Техническая информация
Для обеспечения автозапуска и распространения
Устанавливает следующие настройки сервисов
- [HKLM\System\CurrentControlSet\Services\Enumerator Coordinator Web Profile Compatibility] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\Enumerator Coordinator Web Profile Compatibility] 'ImagePath' = 'C:\cifxvomy\dcywgap.exe'
Создает следующие сервисы
- 'Enumerator Coordinator Web Profile Compatibility' C:\cifxvomy\dcywgap.exe
Изменения в файловой системе
Создает следующие файлы
- %WINDIR%\cifxvomy\wrgvdnqiqzf
- C:\cifxvomy\wrgvdnqiqzf
- C:\cifxvomy\luo2abap3kntxjhqg.exe
- C:\cifxvomy\dcywgap.exe
- C:\cifxvomy\xyzvmxpmd.exe
- C:\cifxvomy\zqswzeh7
Присваивает атрибут 'скрытый' для следующих файлов
- C:\cifxvomy\dcywgap.exe
- C:\cifxvomy\xyzvmxpmd.exe
Удаляет следующие файлы
- %WINDIR%\cifxvomy\wrgvdnqiqzf
- C:\cifxvomy\luo2abap3kntxjhqg.exe
Подменяет следующие файлы
- %WINDIR%\cifxvomy\wrgvdnqiqzf
Сетевая активность
Подключается к
- 'or###system.net':80
- 'le###rtrust.net':80
- 'de###efancy.net':80
- 'fo####dconsider.net':80
- 'de####friend.net':80
- 'fo####dfuture.net':80
- 'he###future.net':80
- 'or###smell.net':80
- 'or###safety.net':80
TCP
Запросы HTTP GET
- http://or###system.net/index.php
- http://le###rtrust.net/index.php
- http://de###efancy.net/index.php
- http://fo####dconsider.net/index.php
- http://de####friend.net/index.php
- http://fo####dfuture.net/index.php
- http://he###future.net/index.php
- http://or###smell.net/index.php
- http://or###safety.net/index.php
UDP
- DNS ASK pl####ntneither.net
- DNS ASK ge####friend.net
- DNS ASK va####slaughter.net
- DNS ASK re####laughter.net
- DNS ASK va####sfancy.net
- DNS ASK re###nfancy.net
- DNS ASK va####sconsider.net
- DNS ASK va####sfriend.net
- DNS ASK he####laughter.net
- DNS ASK re####friend.net
- DNS ASK de###esmell.net
- DNS ASK fo####dsmell.net
- DNS ASK de###eearly.net
- DNS ASK fo####dearly.net
- DNS ASK de####safety.net
- DNS ASK ge####consider.net
- DNS ASK ge###efancy.net
- DNS ASK ge####laughter.net
- DNS ASK he####friend.net
- DNS ASK le####friend.net
- DNS ASK he####consider.net
- DNS ASK le####consider.net
- DNS ASK he###nfancy.net
- DNS ASK le###rfancy.net
- DNS ASK re####consider.net
- DNS ASK le####laughter.net
- DNS ASK re####efriend.net
- DNS ASK or###friend.net
- DNS ASK re####econsider.net
- DNS ASK or####onsider.net
- DNS ASK re####efancy.net
- DNS ASK or###fancy.net
- DNS ASK fo####dsafety.net
- DNS ASK de####future.net
- DNS ASK fo####dfuture.net
- DNS ASK an###rsmell.net
- DNS ASK ne####aryearly.net
- DNS ASK pl####ntsafety.net
- DNS ASK ne####arysafety.net
- DNS ASK pl####ntfuture.net
- DNS ASK ne####aryfuture.net
- DNS ASK or###smell.net
- DNS ASK or###early.net
- DNS ASK re####elaughter.net
- DNS ASK re####eearly.net
- DNS ASK or###safety.net
- DNS ASK re####esafety.net
- DNS ASK or###future.net
- DNS ASK re####efuture.net
- DNS ASK le###rsmell.net
- DNS ASK pl####ntearly.net
- DNS ASK di####ultsmell.net
- DNS ASK ne####arysmell.net
- DNS ASK gl###future.net
- DNS ASK gl###smell.net
- DNS ASK an###rearly.net
- DNS ASK gl###early.net
- DNS ASK an####safety.net
- DNS ASK gl###safety.net
- DNS ASK an####future.net
- DNS ASK he###nsmell.net
- DNS ASK he###future.net
- DNS ASK he###smell.net
- DNS ASK di####ultearly.net
- DNS ASK he###early.net
- DNS ASK di####ultsafety.net
- DNS ASK he###safety.net
- DNS ASK di####ultfuture.net
- DNS ASK pl####ntsmell.net
- DNS ASK re####esmell.net
- DNS ASK or####aughter.net
- DNS ASK di####ultfriend.net
- DNS ASK le####system.net
- DNS ASK he####system.net
- DNS ASK le###rtrust.net
- DNS ASK he###ntrust.net
- DNS ASK he###honor.net
- DNS ASK ge###ehonor.net
- DNS ASK ge####neither.net
- DNS ASK or####either.net
- DNS ASK he###system.net
- DNS ASK ge####system.net
- DNS ASK he###trust.net
- DNS ASK ge###etrust.net
- DNS ASK va####shonor.net
- DNS ASK re###nhonor.net
- DNS ASK he####neither.net
- DNS ASK le####neither.net
- DNS ASK he###nhonor.net
- DNS ASK le###rhonor.net
- DNS ASK re####etrust.net
- DNS ASK or###trust.net
- DNS ASK re####esystem.net
- DNS ASK or###system.net
- DNS ASK re####eneither.net
- DNS ASK he####either.net
- DNS ASK re####ehonor.net
- DNS ASK or###honor.net
- DNS ASK ne####arytrust.net
- DNS ASK pl####nttrust.net
- DNS ASK ne####arysystem.net
- DNS ASK pl####ntsystem.net
- DNS ASK ne#####ryneither.net
- DNS ASK va####sneither.net
- DNS ASK re####neither.net
- DNS ASK va####ssystem.net
- DNS ASK re####system.net
- DNS ASK di#####ltlaughter.net
- DNS ASK he####aughter.net
- DNS ASK di####ultfancy.net
- DNS ASK he###fancy.net
- DNS ASK di#####ltconsider.net
- DNS ASK he####onsider.net
- DNS ASK he###friend.net
- DNS ASK ne####aryfriend.net
- DNS ASK pl#####tlaughter.net
- DNS ASK ne#####rylaughter.net
- DNS ASK pl####ntfancy.net
- DNS ASK ne####aryfancy.net
- DNS ASK pl#####tconsider.net
- DNS ASK ne#####ryconsider.net
- DNS ASK gl###friend.net
- DNS ASK fo####dconsider.net
- DNS ASK an####friend.net
- DNS ASK de####consider.net
- DNS ASK va####strust.net
- DNS ASK re###ntrust.net
- DNS ASK de####laughter.net
- DNS ASK fo####dlaughter.net
- DNS ASK de###efancy.net
- DNS ASK fo####dfancy.net
- DNS ASK pl####ntfriend.net
- DNS ASK an####consider.net
- DNS ASK de####friend.net
- DNS ASK fo####dfriend.net
- DNS ASK an####laughter.net
- DNS ASK gl####aughter.net
- DNS ASK an###rfancy.net
- DNS ASK gl###fancy.net
- DNS ASK gl####onsider.net
- DNS ASK le###rearly.net
Другое
Создает и запускает на исполнение
- 'C:\cifxvomy\luo2abap3kntxjhqg.exe'
- 'C:\cifxvomy\dcywgap.exe'
- 'C:\cifxvomy\xyzvmxpmd.exe' "c:\cifxvomy\dcywgap.exe"
