Техническая информация
Для обеспечения автозапуска и распространения
Устанавливает следующие настройки сервисов
- [HKLM\System\CurrentControlSet\Services\Connect Debugger Assistant Telephony IP Block] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\Connect Debugger Assistant Telephony IP Block] 'ImagePath' = 'C:\lqerzswqzitrca\cdklikyhmyw.exe'
Создает следующие сервисы
- 'Connect Debugger Assistant Telephony IP Block' C:\lqerzswqzitrca\cdklikyhmyw.exe
Изменения в файловой системе
Создает следующие файлы
- %WINDIR%\lqerzswqzitrca\ggnsst
- C:\lqerzswqzitrca\ggnsst
- C:\lqerzswqzitrca\hmaltimentmuqkbktmwxk.exe
- C:\lqerzswqzitrca\cdklikyhmyw.exe
- C:\lqerzswqzitrca\mfpcgtarnue.exe
Присваивает атрибут 'скрытый' для следующих файлов
- C:\lqerzswqzitrca\cdklikyhmyw.exe
- C:\lqerzswqzitrca\mfpcgtarnue.exe
Удаляет следующие файлы
- %WINDIR%\lqerzswqzitrca\ggnsst
- C:\lqerzswqzitrca\hmaltimentmuqkbktmwxk.exe
Подменяет следующие файлы
- %WINDIR%\lqerzswqzitrca\ggnsst
Сетевая активность
Подключается к
- 'st####irplane.net':80
- 'ch####enopinion.net':80
- 'fa####promise.net':80
- 'ma####esupply.net':80
- 'pe####arrive.net':80
- 'fo####noffice.net':80
- 'ri###supply.net':80
- 'fa####supply.net':80
- 'fa####office.net':80
- 'en####hoffice.net':80
- 'pe####caught.net':80
TCP
Запросы HTTP GET
- http://st####irplane.net/index.php
- http://ch####enopinion.net/index.php
- http://fa####promise.net/index.php
- http://pe####arrive.net/index.php
- http://fo####noffice.net/index.php
- http://ri###supply.net/index.php
- http://fa####supply.net/index.php
- http://fa####office.net/index.php
- http://en####hoffice.net/index.php
- http://pe####caught.net/index.php
UDP
- DNS ASK pr####efence.net
- DNS ASK th####distance.net
- DNS ASK fi####office.net
- DNS ASK th####office.net
- DNS ASK fi####arrive.net
- DNS ASK th####arrive.net
- DNS ASK pi####esupply.net
- DNS ASK ci####ttesupply.net
- DNS ASK ch####enoffice.net
- DNS ASK pi####edistance.net
- DNS ASK pi####eoffice.net
- DNS ASK ci####tteoffice.net
- DNS ASK pi####earrive.net
- DNS ASK ci####ttearrive.net
- DNS ASK ch####ensupply.net
- DNS ASK fa####supply.net
- DNS ASK ch#####ndistance.net
- DNS ASK th####supply.net
- DNS ASK fi####distance.net
- DNS ASK ci#####tedistance.net
- DNS ASK fa####distance.net
- DNS ASK wh####rarrive.net
- DNS ASK ma####earrive.net
- DNS ASK su####supply.net
- DNS ASK fo####nsupply.net
- DNS ASK su####distance.net
- DNS ASK fo####ndistance.net
- DNS ASK su####office.net
- DNS ASK fo####noffice.net
- DNS ASK su####arrive.net
- DNS ASK fo####narrive.net
- DNS ASK wh####rsupply.net
- DNS ASK ri###supply.net
- DNS ASK wh####rdistance.net
- DNS ASK ri####istance.net
- DNS ASK wh####roffice.net
- DNS ASK ri###office.net
- DNS ASK ri###arrive.net
- DNS ASK ma####eoffice.net
- DNS ASK fi####supply.net
- DNS ASK ci####tteshort.net
- DNS ASK fa####office.net
- DNS ASK ma#####president.net
- DNS ASK ma####ecaught.net
- DNS ASK su####strong.net
- DNS ASK fo####nstrong.net
- DNS ASK su####trouble.net
- DNS ASK fo####ntrouble.net
- DNS ASK su####president.net
- DNS ASK fo#####president.net
- DNS ASK ch####enarrive.net
- DNS ASK su####caught.net
- DNS ASK wh####rstrong.net
- DNS ASK ri###strong.net
- DNS ASK wh####rtrouble.net
- DNS ASK ri####rouble.net
- DNS ASK wh#####president.net
- DNS ASK ri####resident.net
- DNS ASK pe####president.net
- DNS ASK ma####etrouble.net
- DNS ASK pe####caught.net
- DNS ASK pe####trouble.net
- DNS ASK ma####estrong.net
- DNS ASK fa####arrive.net
- DNS ASK en####hsupply.net
- DNS ASK ei####distance.net
- DNS ASK en####hdistance.net
- DNS ASK ei####office.net
- DNS ASK en####hoffice.net
- DNS ASK ei####arrive.net
- DNS ASK pe####office.net
- DNS ASK en####harrive.net
- DNS ASK pe####arrive.net
- DNS ASK be####estrong.net
- DNS ASK be####etrouble.net
- DNS ASK ex####president.net
- DNS ASK be#####president.net
- DNS ASK ex####caught.net
- DNS ASK be####ecaught.net
- DNS ASK pe####strong.net
- DNS ASK ex####strong.net
- DNS ASK ei####supply.net
- DNS ASK ex####trouble.net
- DNS ASK ma####edistance.net
- DNS ASK pe####distance.net
- DNS ASK ma####esupply.net
- DNS ASK ma####epromise.net
- DNS ASK su####should.net
- DNS ASK fo####nshould.net
- DNS ASK su###nshort.net
- DNS ASK fo####nshort.net
- DNS ASK su####opinion.net
- DNS ASK fo####nopinion.net
- DNS ASK su####promise.net
- DNS ASK fo####npromise.net
- DNS ASK wh####rshould.net
- DNS ASK ri###should.net
- DNS ASK wh####rshort.net
- DNS ASK ri###short.net
- DNS ASK wh####ropinion.net
- DNS ASK ri####pinion.net
- DNS ASK pe####opinion.net
- DNS ASK pe###nshort.net
- DNS ASK pe####promise.net
- DNS ASK ma####eshort.net
- DNS ASK ma####eshould.net
- DNS ASK ex####should.net
- DNS ASK st#####hairplane.net
- DNS ASK st####irplane.net
- DNS ASK st#####hstraight.net
- DNS ASK st####traight.net
- DNS ASK st####thguard.net
- DNS ASK st###guard.net
- DNS ASK st####thfence.net
- DNS ASK wh####rpromise.net
- DNS ASK wh####rcaught.net
- DNS ASK st###fence.net
- DNS ASK ex###tshort.net
- DNS ASK be####eshort.net
- DNS ASK ex####opinion.net
- DNS ASK be####eopinion.net
- DNS ASK ex####promise.net
- DNS ASK be####epromise.net
- DNS ASK pe####should.net
- DNS ASK de###efence.net
- DNS ASK be####eshould.net
- DNS ASK fo####ncaught.net
- DNS ASK ri####romise.net
- DNS ASK th###hshort.net
- DNS ASK ei###rshort.net
- DNS ASK en####hshort.net
- DNS ASK ei####opinion.net
- DNS ASK en####hopinion.net
- DNS ASK ei####promise.net
- DNS ASK en####hpromise.net
- DNS ASK ma####eopinion.net
- DNS ASK ex####supply.net
- DNS ASK ex####distance.net
- DNS ASK be####edistance.net
- DNS ASK ex####office.net
- DNS ASK be####eoffice.net
- DNS ASK ex####arrive.net
- DNS ASK be####earrive.net
- DNS ASK pe####supply.net
- DNS ASK fa####promise.net
- DNS ASK be####esupply.net
- DNS ASK en####hshould.net
- DNS ASK ei####should.net
- DNS ASK ch####enpromise.net
- DNS ASK fa####opinion.net
- DNS ASK fi####opinion.net
- DNS ASK th####opinion.net
- DNS ASK fi####promise.net
- DNS ASK th####promise.net
- DNS ASK pi####eshould.net
- DNS ASK ci####tteshould.net
- DNS ASK fi####should.net
- DNS ASK pi####eshort.net
- DNS ASK th####should.net
- DNS ASK pi####eopinion.net
- DNS ASK pi####epromise.net
- DNS ASK ci#####tepromise.net
- DNS ASK ch####enshould.net
- DNS ASK fa####should.net
- DNS ASK ch####enshort.net
- DNS ASK fa###yshort.net
- DNS ASK fi###eshort.net
- DNS ASK ch####enopinion.net
- DNS ASK ci#####teopinion.net
- DNS ASK ri###caught.net
Другое
Создает и запускает на исполнение
- 'C:\lqerzswqzitrca\hmaltimentmuqkbktmwxk.exe'
- 'C:\lqerzswqzitrca\cdklikyhmyw.exe'
- 'C:\lqerzswqzitrca\mfpcgtarnue.exe' "c:\lqerzswqzitrca\cdklikyhmyw.exe"
