Техническая информация
Для обеспечения автозапуска и распространения
Устанавливает следующие настройки сервисов
- [<HKLM>\System\CurrentControlSet\Services\Volume Protected Gateway KtmRm Proxy Biometric] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\Volume Protected Gateway KtmRm Proxy Biometric] 'ImagePath' = 'C:\bnyxmchvy\cdofcorweyi.exe'
Создает следующие сервисы
- 'Volume Protected Gateway KtmRm Proxy Biometric' C:\bnyxmchvy\cdofcorweyi.exe
Изменения в файловой системе
Создает следующие файлы
- %WINDIR%\bnyxmchvy\r8nyug
- C:\bnyxmchvy\r8nyug
- C:\bnyxmchvy\zpmonosujcnwfis9o.exe
- C:\bnyxmchvy\cdofcorweyi.exe
- C:\bnyxmchvy\fsdnpvobksvg.exe
Присваивает атрибут 'скрытый' для следующих файлов
- C:\bnyxmchvy\cdofcorweyi.exe
- C:\bnyxmchvy\fsdnpvobksvg.exe
Удаляет следующие файлы
- %WINDIR%\bnyxmchvy\r8nyug
- C:\bnyxmchvy\zpmonosujcnwfis9o.exe
Подменяет следующие файлы
- %WINDIR%\bnyxmchvy\r8nyug
Сетевая активность
Подключается к
- 'pl####ntmanner.net':80
- 'fo####dbright.net':80
- 'di#####ltinstead.net':80
- 'di#####ltexplain.net':80
- 'he####xplain.net':80
- 'de####daughter.net':80
- 'le###rready.net':80
- 'ge###ebrown.net':80
- 'ge####people.net':80
TCP
Запросы HTTP GET
- http://pl####ntmanner.net/index.php
- http://fo####dbright.net/index.php
- http://di#####ltinstead.net/index.php
- http://di#####ltexplain.net/index.php
- http://he####xplain.net/index.php
- http://de####daughter.net/index.php
- http://le###rready.net/index.php
- http://ge###ebrown.net/index.php
- http://ge####people.net/index.php
UDP
- DNS ASK an####business.net
- DNS ASK re####instead.net
- DNS ASK va####sexplain.net
- DNS ASK re####explain.net
- DNS ASK va####sbright.net
- DNS ASK re####bright.net
- DNS ASK va####sinside.net
- DNS ASK re####inside.net
- DNS ASK fo####dready.net
- DNS ASK gl###ready.net
- DNS ASK de###ebrown.net
- DNS ASK fo####dbrown.net
- DNS ASK de####people.net
- DNS ASK fo####dpeople.net
- DNS ASK de####daughter.net
- DNS ASK fo####ddaughter.net
- DNS ASK an###rready.net
- DNS ASK va####sinstead.net
- DNS ASK de###eready.net
- DNS ASK ge####inside.net
- DNS ASK le####instead.net
- DNS ASK re####einstead.net
- DNS ASK or####xplain.net
- DNS ASK re####eexplain.net
- DNS ASK or###bright.net
- DNS ASK re####ebright.net
- DNS ASK or###inside.net
- DNS ASK re####einside.net
- DNS ASK he####instead.net
- DNS ASK ge####explain.net
- DNS ASK le####explain.net
- DNS ASK he####explain.net
- DNS ASK le####bright.net
- DNS ASK he####bright.net
- DNS ASK le####inside.net
- DNS ASK he####inside.net
- DNS ASK ge####instead.net
- DNS ASK ge####bright.net
- DNS ASK he###people.net
- DNS ASK ge###ebrown.net
- DNS ASK an####people.net
- DNS ASK re####eready.net
- DNS ASK or###brown.net
- DNS ASK re####ebrown.net
- DNS ASK or###people.net
- DNS ASK re####epeople.net
- DNS ASK or####aughter.net
- DNS ASK re####edaughter.net
- DNS ASK he###nready.net
- DNS ASK gl###brown.net
- DNS ASK le###rbrown.net
- DNS ASK he###nbrown.net
- DNS ASK le####people.net
- DNS ASK he####people.net
- DNS ASK le####daughter.net
- DNS ASK he####daughter.net
- DNS ASK ge###eready.net
- DNS ASK or###ready.net
- DNS ASK or####nstead.net
- DNS ASK ne#####rydaughter.net
- DNS ASK di####ultpeople.net
- DNS ASK gl###people.net
- DNS ASK an####daughter.net
- DNS ASK gl####aughter.net
- DNS ASK di####ultready.net
- DNS ASK he###ready.net
- DNS ASK di####ultbrown.net
- DNS ASK he###brown.net
- DNS ASK an###rbrown.net
- DNS ASK ne####arypeople.net
- DNS ASK di#####ltdaughter.net
- DNS ASK he####aughter.net
- DNS ASK pl####ntready.net
- DNS ASK ne####aryready.net
- DNS ASK pl####ntbrown.net
- DNS ASK ne####arybrown.net
- DNS ASK pl####ntpeople.net
- DNS ASK pl#####tdaughter.net
- DNS ASK le###rready.net
- DNS ASK ne####aryinside.net
- DNS ASK di####ultbright.net
- DNS ASK re####emanner.net
- DNS ASK or####nother.net
- DNS ASK re####eanother.net
- DNS ASK or####usiness.net
- DNS ASK re####ebusiness.net
- DNS ASK or###appear.net
- DNS ASK re####eappear.net
- DNS ASK he####manner.net
- DNS ASK ge####another.net
- DNS ASK le####another.net
- DNS ASK he####another.net
- DNS ASK le####business.net
- DNS ASK he####business.net
- DNS ASK le####appear.net
- DNS ASK he####appear.net
- DNS ASK ge####manner.net
- DNS ASK or###manner.net
- DNS ASK le####manner.net
- DNS ASK ne####aryappear.net
- DNS ASK di#####ltbusiness.net
- DNS ASK gl####usiness.net
- DNS ASK an####appear.net
- DNS ASK gl###appear.net
- DNS ASK di####ultmanner.net
- DNS ASK he###manner.net
- DNS ASK di#####ltanother.net
- DNS ASK he####nother.net
- DNS ASK he####usiness.net
- DNS ASK ne#####rybusiness.net
- DNS ASK di####ultappear.net
- DNS ASK he###appear.net
- DNS ASK pl####ntmanner.net
- DNS ASK ne####arymanner.net
- DNS ASK pl####ntanother.net
- DNS ASK ne#####ryanother.net
- DNS ASK pl#####tbusiness.net
- DNS ASK pl####ntappear.net
- DNS ASK fo####dinstead.net
- DNS ASK ne####arybright.net
- DNS ASK va####smanner.net
- DNS ASK gl###bright.net
- DNS ASK an####inside.net
- DNS ASK gl###inside.net
- DNS ASK di#####ltinstead.net
- DNS ASK he####nstead.net
- DNS ASK di#####ltexplain.net
- DNS ASK he####xplain.net
- DNS ASK he###bright.net
- DNS ASK ge####appear.net
- DNS ASK di####ultinside.net
- DNS ASK he###inside.net
- DNS ASK pl####ntinstead.net
- DNS ASK ne#####ryinstead.net
- DNS ASK pl####ntexplain.net
- DNS ASK ne#####ryexplain.net
- DNS ASK pl####ntbright.net
- DNS ASK an####bright.net
- DNS ASK pl####ntinside.net
- DNS ASK gl####xplain.net
- DNS ASK de####instead.net
- DNS ASK re####manner.net
- DNS ASK va####sanother.net
- DNS ASK re####another.net
- DNS ASK va####sbusiness.net
- DNS ASK re####business.net
- DNS ASK va####sappear.net
- DNS ASK re####appear.net
- DNS ASK ge####business.net
- DNS ASK gl####nstead.net
- DNS ASK de####explain.net
- DNS ASK fo####dexplain.net
- DNS ASK de####bright.net
- DNS ASK fo####dbright.net
- DNS ASK de####inside.net
- DNS ASK fo####dinside.net
- DNS ASK an####instead.net
- DNS ASK an####explain.net
- DNS ASK ge####people.net
Другое
Создает и запускает на исполнение
- 'C:\bnyxmchvy\zpmonosujcnwfis9o.exe'
- 'C:\bnyxmchvy\cdofcorweyi.exe'
- 'C:\bnyxmchvy\fsdnpvobksvg.exe' "c:\bnyxmchvy\cdofcorweyi.exe"
