Техническая информация
Для обеспечения автозапуска и распространения
Устанавливает следующие настройки сервисов
- [HKLM\System\CurrentControlSet\Services\Fax Registry Image DLL Protection Security] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\Fax Registry Image DLL Protection Security] 'ImagePath' = 'C:\qlersljvaezkbbb\yccalaazcze.exe'
Создает следующие сервисы
- 'Fax Registry Image DLL Protection Security' C:\qlersljvaezkbbb\yccalaazcze.exe
Изменения в файловой системе
Создает следующие файлы
- %WINDIR%\qlersljvaezkbbb\duubtjc
- C:\qlersljvaezkbbb\duubtjc
- C:\qlersljvaezkbbb\tylu0eowuccg0w.exe
- C:\qlersljvaezkbbb\yccalaazcze.exe
- C:\qlersljvaezkbbb\fwoshcvqxp.exe
Присваивает атрибут 'скрытый' для следующих файлов
- C:\qlersljvaezkbbb\yccalaazcze.exe
- C:\qlersljvaezkbbb\fwoshcvqxp.exe
Удаляет следующие файлы
- %WINDIR%\qlersljvaezkbbb\duubtjc
- C:\qlersljvaezkbbb\tylu0eowuccg0w.exe
Подменяет следующие файлы
- %WINDIR%\qlersljvaezkbbb\duubtjc
Сетевая активность
Подключается к
- 'pa###spread.net':80
- 'sm###report.net':80
- 'wo###report.net':80
- 'sm###market.net':80
- 'wa###garden.net':80
- 'th####tgarden.net':80
- 'wa###beauty.net':80
- 'wa###report.net':80
- 'wa###market.net':80
- 'th####tmarket.net':80
- 'cr###report.net':80
- 'cr###market.net':80
- 'fo####market.net':80
- 'fr###garden.net':80
- 'fr###beauty.net':80
- 'ex#####ncereport.net':80
- 'wo###beauty.net':80
- 'sm###garden.net':80
TCP
Запросы HTTP GET
- http://pa###spread.net/index.php
- http://sm###report.net/index.php
- http://wo###report.net/index.php
- http://sm###market.net/index.php
- http://wa###garden.net/index.php
- http://th####tgarden.net/index.php
- http://wa###beauty.net/index.php
- http://wa###report.net/index.php
- http://wa###market.net/index.php
- http://th####tmarket.net/index.php
- http://cr###report.net/index.php
- http://cr###market.net/index.php
- http://fo####market.net/index.php
- http://fr###garden.net/index.php
- http://fr###beauty.net/index.php
- http://ex#####ncereport.net/index.php
- http://wo###beauty.net/index.php
- http://sm###garden.net/index.php
UDP
- DNS ASK me####neighbor.net
- DNS ASK kn###beauty.net
- DNS ASK be###beauty.net
- DNS ASK kn###report.net
- DNS ASK be###report.net
- DNS ASK kn###market.net
- DNS ASK be###market.net
- DNS ASK me####garden.net
- DNS ASK fo####garden.net
- DNS ASK me####beauty.net
- DNS ASK fo####beauty.net
- DNS ASK me####report.net
- DNS ASK fo####report.net
- DNS ASK me####market.net
- DNS ASK fo####market.net
- DNS ASK al####ygarden.net
- DNS ASK ge####mangarden.net
- DNS ASK al####ybeauty.net
- DNS ASK ge####manbeauty.net
- DNS ASK al####yreport.net
- DNS ASK ge####manreport.net
- DNS ASK al####ymarket.net
- DNS ASK be###garden.net
- DNS ASK kn###garden.net
- DNS ASK su####market.net
- DNS ASK cr###market.net
- DNS ASK sm###garden.net
- DNS ASK wo###garden.net
- DNS ASK sm###beauty.net
- DNS ASK wo###beauty.net
- DNS ASK sm###report.net
- DNS ASK wo###report.net
- DNS ASK sm###market.net
- DNS ASK wo###market.net
- DNS ASK wa###garden.net
- DNS ASK th####tgarden.net
- DNS ASK th####tbeauty.net
- DNS ASK wa###beauty.net
- DNS ASK wa###report.net
- DNS ASK th####treport.net
- DNS ASK wa###market.net
- DNS ASK th####tmarket.net
- DNS ASK cr###garden.net
- DNS ASK su####garden.net
- DNS ASK cr###beauty.net
- DNS ASK su####beauty.net
- DNS ASK cr###report.net
- DNS ASK su####report.net
- DNS ASK pa###market.net
- DNS ASK ge####manmarket.net
- DNS ASK ex#####ncegarden.net
- DNS ASK fr###garden.net
- DNS ASK th####tsquare.net
- DNS ASK wa####ttempt.net
- DNS ASK th####tattempt.net
- DNS ASK cr###spread.net
- DNS ASK su####spread.net
- DNS ASK cr####eighbor.net
- DNS ASK su####neighbor.net
- DNS ASK cr###square.net
- DNS ASK su####square.net
- DNS ASK cr####ttempt.net
- DNS ASK su####attempt.net
- DNS ASK kn###spread.net
- DNS ASK be###spread.net
- DNS ASK kn####eighbor.net
- DNS ASK be####eighbor.net
- DNS ASK kn###square.net
- DNS ASK be###square.net
- DNS ASK kn####ttempt.net
- DNS ASK be####ttempt.net
- DNS ASK me####spread.net
- DNS ASK fo####spread.net
- DNS ASK wa###square.net
- DNS ASK th####tneighbor.net
- DNS ASK wa####eighbor.net
- DNS ASK th####tspread.net
- DNS ASK fr###beauty.net
- DNS ASK ex#####ncereport.net
- DNS ASK fr###report.net
- DNS ASK ex#####ncemarket.net
- DNS ASK fr###market.net
- DNS ASK fi###spread.net
- DNS ASK pa###spread.net
- DNS ASK fi####eighbor.net
- DNS ASK pa####eighbor.net
- DNS ASK fi###square.net
- DNS ASK fi####ttempt.net
- DNS ASK pa###square.net
- DNS ASK pa####ttempt.net
- DNS ASK sm###spread.net
- DNS ASK wo###spread.net
- DNS ASK sm####eighbor.net
- DNS ASK wo####eighbor.net
- DNS ASK sm###square.net
- DNS ASK wo###square.net
- DNS ASK sm####ttempt.net
- DNS ASK wo####ttempt.net
- DNS ASK wa###spread.net
- DNS ASK ex#####ncebeauty.net
- DNS ASK fi###market.net
Другое
Создает и запускает на исполнение
- 'C:\qlersljvaezkbbb\tylu0eowuccg0w.exe'
- 'C:\qlersljvaezkbbb\yccalaazcze.exe'
- 'C:\qlersljvaezkbbb\fwoshcvqxp.exe' "c:\qlersljvaezkbbb\yccalaazcze.exe"
