Техническая информация
Для обеспечения автозапуска и распространения
Устанавливает следующие настройки сервисов
- [<HKLM>\System\CurrentControlSet\Services\Foundation Fax Performance] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\Foundation Fax Performance] 'ImagePath' = 'C:\zlnkikustbe\kjjgmvhiydnj.exe'
Создает следующие сервисы
- 'Foundation Fax Performance' C:\zlnkikustbe\kjjgmvhiydnj.exe
Изменения в файловой системе
Создает следующие файлы
- %WINDIR%\zlnkikustbe\bgj80gq
- C:\zlnkikustbe\bgj80gq
- C:\zlnkikustbe\jyo71xepoxxfet8h.exe
- C:\zlnkikustbe\kjjgmvhiydnj.exe
- C:\zlnkikustbe\wzlksogxwyo.exe
- C:\zlnkikustbe\hqzsoskpp47
Присваивает атрибут 'скрытый' для следующих файлов
- C:\zlnkikustbe\kjjgmvhiydnj.exe
- C:\zlnkikustbe\wzlksogxwyo.exe
Удаляет следующие файлы
- %WINDIR%\zlnkikustbe\bgj80gq
- C:\zlnkikustbe\jyo71xepoxxfet8h.exe
Подменяет следующие файлы
- %WINDIR%\zlnkikustbe\bgj80gq
Сетевая активность
Подключается к
- 'fo####dappear.net':80
- 'pl####ntmanner.net':80
- 'fo####dbright.net':80
- 'di#####ltinstead.net':80
- 'di#####ltexplain.net':80
TCP
Запросы HTTP GET
- http://fo####dappear.net/index.php
- http://pl####ntmanner.net/index.php
- http://fo####dbright.net/index.php
- http://di#####ltinstead.net/index.php
- http://di#####ltexplain.net/index.php
UDP
- DNS ASK de####appear.net
- DNS ASK fo####dexplain.net
- DNS ASK de####explain.net
- DNS ASK fo####dinstead.net
- DNS ASK de####instead.net
- DNS ASK re####appear.net
- DNS ASK va####sappear.net
- DNS ASK re####business.net
- DNS ASK de####bright.net
- DNS ASK va####sbusiness.net
- DNS ASK va####sanother.net
- DNS ASK re####manner.net
- DNS ASK va####smanner.net
- DNS ASK ge####appear.net
- DNS ASK ge####business.net
- DNS ASK ge####another.net
- DNS ASK ge####manner.net
- DNS ASK re####another.net
- DNS ASK fo####dbright.net
- DNS ASK de####inside.net
- DNS ASK fo####dinside.net
- DNS ASK pl####ntinstead.net
- DNS ASK he###inside.net
- DNS ASK di####ultinside.net
- DNS ASK he###bright.net
- DNS ASK di####ultbright.net
- DNS ASK he####xplain.net
- DNS ASK di#####ltexplain.net
- DNS ASK he####nstead.net
- DNS ASK di#####ltinstead.net
- DNS ASK gl###inside.net
- DNS ASK an####inside.net
- DNS ASK gl###bright.net
- DNS ASK an####bright.net
- DNS ASK gl####xplain.net
- DNS ASK an####explain.net
- DNS ASK gl####nstead.net
- DNS ASK an####instead.net
- DNS ASK he####appear.net
- DNS ASK ne#####ryinstead.net
- DNS ASK le####appear.net
- DNS ASK le####business.net
- DNS ASK di####ultappear.net
- DNS ASK he####usiness.net
- DNS ASK di#####ltbusiness.net
- DNS ASK he####nother.net
- DNS ASK di#####ltanother.net
- DNS ASK he###manner.net
- DNS ASK di####ultmanner.net
- DNS ASK he###appear.net
- DNS ASK gl###appear.net
- DNS ASK gl####usiness.net
- DNS ASK an####business.net
- DNS ASK gl####nother.net
- DNS ASK an####another.net
- DNS ASK gl###manner.net
- DNS ASK an####manner.net
- DNS ASK fo####dappear.net
- DNS ASK an####appear.net
- DNS ASK pl####ntmanner.net
- DNS ASK ne####arymanner.net
- DNS ASK pl####ntanother.net
- DNS ASK he####another.net
- DNS ASK le####another.net
- DNS ASK he####manner.net
- DNS ASK le####manner.net
- DNS ASK re####eappear.net
- DNS ASK or###appear.net
- DNS ASK re####ebusiness.net
- DNS ASK or####usiness.net
- DNS ASK re####eanother.net
- DNS ASK or####nother.net
- DNS ASK re####emanner.net
- DNS ASK or###manner.net
- DNS ASK ne####aryappear.net
- DNS ASK pl####ntappear.net
- DNS ASK ne#####rybusiness.net
- DNS ASK pl#####tbusiness.net
- DNS ASK ne#####ryanother.net
- DNS ASK he####business.net
- DNS ASK pl####ntexplain.net
Другое
Создает и запускает на исполнение
- 'C:\zlnkikustbe\jyo71xepoxxfet8h.exe'
- 'C:\zlnkikustbe\kjjgmvhiydnj.exe'
- 'C:\zlnkikustbe\wzlksogxwyo.exe' "c:\zlnkikustbe\kjjgmvhiydnj.exe"
