Техническая информация
Для обеспечения автозапуска и распространения
Устанавливает следующие настройки сервисов
- [HKLM\System\CurrentControlSet\Services\Connection Interface Error Base Provider] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\Connection Interface Error Base Provider] 'ImagePath' = 'C:\crutpwoa\tzpdlsoj.exe'
Создает следующие сервисы
- 'Connection Interface Error Base Provider' C:\crutpwoa\tzpdlsoj.exe
Изменения в файловой системе
Создает следующие файлы
- %WINDIR%\crutpwoa\hxwufb
- C:\crutpwoa\hxwufb
- C:\crutpwoa\crbt1brbih7tsct.exe
- C:\crutpwoa\tzpdlsoj.exe
- C:\crutpwoa\rthtfts.exe
Присваивает атрибут 'скрытый' для следующих файлов
- C:\crutpwoa\tzpdlsoj.exe
- C:\crutpwoa\rthtfts.exe
Удаляет следующие файлы
- %WINDIR%\crutpwoa\hxwufb
- C:\crutpwoa\crbt1brbih7tsct.exe
Подменяет следующие файлы
- %WINDIR%\crutpwoa\hxwufb
Сетевая активность
Подключается к
- 'ca####npower.net':80
- 'ch###clean.net':80
- 'th###paint.net':80
- 'th###clean.net':80
- 'qu###letter.net':80
- 'be####letter.net':80
- 'qu###power.net':80
- 'co####ecourse.net':80
- 'be###rpower.net':80
- 'tr###power.net':80
- 'st###tpower.net':80
- 'tr###famous.net':80
- 'el####icpower.net':80
- 're###dpower.net':80
- 'el####iccentury.net':80
- 'st####country.net':80
- 'co####ewomen.net':80
TCP
Запросы HTTP GET
- http://ca####npower.net/index.php
- http://el####iccentury.net/index.php
- http://re###dpower.net/index.php
- http://el####icpower.net/index.php
- http://tr###famous.net/index.php
- http://st###tpower.net/index.php
- http://tr###power.net/index.php
- http://st####country.net/index.php
- http://be###rpower.net/index.php
- http://qu###power.net/index.php
- http://be####letter.net/index.php
- http://qu###letter.net/index.php
- http://th###clean.net/index.php
- http://th###paint.net/index.php
- http://ch###clean.net/index.php
- http://co####ecourse.net/index.php
UDP
- DNS ASK ag####tcentury.net
- DNS ASK el####icletter.net
- DNS ASK re####different.net
- DNS ASK el#####cdifferent.net
- DNS ASK st####surprise.net
- DNS ASK tr####urprise.net
- DNS ASK be####beside.net
- DNS ASK re####letter.net
- DNS ASK el####icbeside.net
- DNS ASK tr###letter.net
- DNS ASK st####different.net
- DNS ASK tr####ifferent.net
- DNS ASK be####surprise.net
- DNS ASK ga####surprise.net
- DNS ASK st####beside.net
- DNS ASK st####letter.net
- DNS ASK de####surprise.net
- DNS ASK tr###beside.net
- DNS ASK ca####nsurprise.net
- DNS ASK de####beside.net
- DNS ASK ni###letter.net
- DNS ASK de####letter.net
- DNS ASK ni####ifferent.net
- DNS ASK de####different.net
- DNS ASK re####surprise.net
- DNS ASK re####beside.net
- DNS ASK el#####csurprise.net
- DNS ASK ca####nbeside.net
- DNS ASK la###letter.net
- DNS ASK ca####nletter.net
- DNS ASK la####ifferent.net
- DNS ASK ca#####different.net
- DNS ASK la####urprise.net
- DNS ASK la###beside.net
- DNS ASK ni###beside.net
- DNS ASK ga####beside.net
- DNS ASK ga####different.net
- DNS ASK pr####tclean.net
- DNS ASK th###paint.net
- DNS ASK pr####tpaint.net
- DNS ASK th###course.net
- DNS ASK pr####tcourse.net
- DNS ASK se####different.net
- DNS ASK th###clean.net
- DNS ASK th###women.net
- DNS ASK co####eclean.net
- DNS ASK ch###paint.net
- DNS ASK co####epaint.net
- DNS ASK ch###course.net
- DNS ASK co####ecourse.net
- DNS ASK pr####twomen.net
- DNS ASK ch###clean.net
- DNS ASK ga####letter.net
- DNS ASK be####letter.net
- DNS ASK qu###letter.net
- DNS ASK fl####urprise.net
- DNS ASK br####urprise.net
- DNS ASK fl###beside.net
- DNS ASK br###beside.net
- DNS ASK se####letter.net
- DNS ASK be####different.net
- DNS ASK qu####ifferent.net
- DNS ASK fl###letter.net
- DNS ASK qu####urprise.net
- DNS ASK se####surprise.net
- DNS ASK qu###beside.net
- DNS ASK se####beside.net
- DNS ASK br###letter.net
- DNS ASK fl####ifferent.net
- DNS ASK br####ifferent.net
- DNS ASK ni####urprise.net
- DNS ASK do####ifferent.net
- DNS ASK ag#####different.net
- DNS ASK la###power.net
- DNS ASK ca####npower.net
- DNS ASK la####ountry.net
- DNS ASK ca####ncountry.net
- DNS ASK re####century.net
- DNS ASK la###famous.net
- DNS ASK tr####entury.net
- DNS ASK ca####ncentury.net
- DNS ASK re###dpower.net
- DNS ASK el####icpower.net
- DNS ASK re####country.net
- DNS ASK el####iccountry.net
- DNS ASK st####century.net
- DNS ASK re####famous.net
- DNS ASK el####iccentury.net
- DNS ASK el####icfamous.net
- DNS ASK de####country.net
- DNS ASK de####century.net
- DNS ASK ag####tfamous.net
- DNS ASK do###famous.net
- DNS ASK ag####tpower.net
- DNS ASK do###power.net
- DNS ASK ag####tcountry.net
- DNS ASK la####entury.net
- DNS ASK st####famous.net
- DNS ASK do####entury.net
- DNS ASK ni###famous.net
- DNS ASK de####famous.net
- DNS ASK ni###power.net
- DNS ASK de###epower.net
- DNS ASK ni####ountry.net
- DNS ASK ni####entury.net
- DNS ASK do####ountry.net
- DNS ASK ca####nfamous.net
- DNS ASK tr###famous.net
- DNS ASK qu####entury.net
- DNS ASK qu###famous.net
- DNS ASK se####famous.net
- DNS ASK qu###power.net
- DNS ASK se###npower.net
- DNS ASK br####ountry.net
- DNS ASK br###power.net
- DNS ASK se####century.net
- DNS ASK qu####ountry.net
- DNS ASK ag####tbeside.net
- DNS ASK do###beside.net
- DNS ASK ag####tletter.net
- DNS ASK do###letter.net
- DNS ASK se####country.net
- DNS ASK ag####tsurprise.net
- DNS ASK do####urprise.net
- DNS ASK fl####ountry.net
- DNS ASK fl###power.net
- DNS ASK st###tpower.net
- DNS ASK st####country.net
- DNS ASK tr####ountry.net
- DNS ASK be####century.net
- DNS ASK ga####century.net
- DNS ASK be####famous.net
- DNS ASK ga####famous.net
- DNS ASK tr###power.net
- DNS ASK be###rpower.net
- DNS ASK be####country.net
- DNS ASK ga####country.net
- DNS ASK fl####entury.net
- DNS ASK br####entury.net
- DNS ASK fl###famous.net
- DNS ASK br###famous.net
- DNS ASK ga###rpower.net
- DNS ASK ch###women.net
- DNS ASK co####ewomen.net
Другое
Создает и запускает на исполнение
- 'C:\crutpwoa\crbt1brbih7tsct.exe'
- 'C:\crutpwoa\tzpdlsoj.exe'
- 'C:\crutpwoa\rthtfts.exe' "c:\crutpwoa\tzpdlsoj.exe"
