Техническая информация
Для обеспечения автозапуска и распространения
Устанавливает следующие настройки сервисов
- [HKLM\System\CurrentControlSet\Services\Telephony Link Logon NGEN Card WLAN Notification] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\Telephony Link Logon NGEN Card WLAN Notification] 'ImagePath' = 'C:\ffxdxlvknpkzs\qxpkdhe.exe'
Создает следующие сервисы
- 'Telephony Link Logon NGEN Card WLAN Notification' C:\ffxdxlvknpkzs\qxpkdhe.exe
Изменения в файловой системе
Создает следующие файлы
- %WINDIR%\ffxdxlvknpkzs\zndveifnzgu
- C:\ffxdxlvknpkzs\zndveifnzgu
- C:\ffxdxlvknpkzs\f7l4wwsfzpqsqxuu.exe
- C:\ffxdxlvknpkzs\qxpkdhe.exe
- C:\ffxdxlvknpkzs\venpzhgsds.exe
Присваивает атрибут 'скрытый' для следующих файлов
- C:\ffxdxlvknpkzs\qxpkdhe.exe
- C:\ffxdxlvknpkzs\venpzhgsds.exe
Удаляет следующие файлы
- %WINDIR%\ffxdxlvknpkzs\zndveifnzgu
- C:\ffxdxlvknpkzs\f7l4wwsfzpqsqxuu.exe
Подменяет следующие файлы
- %WINDIR%\ffxdxlvknpkzs\zndveifnzgu
Сетевая активность
Подключается к
- 'de###eheart.net':80
- 'st###heart.net':80
- 'st####thbattle.net':80
- 'ex###tvalue.net':80
- 'ri###reason.net':80
- 'wh####rorderly.net':80
- 'ci####ttereason.net':80
- 'ri###chance.net':80
- 'th####chance.net':80
TCP
Запросы HTTP GET
- http://de###eheart.net/index.php
- http://st###heart.net/index.php
- http://st####thbattle.net/index.php
- http://ex###tvalue.net/index.php
- http://ri###reason.net/index.php
- http://wh####rorderly.net/index.php
- http://ci####ttereason.net/index.php
- http://ri###chance.net/index.php
- http://th####chance.net/index.php
UDP
- DNS ASK re####perfect.net
- DNS ASK wh####rchance.net
- DNS ASK ri###chance.net
- DNS ASK wh####rmeeting.net
- DNS ASK ri####eeting.net
- DNS ASK wh####rtwenty.net
- DNS ASK ri###twenty.net
- DNS ASK wh#####understood.net
- DNS ASK ci####ttechance.net
- DNS ASK ri####nderstood.net
- DNS ASK th####chance.net
- DNS ASK fi####meeting.net
- DNS ASK th####meeting.net
- DNS ASK fi####twenty.net
- DNS ASK th####twenty.net
- DNS ASK fi#####nderstood.net
- DNS ASK th#####nderstood.net
- DNS ASK su#####nderstood.net
- DNS ASK fo#####understood.net
- DNS ASK fi####chance.net
- DNS ASK pi####echance.net
- DNS ASK fo####nmeeting.net
- DNS ASK ex####twenty.net
- DNS ASK be####etwenty.net
- DNS ASK ex#####nderstood.net
- DNS ASK be#####understood.net
- DNS ASK pe####chance.net
- DNS ASK ma####echance.net
- DNS ASK pe####meeting.net
- DNS ASK ma####emeeting.net
- DNS ASK pe####twenty.net
- DNS ASK ma####etwenty.net
- DNS ASK pe#####nderstood.net
- DNS ASK ma#####understood.net
- DNS ASK su####chance.net
- DNS ASK fo####nchance.net
- DNS ASK su####meeting.net
- DNS ASK su####twenty.net
- DNS ASK ex####meeting.net
- DNS ASK fo####ntwenty.net
- DNS ASK fi####almost.net
- DNS ASK pi####emeeting.net
- DNS ASK ex###ttrain.net
- DNS ASK ex#####lectricity.net
- DNS ASK be#####electricity.net
- DNS ASK ex####delight.net
- DNS ASK be####edelight.net
- DNS ASK pe####borrow.net
- DNS ASK ma####eborrow.net
- DNS ASK pe###ntrain.net
- DNS ASK ci#####temeeting.net
- DNS ASK ma####etrain.net
- DNS ASK ma#####electricity.net
- DNS ASK pe####delight.net
- DNS ASK ma####edelight.net
- DNS ASK su####borrow.net
- DNS ASK fo####nborrow.net
- DNS ASK su###ntrain.net
- DNS ASK be####eborrow.net
- DNS ASK ex####borrow.net
- DNS ASK be####etrain.net
- DNS ASK en#####understood.net
- DNS ASK ei#####nderstood.net
- DNS ASK pi####etwenty.net
- DNS ASK pi#####understood.net
- DNS ASK ci#####teunderstood.net
- DNS ASK ch####enchance.net
- DNS ASK fa####chance.net
- DNS ASK ch####enmeeting.net
- DNS ASK fa####meeting.net
- DNS ASK be####echance.net
- DNS ASK ch####entwenty.net
- DNS ASK be####emeeting.net
- DNS ASK ch#####nunderstood.net
- DNS ASK ei####chance.net
- DNS ASK en####hchance.net
- DNS ASK ei####meeting.net
- DNS ASK en####hmeeting.net
- DNS ASK ei####twenty.net
- DNS ASK en####htwenty.net
- DNS ASK fa####twenty.net
- DNS ASK ci####ttetwenty.net
- DNS ASK fa#####nderstood.net
- DNS ASK ex####chance.net
- DNS ASK en####hvalue.net
- DNS ASK ei###rvalue.net
- DNS ASK ex####orderly.net
- DNS ASK be####eorderly.net
- DNS ASK ex###tvalue.net
- DNS ASK be####evalue.net
- DNS ASK pe####almost.net
- DNS ASK ma####ealmost.net
- DNS ASK pe####reason.net
- DNS ASK ma####ereason.net
- DNS ASK pe####orderly.net
- DNS ASK ma####eorderly.net
- DNS ASK pe###nvalue.net
- DNS ASK ma####evalue.net
- DNS ASK su####almost.net
- DNS ASK fo####nalmost.net
- DNS ASK su####reason.net
- DNS ASK be####ealmost.net
- DNS ASK st###battle.net
- DNS ASK be####ereason.net
- DNS ASK ex####almost.net
- DNS ASK st####thbattle.net
- DNS ASK de###emayor.net
- DNS ASK re###tmayor.net
- DNS ASK br####battle.net
- DNS ASK re####battle.net
- DNS ASK pr####eheart.net
- DNS ASK de###eheart.net
- DNS ASK pr####eperfect.net
- DNS ASK de####perfect.net
- DNS ASK fo####nreason.net
- DNS ASK fo####ntrain.net
- DNS ASK pr####emayor.net
- DNS ASK de####battle.net
- DNS ASK st####thheart.net
- DNS ASK st###heart.net
- DNS ASK st####thperfect.net
- DNS ASK st####erfect.net
- DNS ASK st####thmayor.net
- DNS ASK st###mayor.net
- DNS ASK br###nmayor.net
- DNS ASK pr####ebattle.net
- DNS ASK pe#####lectricity.net
- DNS ASK su####orderly.net
- DNS ASK wh####ralmost.net
- DNS ASK ci####ttevalue.net
- DNS ASK ch####enalmost.net
- DNS ASK fa####almost.net
- DNS ASK ch####enreason.net
- DNS ASK fa####reason.net
- DNS ASK ch####enorderly.net
- DNS ASK ex####reason.net
- DNS ASK fa####orderly.net
- DNS ASK fa###yvalue.net
- DNS ASK ei####almost.net
- DNS ASK en####halmost.net
- DNS ASK ei####reason.net
- DNS ASK en####hreason.net
- DNS ASK ei####orderly.net
- DNS ASK en####horderly.net
- DNS ASK pi####eorderly.net
- DNS ASK ch####envalue.net
- DNS ASK pi####evalue.net
- DNS ASK ci#####teorderly.net
- DNS ASK ci####ttereason.net
- DNS ASK pi####ereason.net
- DNS ASK ri###almost.net
- DNS ASK wh####rreason.net
- DNS ASK ri###reason.net
- DNS ASK wh####rorderly.net
- DNS ASK ri####rderly.net
- DNS ASK wh####rvalue.net
- DNS ASK fo####norderly.net
- DNS ASK ri###value.net
- DNS ASK su###nvalue.net
- DNS ASK th####almost.net
- DNS ASK th####reason.net
- DNS ASK fi####orderly.net
- DNS ASK th####orderly.net
- DNS ASK fi###evalue.net
- DNS ASK th###hvalue.net
- DNS ASK pi####ealmost.net
- DNS ASK fo####nvalue.net
- DNS ASK ci####ttealmost.net
- DNS ASK fi####reason.net
- DNS ASK su#####lectricity.net
Другое
Создает и запускает на исполнение
- 'C:\ffxdxlvknpkzs\f7l4wwsfzpqsqxuu.exe'
- 'C:\ffxdxlvknpkzs\qxpkdhe.exe'
- 'C:\ffxdxlvknpkzs\venpzhgsds.exe' "c:\ffxdxlvknpkzs\qxpkdhe.exe"
