Техническая информация
Для обеспечения автозапуска и распространения
Устанавливает следующие настройки сервисов
- [HKLM\SYSTEM\CurrentControlSet\Services\Transfer Acquisition Problem] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\Transfer Acquisition Problem] 'ImagePath' = 'C:\kzcidpzduj\vwtcvoxpayb.exe'
Создает следующие сервисы
- 'Transfer Acquisition Problem' C:\kzcidpzduj\vwtcvoxpayb.exe
Изменения в файловой системе
Создает следующие файлы
- %WINDIR%\kzcidpzduj\uhcgnqrh0c
- C:\kzcidpzduj\uhcgnqrh0c
- C:\kzcidpzduj\l1giqwvfuc9bwceye.exe
- C:\kzcidpzduj\vwtcvoxpayb.exe
- C:\kzcidpzduj\qtcsgpphm.exe
- C:\kzcidpzduj\n7efkvexaqvq
Присваивает атрибут 'скрытый' для следующих файлов
- C:\kzcidpzduj\vwtcvoxpayb.exe
- C:\kzcidpzduj\qtcsgpphm.exe
Сетевая активность
Подключается к
- 'la####aughter.net':80
- 'si####daughter.net':80
- 'mo####daughter.net':80
- 'mo####inready.net':80
- 'mo####inpeople.net':80
- 'mo#####ndaughter.net':80
- 'wi####people.net':80
- 'pr####lyready.net':80
- 'sw###people.net':80
- 'se####lpeople.net':80
- 'si####nation.net':80
- 'po####lenation.net':80
- 'wi####nation.net':80
- 'wi####please.net':80
- 'le###nation.net':80
- 'sw###nation.net':80
- 'si###epower.net':80
- 'mo####inpower.net':80
- 'mo####incountry.net':80
TCP
Запросы HTTP GET
- http://la####aughter.net/index.php
- http://mo####daughter.net/index.php
- http://mo####inpeople.net/index.php
- http://mo#####ndaughter.net/index.php
- http://wi####people.net/index.php
- http://pr####lyready.net/index.php
- http://sw###people.net/index.php
- http://se####lpeople.net/index.php
- http://si####nation.net/index.php
- http://po####lenation.net/index.php
- http://wi####nation.net/index.php
- http://wi####please.net/index.php
- http://le###nation.net/index.php
- http://sw###nation.net/index.php
- http://si###epower.net/index.php
- http://mo####inpower.net/index.php
- http://mo####incountry.net/index.php
UDP
- DNS ASK ma####alexplain.net
- DNS ASK se####lbright.net
- DNS ASK ma####albright.net
- DNS ASK se####linside.net
- DNS ASK ma####alinside.net
- DNS ASK se###aready.net
- DNS ASK la###ready.net
- DNS ASK se###abrown.net
- DNS ASK la###brown.net
- DNS ASK se####people.net
- DNS ASK la###people.net
- DNS ASK se####daughter.net
- DNS ASK la####aughter.net
- DNS ASK si###eready.net
- DNS ASK mo###rready.net
- DNS ASK si###ebrown.net
- DNS ASK mo###rbrown.net
- DNS ASK si####people.net
- DNS ASK mo####people.net
- DNS ASK si####daughter.net
- DNS ASK mo####daughter.net
- DNS ASK mo####inready.net
- DNS ASK po####leready.net
- DNS ASK mo####inbrown.net
- DNS ASK po####lebrown.net
- DNS ASK mo####inpeople.net
- DNS ASK po####lepeople.net
- DNS ASK mo#####ndaughter.net
- DNS ASK po#####edaughter.net
- DNS ASK pe####sready.net
- DNS ASK wi###wready.net
- DNS ASK pe####sbrown.net
- DNS ASK wi###wbrown.net
- DNS ASK pe####speople.net
- DNS ASK wi####people.net
- DNS ASK pe####sdaughter.net
- DNS ASK wi####daughter.net
- DNS ASK wi###rready.net
- DNS ASK su####tready.net
- DNS ASK wi###rbrown.net
- DNS ASK su####tbrown.net
- DNS ASK su####tpeople.net
- DNS ASK su####tdaughter.net
- DNS ASK fi###hready.net
- DNS ASK le###ready.net
- DNS ASK fi###hbrown.net
- DNS ASK le###brown.net
- DNS ASK fi####people.net
- DNS ASK le###people.net
- DNS ASK fi####daughter.net
- DNS ASK le####aughter.net
- DNS ASK sw###ready.net
- DNS ASK pr####lyready.net
- DNS ASK sw###brown.net
- DNS ASK pr####lybrown.net
- DNS ASK sw###people.net
- DNS ASK pr####lypeople.net
- DNS ASK sw####aughter.net
- DNS ASK pr#####ydaughter.net
- DNS ASK se####lready.net
- DNS ASK ma####already.net
- DNS ASK se####lbrown.net
- DNS ASK ma####albrown.net
- DNS ASK se####lpeople.net
- DNS ASK ma####alpeople.net
- DNS ASK se####ldaughter.net
- DNS ASK ma#####ldaughter.net
- DNS ASK se####nation.net
- DNS ASK la###nation.net
- DNS ASK se####soldier.net
- DNS ASK la####oldier.net
- DNS ASK se####please.net
- DNS ASK la###please.net
- DNS ASK se####condition.net
- DNS ASK la####ondition.net
- DNS ASK si####nation.net
- DNS ASK mo####nation.net
- DNS ASK si####soldier.net
- DNS ASK mo####soldier.net
- DNS ASK si####please.net
- DNS ASK mo####please.net
- DNS ASK si####condition.net
- DNS ASK mo####condition.net
- DNS ASK mo####innation.net
- DNS ASK po####lenation.net
- DNS ASK mo####insoldier.net
- DNS ASK po####lesoldier.net
- DNS ASK mo####inplease.net
- DNS ASK po####leplease.net
- DNS ASK mo#####ncondition.net
- DNS ASK po#####econdition.net
- DNS ASK pe####snation.net
- DNS ASK wi####nation.net
- DNS ASK pe####ssoldier.net
- DNS ASK wi####soldier.net
- DNS ASK pe####splease.net
- DNS ASK wi####please.net
- DNS ASK pe#####condition.net
- DNS ASK wi####condition.net
- DNS ASK su####tnation.net
- DNS ASK su####tsoldier.net
- DNS ASK su####tplease.net
- DNS ASK su#####condition.net
- DNS ASK fi####nation.net
- DNS ASK le###nation.net
- DNS ASK fi####soldier.net
- DNS ASK le####oldier.net
- DNS ASK fi####please.net
- DNS ASK le###please.net
- DNS ASK fi####condition.net
- DNS ASK le####ondition.net
- DNS ASK sw###nation.net
- DNS ASK pr####lynation.net
- DNS ASK sw####oldier.net
- DNS ASK pr####lysoldier.net
- DNS ASK sw###please.net
- DNS ASK pr####lyplease.net
- DNS ASK sw####ondition.net
- DNS ASK pr#####ycondition.net
- DNS ASK se####lnation.net
- DNS ASK ma####alnation.net
- DNS ASK se####lsoldier.net
- DNS ASK ma####alsoldier.net
- DNS ASK se####lplease.net
- DNS ASK ma####alplease.net
- DNS ASK se#####condition.net
- DNS ASK ma#####lcondition.net
- DNS ASK se####century.net
- DNS ASK la####entury.net
- DNS ASK se####famous.net
- DNS ASK la###famous.net
- DNS ASK se###apower.net
- DNS ASK la###power.net
- DNS ASK se####country.net
- DNS ASK la####ountry.net
- DNS ASK si####century.net
- DNS ASK mo####century.net
- DNS ASK si####famous.net
- DNS ASK mo####famous.net
- DNS ASK si###epower.net
- DNS ASK mo###rpower.net
- DNS ASK si####country.net
- DNS ASK mo####country.net
- DNS ASK mo####incentury.net
- DNS ASK po####lecentury.net
- DNS ASK mo####infamous.net
- DNS ASK po####lefamous.net
- DNS ASK mo####inpower.net
- DNS ASK po####lepower.net
- DNS ASK mo####incountry.net
- DNS ASK po####lecountry.net
- DNS ASK pe####scentury.net
- DNS ASK wi####century.net
- DNS ASK pe####sfamous.net
- DNS ASK wi####famous.net
- DNS ASK pe####spower.net
- DNS ASK wi###wpower.net
- DNS ASK pe####scountry.net
- DNS ASK wi####country.net
- DNS ASK su####tcentury.net
- DNS ASK su####tfamous.net
- DNS ASK wi###rpower.net
Другое
Создает и запускает на исполнение
- 'C:\kzcidpzduj\l1giqwvfuc9bwceye.exe'
- 'C:\kzcidpzduj\vwtcvoxpayb.exe'
- 'C:\kzcidpzduj\qtcsgpphm.exe' "c:\kzcidpzduj\vwtcvoxpayb.exe"
