Техническая информация
Для обеспечения автозапуска и распространения
Устанавливает следующие настройки сервисов
- [HKLM\System\CurrentControlSet\Services\Publication Support Image Log Connect SPP] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\Publication Support Image Log Connect SPP] 'ImagePath' = 'C:\cmykxnd\dqwnmcuvqia.exe'
Создает следующие сервисы
- 'Publication Support Image Log Connect SPP' C:\cmykxnd\dqwnmcuvqia.exe
Изменения в файловой системе
Создает следующие файлы
- %WINDIR%\cmykxnd\z4swrh
- C:\cmykxnd\z4swrh
- C:\cmykxnd\hfjmdi56zanyizegwmzr.exe
- C:\cmykxnd\dqwnmcuvqia.exe
- C:\cmykxnd\lzboajfv.exe
Присваивает атрибут 'скрытый' для следующих файлов
- C:\cmykxnd\dqwnmcuvqia.exe
- C:\cmykxnd\lzboajfv.exe
Удаляет следующие файлы
- %WINDIR%\cmykxnd\z4swrh
- C:\cmykxnd\hfjmdi56zanyizegwmzr.exe
Подменяет следующие файлы
- %WINDIR%\cmykxnd\z4swrh
Сетевая активность
Подключается к
- 'cl###notice.net':80
- 'of###north.net':80
- 'tw###enorth.net':80
- 'cl####nclude.net':80
- 'we####rbranch.net':80
- 'pr####tneither.net':80
- 'th###system.net':80
- 'of####either.net':80
TCP
Запросы HTTP GET
- http://cl###notice.net/index.php
- http://of###north.net/index.php
- http://tw###enorth.net/index.php
- http://cl####nclude.net/index.php
- http://we####rbranch.net/index.php
- http://pr####tneither.net/index.php
- http://th###system.net/index.php
- http://of####either.net/index.php
UDP
- DNS ASK am####during.net
- DNS ASK mi####believe.net
- DNS ASK tw####believe.net
- DNS ASK mi####receive.net
- DNS ASK tw####receive.net
- DNS ASK mi####quarter.net
- DNS ASK tw####quarter.net
- DNS ASK ra####branch.net
- DNS ASK mo####gbranch.net
- DNS ASK ra####believe.net
- DNS ASK mo####gbelieve.net
- DNS ASK ra####receive.net
- DNS ASK mo####greceive.net
- DNS ASK ra####quarter.net
- DNS ASK mo####gquarter.net
- DNS ASK st####ebranch.net
- DNS ASK tw####branch.net
- DNS ASK hi####ybranch.net
- DNS ASK mi####branch.net
- DNS ASK of####uarter.net
- DNS ASK pr####tquarter.net
- DNS ASK ch###branch.net
- DNS ASK co####ebranch.net
- DNS ASK ch####elieve.net
- DNS ASK co####ebelieve.net
- DNS ASK ch####eceive.net
- DNS ASK co####ereceive.net
- DNS ASK ch####uarter.net
- DNS ASK co####equarter.net
- DNS ASK of###branch.net
- DNS ASK al###branch.net
- DNS ASK of####elieve.net
- DNS ASK al####elieve.net
- DNS ASK of####eceive.net
- DNS ASK al####eceive.net
- DNS ASK al####uarter.net
- DNS ASK pr####thonor.net
- DNS ASK al####either.net
- DNS ASK st####ereceive.net
- DNS ASK th###system.net
- DNS ASK pr####tsystem.net
- DNS ASK th###trust.net
- DNS ASK pr####ttrust.net
- DNS ASK ch###honor.net
- DNS ASK co####ehonor.net
- DNS ASK ch####either.net
- DNS ASK co####eneither.net
- DNS ASK ch###system.net
- DNS ASK co####esystem.net
- DNS ASK ch###trust.net
- DNS ASK co####etrust.net
- DNS ASK of###honor.net
- DNS ASK al###honor.net
- DNS ASK of####either.net
- DNS ASK pr####tneither.net
- DNS ASK th####uarter.net
- DNS ASK th####either.net
- DNS ASK th###honor.net
- DNS ASK hi####yreceive.net
- DNS ASK st####equarter.net
- DNS ASK hi####yquarter.net
- DNS ASK am####branch.net
- DNS ASK we####rbranch.net
- DNS ASK am####believe.net
- DNS ASK we####rbelieve.net
- DNS ASK am####receive.net
- DNS ASK we####rreceive.net
- DNS ASK am####quarter.net
- DNS ASK we####rquarter.net
- DNS ASK cl###branch.net
- DNS ASK cl####elieve.net
- DNS ASK cl####eceive.net
- DNS ASK cl####uarter.net
- DNS ASK st####ebelieve.net
- DNS ASK hi####ybelieve.net
- DNS ASK pr####treceive.net
- DNS ASK tw####general.net
- DNS ASK ch####eneral.net
- DNS ASK co####egeneral.net
- DNS ASK ch####nclude.net
- DNS ASK co####einclude.net
- DNS ASK ch###north.net
- DNS ASK co####enorth.net
- DNS ASK of###clear.net
- DNS ASK al###clear.net
- DNS ASK of####eneral.net
- DNS ASK al####eneral.net
- DNS ASK of####nclude.net
- DNS ASK al####nclude.net
- DNS ASK of###north.net
- DNS ASK al###north.net
- DNS ASK mi###eclear.net
- DNS ASK co####eclear.net
- DNS ASK tw###eclear.net
- DNS ASK ch###clear.net
- DNS ASK th###north.net
- DNS ASK we####rduring.net
- DNS ASK th###length.net
- DNS ASK cl###length.net
- DNS ASK th###notice.net
- DNS ASK cl###notice.net
- DNS ASK th###indeed.net
- DNS ASK cl###indeed.net
- DNS ASK th###during.net
- DNS ASK cl###during.net
- DNS ASK th###clear.net
- DNS ASK pr####tclear.net
- DNS ASK th####eneral.net
- DNS ASK pr####tgeneral.net
- DNS ASK th####nclude.net
- DNS ASK pr####tinclude.net
- DNS ASK pr####tnorth.net
- DNS ASK hi####yinclude.net
- DNS ASK pr####tbelieve.net
- DNS ASK mi####include.net
- DNS ASK am###tclear.net
- DNS ASK we####rclear.net
- DNS ASK am####general.net
- DNS ASK we####rgeneral.net
- DNS ASK am####include.net
- DNS ASK we####rinclude.net
- DNS ASK am###tnorth.net
- DNS ASK we####rnorth.net
- DNS ASK cl###clear.net
- DNS ASK cl####eneral.net
- DNS ASK cl####nclude.net
- DNS ASK cl###north.net
- DNS ASK th###branch.net
- DNS ASK pr####tbranch.net
- DNS ASK th####elieve.net
- DNS ASK hi####ynorth.net
- DNS ASK th####eceive.net
- DNS ASK st####enorth.net
- DNS ASK st####einclude.net
- DNS ASK tw####include.net
- DNS ASK mi###enorth.net
- DNS ASK tw###enorth.net
- DNS ASK ra###rclear.net
- DNS ASK mo####gclear.net
- DNS ASK ra####general.net
- DNS ASK mo####ggeneral.net
- DNS ASK ra####include.net
- DNS ASK mo####ginclude.net
- DNS ASK ra###rnorth.net
- DNS ASK mo####gnorth.net
- DNS ASK st####eclear.net
- DNS ASK hi####yclear.net
- DNS ASK st####egeneral.net
- DNS ASK hi####ygeneral.net
- DNS ASK mi####general.net
- DNS ASK of###system.net
Другое
Создает и запускает на исполнение
- 'C:\cmykxnd\hfjmdi56zanyizegwmzr.exe'
- 'C:\cmykxnd\dqwnmcuvqia.exe'
- 'C:\cmykxnd\lzboajfv.exe' "c:\cmykxnd\dqwnmcuvqia.exe"
