Техническая информация
Для обеспечения автозапуска и распространения
Устанавливает следующие настройки сервисов
- [HKLM\System\CurrentControlSet\Services\Process KtmRm COM+ Logon Player] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\Process KtmRm COM+ Logon Player] 'ImagePath' = 'C:\rxwhkefdhtbqpzo\ghfuucvwuop.exe'
Создает следующие сервисы
- 'Process KtmRm COM+ Logon Player' C:\rxwhkefdhtbqpzo\ghfuucvwuop.exe
Изменения в файловой системе
Создает следующие файлы
- %WINDIR%\rxwhkefdhtbqpzo\syndwfbbpp7
- C:\rxwhkefdhtbqpzo\syndwfbbpp7
- C:\rxwhkefdhtbqpzo\mi5q0mqlexfzpavxj.exe
- C:\rxwhkefdhtbqpzo\ghfuucvwuop.exe
- C:\rxwhkefdhtbqpzo\hwlpmka.exe
Присваивает атрибут 'скрытый' для следующих файлов
- C:\rxwhkefdhtbqpzo\ghfuucvwuop.exe
- C:\rxwhkefdhtbqpzo\hwlpmka.exe
Удаляет следующие файлы
- %WINDIR%\rxwhkefdhtbqpzo\syndwfbbpp7
- C:\rxwhkefdhtbqpzo\mi5q0mqlexfzpavxj.exe
Подменяет следующие файлы
- %WINDIR%\rxwhkefdhtbqpzo\syndwfbbpp7
Сетевая активность
Подключается к
- 'fr####elight.net':80
- 'th####ttrain.net':80
- 'wa###train.net':80
- 'ex#####nceposition.net':80
- 'cr###strike.net':80
TCP
Запросы HTTP GET
- http://fr####elight.net/index.php
- http://th####ttrain.net/index.php
- http://wa###train.net/index.php
- http://ex#####nceposition.net/index.php
- http://cr###strike.net/index.php
UDP
- DNS ASK wo####eeting.net
- DNS ASK fo####strike.net
- DNS ASK me####position.net
- DNS ASK fo####position.net
- DNS ASK me####number.net
- DNS ASK fo####number.net
- DNS ASK al####ypartial.net
- DNS ASK ge#####anpartial.net
- DNS ASK al####ystrike.net
- DNS ASK ge####manstrike.net
- DNS ASK al####yposition.net
- DNS ASK ge#####anposition.net
- DNS ASK al####ynumber.net
- DNS ASK ge####mannumber.net
- DNS ASK ex#####ncepartial.net
- DNS ASK me####strike.net
- DNS ASK fr####artial.net
- DNS ASK fr###strike.net
- DNS ASK ex#####nceposition.net
- DNS ASK fr####osition.net
- DNS ASK ex#####ncenumber.net
- DNS ASK fr###number.net
- DNS ASK fi####elight.net
- DNS ASK pa####elight.net
- DNS ASK fi#####ectricity.net
- DNS ASK pa#####ectricity.net
- DNS ASK fi###train.net
- DNS ASK pa###train.net
- DNS ASK fi###borrow.net
- DNS ASK pa###borrow.net
- DNS ASK sm####elight.net
- DNS ASK ex#####ncestrike.net
- DNS ASK cr####artial.net
- DNS ASK sm####artial.net
- DNS ASK be###number.net
- DNS ASK wo####artial.net
- DNS ASK sm###strike.net
- DNS ASK wo###strike.net
- DNS ASK sm####osition.net
- DNS ASK wo####osition.net
- DNS ASK sm###number.net
- DNS ASK wo###number.net
- DNS ASK wa####artial.net
- DNS ASK th####tpartial.net
- DNS ASK wa###strike.net
- DNS ASK th####tstrike.net
- DNS ASK wa####osition.net
- DNS ASK th####tposition.net
- DNS ASK wa###number.net
- DNS ASK wo####elight.net
- DNS ASK th####tnumber.net
- DNS ASK su####partial.net
- DNS ASK cr###strike.net
- DNS ASK su####strike.net
- DNS ASK cr####osition.net
- DNS ASK su####position.net
- DNS ASK cr###number.net
- DNS ASK su####number.net
- DNS ASK kn####artial.net
- DNS ASK be####artial.net
- DNS ASK kn###strike.net
- DNS ASK be###strike.net
- DNS ASK kn####osition.net
- DNS ASK be####osition.net
- DNS ASK kn###number.net
- DNS ASK fo####partial.net
- DNS ASK me####partial.net
- DNS ASK sm#####ectricity.net
- DNS ASK me###rtrain.net
- DNS ASK fo####borrow.net
- DNS ASK al####ydelight.net
- DNS ASK ge#####andelight.net
- DNS ASK al#####electricity.net
- DNS ASK ge######nelectricity.net
- DNS ASK al####ytrain.net
- DNS ASK ge####mantrain.net
- DNS ASK al####yborrow.net
- DNS ASK ge####manborrow.net
- DNS ASK ex#####ncedelight.net
- DNS ASK fr####elight.net
- DNS ASK ex######ceelectricity.net
- DNS ASK fr#####ectricity.net
- DNS ASK ex####encetrain.net
- DNS ASK me####borrow.net
- DNS ASK fr###train.net
- DNS ASK fr###borrow.net
- DNS ASK fi####nderstood.net
- DNS ASK pa####nderstood.net
- DNS ASK fi###twenty.net
- DNS ASK pa###twenty.net
- DNS ASK fi####eeting.net
- DNS ASK pa####eeting.net
- DNS ASK fi###chance.net
- DNS ASK pa###chance.net
- DNS ASK sm####nderstood.net
- DNS ASK wo####nderstood.net
- DNS ASK sm###twenty.net
- DNS ASK wo###twenty.net
- DNS ASK sm####eeting.net
- DNS ASK ex#####nceborrow.net
- DNS ASK cr###train.net
- DNS ASK sm###train.net
- DNS ASK fo#####lectricity.net
- DNS ASK wo###train.net
- DNS ASK sm###borrow.net
- DNS ASK wo###borrow.net
- DNS ASK wa####elight.net
- DNS ASK th####tdelight.net
- DNS ASK wa#####ectricity.net
- DNS ASK th#####electricity.net
- DNS ASK wa###train.net
- DNS ASK th####ttrain.net
- DNS ASK wa###borrow.net
- DNS ASK th####tborrow.net
- DNS ASK cr####elight.net
- DNS ASK su####delight.net
- DNS ASK cr#####ectricity.net
- DNS ASK wo#####ectricity.net
- DNS ASK su#####lectricity.net
- DNS ASK su###rtrain.net
- DNS ASK cr###borrow.net
- DNS ASK su####borrow.net
- DNS ASK kn####elight.net
- DNS ASK be####elight.net
- DNS ASK kn#####ectricity.net
- DNS ASK be#####ectricity.net
- DNS ASK kn###train.net
- DNS ASK be###train.net
- DNS ASK kn###borrow.net
- DNS ASK be###borrow.net
- DNS ASK me####delight.net
- DNS ASK fo####delight.net
- DNS ASK me#####lectricity.net
- DNS ASK fo###wtrain.net
- DNS ASK pa###number.net
Другое
Создает и запускает на исполнение
- 'C:\rxwhkefdhtbqpzo\mi5q0mqlexfzpavxj.exe'
- 'C:\rxwhkefdhtbqpzo\ghfuucvwuop.exe'
- 'C:\rxwhkefdhtbqpzo\hwlpmka.exe' "c:\rxwhkefdhtbqpzo\ghfuucvwuop.exe"
