Техническая информация
Для обеспечения автозапуска и распространения
Устанавливает следующие настройки сервисов
- [HKLM\System\CurrentControlSet\Services\Filtering Grouping Software Volume] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\Filtering Grouping Software Volume] 'ImagePath' = 'C:\mzgbhcmxnbu\mkosrpucrypq.exe'
Создает следующие сервисы
- 'Filtering Grouping Software Volume' C:\mzgbhcmxnbu\mkosrpucrypq.exe
Изменения в файловой системе
Создает следующие файлы
- %WINDIR%\mzgbhcmxnbu\dacrfexuc
- C:\mzgbhcmxnbu\dacrfexuc
- C:\mzgbhcmxnbu\nddq4zmidnkhvketrsw.exe
- C:\mzgbhcmxnbu\mkosrpucrypq.exe
- C:\mzgbhcmxnbu\lxrjwwiuv.exe
Присваивает атрибут 'скрытый' для следующих файлов
- C:\mzgbhcmxnbu\mkosrpucrypq.exe
- C:\mzgbhcmxnbu\lxrjwwiuv.exe
Удаляет следующие файлы
- %WINDIR%\mzgbhcmxnbu\dacrfexuc
- C:\mzgbhcmxnbu\nddq4zmidnkhvketrsw.exe
Подменяет следующие файлы
- %WINDIR%\mzgbhcmxnbu\dacrfexuc
Сетевая активность
Подключается к
- 'br####system.net':80
- 'br###ntrust.net':80
- 'st###trust.net':80
- 'mi###fancy.net':80
- 'pr####friend.net':80
- 'pr####efancy.net':80
- 'st###fancy.net':80
- 'do####future.net':80
TCP
Запросы HTTP GET
- http://br####system.net/index.php
- http://br###ntrust.net/index.php
- http://st###trust.net/index.php
- http://mi###fancy.net/index.php
- http://pr####friend.net/index.php
- http://pr####efancy.net/index.php
- http://st###fancy.net/index.php
- http://do####future.net/index.php
UDP
- DNS ASK br####system.net
- DNS ASK ev####gsmell.net
- DNS ASK bu####ngsmell.net
- DNS ASK ou####efuture.net
- DNS ASK mo####ntfuture.net
- DNS ASK ou####esafety.net
- DNS ASK mo####ntsafety.net
- DNS ASK ou####eearly.net
- DNS ASK mo####ntearly.net
- DNS ASK ou####esmell.net
- DNS ASK mo####ntsmell.net
- DNS ASK st####thfriend.net
- DNS ASK st#####hconsider.net
- DNS ASK bu####ngearly.net
- DNS ASK st####thfancy.net
- DNS ASK de####friend.net
- DNS ASK pr####efriend.net
- DNS ASK de####consider.net
- DNS ASK pr####econsider.net
- DNS ASK de###efancy.net
- DNS ASK pr####efancy.net
- DNS ASK de####laughter.net
- DNS ASK pr####elaughter.net
- DNS ASK re####friend.net
- DNS ASK br####friend.net
- DNS ASK re####consider.net
- DNS ASK br####consider.net
- DNS ASK st#####hlaughter.net
- DNS ASK do###rearly.net
- DNS ASK br###nearly.net
- DNS ASK ev####gsafety.net
- DNS ASK re###tsmell.net
- DNS ASK br###nsmell.net
- DNS ASK fe####future.net
- DNS ASK fe####safety.net
- DNS ASK do###eearly.net
- DNS ASK fe###wearly.net
- DNS ASK do###esmell.net
- DNS ASK fe###wsmell.net
- DNS ASK pr####future.net
- DNS ASK do####future.net
- DNS ASK pr####safety.net
- DNS ASK do####safety.net
- DNS ASK re###tfancy.net
- DNS ASK pr###yearly.net
- DNS ASK pr###ysmell.net
- DNS ASK do###rsmell.net
- DNS ASK mi###future.net
- DNS ASK st###future.net
- DNS ASK mi###safety.net
- DNS ASK st###safety.net
- DNS ASK mi###early.net
- DNS ASK st###early.net
- DNS ASK mi###smell.net
- DNS ASK st###smell.net
- DNS ASK ev####gfuture.net
- DNS ASK bu####ngfuture.net
- DNS ASK ev####gearly.net
- DNS ASK bu####ngsafety.net
- DNS ASK br###nfancy.net
- DNS ASK ev####glaughter.net
- DNS ASK mo####ntfriend.net
- DNS ASK ou####econsider.net
- DNS ASK mo#####tconsider.net
- DNS ASK ou####efancy.net
- DNS ASK mo####ntfancy.net
- DNS ASK ou####elaughter.net
- DNS ASK mo#####tlaughter.net
- DNS ASK st###trust.net
- DNS ASK st####thtrust.net
- DNS ASK st###system.net
- DNS ASK st####thsystem.net
- DNS ASK st####either.net
- DNS ASK ou####efriend.net
- DNS ASK st####thneither.net
- DNS ASK st####thhonor.net
- DNS ASK de###etrust.net
- DNS ASK pr####etrust.net
- DNS ASK de####system.net
- DNS ASK pr####esystem.net
- DNS ASK de####neither.net
- DNS ASK pr####eneither.net
- DNS ASK de###ehonor.net
- DNS ASK pr####ehonor.net
- DNS ASK re###ttrust.net
- DNS ASK br###ntrust.net
- DNS ASK re####system.net
- DNS ASK st###honor.net
- DNS ASK mi###friend.net
- DNS ASK br####laughter.net
- DNS ASK bu####ngfancy.net
- DNS ASK fe####friend.net
- DNS ASK fe####consider.net
- DNS ASK do###efancy.net
- DNS ASK fe###wfancy.net
- DNS ASK fe####laughter.net
- DNS ASK pr####friend.net
- DNS ASK do####friend.net
- DNS ASK pr####consider.net
- DNS ASK do####consider.net
- DNS ASK pr###yfancy.net
- DNS ASK do###rfancy.net
- DNS ASK pr####laughter.net
- DNS ASK re####laughter.net
- DNS ASK do####laughter.net
- DNS ASK st###friend.net
- DNS ASK mi####onsider.net
- DNS ASK st####onsider.net
- DNS ASK mi###fancy.net
- DNS ASK st###fancy.net
- DNS ASK mi####aughter.net
- DNS ASK st####aughter.net
- DNS ASK ev####gfriend.net
- DNS ASK bu####ngfriend.net
- DNS ASK ev####gconsider.net
- DNS ASK bu#####gconsider.net
- DNS ASK ev####gfancy.net
- DNS ASK bu#####glaughter.net
- DNS ASK re###tearly.net
Другое
Создает и запускает на исполнение
- 'C:\mzgbhcmxnbu\nddq4zmidnkhvketrsw.exe'
- 'C:\mzgbhcmxnbu\mkosrpucrypq.exe'
- 'C:\mzgbhcmxnbu\lxrjwwiuv.exe' "c:\mzgbhcmxnbu\mkosrpucrypq.exe"
