Техническая информация
Для обеспечения автозапуска и распространения
Устанавливает следующие настройки сервисов
- [HKLM\System\CurrentControlSet\Services\Alerts User-mode Proxy WebClient Networking] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\Alerts User-mode Proxy WebClient Networking] 'ImagePath' = 'C:\eqamqtlfccud\jqoavupwwx.exe'
Создает следующие сервисы
- 'Alerts User-mode Proxy WebClient Networking' C:\eqamqtlfccud\jqoavupwwx.exe
Изменения в файловой системе
Создает следующие файлы
- %WINDIR%\eqamqtlfccud\qyhypb
- C:\eqamqtlfccud\qyhypb
- C:\eqamqtlfccud\ukwflhp4fwasi3jhgvhg.exe
- C:\eqamqtlfccud\jqoavupwwx.exe
- C:\eqamqtlfccud\egyddanwgny.exe
- C:\eqamqtlfccud\pxpevnsbkmr
Присваивает атрибут 'скрытый' для следующих файлов
- C:\eqamqtlfccud\jqoavupwwx.exe
- C:\eqamqtlfccud\egyddanwgny.exe
Удаляет следующие файлы
- %WINDIR%\eqamqtlfccud\qyhypb
- C:\eqamqtlfccud\ukwflhp4fwasi3jhgvhg.exe
Подменяет следующие файлы
- %WINDIR%\eqamqtlfccud\qyhypb
Сетевая активность
Подключается к
- 'pr####opinion.net':80
- 'do####promise.net':80
- 'br####promise.net':80
- 'st####thpromise.net':80
- 'ou####eoffice.net':80
- 'bu####ngsupply.net':80
- 'bu####ngoffice.net':80
- 'st###supply.net':80
TCP
Запросы HTTP GET
- http://pr####opinion.net/index.php
- http://do####promise.net/index.php
- http://br####promise.net/index.php
- http://st####thpromise.net/index.php
- http://ou####eoffice.net/index.php
- http://bu####ngsupply.net/index.php
- http://st###supply.net/index.php
UDP
- DNS ASK mo####ntshould.net
- DNS ASK st####thopinion.net
- DNS ASK st####thshort.net
- DNS ASK st####thshould.net
- DNS ASK de####promise.net
- DNS ASK pr####epromise.net
- DNS ASK de####opinion.net
- DNS ASK pr####eopinion.net
- DNS ASK pr####eshort.net
- DNS ASK mo####ntsupply.net
- DNS ASK de####should.net
- DNS ASK pr####eshould.net
- DNS ASK re####promise.net
- DNS ASK br####promise.net
- DNS ASK re####opinion.net
- DNS ASK br####opinion.net
- DNS ASK de###eshort.net
- DNS ASK do####opinion.net
- DNS ASK ou####esupply.net
- DNS ASK st####istance.net
- DNS ASK mi###supply.net
- DNS ASK st###supply.net
- DNS ASK ev####garrive.net
- DNS ASK bu####ngarrive.net
- DNS ASK ev####goffice.net
- DNS ASK bu####ngoffice.net
- DNS ASK re###tshort.net
- DNS ASK st####thpromise.net
- DNS ASK ev####gsupply.net
- DNS ASK bu####ngsupply.net
- DNS ASK ou####earrive.net
- DNS ASK mo####ntarrive.net
- DNS ASK ou####eoffice.net
- DNS ASK mo####ntoffice.net
- DNS ASK ou####edistance.net
- DNS ASK bu#####gdistance.net
- DNS ASK mo#####tdistance.net
- DNS ASK br###nshort.net
- DNS ASK re####should.net
- DNS ASK br####should.net
- DNS ASK bu####ngshould.net
- DNS ASK ev####gpromise.net
- DNS ASK bu####ngpromise.net
- DNS ASK ev####gopinion.net
- DNS ASK bu####ngopinion.net
- DNS ASK ev####gshort.net
- DNS ASK bu####ngshort.net
- DNS ASK mi####istance.net
- DNS ASK mi###should.net
- DNS ASK ou####epromise.net
- DNS ASK mo####ntpromise.net
- DNS ASK ou####eopinion.net
- DNS ASK mo####ntopinion.net
- DNS ASK ou####eshort.net
- DNS ASK mo####ntshort.net
- DNS ASK ou####eshould.net
- DNS ASK ev####gshould.net
- DNS ASK ev####gdistance.net
- DNS ASK st###short.net
- DNS ASK mi####pinion.net
- DNS ASK mi###short.net
- DNS ASK fe####promise.net
- DNS ASK fe####opinion.net
- DNS ASK do###eshort.net
- DNS ASK fe###wshort.net
- DNS ASK fe####should.net
- DNS ASK pr####promise.net
- DNS ASK st####pinion.net
- DNS ASK do####promise.net
- DNS ASK st###should.net
- DNS ASK pr###yshort.net
- DNS ASK do###rshort.net
- DNS ASK pr####should.net
- DNS ASK do####should.net
- DNS ASK mi####romise.net
- DNS ASK st####romise.net
- DNS ASK pr####opinion.net
- DNS ASK st###office.net
Другое
Создает и запускает на исполнение
- 'C:\eqamqtlfccud\ukwflhp4fwasi3jhgvhg.exe'
- 'C:\eqamqtlfccud\jqoavupwwx.exe'
- 'C:\eqamqtlfccud\egyddanwgny.exe' "c:\eqamqtlfccud\jqoavupwwx.exe"
