Техническая информация
Для обеспечения автозапуска и распространения
Устанавливает следующие настройки сервисов
- [HKLM\System\CurrentControlSet\Services\Authentication Remote] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\Authentication Remote] 'ImagePath' = 'C:\ufbfdclvjdpr\lqjstjh.exe'
Создает следующие сервисы
- 'Authentication Remote' C:\ufbfdclvjdpr\lqjstjh.exe
Изменения в файловой системе
Создает следующие файлы
- %WINDIR%\ufbfdclvjdpr\noge1xrqvtva
- C:\ufbfdclvjdpr\noge1xrqvtva
- C:\ufbfdclvjdpr\ft2jcu9ssf0zemwlq.exe
- C:\ufbfdclvjdpr\lqjstjh.exe
- C:\ufbfdclvjdpr\yquahulebw.exe
Присваивает атрибут 'скрытый' для следующих файлов
- C:\ufbfdclvjdpr\lqjstjh.exe
- C:\ufbfdclvjdpr\yquahulebw.exe
Удаляет следующие файлы
- %WINDIR%\ufbfdclvjdpr\noge1xrqvtva
- C:\ufbfdclvjdpr\ft2jcu9ssf0zemwlq.exe
Подменяет следующие файлы
- %WINDIR%\ufbfdclvjdpr\noge1xrqvtva
Сетевая активность
Подключается к
- 'bu####ngpower.net':80
- 'pr####famous.net':80
- 'pr###ypower.net':80
- 'br###npower.net':80
- 'bu#####gdifferent.net':80
- 'do####different.net':80
- 'pr#####different.net':80
- 'fo####nwomen.net':80
- 'ri###course.net':80
TCP
Запросы HTTP GET
- http://bu####ngpower.net/index.php
- http://pr####famous.net/index.php
- http://pr###ypower.net/index.php
- http://br###npower.net/index.php
- http://bu#####gdifferent.net/index.php
- http://do####different.net/index.php
- http://pr#####different.net/index.php
- http://fo####nwomen.net/index.php
- http://ri###course.net/index.php
UDP
- DNS ASK bu####ngfamous.net
- DNS ASK st####thbeside.net
- DNS ASK st####thletter.net
- DNS ASK st#####hdifferent.net
- DNS ASK ex###tclean.net
- DNS ASK be####eclean.net
- DNS ASK ex###tpaint.net
- DNS ASK br####letter.net
- DNS ASK be####epaint.net
- DNS ASK be####ecourse.net
- DNS ASK ex###twomen.net
- DNS ASK be####ewomen.net
- DNS ASK pe###nclean.net
- DNS ASK ma####eclean.net
- DNS ASK pe###npaint.net
- DNS ASK de####different.net
- DNS ASK st#####hsurprise.net
- DNS ASK pr#####different.net
- DNS ASK de####letter.net
- DNS ASK pr####eletter.net
- DNS ASK fe####beside.net
- DNS ASK fe####letter.net
- DNS ASK fe####different.net
- DNS ASK br####surprise.net
- DNS ASK re####surprise.net
- DNS ASK br####beside.net
- DNS ASK ma####epaint.net
- DNS ASK ex####course.net
- DNS ASK re####beside.net
- DNS ASK br####different.net
- DNS ASK re####different.net
- DNS ASK pr####esurprise.net
- DNS ASK de####surprise.net
- DNS ASK pr####ebeside.net
- DNS ASK de####beside.net
- DNS ASK fe####surprise.net
- DNS ASK re####letter.net
- DNS ASK fo####nwomen.net
- DNS ASK ch####enpaint.net
- DNS ASK pe###nwomen.net
- DNS ASK fi####course.net
- DNS ASK th####course.net
- DNS ASK fi###ewomen.net
- DNS ASK th###hwomen.net
- DNS ASK pi####eclean.net
- DNS ASK ci####tteclean.net
- DNS ASK pe####course.net
- DNS ASK pi####epaint.net
- DNS ASK pi####ecourse.net
- DNS ASK ci####ttecourse.net
- DNS ASK pi####ewomen.net
- DNS ASK ci####ttewomen.net
- DNS ASK ch####enclean.net
- DNS ASK fa###yclean.net
- DNS ASK fi###epaint.net
- DNS ASK th###hpaint.net
- DNS ASK th###hclean.net
- DNS ASK fi###eclean.net
- DNS ASK ri###women.net
- DNS ASK su###nclean.net
- DNS ASK fo####nclean.net
- DNS ASK su###npaint.net
- DNS ASK fo####npaint.net
- DNS ASK su####course.net
- DNS ASK fo####ncourse.net
- DNS ASK ma####ecourse.net
- DNS ASK pr####different.net
- DNS ASK su###nwomen.net
- DNS ASK ri###clean.net
- DNS ASK wh####rpaint.net
- DNS ASK ri###paint.net
- DNS ASK wh####rcourse.net
- DNS ASK ri###course.net
- DNS ASK wh####rwomen.net
- DNS ASK ma####ewomen.net
- DNS ASK wh####rclean.net
- DNS ASK ci####ttepaint.net
- DNS ASK do####different.net
- DNS ASK mi###letter.net
- DNS ASK fe####century.net
- DNS ASK fe####famous.net
- DNS ASK fe###wpower.net
- DNS ASK do###epower.net
- DNS ASK fe####country.net
- DNS ASK br####century.net
- DNS ASK mi###famous.net
- DNS ASK re####century.net
- DNS ASK re####famous.net
- DNS ASK br###npower.net
- DNS ASK re###tpower.net
- DNS ASK br####country.net
- DNS ASK re####country.net
- DNS ASK pr####ecentury.net
- DNS ASK do####country.net
- DNS ASK pr####country.net
- DNS ASK pr###ypower.net
- DNS ASK do###rpower.net
- DNS ASK pr####famous.net
- DNS ASK bu####ngpower.net
- DNS ASK ev####gpower.net
- DNS ASK bu####ngcountry.net
- DNS ASK ev####gcountry.net
- DNS ASK st####entury.net
- DNS ASK mi####entury.net
- DNS ASK de####century.net
- DNS ASK br####famous.net
- DNS ASK st###famous.net
- DNS ASK mi###power.net
- DNS ASK st####ountry.net
- DNS ASK mi####ountry.net
- DNS ASK do####century.net
- DNS ASK pr####century.net
- DNS ASK do####famous.net
- DNS ASK ev####gfamous.net
- DNS ASK st###power.net
- DNS ASK ou####esurprise.net
- DNS ASK do####letter.net
- DNS ASK pr####epower.net
- DNS ASK bu#####gdifferent.net
- DNS ASK ev#####different.net
- DNS ASK st####urprise.net
- DNS ASK mi####urprise.net
- DNS ASK st###beside.net
- DNS ASK mi###beside.net
- DNS ASK pr####efamous.net
- DNS ASK st###letter.net
- DNS ASK st####ifferent.net
- DNS ASK mi####ifferent.net
- DNS ASK do####surprise.net
- DNS ASK pr####surprise.net
- DNS ASK do####beside.net
- DNS ASK pr####beside.net
- DNS ASK bu####ngletter.net
- DNS ASK ev####gletter.net
- DNS ASK ev####gbeside.net
- DNS ASK bu####ngbeside.net
- DNS ASK ev####gsurprise.net
- DNS ASK pr####ecountry.net
- DNS ASK de####country.net
- DNS ASK st####thcentury.net
- DNS ASK st####thfamous.net
- DNS ASK st####thpower.net
- DNS ASK st####thcountry.net
- DNS ASK de####famous.net
- DNS ASK pr####letter.net
- DNS ASK mo#####tsurprise.net
- DNS ASK ou####ebeside.net
- DNS ASK mo####ntletter.net
- DNS ASK ou####eletter.net
- DNS ASK mo#####tdifferent.net
- DNS ASK ou#####different.net
- DNS ASK bu#####gsurprise.net
- DNS ASK de###epower.net
- DNS ASK mo####ntbeside.net
- DNS ASK fa###ypaint.net
Другое
Создает и запускает на исполнение
- 'C:\ufbfdclvjdpr\ft2jcu9ssf0zemwlq.exe'
- 'C:\ufbfdclvjdpr\lqjstjh.exe'
- 'C:\ufbfdclvjdpr\yquahulebw.exe' "c:\ufbfdclvjdpr\lqjstjh.exe"
