Техническая информация
Для обеспечения автозапуска и распространения
Модифицирует следующие ключи реестра
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'Protocol Shell Endpoint NetBIOS' = '%APPDATA%\tjvqempup\clvrrcypbd.exe'
Изменения в файловой системе
Создает следующие файлы
- %APPDATA%\tjvqempup\clvrrcypbd.exe
- %APPDATA%\tjvqempup\rvvmsdzfjwm.exe
- %APPDATA%\tjvqempup\clvrrcypbd.nxin
Присваивает атрибут 'скрытый' для следующих файлов
- %APPDATA%\tjvqempup\clvrrcypbd.exe
Сетевая активность
Подключается к
- 'qu###please.net':80
- 'ca####npower.net':80
- 'el####iccentury.net':80
- 're###dpower.net':80
- 'el####icpower.net':80
- 'tr###famous.net':80
- 'st###tpower.net':80
- 'tr###power.net':80
- 'st####country.net':80
- 'be###rpower.net':80
- 'qu###power.net':80
TCP
Запросы HTTP GET
- http://qu###please.net/index.php?em########################################
- http://ca####npower.net/index.php?em########################################
- http://el####iccentury.net/index.php?em########################################
- http://re###dpower.net/index.php?em########################################
- http://el####icpower.net/index.php?em########################################
- http://tr###famous.net/index.php?em########################################
- http://st###tpower.net/index.php?em########################################
- http://tr###power.net/index.php?em########################################
- http://st####country.net/index.php?em########################################
- http://be###rpower.net/index.php?em########################################
- http://qu###power.net/index.php?em########################################
UDP
- DNS ASK fl###nation.net
- DNS ASK be###rpower.net
- DNS ASK ga####famous.net
- DNS ASK be####famous.net
- DNS ASK ga####century.net
- DNS ASK be####century.net
- DNS ASK tr####ountry.net
- DNS ASK st####country.net
- DNS ASK tr###power.net
- DNS ASK st###tpower.net
- DNS ASK tr###famous.net
- DNS ASK st####famous.net
- DNS ASK tr####entury.net
- DNS ASK st####century.net
- DNS ASK el####iccountry.net
- DNS ASK re####country.net
- DNS ASK el####icpower.net
- DNS ASK re###dpower.net
- DNS ASK ga###rpower.net
- DNS ASK be####country.net
- DNS ASK ga####country.net
- DNS ASK fl####entury.net
- DNS ASK ag####tbeside.net
- DNS ASK do####urprise.net
- DNS ASK ag####tsurprise.net
- DNS ASK se####country.net
- DNS ASK qu####ountry.net
- DNS ASK se###npower.net
- DNS ASK qu###power.net
- DNS ASK se####famous.net
- DNS ASK se####century.net
- DNS ASK qu###famous.net
- DNS ASK qu####entury.net
- DNS ASK br####ountry.net
- DNS ASK fl####ountry.net
- DNS ASK br###power.net
- DNS ASK fl###power.net
- DNS ASK br###famous.net
- DNS ASK fl###famous.net
- DNS ASK br####entury.net
- DNS ASK do###beside.net
- DNS ASK el####icfamous.net
- DNS ASK re####famous.net
- DNS ASK el####iccentury.net
- DNS ASK do####entury.net
- DNS ASK ag####tcentury.net
- DNS ASK se####condition.net
- DNS ASK qu####ondition.net
- DNS ASK se####please.net
- DNS ASK qu###please.net
- DNS ASK se####soldier.net
- DNS ASK qu####oldier.net
- DNS ASK se####nation.net
- DNS ASK qu###nation.net
- DNS ASK br####ondition.net
- DNS ASK fl####ondition.net
- DNS ASK br###please.net
- DNS ASK fl###please.net
- DNS ASK br####oldier.net
- DNS ASK fl####oldier.net
- DNS ASK br###nation.net
- DNS ASK ag####tfamous.net
- DNS ASK do###famous.net
- DNS ASK ag####tpower.net
- DNS ASK do###power.net
- DNS ASK ca####ncountry.net
- DNS ASK la####ountry.net
- DNS ASK ca####npower.net
- DNS ASK la###power.net
- DNS ASK ca####nfamous.net
- DNS ASK la###famous.net
- DNS ASK ca####ncentury.net
- DNS ASK la####entury.net
- DNS ASK ni####ountry.net
- DNS ASK de####country.net
- DNS ASK de###epower.net
- DNS ASK ni###power.net
- DNS ASK de####famous.net
- DNS ASK ni###famous.net
- DNS ASK de####century.net
- DNS ASK ni####entury.net
- DNS ASK do####ountry.net
- DNS ASK ag####tcountry.net
- DNS ASK re####century.net
- DNS ASK ag####tletter.net
Другое
Создает и запускает на исполнение
- '%APPDATA%\tjvqempup\clvrrcypbd.exe'
- '%APPDATA%\tjvqempup\rvvmsdzfjwm.exe' "%APPDATA%\tjvqempup\clvrrcypbd.exe"
