Техническая информация
Сетевая активность
Подключается к
- 'to#####ngobongoboom.com':8080
- '31.##.185.107':8081
- 'localhost':12345
- 'sm##.#orsincorso.it':587
- 'ma##.#####oportariavirtual.com.br':587
- 'as#.###engprov.go.id':587
- 'ma##.###terflyjewels.co.uk':587
- 'smtp.yandex.ru':587
- 'sm##.##stinpayne.com':587
- 'sm##.##iftdsl.com.au':587
- 'sm##.#ingnet.com':587
- 'ma##.c###.li':587
- 'sm##.#etrocast.net':587
- 'va###ali.co.in':587
- 'sm##.#otkey.net.au':587
- 'ma##.#kyhistore.com':587
- 'ma##.###hberryinfotech.com':587
- 'sm##.##morestelecom.km':587
- 'ze####oolhyd.com':587
- 'ma##.#tlanticbb.net':587
- 'ma##.#yrianwa.net':587
- 'ho#####cemarket.com.br':587
- 'da##-hub.at':587
- 'ma##.#oda-ci.com':587
- 'sm##.##ivateemail.com':587
- 'ma##.##mcongroup.com':587
- 'sm##.##limkartal.com.tr':587
- 'sm##.##cochea.gov.ar':587
- 'sm##.#aanimail.com':587
- 'sm##.azet.sk':465
- 'ma##.#bilir.com.tr':587
- 'sm##.volny.cz':587
- 'al####a###areqa.com':587
- 'ma##.###termediamusical.com':587
- 'i-##ve.mx':587
- 'sm##.##tactive.co.za':587
- 'sm##.#ecoleaf.it':587
- 'sm##.###ica89immobiliare.it':587
- 'we#####.officebeacon.com':587
- 'co###o.ugr.es':587
- 'sm##.xemail.de':587
- 'za####oastery.com':587
- 'ma##.#oia.org.uk':587
- 'sm##.#ransip.email':587
TCP
Запросы HTTP GET
- http://to#######obongoboom.com:8080/updater?fo################################## via to#####ngobongoboom.com
Другие
- '31.##.185.107':8081
- 'localhost':12345
- 'localhost':49701
- 'localhost':49704
- 'localhost':49707
- 'ma##.#####oportariavirtual.com.br':587
- 'localhost':49710
- 'localhost':49713
- 'smtp.yandex.ru':587
- 'localhost':49716
- 'localhost':49718
- 'sm##.##stinpayne.com':587
- 'localhost':49722
- 'sm##.#ingnet.com':587
- 'localhost':49725
- 'localhost':49728
- 'sm##.#etrocast.net':587
- 'localhost':49732
- 'localhost':49733
- 'localhost':49737
- 'localhost':49740
- 'ma##.#kyhistore.com':587
- 'localhost':49743
- 'va###ali.co.in':587
- 'localhost':49745
- 'sm##.##morestelecom.km':587
- 'localhost':49749
- 'ma##.###hberryinfotech.com':587
- 'ze####oolhyd.com':587
- 'localhost':49753
- 'localhost':49755
- 'localhost':49758
- 'localhost':49761
- 'ma##.#tlanticbb.net':587
- 'localhost':49764
- 'localhost':49767
- 'ma##.#yrianwa.net':587
- 'localhost':49770
- 'ho#####cemarket.com.br':587
- 'localhost':49773
- 'da##-hub.at':587
- 'ma##.#oda-ci.com':587
- 'localhost':49776
- 'sm##.##ivateemail.com':587
- 'localhost':49779
- 'ma##.##mcongroup.com':587
- 'localhost':49782
- 'localhost':49785
- 'localhost':49787
- 'sm##.#aanimail.com':587
- 'sm##.##cochea.gov.ar':587
- 'localhost':49791
- 'localhost':49794
- 'localhost':49797
- 'localhost':49800
- 'sm##.azet.sk':465
- 'localhost':49803
- 'localhost':49806
- 'localhost':49810
- 'localhost':49813
- 'localhost':49815
- 'al####a###areqa.com':587
- 'localhost':49818
- 'localhost':49822
- 'ma##.###termediamusical.com':587
- 'localhost':49824
- 'localhost':49827
- 'localhost':49830
- 'localhost':49833
- 'i-##ve.mx':587
- 'localhost':49837
- 'sm##.##tactive.co.za':587
- 'localhost':49838
- 'localhost':49842
- 'localhost':49845
- 'localhost':49848
- 'we#####.officebeacon.com':587
- 'localhost':49851
- 'localhost':49854
- 'localhost':49857
- 'localhost':49860
- 'localhost':49863
- 'sm##.xemail.de':587
- 'za####oastery.com':587
- 'localhost':49867
- 'localhost':49869
- 'localhost':49872
- 'localhost':49875
- 'localhost':49878
- 'sm##.#ransip.email':587
- 'localhost':49881
UDP
- DNS ASK to#####ngobongoboom.com
- DNS ASK sm##.#orsincorso.it
- DNS ASK ma##.#####oportariavirtual.com.br
- DNS ASK as#.###engprov.go.id
- DNS ASK ma##.###terflyjewels.co.uk
- DNS ASK smtp.yandex.ru
- DNS ASK sm##.##iftdsl.com.au
- DNS ASK sm##.##stinpayne.com
- DNS ASK sm##.#ingnet.com
- DNS ASK ma##.c###.li
- DNS ASK sm##.#etrocast.net
- DNS ASK va###ali.co.in
- DNS ASK sm##.#otkey.net.au
- DNS ASK ma##.#kyhistore.com
- DNS ASK sm##.##morestelecom.km
- DNS ASK ma##.###hberryinfotech.com
- DNS ASK ze####oolhyd.com
- DNS ASK ma##.#tlanticbb.net
- DNS ASK ma##.#yrianwa.net
- DNS ASK ho#####cemarket.com.br
- DNS ASK da##-hub.at
- DNS ASK ma##.#oda-ci.com
- DNS ASK sm##.##ivateemail.com
- DNS ASK ma##.##mcongroup.com
- DNS ASK sm##.##limkartal.com.tr
- DNS ASK sm##.##cochea.gov.ar
- DNS ASK sm##.#aanimail.com
- DNS ASK sm##.azet.sk
- DNS ASK ma##.#bilir.com.tr
- DNS ASK sm##.volny.cz
- DNS ASK al####a###areqa.com
- DNS ASK ma##.###termediamusical.com
- DNS ASK i-##ve.mx
- DNS ASK sm##.##tactive.co.za
- DNS ASK sm##.#ecoleaf.it
- DNS ASK sm##.###ica89immobiliare.it
- DNS ASK we#####.officebeacon.com
- DNS ASK co###o.ugr.es
- DNS ASK sm##.xemail.de
- DNS ASK za####oastery.com
- DNS ASK ma##.#oia.org.uk
- DNS ASK sm##.#ransip.email
Другое
Запускает на исполнение
- '<SYSTEM32>\cmd.exe' /C "WMIC BIOS GET SERIALNUMBER" (со скрытым окном)
- '<SYSTEM32>\wbem\wmic.exe' BIOS GET SERIALNUMBER
- '<SYSTEM32>\cmd.exe' /C "WMIC DISKDRIVE GET SERIALNUMBER" (со скрытым окном)
- '<SYSTEM32>\wbem\wmic.exe' DISKDRIVE GET SERIALNUMBER
- '<SYSTEM32>\cmd.exe' /C "WMIC CPU GET ProcessorID" (со скрытым окном)
- '<SYSTEM32>\wbem\wmic.exe' CPU GET ProcessorID
