Техническая информация
Для обеспечения автозапуска и распространения
Устанавливает следующие настройки сервисов
- [HKLM\SYSTEM\CurrentControlSet\Services\ActiveX Peer Visual Access] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\ActiveX Peer Visual Access] 'ImagePath' = 'C:\hhynxdhbfjou\zqbbyyqchvt.exe'
Создает следующие сервисы
- 'ActiveX Peer Visual Access' C:\hhynxdhbfjou\zqbbyyqchvt.exe
Изменения в файловой системе
Создает следующие файлы
- %WINDIR%\hhynxdhbfjou\vsn9h9
- C:\hhynxdhbfjou\vsn9h9
- C:\hhynxdhbfjou\nak90cnaqknrlx6iny.exe
- C:\hhynxdhbfjou\zqbbyyqchvt.exe
- C:\hhynxdhbfjou\qzbfenrf.exe
Присваивает атрибут 'скрытый' для следующих файлов
- C:\hhynxdhbfjou\zqbbyyqchvt.exe
- C:\hhynxdhbfjou\qzbfenrf.exe
Сетевая активность
Подключается к
- 'ev####gschool.net':80
- 'de####school.net':80
- 'st#####hquestion.net':80
- 'st####raining.net':80
- 'do####training.net':80
- 'mi####owever.net':80
- 'do####however.net':80
TCP
Запросы HTTP GET
- http://ev####gschool.net/index.php
- http://de####school.net/index.php
- http://st####raining.net/index.php
- http://do####training.net/index.php
- http://mi####owever.net/index.php
- http://do####however.net/index.php
UDP
- DNS ASK ou####equestion.net
- DNS ASK mo#####ttherefore.net
- DNS ASK ou#####therefore.net
- DNS ASK bu####ngschool.net
- DNS ASK ev####gschool.net
- DNS ASK bu####ngwhile.net
- DNS ASK ev####gwhile.net
- DNS ASK bu#####gquestion.net
- DNS ASK ev####gquestion.net
- DNS ASK bu#####gtherefore.net
- DNS ASK ev#####therefore.net
- DNS ASK st###school.net
- DNS ASK mi###school.net
- DNS ASK st###while.net
- DNS ASK mi###while.net
- DNS ASK st####uestion.net
- DNS ASK mi####uestion.net
- DNS ASK st####herefore.net
- DNS ASK mi####herefore.net
- DNS ASK do####school.net
- DNS ASK pr####school.net
- DNS ASK do###rwhile.net
- DNS ASK pr###ywhile.net
- DNS ASK do####question.net
- DNS ASK pr####question.net
- DNS ASK do####therefore.net
- DNS ASK pr####therefore.net
- DNS ASK fe####school.net
- DNS ASK fe###wwhile.net
- DNS ASK do###ewhile.net
- DNS ASK fe####question.net
- DNS ASK fe####therefore.net
- DNS ASK br####school.net
- DNS ASK re####school.net
- DNS ASK br###nwhile.net
- DNS ASK re###twhile.net
- DNS ASK br####question.net
- DNS ASK re####question.net
- DNS ASK br####therefore.net
- DNS ASK re####therefore.net
- DNS ASK pr####eschool.net
- DNS ASK de####school.net
- DNS ASK pr####ewhile.net
- DNS ASK de###ewhile.net
- DNS ASK pr####equestion.net
- DNS ASK de####question.net
- DNS ASK pr#####therefore.net
- DNS ASK de####therefore.net
- DNS ASK st####thschool.net
- DNS ASK st####thwhile.net
- DNS ASK st#####hquestion.net
- DNS ASK st#####htherefore.net
- DNS ASK mo####nthunger.net
- DNS ASK ou####ehunger.net
- DNS ASK mo#####ttraining.net
- DNS ASK ou####etraining.net
- DNS ASK mo####ntstorm.net
- DNS ASK ou####estorm.net
- DNS ASK mo####ntthrown.net
- DNS ASK ou####ethrown.net
- DNS ASK bu####nghunger.net
- DNS ASK ev####ghunger.net
- DNS ASK bu#####gtraining.net
- DNS ASK ev####gtraining.net
- DNS ASK bu####ngstorm.net
- DNS ASK ev####gstorm.net
- DNS ASK bu####ngthrown.net
- DNS ASK ev####gthrown.net
- DNS ASK st###hunger.net
- DNS ASK mi###hunger.net
- DNS ASK st####raining.net
- DNS ASK mi####raining.net
- DNS ASK st###storm.net
- DNS ASK mi###storm.net
- DNS ASK st###thrown.net
- DNS ASK mi###thrown.net
- DNS ASK do####hunger.net
- DNS ASK pr####hunger.net
- DNS ASK do####training.net
- DNS ASK pr####training.net
- DNS ASK do###rstorm.net
- DNS ASK pr###ystorm.net
- DNS ASK do####thrown.net
- DNS ASK pr####thrown.net
- DNS ASK fe####hunger.net
- DNS ASK fe####training.net
- DNS ASK fe###wstorm.net
- DNS ASK do###estorm.net
- DNS ASK fe####thrown.net
- DNS ASK br####hunger.net
- DNS ASK re####hunger.net
- DNS ASK br####training.net
- DNS ASK re####training.net
- DNS ASK br###nstorm.net
- DNS ASK re###tstorm.net
- DNS ASK br####thrown.net
- DNS ASK re####thrown.net
- DNS ASK pr####ehunger.net
- DNS ASK de####hunger.net
- DNS ASK pr####etraining.net
- DNS ASK de####training.net
- DNS ASK pr####estorm.net
- DNS ASK de###estorm.net
- DNS ASK pr####ethrown.net
- DNS ASK de####thrown.net
- DNS ASK st####thhunger.net
- DNS ASK st#####htraining.net
- DNS ASK st####thstorm.net
- DNS ASK st####ththrown.net
- DNS ASK mo####ntchoose.net
- DNS ASK ou####echoose.net
- DNS ASK mo#####talthough.net
- DNS ASK ou####ealthough.net
- DNS ASK mo####ntperiod.net
- DNS ASK ou####eperiod.net
- DNS ASK mo####nthowever.net
- DNS ASK ou####ehowever.net
- DNS ASK bu####ngchoose.net
- DNS ASK ev####gchoose.net
- DNS ASK bu#####galthough.net
- DNS ASK ev####galthough.net
- DNS ASK bu####ngperiod.net
- DNS ASK ev####gperiod.net
- DNS ASK bu####nghowever.net
- DNS ASK ev####ghowever.net
- DNS ASK st###choose.net
- DNS ASK mi###choose.net
- DNS ASK st####lthough.net
- DNS ASK mi####lthough.net
- DNS ASK st###period.net
- DNS ASK mi###period.net
- DNS ASK st####owever.net
- DNS ASK mi####owever.net
- DNS ASK do####choose.net
- DNS ASK pr####choose.net
- DNS ASK do####although.net
- DNS ASK pr####although.net
- DNS ASK do####period.net
- DNS ASK pr####period.net
- DNS ASK do####however.net
- DNS ASK pr####however.net
- DNS ASK fe####choose.net
- DNS ASK fe####although.net
- DNS ASK fe####period.net
- DNS ASK fe####however.net
- DNS ASK br####choose.net
- DNS ASK re####choose.net
- DNS ASK br####although.net
- DNS ASK re####although.net
- DNS ASK br####period.net
- DNS ASK re####period.net
- DNS ASK br####however.net
Другое
Создает и запускает на исполнение
- 'C:\hhynxdhbfjou\nak90cnaqknrlx6iny.exe'
- 'C:\hhynxdhbfjou\zqbbyyqchvt.exe'
- 'C:\hhynxdhbfjou\qzbfenrf.exe' "c:\hhynxdhbfjou\zqbbyyqchvt.exe"
