Техническая информация
Для обеспечения автозапуска и распространения
Устанавливает следующие настройки сервисов
- [HKLM\System\CurrentControlSet\Services\Session Tracking Telephony] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\Session Tracking Telephony] 'ImagePath' = 'C:\rfncqlvhyypamz\basjbkmojh.exe'
Создает следующие сервисы
- 'Session Tracking Telephony' C:\rfncqlvhyypamz\basjbkmojh.exe
Изменения в файловой системе
Создает следующие файлы
- %WINDIR%\rfncqlvhyypamz\mbtohbfcth
- C:\rfncqlvhyypamz\mbtohbfcth
- C:\rfncqlvhyypamz\m26ok6d8kbt4xveohe.exe
- C:\rfncqlvhyypamz\basjbkmojh.exe
- C:\rfncqlvhyypamz\xwwvkvvnqh.exe
- C:\rfncqlvhyypamz\ba3ognkckuvb
Присваивает атрибут 'скрытый' для следующих файлов
- C:\rfncqlvhyypamz\basjbkmojh.exe
- C:\rfncqlvhyypamz\xwwvkvvnqh.exe
Удаляет следующие файлы
- %WINDIR%\rfncqlvhyypamz\mbtohbfcth
- C:\rfncqlvhyypamz\m26ok6d8kbt4xveohe.exe
Подменяет следующие файлы
- %WINDIR%\rfncqlvhyypamz\mbtohbfcth
Сетевая активность
Подключается к
- 'le####ladder.net':80
- 'le###rboard.net':80
- 'he####haracter.net':80
- 'ge###eboard.net':80
- 'gl###bridge.net':80
- 'or###bridge.net':80
- 'le####bridge.net':80
- 'fo####dkitchen.net':80
- 'di####ultwagon.net':80
- 'ge####kitchen.net':80
- 'gl####elcome.net':80
TCP
Запросы HTTP GET
- http://le####ladder.net/index.php
- http://le###rboard.net/index.php
- http://he####haracter.net/index.php
- http://ge###eboard.net/index.php
- http://gl###bridge.net/index.php
- http://or###bridge.net/index.php
- http://le####bridge.net/index.php
- http://fo####dkitchen.net/index.php
- http://di####ultwagon.net/index.php
- http://ge####kitchen.net/index.php
- http://gl####elcome.net/index.php
UDP
- DNS ASK le####ladder.net
- DNS ASK he###wagon.net
- DNS ASK di#####ltwithout.net
- DNS ASK he####ithout.net
- DNS ASK di#####ltkitchen.net
- DNS ASK he####itchen.net
- DNS ASK di#####ltprobable.net
- DNS ASK or###wagon.net
- DNS ASK he####robable.net
- DNS ASK ne####arywagon.net
- DNS ASK pl####ntwithout.net
- DNS ASK ne#####rywithout.net
- DNS ASK pl####ntkitchen.net
- DNS ASK ne#####rykitchen.net
- DNS ASK pl#####tprobable.net
- DNS ASK gl####robable.net
- DNS ASK di####ultwagon.net
- DNS ASK pl####ntwagon.net
- DNS ASK ne#####ryprobable.net
- DNS ASK an####kitchen.net
- DNS ASK re###nwhose.net
- DNS ASK de###ewagon.net
- DNS ASK fo####dwagon.net
- DNS ASK de####without.net
- DNS ASK fo####dwithout.net
- DNS ASK de####kitchen.net
- DNS ASK fo####dkitchen.net
- DNS ASK de####probable.net
- DNS ASK fo####dprobable.net
- DNS ASK an###rwagon.net
- DNS ASK gl###wagon.net
- DNS ASK an####without.net
- DNS ASK gl####ithout.net
- DNS ASK gl####itchen.net
- DNS ASK re####bicycle.net
- DNS ASK an####probable.net
- DNS ASK pl####ntbridge.net
- DNS ASK re####ewagon.net
- DNS ASK re####without.net
- DNS ASK re####kitchen.net
- DNS ASK va####sprobable.net
- DNS ASK re####probable.net
- DNS ASK de####welcome.net
- DNS ASK fo####dwelcome.net
- DNS ASK de####around.net
- DNS ASK or####ithout.net
- DNS ASK fo####daround.net
- DNS ASK fo####dproud.net
- DNS ASK de####complete.net
- DNS ASK fo####dcomplete.net
- DNS ASK an####welcome.net
- DNS ASK gl####elcome.net
- DNS ASK va####swithout.net
- DNS ASK re###nwagon.net
- DNS ASK va####skitchen.net
- DNS ASK va####swagon.net
- DNS ASK ge####probable.net
- DNS ASK re####ewithout.net
- DNS ASK re####ekitchen.net
- DNS ASK or####robable.net
- DNS ASK re####eprobable.net
- DNS ASK le###rwagon.net
- DNS ASK he###nwagon.net
- DNS ASK va####sbicycle.net
- DNS ASK le####without.net
- DNS ASK va####swhose.net
- DNS ASK le####kitchen.net
- DNS ASK le####probable.net
- DNS ASK he####probable.net
- DNS ASK ge###ewagon.net
- DNS ASK ge####without.net
- DNS ASK ge####kitchen.net
- DNS ASK he####without.net
- DNS ASK or####itchen.net
- DNS ASK he####kitchen.net
- DNS ASK re####bridge.net
- DNS ASK va####sbridge.net
- DNS ASK re####except.net
- DNS ASK fo####dexcept.net
- DNS ASK de####bridge.net
- DNS ASK fo####dbridge.net
- DNS ASK de####bicycle.net
- DNS ASK fo####dbicycle.net
- DNS ASK de###ewhose.net
- DNS ASK fo####dwhose.net
- DNS ASK an####except.net
- DNS ASK gl###except.net
- DNS ASK an####bridge.net
- DNS ASK gl###bridge.net
- DNS ASK an####bicycle.net
- DNS ASK gl####icycle.net
- DNS ASK va####senter.net
- DNS ASK va####sboard.net
- DNS ASK de####except.net
- DNS ASK re###nboard.net
- DNS ASK re####ladder.net
- DNS ASK ge####ladder.net
- DNS ASK le###rboard.net
- DNS ASK he###nboard.net
- DNS ASK le###renter.net
- DNS ASK he###nenter.net
- DNS ASK he####haracter.net
- DNS ASK ge####character.net
- DNS ASK an###rwhose.net
- DNS ASK an####around.net
- DNS ASK he###ladder.net
- DNS ASK ge###eboard.net
- DNS ASK he###enter.net
- DNS ASK ge###eenter.net
- DNS ASK va#####character.net
- DNS ASK re####character.net
- DNS ASK va####sladder.net
- DNS ASK he####ladder.net
- DNS ASK he###board.net
- DNS ASK de###eproud.net
- DNS ASK gl###whose.net
- DNS ASK he###bridge.net
- DNS ASK le####except.net
- DNS ASK he####except.net
- DNS ASK le####bridge.net
- DNS ASK he####bridge.net
- DNS ASK le####bicycle.net
- DNS ASK re###nenter.net
- DNS ASK he####bicycle.net
- DNS ASK he###nwhose.net
- DNS ASK ge####except.net
- DNS ASK ge####bridge.net
- DNS ASK ge####bicycle.net
- DNS ASK ge###ewhose.net
- DNS ASK va####s##cept.net
- DNS ASK re####ebicycle.net
- DNS ASK le###rwhose.net
- DNS ASK re####ewhose.net
- DNS ASK or###whose.net
- DNS ASK or####icycle.net
- DNS ASK re####ebridge.net
- DNS ASK di#####ltbicycle.net
- DNS ASK he####icycle.net
- DNS ASK di####ultwhose.net
- DNS ASK he###whose.net
- DNS ASK pl####ntexcept.net
- DNS ASK di####ultexcept.net
- DNS ASK ne####aryexcept.net
- DNS ASK he###except.net
- DNS ASK ne####arybridge.net
- DNS ASK ne#####rybicycle.net
- DNS ASK pl####ntwhose.net
- DNS ASK ne####arywhose.net
- DNS ASK or###except.net
- DNS ASK re####eexcept.net
- DNS ASK di####ultbridge.net
- DNS ASK or###bridge.net
- DNS ASK pl####ntbicycle.net
- DNS ASK gl###around.net
Другое
Создает и запускает на исполнение
- 'C:\rfncqlvhyypamz\m26ok6d8kbt4xveohe.exe'
- 'C:\rfncqlvhyypamz\basjbkmojh.exe'
- 'C:\rfncqlvhyypamz\xwwvkvvnqh.exe' "c:\rfncqlvhyypamz\basjbkmojh.exe"
