeyond.net
- DNS ASK li####beyond.net
- DNS ASK de####ybeing.net
- DNS ASK li###ebeing.net
- DNS ASK de####yforever.net
- DNS ASK li####forever.net
- DNS ASK va####sshoulder.net
- DNS ASK jo####ybottom.net
- DNS ASK ch####oodbye.net
- DNS ASK wi####forever.net
- DNS ASK ef####beyond.net
- DNS ASK re####erbottom.net
- DNS ASK jo####yflower.net
- DNS ASK hu####dflower.net
- DNS ASK jo####yminute.net
- DNS ASK hu####dminute.net
- DNS ASK jo####yspecial.net
- DNS ASK ri###nbeing.net
- DNS ASK hu####dspecial.net
- DNS ASK hu####dcorner.net
- DNS ASK de####yflower.net
- DNS ASK li####flower.net
- DNS ASK de####yminute.net
- DNS ASK li####minute.net
- DNS ASK de####yspecial.net
- DNS ASK li####special.net
- DNS ASK wo####orever.net
- DNS ASK jo####ycorner.net
- DNS ASK wo###bottom.net
- DNS ASK re####erforever.net
- DNS ASK re####erbeing.net
- DNS ASK wo###being.net
- DNS ASK th####hbeyond.net
- DNS ASK ef###tbeing.net
- DNS ASK th####hbeing.net
- DNS ASK ef####forever.net
- DNS ASK th####hforever.net
- DNS ASK ef####bottom.net
- DNS ASK su####forever.net
- DNS ASK th####hbottom.net
- DNS ASK wi####bottom.net
- DNS ASK in####sebeyond.net
- DNS ASK in####sebeing.net
- DNS ASK fo####forever.net
- DNS ASK in####seforever.net
- DNS ASK fo####bottom.net
- DNS ASK in####sebottom.net
- DNS ASK wo###beyond.net
- DNS ASK su####bottom.net
- DNS ASK re####erbeyond.net
- DNS ASK fo###tbeing.net
- DNS ASK wi####goodbye.net
Другое
Создает и запускает на исполнение
- 'C:\beimoeapr\vziwlt6nbn8op0kk1twdk.exe'
- 'C:\beimoeapr\fhehlqyd.exe'
- 'C:\beimoeapr\ajbpikcck.exe' "c:\beimoeapr\fhehlqyd.exe"
