Техническая информация
Для обеспечения автозапуска и распространения
Устанавливает следующие настройки сервисов
- [HKLM\System\CurrentControlSet\Services\Netlogon IP Center Support Routing] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\Netlogon IP Center Support Routing] 'ImagePath' = 'C:\eycxddmd\tjuvfepdiv.exe'
Создает следующие сервисы
- 'Netlogon IP Center Support Routing' C:\eycxddmd\tjuvfepdiv.exe
Изменения в файловой системе
Создает следующие файлы
- %WINDIR%\eycxddmd\bwjkayq
- C:\eycxddmd\bwjkayq
- C:\eycxddmd\libwj7mvzwcqtutpf.exe
- C:\eycxddmd\tjuvfepdiv.exe
- C:\eycxddmd\wkwdlpdi.exe
- C:\eycxddmd\ixqyhp
Присваивает атрибут 'скрытый' для следующих файлов
- C:\eycxddmd\tjuvfepdiv.exe
- C:\eycxddmd\wkwdlpdi.exe
Удаляет следующие файлы
- %WINDIR%\eycxddmd\bwjkayq
- C:\eycxddmd\libwj7mvzwcqtutpf.exe
Подменяет следующие файлы
- %WINDIR%\eycxddmd\bwjkayq
Сетевая активность
Подключается к
- 'fe####contain.net':80
- 'de####industry.net':80
- 'bu#####glanguage.net':80
- 'st###before.net':80
- 'fe####success.net':80
- 'br####spring.net':80
- 're####spring.net':80
- 'de####success.net':80
- 'st###spring.net':80
TCP
Запросы HTTP GET
- http://fe####contain.net/index.php
- http://de####industry.net/index.php
- http://bu#####glanguage.net/index.php
- http://st###before.net/index.php
- http://fe####success.net/index.php
- http://br####spring.net/index.php
- http://re####spring.net/index.php
- http://de####success.net/index.php
- http://st###spring.net/index.php
UDP
- DNS ASK pr####contain.net
- DNS ASK ev####gfound.net
- DNS ASK bu####ngspring.net
- DNS ASK ev####gspring.net
- DNS ASK bu####ngsuccess.net
- DNS ASK ev####gsuccess.net
- DNS ASK bu####ngbanker.net
- DNS ASK do###rfound.net
- DNS ASK ev####gbanker.net
- DNS ASK mi###found.net
- DNS ASK st###spring.net
- DNS ASK mi###spring.net
- DNS ASK st####uccess.net
- DNS ASK mi####uccess.net
- DNS ASK st###banker.net
- DNS ASK ou####ebanker.net
- DNS ASK bu####ngfound.net
- DNS ASK st###found.net
- DNS ASK mi###banker.net
- DNS ASK mo####ntsuccess.net
- DNS ASK de####language.net
- DNS ASK pr####edevice.net
- DNS ASK de####device.net
- DNS ASK pr####ebefore.net
- DNS ASK de####before.net
- DNS ASK st####thsettle.net
- DNS ASK st#####hlanguage.net
- DNS ASK st####thdevice.net
- DNS ASK st####thbefore.net
- DNS ASK mo####ntfound.net
- DNS ASK ou####efound.net
- DNS ASK mo####ntspring.net
- DNS ASK ou####espring.net
- DNS ASK ou####esuccess.net
- DNS ASK de####settle.net
- DNS ASK mo####ntbanker.net
- DNS ASK bu####ngbefore.net
- DNS ASK pr###yfound.net
- DNS ASK pr####espring.net
- DNS ASK pr####esuccess.net
- DNS ASK de####success.net
- DNS ASK pr####ebanker.net
- DNS ASK de####banker.net
- DNS ASK st####thfound.net
- DNS ASK st####thspring.net
- DNS ASK do####spring.net
- DNS ASK st####thsuccess.net
- DNS ASK mo#####tairplane.net
- DNS ASK ou####eairplane.net
- DNS ASK mo#####tstraight.net
- DNS ASK ou####estraight.net
- DNS ASK mo####ntguard.net
- DNS ASK de###efound.net
- DNS ASK pr####efound.net
- DNS ASK de####spring.net
- DNS ASK re####banker.net
- DNS ASK br####banker.net
- DNS ASK pr####spring.net
- DNS ASK pr####success.net
- DNS ASK do####banker.net
- DNS ASK pr####banker.net
- DNS ASK fe###wfound.net
- DNS ASK do###efound.net
- DNS ASK pr####esettle.net
- DNS ASK fe####spring.net
- DNS ASK pr####elanguage.net
- DNS ASK fe####banker.net
- DNS ASK re###tfound.net
- DNS ASK br####spring.net
- DNS ASK re####spring.net
- DNS ASK br####success.net
- DNS ASK re####success.net
- DNS ASK fe####success.net
- DNS ASK do####success.net
- DNS ASK br###nfound.net
- DNS ASK re####before.net
- DNS ASK br####before.net
- DNS ASK re####device.net
- DNS ASK de####contain.net
- DNS ASK pr####ebasket.net
- DNS ASK de####basket.net
- DNS ASK st#####hindustry.net
- DNS ASK st####ndustry.net
- DNS ASK st####thbecame.net
- DNS ASK st###became.net
- DNS ASK st####thcontain.net
- DNS ASK st####ontain.net
- DNS ASK st####thbasket.net
- DNS ASK st###basket.net
- DNS ASK mo####ntsettle.net
- DNS ASK ou####esettle.net
- DNS ASK pr####ebecame.net
- DNS ASK pr####eindustry.net
- DNS ASK pr####econtain.net
- DNS ASK de####industry.net
- DNS ASK re####basket.net
- DNS ASK fe####basket.net
- DNS ASK pr####basket.net
- DNS ASK fe####industry.net
- DNS ASK do####industry.net
- DNS ASK fe####became.net
- DNS ASK do####became.net
- DNS ASK fe####contain.net
- DNS ASK mo#####tlanguage.net
- DNS ASK ou####eguard.net
- DNS ASK do####contain.net
- DNS ASK re####industry.net
- DNS ASK br####became.net
- DNS ASK re####became.net
- DNS ASK br####contain.net
- DNS ASK re####contain.net
- DNS ASK br####basket.net
- DNS ASK do####basket.net
- DNS ASK br####industry.net
- DNS ASK st####thbanker.net
- DNS ASK ou####elanguage.net
- DNS ASK ou####ebefore.net
- DNS ASK do####device.net
- DNS ASK pr####device.net
- DNS ASK do####before.net
- DNS ASK pr####before.net
- DNS ASK fe####settle.net
- DNS ASK de####became.net
- DNS ASK fe####language.net
- DNS ASK fe####before.net
- DNS ASK br####settle.net
- DNS ASK re####settle.net
- DNS ASK br####language.net
- DNS ASK re####language.net
- DNS ASK br####device.net
- DNS ASK pr####settle.net
- DNS ASK fe####device.net
- DNS ASK pr####language.net
- DNS ASK do####language.net
- DNS ASK do####settle.net
- DNS ASK mi###before.net
- DNS ASK bu####ngsettle.net
- DNS ASK ev####gsettle.net
- DNS ASK bu#####glanguage.net
- DNS ASK ev####glanguage.net
- DNS ASK bu####ngdevice.net
- DNS ASK mo####ntdevice.net
- DNS ASK ev####gdevice.net
- DNS ASK ou####edevice.net
- DNS ASK ev####gbefore.net
- DNS ASK mi###settle.net
- DNS ASK st####anguage.net
- DNS ASK mi####anguage.net
- DNS ASK st###device.net
- DNS ASK mi###device.net
- DNS ASK mo####ntbefore.net
- DNS ASK st###before.net
- DNS ASK st###settle.net
- DNS ASK mo####ntfence.net
Другое
Создает и запускает на исполнение
- 'C:\eycxddmd\libwj7mvzwcqtutpf.exe'
- 'C:\eycxddmd\tjuvfepdiv.exe'
- 'C:\eycxddmd\wkwdlpdi.exe' "c:\eycxddmd\tjuvfepdiv.exe"
