Техническая информация
Для обеспечения автозапуска и распространения
Устанавливает следующие настройки сервисов
- [HKLM\System\CurrentControlSet\Services\Sharing Networking DHCP Telephony System] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\Sharing Networking DHCP Telephony System] 'ImagePath' = 'C:\blujvqvzd\tjjlzqeuxnwv.exe'
Создает следующие сервисы
- 'Sharing Networking DHCP Telephony System' C:\blujvqvzd\tjjlzqeuxnwv.exe
Изменения в файловой системе
Создает следующие файлы
- %WINDIR%\blujvqvzd\lctrwfbyl
- C:\blujvqvzd\lctrwfbyl
- C:\blujvqvzd\fpbozlqayrvmloztgm9.exe
- C:\blujvqvzd\tjjlzqeuxnwv.exe
- C:\blujvqvzd\wrpdgeg.exe
Присваивает атрибут 'скрытый' для следующих файлов
- C:\blujvqvzd\tjjlzqeuxnwv.exe
- C:\blujvqvzd\wrpdgeg.exe
Удаляет следующие файлы
- %WINDIR%\blujvqvzd\lctrwfbyl
- C:\blujvqvzd\fpbozlqayrvmloztgm9.exe
Подменяет следующие файлы
- %WINDIR%\blujvqvzd\lctrwfbyl
Сетевая активность
Подключается к
- 're###nearly.net':80
- 'fo####dhealth.net':80
- 'an####health.net':80
- 'pl####nthealth.net':80
- 'le####health.net':80
- 'he###health.net':80
- 'ge####clothes.net':80
TCP
Запросы HTTP GET
- http://re###nearly.net/index.php
- http://fo####dhealth.net/index.php
- http://an####health.net/index.php
- http://pl####nthealth.net/index.php
- http://le####health.net/index.php
- http://he###health.net/index.php
- http://ge####clothes.net/index.php
UDP
- DNS ASK he###smell.net
- DNS ASK di####ulteearly.net
- DNS ASK he###catch.net
- DNS ASK di####ultcatch.net
- DNS ASK gl###dress.net
- DNS ASK an###rdress.net
- DNS ASK gl###public.net
- DNS ASK an####public.net
- DNS ASK gl###eearly.net
- DNS ASK an####eearly.net
- DNS ASK gl###catch.net
- DNS ASK an###rcatch.net
- DNS ASK fo####ddress.net
- DNS ASK de###edress.net
- DNS ASK di####ultpublic.net
- DNS ASK he###eearly.net
- DNS ASK fo####deearly.net
- DNS ASK de####eearly.net
- DNS ASK fo####dcatch.net
- DNS ASK de###ecatch.net
- DNS ASK re####distant.net
- DNS ASK va####sdistant.net
- DNS ASK re####clothes.net
- DNS ASK va####sclothes.net
- DNS ASK re####health.net
- DNS ASK va####shealth.net
- DNS ASK re####separate.net
- DNS ASK va####sseparate.net
- DNS ASK ge####distant.net
- DNS ASK fo####dpublic.net
- DNS ASK di#####ltseparate.net
- DNS ASK he###public.net
- DNS ASK ge###edress.net
- DNS ASK ge####public.net
- DNS ASK ge####eearly.net
- DNS ASK ge###ecatch.net
- DNS ASK he###ndress.net
- DNS ASK le###rdress.net
- DNS ASK he####public.net
- DNS ASK le####public.net
- DNS ASK he####eearly.net
- DNS ASK le####eearly.net
- DNS ASK he###ncatch.net
- DNS ASK le###rcatch.net
- DNS ASK re####edress.net
- DNS ASK or###dress.net
- DNS ASK re####epublic.net
- DNS ASK or###public.net
- DNS ASK re####eeearly.net
- DNS ASK or###eearly.net
- DNS ASK re####ecatch.net
- DNS ASK or###catch.net
- DNS ASK ne####arydress.net
- DNS ASK pl####ntdress.net
- DNS ASK ne####arypublic.net
- DNS ASK pl####ntpublic.net
- DNS ASK ne####aryeearly.net
- DNS ASK pl####nteearly.net
- DNS ASK ne####arycatch.net
- DNS ASK pl####ntcatch.net
- DNS ASK he###dress.net
- DNS ASK ge####clothes.net
- DNS ASK de####public.net
- DNS ASK ge####health.net
- DNS ASK ge####separate.net
- DNS ASK he####distant.net
- DNS ASK re####future.net
- DNS ASK an####clothes.net
- DNS ASK gl###health.net
- DNS ASK an####health.net
- DNS ASK gl####eparate.net
- DNS ASK an####separate.net
- DNS ASK fo####ddistant.net
- DNS ASK de####distant.net
- DNS ASK fo####dclothes.net
- DNS ASK de####clothes.net
- DNS ASK fo####dhealth.net
- DNS ASK de####health.net
- DNS ASK fo####dseparate.net
- DNS ASK de####separate.net
- DNS ASK va####sfuture.net
- DNS ASK an####distant.net
- DNS ASK re####safety.net
- DNS ASK va####ssafety.net
- DNS ASK re###nearly.net
- DNS ASK va####searly.net
- DNS ASK re###nsmell.net
- DNS ASK va####ssmell.net
- DNS ASK ge####future.net
- DNS ASK he###future.net
- DNS ASK ge####safety.net
- DNS ASK he###safety.net
- DNS ASK ge###eearly.net
- DNS ASK he###early.net
- DNS ASK ge###esmell.net
- DNS ASK va####scatch.net
- DNS ASK di####ultdress.net
- DNS ASK gl####istant.net
- DNS ASK di####ulthealth.net
- DNS ASK gl####lothes.net
- DNS ASK le####distant.net
- DNS ASK he####clothes.net
- DNS ASK le####clothes.net
- DNS ASK he####health.net
- DNS ASK le####health.net
- DNS ASK he####separate.net
- DNS ASK le####separate.net
- DNS ASK re####edistant.net
- DNS ASK or####istant.net
- DNS ASK re####eclothes.net
- DNS ASK or####lothes.net
- DNS ASK re####ehealth.net
- DNS ASK or###health.net
- DNS ASK re####eseparate.net
- DNS ASK or####eparate.net
- DNS ASK ne#####rydistant.net
- DNS ASK pl####ntdistant.net
- DNS ASK ne#####ryclothes.net
- DNS ASK pl####ntclothes.net
- DNS ASK ne####aryhealth.net
- DNS ASK pl####nthealth.net
- DNS ASK ne#####ryseparate.net
- DNS ASK pl#####tseparate.net
- DNS ASK he####istant.net
- DNS ASK di#####ltdistant.net
- DNS ASK he####lothes.net
- DNS ASK di#####ltclothes.net
- DNS ASK he###health.net
- DNS ASK he####eparate.net
- DNS ASK re###ncatch.net
Другое
Создает и запускает на исполнение
- 'C:\blujvqvzd\fpbozlqayrvmloztgm9.exe'
- 'C:\blujvqvzd\tjjlzqeuxnwv.exe'
- 'C:\blujvqvzd\wrpdgeg.exe' "c:\blujvqvzd\tjjlzqeuxnwv.exe"
