Техническая информация
Для обеспечения автозапуска и распространения
Устанавливает следующие настройки сервисов
- [HKLM\System\CurrentControlSet\Services\Files PNRP Alerts Support Enumerator Keying] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\Files PNRP Alerts Support Enumerator Keying] 'ImagePath' = 'C:\homldvlzjw\uxyjsnaw.exe'
Создает следующие сервисы
- 'Files PNRP Alerts Support Enumerator Keying' C:\homldvlzjw\uxyjsnaw.exe
Изменения в файловой системе
Создает следующие файлы
- %WINDIR%\homldvlzjw\meeqtkvjfob
- C:\homldvlzjw\meeqtkvjfob
- C:\homldvlzjw\ob9p9o2k3itmonnf.exe
- C:\homldvlzjw\uxyjsnaw.exe
- C:\homldvlzjw\vqcevivp.exe
Присваивает атрибут 'скрытый' для следующих файлов
- C:\homldvlzjw\uxyjsnaw.exe
- C:\homldvlzjw\vqcevivp.exe
Удаляет следующие файлы
- %WINDIR%\homldvlzjw\meeqtkvjfob
- C:\homldvlzjw\ob9p9o2k3itmonnf.exe
Подменяет следующие файлы
- %WINDIR%\homldvlzjw\meeqtkvjfob
Сетевая активность
Подключается к
- 'st####training.net':80
- 'tr###storm.net':80
- 'be####training.net':80
- 'se####training.net':80
- 'la###period.net':80
- 'la###every.net':80
- 'el####iccharge.net':80
TCP
Запросы HTTP GET
- http://st####training.net/index.php
- http://tr###storm.net/index.php
- http://be####training.net/index.php
- http://se####training.net/index.php
- http://la###period.net/index.php
- http://la###every.net/index.php
- http://el####iccharge.net/index.php
UDP
- DNS ASK st####training.net
- DNS ASK ag####tcharge.net
- DNS ASK do###single.net
- DNS ASK ag####tsingle.net
- DNS ASK se####however.net
- DNS ASK qu####owever.net
- DNS ASK se####period.net
- DNS ASK qu###period.net
- DNS ASK se####although.net
- DNS ASK qu####lthough.net
- DNS ASK se####choose.net
- DNS ASK qu###choose.net
- DNS ASK br####owever.net
- DNS ASK fl####owever.net
- DNS ASK br###period.net
- DNS ASK fl###period.net
- DNS ASK br####lthough.net
- DNS ASK fl####lthough.net
- DNS ASK br###choose.net
- DNS ASK fl###choose.net
- DNS ASK ga####however.net
- DNS ASK be####however.net
- DNS ASK ga####period.net
- DNS ASK be####period.net
- DNS ASK ga####although.net
- DNS ASK be####although.net
- DNS ASK ga####choose.net
- DNS ASK be####choose.net
- DNS ASK tr####owever.net
- DNS ASK st####however.net
- DNS ASK do###charge.net
- DNS ASK ag#####difference.net
- DNS ASK do####ifference.net
- DNS ASK ag####tevery.net
- DNS ASK st#####ifference.net
- DNS ASK tr###charge.net
- DNS ASK st####charge.net
- DNS ASK tr###single.net
- DNS ASK st####single.net
- DNS ASK el####icevery.net
- DNS ASK re###devery.net
- DNS ASK el#####cdifference.net
- DNS ASK re#####ifference.net
- DNS ASK el####iccharge.net
- DNS ASK re####charge.net
- DNS ASK el####icsingle.net
- DNS ASK re####single.net
- DNS ASK ca####nevery.net
- DNS ASK ca#####difference.net
- DNS ASK la###every.net
- DNS ASK la####ifference.net
- DNS ASK ca####ncharge.net
- DNS ASK la###charge.net
- DNS ASK ca####nsingle.net
- DNS ASK la###single.net
- DNS ASK de###eevery.net
- DNS ASK ni###every.net
- DNS ASK de#####ifference.net
- DNS ASK ni####ifference.net
- DNS ASK de####charge.net
- DNS ASK ni###charge.net
- DNS ASK de####single.net
- DNS ASK ni###single.net
- DNS ASK do###every.net
- DNS ASK tr####ifference.net
- DNS ASK tr###period.net
- DNS ASK st####period.net
- DNS ASK tr####lthough.net
- DNS ASK se####thrown.net
- DNS ASK qu###thrown.net
- DNS ASK se###nstorm.net
- DNS ASK qu###storm.net
- DNS ASK se####training.net
- DNS ASK qu####raining.net
- DNS ASK se####hunger.net
- DNS ASK qu###hunger.net
- DNS ASK br###thrown.net
- DNS ASK fl###thrown.net
- DNS ASK br###storm.net
- DNS ASK fl###storm.net
- DNS ASK br####raining.net
- DNS ASK fl####raining.net
- DNS ASK br###hunger.net
- DNS ASK fl###hunger.net
- DNS ASK ga####thrown.net
- DNS ASK be####thrown.net
- DNS ASK ga###rstorm.net
- DNS ASK be###rstorm.net
- DNS ASK ga####training.net
- DNS ASK be####training.net
- DNS ASK ga####hunger.net
- DNS ASK be####hunger.net
- DNS ASK tr###thrown.net
- DNS ASK st####thrown.net
- DNS ASK tr###storm.net
- DNS ASK st###tstorm.net
- DNS ASK tr####raining.net
- DNS ASK ag####tchoose.net
- DNS ASK do###choose.net
- DNS ASK ag####talthough.net
- DNS ASK do####lthough.net
- DNS ASK tr###choose.net
- DNS ASK st####choose.net
- DNS ASK el####ichowever.net
- DNS ASK re####however.net
- DNS ASK el####icperiod.net
- DNS ASK re####period.net
- DNS ASK el#####calthough.net
- DNS ASK re####although.net
- DNS ASK el####icchoose.net
- DNS ASK re####choose.net
- DNS ASK ca####nhowever.net
- DNS ASK la####owever.net
- DNS ASK ca####nperiod.net
- DNS ASK la###period.net
- DNS ASK la####lthough.net
- DNS ASK ca####nalthough.net
- DNS ASK ca####nchoose.net
- DNS ASK la###choose.net
- DNS ASK de####however.net
- DNS ASK ni####owever.net
- DNS ASK de####period.net
- DNS ASK ni###period.net
- DNS ASK de####although.net
- DNS ASK ni####lthough.net
- DNS ASK de####choose.net
- DNS ASK ni###choose.net
- DNS ASK do####owever.net
- DNS ASK ag####thowever.net
- DNS ASK do###period.net
- DNS ASK ag####tperiod.net
- DNS ASK st####although.net
- DNS ASK st###tevery.net
Другое
Создает и запускает на исполнение
- 'C:\homldvlzjw\ob9p9o2k3itmonnf.exe'
- 'C:\homldvlzjw\uxyjsnaw.exe'
- 'C:\homldvlzjw\vqcevivp.exe' "c:\homldvlzjw\uxyjsnaw.exe"
