Техническая информация
Для обеспечения автозапуска и распространения
Устанавливает следующие настройки сервисов
- [HKLM\SYSTEM\CurrentControlSet\Services\Policy Provider NetBIOS Web Computer Smart] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\Policy Provider NetBIOS Web Computer Smart] 'ImagePath' = 'C:\nxntxpeqs\kwegiastm.exe'
Создает следующие сервисы
- 'Policy Provider NetBIOS Web Computer Smart' C:\nxntxpeqs\kwegiastm.exe
Изменения в файловой системе
Создает следующие файлы
- %WINDIR%\nxntxpeqs\rspkpwjlw
- C:\nxntxpeqs\rspkpwjlw
- C:\nxntxpeqs\y0uebigx2gwpr3gslbui.exe
- C:\nxntxpeqs\kwegiastm.exe
- C:\nxntxpeqs\jhulcdgpdmjx.exe
- C:\nxntxpeqs\e8snux
Присваивает атрибут 'скрытый' для следующих файлов
- C:\nxntxpeqs\kwegiastm.exe
- C:\nxntxpeqs\jhulcdgpdmjx.exe
Удаляет файлы, которые сам же создал
- %WINDIR%\nxntxpeqs\rspkpwjlw
- C:\nxntxpeqs\y0uebigx2gwpr3gslbui.exe
Подменяет следующие файлы
- %WINDIR%\nxntxpeqs\rspkpwjlw
Сетевая активность
Подключается к
- 'li###eapple.net':80
- 'in####sebuilt.net':80
- 'wo###carry.net':80
TCP
Запросы HTTP GET
- http://li###eapple.net/index.php
- http://in####sebuilt.net/index.php
- http://wo###carry.net/index.php
UDP
- DNS ASK wi####control.net
- DNS ASK su####control.net
- DNS ASK ef####matter.net
- DNS ASK th####hmatter.net
- DNS ASK ef###tspent.net
- DNS ASK th####hspent.net
- DNS ASK ef####together.net
- DNS ASK th####htogether.net
- DNS ASK ef####control.net
- DNS ASK th####hcontrol.net
- DNS ASK fo####matter.net
- DNS ASK in####sematter.net
- DNS ASK fo###tspent.net
- DNS ASK in####sespent.net
- DNS ASK fo####together.net
- DNS ASK in#####etogether.net
- DNS ASK fo####control.net
- DNS ASK in####secontrol.net
- DNS ASK wo###matter.net
- DNS ASK re####ermatter.net
- DNS ASK wo###spent.net
- DNS ASK re####erspent.net
- DNS ASK wo####ogether.net
- DNS ASK re#####rtogether.net
- DNS ASK wo####ontrol.net
- DNS ASK re####ercontrol.net
- DNS ASK jo####yfather.net
- DNS ASK hu####dfather.net
- DNS ASK jo####yapple.net
- DNS ASK hu####dapple.net
- DNS ASK jo####ybuilt.net
- DNS ASK hu####dbuilt.net
- DNS ASK jo####ycarry.net
- DNS ASK hu####dcarry.net
- DNS ASK de####yfather.net
- DNS ASK li####father.net
- DNS ASK de####yapple.net
- DNS ASK li###eapple.net
- DNS ASK de####ybuilt.net
- DNS ASK li###ebuilt.net
- DNS ASK de####ycarry.net
- DNS ASK li###ecarry.net
- DNS ASK ri####father.net
- DNS ASK be####father.net
- DNS ASK ri###napple.net
- DNS ASK be###gapple.net
- DNS ASK ri###nbuilt.net
- DNS ASK be###gbuilt.net
- DNS ASK ri###ncarry.net
- DNS ASK be###gcarry.net
- DNS ASK ch###father.net
- DNS ASK th###father.net
- DNS ASK ch###apple.net
- DNS ASK th###apple.net
- DNS ASK ch###built.net
- DNS ASK th###built.net
- DNS ASK ch###carry.net
- DNS ASK th###carry.net
- DNS ASK wi####father.net
- DNS ASK su####father.net
- DNS ASK wi###napple.net
- DNS ASK su###rapple.net
- DNS ASK wi###nbuilt.net
- DNS ASK su###rbuilt.net
- DNS ASK wi###ncarry.net
- DNS ASK su###rcarry.net
- DNS ASK ef####father.net
- DNS ASK th####hfather.net
- DNS ASK ef###tapple.net
- DNS ASK th####happle.net
- DNS ASK ef###tbuilt.net
- DNS ASK th####hbuilt.net
- DNS ASK ef###tcarry.net
- DNS ASK th####hcarry.net
- DNS ASK fo####father.net
- DNS ASK in####sefather.net
- DNS ASK fo###tapple.net
- DNS ASK in####seapple.net
- DNS ASK fo###tbuilt.net
- DNS ASK in####sebuilt.net
- DNS ASK fo###tcarry.net
- DNS ASK in####secarry.net
- DNS ASK wo###father.net
- DNS ASK re####erfather.net
- DNS ASK wo###apple.net
- DNS ASK re####erapple.net
- DNS ASK wo###built.net
- DNS ASK re####erbuilt.net
- DNS ASK wo###carry.net
- DNS ASK re####ercarry.net
- DNS ASK jo####ymeasure.net
- DNS ASK hu####dmeasure.net
- DNS ASK jo####ydinner.net
- DNS ASK hu####ddinner.net
- DNS ASK jo####yafraid.net
- DNS ASK hu####dafraid.net
- DNS ASK jo####ycircle.net
- DNS ASK hu####dcircle.net
- DNS ASK de####ymeasure.net
- DNS ASK li####measure.net
- DNS ASK de####ydinner.net
- DNS ASK li####dinner.net
- DNS ASK de####yafraid.net
- DNS ASK li####afraid.net
- DNS ASK de####ycircle.net
- DNS ASK li####circle.net
- DNS ASK ri####measure.net
- DNS ASK be####measure.net
- DNS ASK ri####dinner.net
- DNS ASK be####dinner.net
- DNS ASK ri####afraid.net
- DNS ASK be####afraid.net
- DNS ASK ri####circle.net
- DNS ASK be####circle.net
- DNS ASK ch####easure.net
- DNS ASK th####easure.net
- DNS ASK ch###dinner.net
- DNS ASK th###dinner.net
- DNS ASK ch###afraid.net
- DNS ASK th###afraid.net
- DNS ASK ch###circle.net
- DNS ASK th###circle.net
- DNS ASK wi####measure.net
- DNS ASK su####measure.net
- DNS ASK wi####dinner.net
- DNS ASK su####dinner.net
- DNS ASK wi####afraid.net
- DNS ASK su####afraid.net
- DNS ASK wi####circle.net
- DNS ASK su####circle.net
- DNS ASK ef####measure.net
- DNS ASK th####hmeasure.net
- DNS ASK ef####dinner.net
- DNS ASK th####hdinner.net
- DNS ASK ef####afraid.net
- DNS ASK th####hafraid.net
- DNS ASK ef####circle.net
- DNS ASK th####hcircle.net
- DNS ASK fo####measure.net
- DNS ASK in####semeasure.net
- DNS ASK fo####dinner.net
- DNS ASK in####sedinner.net
- DNS ASK fo####afraid.net
- DNS ASK in####seafraid.net
- DNS ASK fo####circle.net
- DNS ASK in####secircle.net
- DNS ASK wo####easure.net
- DNS ASK re####ermeasure.net
- DNS ASK wo###dinner.net
- DNS ASK re####erdinner.net
- DNS ASK wo###afraid.net
- DNS ASK re####erafraid.net
- DNS ASK wo###circle.net
- DNS ASK re####ercircle.net
- DNS ASK jo####ywheat.net
- DNS ASK hu####dwheat.net
- DNS ASK jo####yanger.net
- DNS ASK hu####danger.net
- DNS ASK jo####yalways.net
- DNS ASK hu####dalways.net
- DNS ASK jo####yforest.net
- DNS ASK hu####dforest.net
- DNS ASK de####ywheat.net
- DNS ASK li###ewheat.net
- DNS ASK de####yanger.net
- DNS ASK li###eanger.net
- DNS ASK de####yalways.net
- DNS ASK li####always.net
- DNS ASK de####yforest.net
- DNS ASK li####forest.net
Другое
Создает и запускает на исполнение
- 'C:\nxntxpeqs\y0uebigx2gwpr3gslbui.exe'
- 'C:\nxntxpeqs\kwegiastm.exe'
- 'C:\nxntxpeqs\jhulcdgpdmjx.exe' "c:\nxntxpeqs\kwegiastm.exe"
