Техническая информация
Для обеспечения автозапуска и распространения
Устанавливает следующие настройки сервисов
- [<HKLM>\System\CurrentControlSet\Services\Config Procedure Interactive Installer] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\Config Procedure Interactive Installer] 'ImagePath' = 'C:\tffalcje\ptakbpo.exe'
Создает следующие сервисы
- 'Config Procedure Interactive Installer' C:\tffalcje\ptakbpo.exe
Изменения в файловой системе
Создает следующие файлы
- %WINDIR%\tffalcje\qq5ykof
- C:\tffalcje\qq5ykof
- C:\tffalcje\s3oo7fawqyl6kbep.exe
- C:\tffalcje\ptakbpo.exe
- C:\tffalcje\mscmozyb.exe
- C:\tffalcje\dnraamkq
Присваивает атрибут 'скрытый' для следующих файлов
- C:\tffalcje\ptakbpo.exe
- C:\tffalcje\mscmozyb.exe
Удаляет следующие файлы
- %WINDIR%\tffalcje\qq5ykof
- C:\tffalcje\s3oo7fawqyl6kbep.exe
Подменяет следующие файлы
- %WINDIR%\tffalcje\qq5ykof
Сетевая активность
Подключается к
- 'cl###space.net':80
- 'ch###indeed.net':80
- 'jo####ynorth.net':80
- 'li###enorth.net':80
TCP
Запросы HTTP GET
- http://ch###indeed.net/index.php
- http://li###enorth.net/index.php
UDP
- DNS ASK st####eclose.net
- DNS ASK hu####dgeneral.net
- DNS ASK jo####ygeneral.net
- DNS ASK hu####dclear.net
- DNS ASK jo####yclear.net
- DNS ASK re####erduring.net
- DNS ASK wo###during.net
- DNS ASK re####erindeed.net
- DNS ASK wo###indeed.net
- DNS ASK re####ernotice.net
- DNS ASK wo###notice.net
- DNS ASK re####erlength.net
- DNS ASK wo###length.net
- DNS ASK in####seduring.net
- DNS ASK fo####during.net
- DNS ASK in####seindeed.net
- DNS ASK fo####indeed.net
- DNS ASK in####senotice.net
- DNS ASK fo####notice.net
- DNS ASK in####selength.net
- DNS ASK fo####length.net
- DNS ASK th####hduring.net
- DNS ASK ef####during.net
- DNS ASK th####hindeed.net
- DNS ASK ef####indeed.net
- DNS ASK th####hnotice.net
- DNS ASK th####hlength.net
- DNS ASK ef####notice.net
- DNS ASK jo####yinclude.net
- DNS ASK hu####dinclude.net
- DNS ASK th###north.net
- DNS ASK ch###north.net
- DNS ASK th####nclude.net
- DNS ASK ch####nclude.net
- DNS ASK th####eneral.net
- DNS ASK ch####eneral.net
- DNS ASK th###clear.net
- DNS ASK ch###clear.net
- DNS ASK be###gnorth.net
- DNS ASK ri###nnorth.net
- DNS ASK be####include.net
- DNS ASK ri####include.net
- DNS ASK ri####general.net
- DNS ASK ch###length.net
- DNS ASK be###gclear.net
- DNS ASK ri###nclear.net
- DNS ASK li###enorth.net
- DNS ASK de####ynorth.net
- DNS ASK li####include.net
- DNS ASK de####yinclude.net
- DNS ASK li####general.net
- DNS ASK de####ygeneral.net
- DNS ASK li###eclear.net
- DNS ASK de####yclear.net
- DNS ASK hu####dnorth.net
- DNS ASK jo####ynorth.net
- DNS ASK ef####length.net
- DNS ASK su####during.net
- DNS ASK wi####during.net
- DNS ASK jo####yduring.net
- DNS ASK hu####dindeed.net
- DNS ASK jo####yindeed.net
- DNS ASK hu####dnotice.net
- DNS ASK jo####ynotice.net
- DNS ASK hu####dlength.net
- DNS ASK jo####ylength.net
- DNS ASK cl###close.net
- DNS ASK th###close.net
- DNS ASK cl###yellow.net
- DNS ASK th###yellow.net
- DNS ASK cl###travel.net
- DNS ASK th###travel.net
- DNS ASK cl###space.net
- DNS ASK th###space.net
- DNS ASK we####rclose.net
- DNS ASK am###tclose.net
- DNS ASK we####ryellow.net
- DNS ASK am####yellow.net
- DNS ASK we####rtravel.net
- DNS ASK am####travel.net
- DNS ASK we####rspace.net
- DNS ASK am###tspace.net
- DNS ASK hi####yclose.net
- DNS ASK de####ylength.net
- DNS ASK li####length.net
- DNS ASK hu####dduring.net
- DNS ASK de####ynotice.net
- DNS ASK su####indeed.net
- DNS ASK li####notice.net
- DNS ASK wi####indeed.net
- DNS ASK su####notice.net
- DNS ASK wi####notice.net
- DNS ASK su####length.net
- DNS ASK wi####length.net
- DNS ASK th###during.net
- DNS ASK ch###during.net
- DNS ASK th###indeed.net
- DNS ASK ch###indeed.net
- DNS ASK th###notice.net
- DNS ASK ch###notice.net
- DNS ASK be####general.net
- DNS ASK wi###nclear.net
- DNS ASK be####during.net
- DNS ASK ri####during.net
- DNS ASK be####indeed.net
- DNS ASK ri####indeed.net
- DNS ASK be####notice.net
- DNS ASK ri####notice.net
- DNS ASK be####length.net
- DNS ASK ri####length.net
- DNS ASK li####during.net
- DNS ASK de####yduring.net
- DNS ASK li####indeed.net
- DNS ASK de####yindeed.net
- DNS ASK th###length.net
- DNS ASK su###rclear.net
Другое
Создает и запускает на исполнение
- 'C:\tffalcje\s3oo7fawqyl6kbep.exe'
- 'C:\tffalcje\ptakbpo.exe'
- 'C:\tffalcje\mscmozyb.exe' "c:\tffalcje\ptakbpo.exe"
