Техническая информация
Для обеспечения автозапуска и распространения
Устанавливает следующие настройки сервисов
- [HKLM\System\CurrentControlSet\Services\Reports Reporting Fax Window Support Telephony] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\Reports Reporting Fax Window Support Telephony] 'ImagePath' = 'C:\oogevfqmzqbz\hgitbtw.exe'
Создает следующие сервисы
- 'Reports Reporting Fax Window Support Telephony' C:\oogevfqmzqbz\hgitbtw.exe
Изменения в файловой системе
Создает следующие файлы
- %WINDIR%\oogevfqmzqbz\tlwa5cq
- C:\oogevfqmzqbz\tlwa5cq
- C:\oogevfqmzqbz\gkefj7yrtpkoobyr9oe.exe
- C:\oogevfqmzqbz\hgitbtw.exe
- C:\oogevfqmzqbz\hbjyvyobp.exe
- C:\oogevfqmzqbz\rz5tolcjzx0a
Присваивает атрибут 'скрытый' для следующих файлов
- C:\oogevfqmzqbz\hgitbtw.exe
- C:\oogevfqmzqbz\hbjyvyobp.exe
Удаляет следующие файлы
- %WINDIR%\oogevfqmzqbz\tlwa5cq
- C:\oogevfqmzqbz\gkefj7yrtpkoobyr9oe.exe
Подменяет следующие файлы
- %WINDIR%\oogevfqmzqbz\tlwa5cq
Сетевая активность
Подключается к
- 'ch###ladder.net':80
- 'ch###board.net':80
- 'ef###tboard.net':80
- 'in#####echaracter.net':80
TCP
Запросы HTTP GET
- http://ch###ladder.net/index.php
- http://ef###tboard.net/index.php
- http://in#####echaracter.net/index.php
UDP
- DNS ASK th###dollar.net
- DNS ASK th####haracter.net
- DNS ASK ch####haracter.net
- DNS ASK be###genter.net
- DNS ASK ri###nenter.net
- DNS ASK be###gboard.net
- DNS ASK ri###nboard.net
- DNS ASK be####ladder.net
- DNS ASK ri####ladder.net
- DNS ASK be####character.net
- DNS ASK ri####character.net
- DNS ASK li###eenter.net
- DNS ASK de####yenter.net
- DNS ASK li###eboard.net
- DNS ASK de####yboard.net
- DNS ASK li####ladder.net
- DNS ASK de####yladder.net
- DNS ASK li####character.net
- DNS ASK ch###ladder.net
- DNS ASK th###ladder.net
- DNS ASK ch###board.net
- DNS ASK th###board.net
- DNS ASK th####henter.net
- DNS ASK ef###tenter.net
- DNS ASK th####hboard.net
- DNS ASK ef###tboard.net
- DNS ASK th####hladder.net
- DNS ASK ef####ladder.net
- DNS ASK th#####character.net
- DNS ASK ef####character.net
- DNS ASK wi###nenter.net
- DNS ASK su###renter.net
- DNS ASK su###rboard.net
- DNS ASK wi###nboard.net
- DNS ASK su####ladder.net
- DNS ASK wi####ladder.net
- DNS ASK su####character.net
- DNS ASK wi####character.net
- DNS ASK th###enter.net
- DNS ASK ch###enter.net
- DNS ASK fo####character.net
- DNS ASK de#####character.net
- DNS ASK hu####denter.net
- DNS ASK jo####yenter.net
- DNS ASK ef####realize.net
- DNS ASK th####hdollar.net
- DNS ASK ef####dollar.net
- DNS ASK th####hwritten.net
- DNS ASK ef####written.net
- DNS ASK th####hshore.net
- DNS ASK ef###tshore.net
- DNS ASK su####realize.net
- DNS ASK wi####realize.net
- DNS ASK su####dollar.net
- DNS ASK wi####dollar.net
- DNS ASK su####written.net
- DNS ASK wi####written.net
- DNS ASK su###rshore.net
- DNS ASK wi###nshore.net
- DNS ASK th####ealize.net
- DNS ASK ch####ealize.net
- DNS ASK th####hrealize.net
- DNS ASK fo###tshore.net
- DNS ASK in####seshore.net
- DNS ASK fo####written.net
- DNS ASK jo####yboard.net
- DNS ASK hu####dladder.net
- DNS ASK jo####yladder.net
- DNS ASK hu#####character.net
- DNS ASK jo#####character.net
- DNS ASK re####errealize.net
- DNS ASK wo####ealize.net
- DNS ASK re####erdollar.net
- DNS ASK re####erwritten.net
- DNS ASK wo###dollar.net
- DNS ASK wo####ritten.net
- DNS ASK re####ershore.net
- DNS ASK wo###shore.net
- DNS ASK in####serealize.net
- DNS ASK fo####realize.net
- DNS ASK in####sedollar.net
- DNS ASK fo####dollar.net
- DNS ASK in####sewritten.net
- DNS ASK hu####dboard.net
- DNS ASK in#####echaracter.net
Другое
Создает и запускает на исполнение
- 'C:\oogevfqmzqbz\gkefj7yrtpkoobyr9oe.exe'
- 'C:\oogevfqmzqbz\hgitbtw.exe'
- 'C:\oogevfqmzqbz\hbjyvyobp.exe' "c:\oogevfqmzqbz\hgitbtw.exe"
