Техническая информация
Для обеспечения автозапуска и распространения
Устанавливает следующие настройки сервисов
- [HKLM\SYSTEM\CurrentControlSet\Services\Detection Session IPsec Browser] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\Detection Session IPsec Browser] 'ImagePath' = 'C:\dkjxpubhb\gbadvau.exe'
Создает следующие сервисы
- 'Detection Session IPsec Browser' C:\dkjxpubhb\gbadvau.exe
Изменения в файловой системе
Создает следующие файлы
- %WINDIR%\dkjxpubhb\xsn8iih4ay8
- C:\dkjxpubhb\xsn8iih4ay8
- C:\dkjxpubhb\hwjql5sawgeecdqqxza.exe
- C:\dkjxpubhb\gbadvau.exe
- C:\dkjxpubhb\btqptcnpkg.exe
- C:\dkjxpubhb\fjcnhdo92
Присваивает атрибут 'скрытый' для следующих файлов
- C:\dkjxpubhb\gbadvau.exe
- C:\dkjxpubhb\btqptcnpkg.exe
Удаляет файлы, которые сам же создал
- %WINDIR%\dkjxpubhb\xsn8iih4ay8
- C:\dkjxpubhb\hwjql5sawgeecdqqxza.exe
Подменяет следующие файлы
- %WINDIR%\dkjxpubhb\xsn8iih4ay8
Сетевая активность
Подключается к
- 'ch####enwelcome.net':80
- 'be####enature.net':80
- 'be####ecover.net':80
- 'ma####ecompany.net':80
- 'su####company.net':80
- 'fo####ncompany.net':80
- 'en####hcompany.net':80
TCP
Запросы HTTP GET
- http://be####enature.net/index.php
- http://be####ecover.net/index.php
- http://ma####ecompany.net/index.php
- http://su####company.net/index.php
- http://en####hcompany.net/index.php
UDP
- DNS ASK pi####eproud.net
- DNS ASK ci####tteproud.net
- DNS ASK pi####ecomplete.net
- DNS ASK ci#####tecomplete.net
- DNS ASK ch####enwelcome.net
- DNS ASK fa####welcome.net
- DNS ASK ch####enaround.net
- DNS ASK fa####around.net
- DNS ASK ch####enproud.net
- DNS ASK fa###yproud.net
- DNS ASK ch#####ncomplete.net
- DNS ASK fa####complete.net
- DNS ASK ei####welcome.net
- DNS ASK en####hwelcome.net
- DNS ASK ei####around.net
- DNS ASK en####haround.net
- DNS ASK ei###rproud.net
- DNS ASK en####hproud.net
- DNS ASK ei####complete.net
- DNS ASK en####hcomplete.net
- DNS ASK ex####nature.net
- DNS ASK be####enature.net
- DNS ASK ex####needle.net
- DNS ASK be####eneedle.net
- DNS ASK ex####enough.net
- DNS ASK be####eenough.net
- DNS ASK ex####govern.net
- DNS ASK be####egovern.net
- DNS ASK pe####nature.net
- DNS ASK ma####enature.net
- DNS ASK pe####needle.net
- DNS ASK ma####eneedle.net
- DNS ASK pe####enough.net
- DNS ASK ma####eenough.net
- DNS ASK pe####govern.net
- DNS ASK ma####egovern.net
- DNS ASK su####nature.net
- DNS ASK fo####nnature.net
- DNS ASK su####needle.net
- DNS ASK fo####nneedle.net
- DNS ASK su####enough.net
- DNS ASK fo####nenough.net
- DNS ASK su####govern.net
- DNS ASK fo####ngovern.net
- DNS ASK wh####rnature.net
- DNS ASK ri###nature.net
- DNS ASK wh####rneedle.net
- DNS ASK ri###needle.net
- DNS ASK wh####renough.net
- DNS ASK ri###enough.net
- DNS ASK wh####rgovern.net
- DNS ASK ri###govern.net
- DNS ASK fi####nature.net
- DNS ASK th####nature.net
- DNS ASK fi####needle.net
- DNS ASK th####needle.net
- DNS ASK fi####enough.net
- DNS ASK th####enough.net
- DNS ASK fi####govern.net
- DNS ASK th####govern.net
- DNS ASK pi####enature.net
- DNS ASK ci####ttenature.net
- DNS ASK pi####eneedle.net
- DNS ASK ci####tteneedle.net
- DNS ASK pi####eenough.net
- DNS ASK ci####tteenough.net
- DNS ASK pi####egovern.net
- DNS ASK ci####ttegovern.net
- DNS ASK ch####ennature.net
- DNS ASK fa####nature.net
- DNS ASK ch####enneedle.net
- DNS ASK fa####needle.net
- DNS ASK ch####enenough.net
- DNS ASK fa####enough.net
- DNS ASK ch####engovern.net
- DNS ASK fa####govern.net
- DNS ASK ei####nature.net
- DNS ASK en####hnature.net
- DNS ASK ei####needle.net
- DNS ASK en####hneedle.net
- DNS ASK ei####enough.net
- DNS ASK en####henough.net
- DNS ASK ei####govern.net
- DNS ASK en####hgovern.net
- DNS ASK ex####further.net
- DNS ASK be####efurther.net
- DNS ASK ex###tcover.net
- DNS ASK be####ecover.net
- DNS ASK ex####become.net
- DNS ASK be####ebecome.net
- DNS ASK ex####company.net
- DNS ASK be####ecompany.net
- DNS ASK pe####further.net
- DNS ASK ma####efurther.net
- DNS ASK pe###ncover.net
- DNS ASK ma####ecover.net
- DNS ASK pe####become.net
- DNS ASK ma####ebecome.net
- DNS ASK pe####company.net
- DNS ASK ma####ecompany.net
- DNS ASK su####further.net
- DNS ASK fo####nfurther.net
- DNS ASK su###ncover.net
- DNS ASK fo####ncover.net
- DNS ASK su####become.net
- DNS ASK fo####nbecome.net
- DNS ASK su####company.net
- DNS ASK fo####ncompany.net
- DNS ASK wh####rfurther.net
- DNS ASK ri####urther.net
- DNS ASK wh####rcover.net
- DNS ASK ri###cover.net
- DNS ASK wh####rbecome.net
- DNS ASK ri###become.net
- DNS ASK wh####rcompany.net
- DNS ASK ri####ompany.net
- DNS ASK fi####further.net
- DNS ASK th####further.net
- DNS ASK fi###ecover.net
- DNS ASK th###hcover.net
- DNS ASK fi####become.net
- DNS ASK th####become.net
- DNS ASK fi####company.net
- DNS ASK th####company.net
- DNS ASK pi####efurther.net
- DNS ASK ci#####tefurther.net
- DNS ASK pi####ecover.net
- DNS ASK ci####ttecover.net
- DNS ASK pi####ebecome.net
- DNS ASK ci####ttebecome.net
- DNS ASK pi####ecompany.net
- DNS ASK ci#####tecompany.net
- DNS ASK ch####enfurther.net
- DNS ASK fa####further.net
- DNS ASK ch####encover.net
- DNS ASK fa###ycover.net
- DNS ASK ch####enbecome.net
- DNS ASK fa####become.net
- DNS ASK ch####encompany.net
- DNS ASK fa####company.net
- DNS ASK ei####further.net
- DNS ASK en####hfurther.net
- DNS ASK ei###rcover.net
- DNS ASK en####hcover.net
- DNS ASK ei####become.net
- DNS ASK en####hbecome.net
- DNS ASK ei####company.net
- DNS ASK en####hcompany.net
- DNS ASK ex###tuntil.net
- DNS ASK be####euntil.net
- DNS ASK ex###tabove.net
- DNS ASK be####eabove.net
- DNS ASK ex####shoulder.net
- DNS ASK be####eshoulder.net
- DNS ASK ex####finger.net
- DNS ASK be####efinger.net
- DNS ASK pe###nuntil.net
- DNS ASK ma####euntil.net
- DNS ASK pe###nabove.net
- DNS ASK ma####eabove.net
- DNS ASK pe####shoulder.net
- DNS ASK ma####eshoulder.net
- DNS ASK pe####finger.net
- DNS ASK ma####efinger.net
- DNS ASK su###nuntil.net
- DNS ASK fo####nuntil.net
- DNS ASK su###nabove.net
- DNS ASK fo####nabove.net
- DNS ASK su####shoulder.net
- DNS ASK fo####nshoulder.net
Другое
Создает и запускает на исполнение
- 'C:\dkjxpubhb\hwjql5sawgeecdqqxza.exe'
- 'C:\dkjxpubhb\gbadvau.exe'
- 'C:\dkjxpubhb\btqptcnpkg.exe' "c:\dkjxpubhb\gbadvau.exe"
