Техническая информация
Для обеспечения автозапуска и распространения
Устанавливает следующие настройки сервисов
- [HKLM\SYSTEM\CurrentControlSet\Services\Tunneling Function Solutions Foundation] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\Tunneling Function Solutions Foundation] 'ImagePath' = 'C:\kgnkgnsgvpsiws\fqiayyqg.exe'
Создает следующие сервисы
- 'Tunneling Function Solutions Foundation' C:\kgnkgnsgvpsiws\fqiayyqg.exe
Изменения в файловой системе
Создает следующие файлы
- %WINDIR%\kgnkgnsgvpsiws\scjtxn
- C:\kgnkgnsgvpsiws\scjtxn
- C:\kgnkgnsgvpsiws\urwehppgpppxy9s9p.exe
- C:\kgnkgnsgvpsiws\fqiayyqg.exe
- C:\kgnkgnsgvpsiws\zetjipcdch.exe
- C:\kgnkgnsgvpsiws\drtzer
Присваивает атрибут 'скрытый' для следующих файлов
- C:\kgnkgnsgvpsiws\fqiayyqg.exe
- C:\kgnkgnsgvpsiws\zetjipcdch.exe
Удаляет файлы, которые сам же создал
- %WINDIR%\kgnkgnsgvpsiws\scjtxn
- C:\kgnkgnsgvpsiws\urwehppgpppxy9s9p.exe
Подменяет следующие файлы
- %WINDIR%\kgnkgnsgvpsiws\scjtxn
Сетевая активность
Подключается к
- 'de####father.net':80
- 'fo####dbuilt.net':80
- 'gl###apple.net':80
- 'gl###built.net':80
- 'he###afraid.net':80
- 'or###circle.net':80
- 'le####circle.net':80
- 'he####circle.net':80
TCP
Запросы HTTP GET
- http://fo####dbuilt.net/index.php
- http://gl###built.net/index.php
- http://he###afraid.net/index.php
- http://or###circle.net/index.php
- http://he####circle.net/index.php
UDP
- DNS ASK va####smatter.net
- DNS ASK re####matter.net
- DNS ASK va####sspent.net
- DNS ASK re###nspent.net
- DNS ASK va####stogether.net
- DNS ASK re####together.net
- DNS ASK va####scontrol.net
- DNS ASK re####control.net
- DNS ASK de####father.net
- DNS ASK fo####dfather.net
- DNS ASK de###eapple.net
- DNS ASK fo####dapple.net
- DNS ASK de###ebuilt.net
- DNS ASK fo####dbuilt.net
- DNS ASK de###ecarry.net
- DNS ASK fo####dcarry.net
- DNS ASK an####father.net
- DNS ASK gl###father.net
- DNS ASK an###rapple.net
- DNS ASK gl###apple.net
- DNS ASK an###rbuilt.net
- DNS ASK gl###built.net
- DNS ASK an###rcarry.net
- DNS ASK gl###carry.net
- DNS ASK di####ultfather.net
- DNS ASK he###father.net
- DNS ASK di####ultapple.net
- DNS ASK he###apple.net
- DNS ASK di####ultbuilt.net
- DNS ASK he###built.net
- DNS ASK di####ultcarry.net
- DNS ASK he###carry.net
- DNS ASK pl####ntfather.net
- DNS ASK ne####aryfather.net
- DNS ASK pl####ntapple.net
- DNS ASK ne####aryapple.net
- DNS ASK pl####ntbuilt.net
- DNS ASK ne####arybuilt.net
- DNS ASK pl####ntcarry.net
- DNS ASK ne####arycarry.net
- DNS ASK or###father.net
- DNS ASK re####efather.net
- DNS ASK or###apple.net
- DNS ASK re####eapple.net
- DNS ASK or###built.net
- DNS ASK re####ebuilt.net
- DNS ASK or###carry.net
- DNS ASK re####ecarry.net
- DNS ASK le####father.net
- DNS ASK he####father.net
- DNS ASK le###rapple.net
- DNS ASK he###napple.net
- DNS ASK le###rbuilt.net
- DNS ASK he###nbuilt.net
- DNS ASK le###rcarry.net
- DNS ASK he###ncarry.net
- DNS ASK ge####father.net
- DNS ASK ge###eapple.net
- DNS ASK ge###ebuilt.net
- DNS ASK ge###ecarry.net
- DNS ASK va####sfather.net
- DNS ASK re####father.net
- DNS ASK va####sapple.net
- DNS ASK re###napple.net
- DNS ASK va####sbuilt.net
- DNS ASK re###nbuilt.net
- DNS ASK va####scarry.net
- DNS ASK re###ncarry.net
- DNS ASK de####measure.net
- DNS ASK fo####dmeasure.net
- DNS ASK de####dinner.net
- DNS ASK fo####ddinner.net
- DNS ASK de####afraid.net
- DNS ASK fo####dafraid.net
- DNS ASK de####circle.net
- DNS ASK fo####dcircle.net
- DNS ASK an####measure.net
- DNS ASK gl####easure.net
- DNS ASK an####dinner.net
- DNS ASK gl###dinner.net
- DNS ASK an####afraid.net
- DNS ASK gl###afraid.net
- DNS ASK an####circle.net
- DNS ASK gl###circle.net
- DNS ASK di#####ltmeasure.net
- DNS ASK he####easure.net
- DNS ASK di####ultdinner.net
- DNS ASK he###dinner.net
- DNS ASK di####ultafraid.net
- DNS ASK he###afraid.net
- DNS ASK di####ultcircle.net
- DNS ASK he###circle.net
- DNS ASK pl####ntmeasure.net
- DNS ASK ne#####rymeasure.net
- DNS ASK pl####ntdinner.net
- DNS ASK ne####arydinner.net
- DNS ASK pl####ntafraid.net
- DNS ASK ne####aryafraid.net
- DNS ASK pl####ntcircle.net
- DNS ASK ne####arycircle.net
- DNS ASK or####easure.net
- DNS ASK re####emeasure.net
- DNS ASK or###dinner.net
- DNS ASK re####edinner.net
- DNS ASK or###afraid.net
- DNS ASK re####eafraid.net
- DNS ASK or###circle.net
- DNS ASK re####ecircle.net
- DNS ASK le####measure.net
- DNS ASK he####measure.net
- DNS ASK le####dinner.net
- DNS ASK he####dinner.net
- DNS ASK le####afraid.net
- DNS ASK he####afraid.net
- DNS ASK le####circle.net
- DNS ASK he####circle.net
- DNS ASK ge####measure.net
- DNS ASK ge####dinner.net
- DNS ASK ge####afraid.net
- DNS ASK ge####circle.net
- DNS ASK va####smeasure.net
- DNS ASK re####measure.net
- DNS ASK va####sdinner.net
- DNS ASK re####dinner.net
- DNS ASK va####safraid.net
- DNS ASK re####afraid.net
- DNS ASK va####scircle.net
- DNS ASK re####circle.net
- DNS ASK de###ewheat.net
- DNS ASK fo####dwheat.net
- DNS ASK de###eanger.net
- DNS ASK fo####danger.net
- DNS ASK de####always.net
- DNS ASK fo####dalways.net
- DNS ASK de####forest.net
- DNS ASK fo####dforest.net
- DNS ASK an###rwheat.net
- DNS ASK gl###wheat.net
- DNS ASK an###ranger.net
- DNS ASK gl###anger.net
- DNS ASK an####always.net
- DNS ASK gl###always.net
- DNS ASK an####forest.net
- DNS ASK gl###forest.net
- DNS ASK di####ultwheat.net
- DNS ASK he###wheat.net
- DNS ASK di####ultanger.net
- DNS ASK he###anger.net
- DNS ASK di####ultalways.net
- DNS ASK he###always.net
- DNS ASK di####ultforest.net
- DNS ASK he###forest.net
- DNS ASK pl####ntwheat.net
- DNS ASK ne####arywheat.net
- DNS ASK pl####ntanger.net
- DNS ASK ne####aryanger.net
- DNS ASK pl####ntalways.net
- DNS ASK ne####aryalways.net
- DNS ASK pl####ntforest.net
- DNS ASK ne####aryforest.net
- DNS ASK or###wheat.net
- DNS ASK re####ewheat.net
Другое
Создает и запускает на исполнение
- 'C:\kgnkgnsgvpsiws\urwehppgpppxy9s9p.exe'
- 'C:\kgnkgnsgvpsiws\fqiayyqg.exe'
- 'C:\kgnkgnsgvpsiws\zetjipcdch.exe' "c:\kgnkgnsgvpsiws\fqiayyqg.exe"
