Техническая информация
Для обеспечения автозапуска и распространения
Устанавливает следующие настройки сервисов
- [HKLM\System\CurrentControlSet\Services\PNRP Resource Registry WinHTTP Visual] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\PNRP Resource Registry WinHTTP Visual] 'ImagePath' = 'C:\qygpzdcmscxp\seibgwdb.exe'
Создает следующие сервисы
- 'PNRP Resource Registry WinHTTP Visual' C:\qygpzdcmscxp\seibgwdb.exe
Изменения в файловой системе
Создает следующие файлы
- %WINDIR%\qygpzdcmscxp\j3rvto
- C:\qygpzdcmscxp\j3rvto
- C:\qygpzdcmscxp\nujtqnffyolxrbm.exe
- C:\qygpzdcmscxp\seibgwdb.exe
- C:\qygpzdcmscxp\auvtzoowz.exe
- C:\qygpzdcmscxp\nwaokdcqwed
Присваивает атрибут 'скрытый' для следующих файлов
- C:\qygpzdcmscxp\seibgwdb.exe
- C:\qygpzdcmscxp\auvtzoowz.exe
Удаляет следующие файлы
- %WINDIR%\qygpzdcmscxp\j3rvto
- C:\qygpzdcmscxp\nujtqnffyolxrbm.exe
Подменяет следующие файлы
- %WINDIR%\qygpzdcmscxp\j3rvto
Сетевая активность
Подключается к
- 'bu#####glanguage.net':80
- 'st###device.net':80
- 'fe####success.net':80
- 're###tfound.net':80
- 'br####spring.net':80
- 'de####success.net':80
- 'st###spring.net':80
- 'bu####ngguard.net':80
- 'st###guard.net':80
- 'pr####airplane.net':80
- 'br###nfence.net':80
TCP
Запросы HTTP GET
- http://bu#####glanguage.net/index.php
- http://st###device.net/index.php
- http://fe####success.net/index.php
- http://re###tfound.net/index.php
- http://br####spring.net/index.php
- http://de####success.net/index.php
- http://st###spring.net/index.php
- http://bu####ngguard.net/index.php
- http://st###guard.net/index.php
- http://pr####airplane.net/index.php
- http://br###nfence.net/index.php
UDP
- DNS ASK bu#####glanguage.net
- DNS ASK de####success.net
- DNS ASK pr####ebanker.net
- DNS ASK de####banker.net
- DNS ASK st####thfound.net
- DNS ASK st####thspring.net
- DNS ASK de####spring.net
- DNS ASK pr####esuccess.net
- DNS ASK st####thsuccess.net
- DNS ASK ou####eairplane.net
- DNS ASK mo#####tstraight.net
- DNS ASK ou####estraight.net
- DNS ASK mo####ntguard.net
- DNS ASK ou####eguard.net
- DNS ASK st####thbanker.net
- DNS ASK mo#####tairplane.net
- DNS ASK pr####espring.net
- DNS ASK de###efound.net
- DNS ASK pr####efound.net
- DNS ASK pr####banker.net
- DNS ASK fe###wfound.net
- DNS ASK do###efound.net
- DNS ASK fe####spring.net
- DNS ASK fe####success.net
- DNS ASK fe####banker.net
- DNS ASK do####banker.net
- DNS ASK br###nfound.net
- DNS ASK br####spring.net
- DNS ASK re####spring.net
- DNS ASK br####success.net
- DNS ASK re####success.net
- DNS ASK br####banker.net
- DNS ASK re####banker.net
- DNS ASK re###tfound.net
- DNS ASK mo####ntfence.net
- DNS ASK ou####efence.net
- DNS ASK bu#####gairplane.net
- DNS ASK ev####gairplane.net
- DNS ASK pr###yguard.net
- DNS ASK do###rfence.net
- DNS ASK pr###yfence.net
- DNS ASK fe####airplane.net
- DNS ASK fe####straight.net
- DNS ASK fe###wguard.net
- DNS ASK do###eguard.net
- DNS ASK fe###wfence.net
- DNS ASK do###efence.net
- DNS ASK br####airplane.net
- DNS ASK re####airplane.net
- DNS ASK br####straight.net
- DNS ASK re####straight.net
- DNS ASK br###nguard.net
- DNS ASK re###tguard.net
- DNS ASK do###rguard.net
- DNS ASK do####straight.net
- DNS ASK pr####straight.net
- DNS ASK pr####airplane.net
- DNS ASK bu#####gstraight.net
- DNS ASK ev####gstraight.net
- DNS ASK bu####ngguard.net
- DNS ASK ev####gguard.net
- DNS ASK bu####ngfence.net
- DNS ASK ev####gfence.net
- DNS ASK st####irplane.net
- DNS ASK mi####irplane.net
- DNS ASK st####traight.net
- DNS ASK mi####traight.net
- DNS ASK st###guard.net
- DNS ASK mi###guard.net
- DNS ASK st###fence.net
- DNS ASK mi###fence.net
- DNS ASK do####airplane.net
- DNS ASK br###nfence.net
- DNS ASK pr####success.net
- DNS ASK do####success.net
- DNS ASK pr####spring.net
- DNS ASK pr####before.net
- DNS ASK fe####settle.net
- DNS ASK fe####language.net
- DNS ASK fe####device.net
- DNS ASK fe####before.net
- DNS ASK pr####device.net
- DNS ASK do####before.net
- DNS ASK br####settle.net
- DNS ASK re####language.net
- DNS ASK br####device.net
- DNS ASK re####device.net
- DNS ASK br####before.net
- DNS ASK re####before.net
- DNS ASK re####settle.net
- DNS ASK br####language.net
- DNS ASK do####device.net
- DNS ASK pr####language.net
- DNS ASK do####language.net
- DNS ASK bu####ngdevice.net
- DNS ASK ev####gdevice.net
- DNS ASK bu####ngbefore.net
- DNS ASK ev####gbefore.net
- DNS ASK st###settle.net
- DNS ASK mi###settle.net
- DNS ASK ev####glanguage.net
- DNS ASK st####anguage.net
- DNS ASK st###device.net
- DNS ASK mi###device.net
- DNS ASK st###before.net
- DNS ASK mi###before.net
- DNS ASK do####settle.net
- DNS ASK pr####settle.net
- DNS ASK mi####anguage.net
- DNS ASK pr####esettle.net
- DNS ASK de####settle.net
- DNS ASK pr####elanguage.net
- DNS ASK de####language.net
- DNS ASK ev####gspring.net
- DNS ASK bu####ngsuccess.net
- DNS ASK ev####gsuccess.net
- DNS ASK bu####ngbanker.net
- DNS ASK ev####gbanker.net
- DNS ASK st###found.net
- DNS ASK mi###found.net
- DNS ASK st###spring.net
- DNS ASK mi###spring.net
- DNS ASK st####uccess.net
- DNS ASK mi####uccess.net
- DNS ASK st###banker.net
- DNS ASK mi###banker.net
- DNS ASK do###rfound.net
- DNS ASK pr###yfound.net
- DNS ASK bu####ngspring.net
- DNS ASK bu####ngfound.net
- DNS ASK ev####gfound.net
- DNS ASK ou####ebanker.net
- DNS ASK pr####edevice.net
- DNS ASK de####device.net
- DNS ASK pr####ebefore.net
- DNS ASK de####before.net
- DNS ASK st####thsettle.net
- DNS ASK st#####hlanguage.net
- DNS ASK st####thdevice.net
- DNS ASK st####thbefore.net
- DNS ASK mo####ntfound.net
- DNS ASK ou####efound.net
- DNS ASK mo####ntspring.net
- DNS ASK ou####espring.net
- DNS ASK mo####ntsuccess.net
- DNS ASK ou####esuccess.net
- DNS ASK mo####ntbanker.net
- DNS ASK do####spring.net
- DNS ASK re###tfence.net
Другое
Создает и запускает на исполнение
- 'C:\qygpzdcmscxp\nujtqnffyolxrbm.exe'
- 'C:\qygpzdcmscxp\seibgwdb.exe'
- 'C:\qygpzdcmscxp\auvtzoowz.exe' "c:\qygpzdcmscxp\seibgwdb.exe"
