Техническая информация
Для обеспечения автозапуска и распространения
Устанавливает следующие настройки сервисов
- [HKLM\SYSTEM\CurrentControlSet\Services\WLAN Registrar Protocol] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\WLAN Registrar Protocol] 'ImagePath' = 'C:\jxiuqsj\wezgkujjguco.exe'
Создает следующие сервисы
- 'WLAN Registrar Protocol' C:\jxiuqsj\wezgkujjguco.exe
Изменения в файловой системе
Создает следующие файлы
- %WINDIR%\jxiuqsj\etfqkf
- C:\jxiuqsj\etfqkf
- C:\jxiuqsj\gbvunjj5sa2pg3xdtw.exe
- C:\jxiuqsj\wezgkujjguco.exe
- C:\jxiuqsj\chuqiqjs.exe
Присваивает атрибут 'скрытый' для следующих файлов
- C:\jxiuqsj\wezgkujjguco.exe
- C:\jxiuqsj\chuqiqjs.exe
Удаляет файлы, которые сам же создал
- %WINDIR%\jxiuqsj\etfqkf
- C:\jxiuqsj\gbvunjj5sa2pg3xdtw.exe
Подменяет следующие файлы
- %WINDIR%\jxiuqsj\etfqkf
Сетевая активность
Подключается к
- 'mo####gflower.net':80
- 'we####rminute.net':80
- 'th###corner.net':80
- 'pr####tstranger.net':80
- 'mo####gstranger.net':80
- 'of###animal.net':80
- 'mi####modern.net':80
- 'th###sister.net':80
TCP
Запросы HTTP GET
- http://mo####gflower.net/index.php
- http://we####rminute.net/index.php
- http://th###corner.net/index.php
- http://pr####tstranger.net/index.php
- http://mo####gstranger.net/index.php
- http://of###animal.net/index.php
- http://mi####modern.net/index.php
- http://th###sister.net/index.php
UDP
- DNS ASK tw####corner.net
- DNS ASK ra####flower.net
- DNS ASK mo####gflower.net
- DNS ASK ra####minute.net
- DNS ASK mo####gminute.net
- DNS ASK ra####special.net
- DNS ASK mo####gspecial.net
- DNS ASK ra####corner.net
- DNS ASK mo####gcorner.net
- DNS ASK st####eflower.net
- DNS ASK hi####yflower.net
- DNS ASK st####eminute.net
- DNS ASK hi####yminute.net
- DNS ASK st####especial.net
- DNS ASK hi####yspecial.net
- DNS ASK st####ecorner.net
- DNS ASK hi####ycorner.net
- DNS ASK am####flower.net
- DNS ASK we####rflower.net
- DNS ASK am####minute.net
- DNS ASK we####rminute.net
- DNS ASK am####special.net
- DNS ASK we####rspecial.net
- DNS ASK am####corner.net
- DNS ASK we####rcorner.net
- DNS ASK th###flower.net
- DNS ASK cl###flower.net
- DNS ASK th###minute.net
- DNS ASK cl###minute.net
- DNS ASK th####pecial.net
- DNS ASK cl####pecial.net
- DNS ASK th###corner.net
- DNS ASK cl###corner.net
- DNS ASK th####dvance.net
- DNS ASK pr####tadvance.net
- DNS ASK th####tranger.net
- DNS ASK pr####tstranger.net
- DNS ASK th####oodbye.net
- DNS ASK pr####tgoodbye.net
- DNS ASK th####ortieth.net
- DNS ASK pr####tfortieth.net
- DNS ASK ch####dvance.net
- DNS ASK co####eadvance.net
- DNS ASK ch####tranger.net
- DNS ASK co####estranger.net
- DNS ASK ch####oodbye.net
- DNS ASK co####egoodbye.net
- DNS ASK ch####ortieth.net
- DNS ASK co####efortieth.net
- DNS ASK of####dvance.net
- DNS ASK al####dvance.net
- DNS ASK of####tranger.net
- DNS ASK al####tranger.net
- DNS ASK of####oodbye.net
- DNS ASK al####oodbye.net
- DNS ASK of####ortieth.net
- DNS ASK al####ortieth.net
- DNS ASK mi####advance.net
- DNS ASK tw####advance.net
- DNS ASK mi####stranger.net
- DNS ASK tw####stranger.net
- DNS ASK mi####goodbye.net
- DNS ASK tw####goodbye.net
- DNS ASK mi####fortieth.net
- DNS ASK tw####fortieth.net
- DNS ASK ra####advance.net
- DNS ASK mo####gadvance.net
- DNS ASK ra####stranger.net
- DNS ASK mo####gstranger.net
- DNS ASK ra####goodbye.net
- DNS ASK mo####ggoodbye.net
- DNS ASK ra####fortieth.net
- DNS ASK mo####gfortieth.net
- DNS ASK st####eadvance.net
- DNS ASK hi####yadvance.net
- DNS ASK st####estranger.net
- DNS ASK hi####ystranger.net
- DNS ASK st####egoodbye.net
- DNS ASK hi####ygoodbye.net
- DNS ASK st####efortieth.net
- DNS ASK hi####yfortieth.net
- DNS ASK am####advance.net
- DNS ASK we####radvance.net
- DNS ASK am####stranger.net
- DNS ASK we####rstranger.net
- DNS ASK am####goodbye.net
- DNS ASK we####rgoodbye.net
- DNS ASK am####fortieth.net
- DNS ASK we####rfortieth.net
- DNS ASK cl####dvance.net
- DNS ASK cl####tranger.net
- DNS ASK cl####oodbye.net
- DNS ASK cl####ortieth.net
- DNS ASK th###escape.net
- DNS ASK pr####tescape.net
- DNS ASK th###animal.net
- DNS ASK pr####tanimal.net
- DNS ASK th####roblem.net
- DNS ASK pr####tproblem.net
- DNS ASK th###modern.net
- DNS ASK pr####tmodern.net
- DNS ASK ch###escape.net
- DNS ASK co####eescape.net
- DNS ASK ch###animal.net
- DNS ASK co####eanimal.net
- DNS ASK ch####roblem.net
- DNS ASK co####eproblem.net
- DNS ASK ch###modern.net
- DNS ASK co####emodern.net
- DNS ASK of###escape.net
- DNS ASK al###escape.net
- DNS ASK of###animal.net
- DNS ASK al###animal.net
- DNS ASK of####roblem.net
- DNS ASK al####roblem.net
- DNS ASK of###modern.net
- DNS ASK al###modern.net
- DNS ASK mi####escape.net
- DNS ASK tw####escape.net
- DNS ASK mi####animal.net
- DNS ASK tw####animal.net
- DNS ASK mi####problem.net
- DNS ASK tw####problem.net
- DNS ASK mi####modern.net
- DNS ASK tw####modern.net
- DNS ASK ra####escape.net
- DNS ASK mo####gescape.net
- DNS ASK ra####animal.net
- DNS ASK mo####ganimal.net
- DNS ASK ra####problem.net
- DNS ASK mo####gproblem.net
- DNS ASK ra####modern.net
- DNS ASK mo####gmodern.net
- DNS ASK st####eescape.net
- DNS ASK hi####yescape.net
- DNS ASK st####eanimal.net
- DNS ASK hi####yanimal.net
- DNS ASK st####eproblem.net
- DNS ASK hi####yproblem.net
- DNS ASK st####emodern.net
- DNS ASK hi####ymodern.net
- DNS ASK am####escape.net
- DNS ASK we####rescape.net
- DNS ASK am####animal.net
- DNS ASK we####ranimal.net
- DNS ASK am####problem.net
- DNS ASK we####rproblem.net
- DNS ASK am####modern.net
- DNS ASK we####rmodern.net
- DNS ASK cl###escape.net
- DNS ASK cl###animal.net
- DNS ASK cl####roblem.net
- DNS ASK cl###modern.net
- DNS ASK th###silver.net
- DNS ASK pr####tsilver.net
- DNS ASK th###sister.net
- DNS ASK pr####tsister.net
- DNS ASK th###valley.net
- DNS ASK pr####tvalley.net
- DNS ASK th###labor.net
- DNS ASK pr####tlabor.net
- DNS ASK ch###silver.net
Другое
Создает и запускает на исполнение
- 'C:\jxiuqsj\gbvunjj5sa2pg3xdtw.exe'
- 'C:\jxiuqsj\wezgkujjguco.exe'
- 'C:\jxiuqsj\chuqiqjs.exe' "c:\jxiuqsj\wezgkujjguco.exe"
