Техническая информация
Для обеспечения автозапуска и распространения
Устанавливает следующие настройки сервисов
- [HKLM\System\CurrentControlSet\Services\AutoConfig Print Modules Identity] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\AutoConfig Print Modules Identity] 'ImagePath' = 'C:\jjjnyavgkj\slhwyrqds.exe'
Создает следующие сервисы
- 'AutoConfig Print Modules Identity' C:\jjjnyavgkj\slhwyrqds.exe
Изменения в файловой системе
Создает следующие файлы
- %WINDIR%\jjjnyavgkj\qfslkrqntqbu
- C:\jjjnyavgkj\qfslkrqntqbu
- C:\jjjnyavgkj\rsi5a0zlacfcxwimx.exe
- C:\jjjnyavgkj\slhwyrqds.exe
- C:\jjjnyavgkj\ejxakeiemhem.exe
Присваивает атрибут 'скрытый' для следующих файлов
- C:\jjjnyavgkj\slhwyrqds.exe
- C:\jjjnyavgkj\ejxakeiemhem.exe
Удаляет следующие файлы
- %WINDIR%\jjjnyavgkj\qfslkrqntqbu
- C:\jjjnyavgkj\rsi5a0zlacfcxwimx.exe
Подменяет следующие файлы
- %WINDIR%\jjjnyavgkj\qfslkrqntqbu
Сетевая активность
Подключается к
- 'do####behind.net':80
- 'do####butter.net':80
- 'st###broad.net':80
- 'bu####ngservice.net':80
- 'st###river.net':80
- 'pr###yriver.net':80
TCP
Запросы HTTP GET
- http://do####behind.net/index.php
- http://do####butter.net/index.php
- http://st###broad.net/index.php
- http://bu####ngservice.net/index.php
- http://st###river.net/index.php
- http://pr###yriver.net/index.php
UDP
- DNS ASK bu#####gunderstand.net
- DNS ASK br####article.net
- DNS ASK re####article.net
- DNS ASK pr####edried.net
- DNS ASK de###edried.net
- DNS ASK pr####efifteen.net
- DNS ASK st####tharticle.net
- DNS ASK re###tangry.net
- DNS ASK br###nangry.net
- DNS ASK pr####earticle.net
- DNS ASK de####article.net
- DNS ASK st####thdried.net
- DNS ASK st####thfifteen.net
- DNS ASK st####thangry.net
- DNS ASK de####fifteen.net
- DNS ASK de###eangry.net
- DNS ASK do###rdried.net
- DNS ASK pr####eangry.net
- DNS ASK fe###wdried.net
- DNS ASK do####fifteen.net
- DNS ASK pr####fifteen.net
- DNS ASK do###rangry.net
- DNS ASK pr###yangry.net
- DNS ASK do####article.net
- DNS ASK re###tdried.net
- DNS ASK re####fifteen.net
- DNS ASK br####fifteen.net
- DNS ASK fe####fifteen.net
- DNS ASK fe###wangry.net
- DNS ASK do###eangry.net
- DNS ASK fe####article.net
- DNS ASK br###ndried.net
- DNS ASK pr####article.net
- DNS ASK do###edried.net
- DNS ASK pr###ydried.net
- DNS ASK mo####ntmister.net
- DNS ASK mo####ntservice.net
- DNS ASK st###river.net
- DNS ASK mi###river.net
- DNS ASK do####mister.net
- DNS ASK pr####mister.net
- DNS ASK do####suppose.net
- DNS ASK st####ervice.net
- DNS ASK mi####ervice.net
- DNS ASK pr####suppose.net
- DNS ASK do###rriver.net
- DNS ASK pr###yriver.net
- DNS ASK fe####mister.net
- DNS ASK fe####suppose.net
- DNS ASK fe####service.net
- DNS ASK do####service.net
- DNS ASK pr####service.net
- DNS ASK mo####ntsuppose.net
- DNS ASK ou####emister.net
- DNS ASK mi###mister.net
- DNS ASK ou####eservice.net
- DNS ASK mo####ntriver.net
- DNS ASK ou####eriver.net
- DNS ASK bu####ngmister.net
- DNS ASK st####uppose.net
- DNS ASK ou####esuppose.net
- DNS ASK mi####uppose.net
- DNS ASK ev####gmister.net
- DNS ASK ev####gservice.net
- DNS ASK bu####ngriver.net
- DNS ASK ev####griver.net
- DNS ASK st###mister.net
- DNS ASK bu####ngsuppose.net
- DNS ASK ev####gsuppose.net
- DNS ASK bu####ngservice.net
- DNS ASK mi####rticle.net
- DNS ASK st####rticle.net
- DNS ASK mi###angry.net
- DNS ASK do####behind.net
- DNS ASK pr####behind.net
- DNS ASK do####butter.net
- DNS ASK pr####butter.net
- DNS ASK fe#####nderstand.net
- DNS ASK do###rbroad.net
- DNS ASK br####behind.net
- DNS ASK pr#####nderstand.net
- DNS ASK fe####butter.net
- DNS ASK br#####nderstand.net
- DNS ASK re#####nderstand.net
- DNS ASK br###nbroad.net
- DNS ASK re###tbroad.net
- DNS ASK do###ebroad.net
- DNS ASK fe###wbroad.net
- DNS ASK fe####behind.net
- DNS ASK mi###butter.net
- DNS ASK mi####nderstand.net
- DNS ASK bu####ngbroad.net
- DNS ASK ev####gbroad.net
- DNS ASK bu####ngbehind.net
- DNS ASK ev####gbehind.net
- DNS ASK bu####ngbutter.net
- DNS ASK do#####nderstand.net
- DNS ASK re####behind.net
- DNS ASK ev#####understand.net
- DNS ASK st###broad.net
- DNS ASK mi###broad.net
- DNS ASK st###behind.net
- DNS ASK mi###behind.net
- DNS ASK st###butter.net
- DNS ASK st####nderstand.net
- DNS ASK ev####gbutter.net
- DNS ASK pr###ybroad.net
- DNS ASK br####butter.net
- DNS ASK ou####earticle.net
- DNS ASK ev####gdried.net
- DNS ASK bu####ngfifteen.net
- DNS ASK ev####gfifteen.net
- DNS ASK bu####ngangry.net
- DNS ASK mo####ntarticle.net
- DNS ASK mo####ntangry.net
- DNS ASK bu####ngdried.net
- DNS ASK ev####gangry.net
- DNS ASK mi###dried.net
- DNS ASK st####ifteen.net
- DNS ASK mi####ifteen.net
- DNS ASK st###angry.net
- DNS ASK bu####ngarticle.net
- DNS ASK ev####garticle.net
- DNS ASK st###dried.net
- DNS ASK ou####eangry.net
- DNS ASK ou####efifteen.net
- DNS ASK re####butter.net
- DNS ASK de#####nderstand.net
- DNS ASK pr####ebroad.net
- DNS ASK de###ebroad.net
- DNS ASK pr####ebehind.net
- DNS ASK de####behind.net
- DNS ASK pr####ebutter.net
- DNS ASK pr#####understand.net
- DNS ASK de####butter.net
- DNS ASK st####thbroad.net
- DNS ASK st####thbehind.net
- DNS ASK st####thbutter.net
- DNS ASK mo####ntdried.net
- DNS ASK ou####edried.net
- DNS ASK mo####ntfifteen.net
- DNS ASK st#####hunderstand.net
- DNS ASK fe###wriver.net
- DNS ASK do###eriver.net
Другое
Создает и запускает на исполнение
- 'C:\jjjnyavgkj\rsi5a0zlacfcxwimx.exe'
- 'C:\jjjnyavgkj\slhwyrqds.exe'
- 'C:\jjjnyavgkj\ejxakeiemhem.exe' "c:\jjjnyavgkj\slhwyrqds.exe"
