Техническая информация
Для обеспечения автозапуска и распространения
Устанавливает следующие настройки сервисов
- [HKLM\SYSTEM\CurrentControlSet\Services\Base Secondary Endpoint Mapper Window] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\Base Secondary Endpoint Mapper Window] 'ImagePath' = 'C:\xhcxvkkmdkrszd\gaosysners.exe'
Создает следующие сервисы
- 'Base Secondary Endpoint Mapper Window' C:\xhcxvkkmdkrszd\gaosysners.exe
Изменения в файловой системе
Создает следующие файлы
- %WINDIR%\xhcxvkkmdkrszd\tmmwypwvi
- C:\xhcxvkkmdkrszd\tmmwypwvi
- C:\xhcxvkkmdkrszd\r8qlsjhyezp7ayflffg4t.exe
- C:\xhcxvkkmdkrszd\gaosysners.exe
- C:\xhcxvkkmdkrszd\bvoepnwb.exe
Присваивает атрибут 'скрытый' для следующих файлов
- C:\xhcxvkkmdkrszd\gaosysners.exe
- C:\xhcxvkkmdkrszd\bvoepnwb.exe
Удаляет файлы, которые сам же создал
- %WINDIR%\xhcxvkkmdkrszd\tmmwypwvi
- C:\xhcxvkkmdkrszd\r8qlsjhyezp7ayflffg4t.exe
Подменяет следующие файлы
- %WINDIR%\xhcxvkkmdkrszd\tmmwypwvi
Сетевая активность
Подключается к
- 'he###thrown.net':80
- 'le####training.net':80
- 'le###rstorm.net':80
- 're####ehowever.net':80
- 'le####period.net':80
TCP
Запросы HTTP GET
- http://he###thrown.net/index.php
- http://le####training.net/index.php
- http://le###rstorm.net/index.php
- http://re####ehowever.net/index.php
- http://le####period.net/index.php
UDP
- DNS ASK he###thrown.net
- DNS ASK pl####nthunger.net
- DNS ASK ne####aryhunger.net
- DNS ASK pl#####ttraining.net
- DNS ASK ne#####rytraining.net
- DNS ASK pl####ntstorm.net
- DNS ASK ne####arystorm.net
- DNS ASK pl####ntthrown.net
- DNS ASK ne####arythrown.net
- DNS ASK or###hunger.net
- DNS ASK re####ehunger.net
- DNS ASK or####raining.net
- DNS ASK re####etraining.net
- DNS ASK or###storm.net
- DNS ASK re####estorm.net
- DNS ASK or###thrown.net
- DNS ASK re####ethrown.net
- DNS ASK le####hunger.net
- DNS ASK he####hunger.net
- DNS ASK le####training.net
- DNS ASK he####training.net
- DNS ASK le###rstorm.net
- DNS ASK he###nstorm.net
- DNS ASK le####thrown.net
- DNS ASK he####thrown.net
- DNS ASK he###hunger.net
- DNS ASK ge####hunger.net
- DNS ASK he####raining.net
- DNS ASK ge####training.net
- DNS ASK he###storm.net
- DNS ASK ge###estorm.net
- DNS ASK ge####thrown.net
- DNS ASK va####shunger.net
- DNS ASK re####hunger.net
- DNS ASK va####straining.net
- DNS ASK re####training.net
- DNS ASK va####sstorm.net
- DNS ASK re###nstorm.net
- DNS ASK va####sthrown.net
- DNS ASK re####thrown.net
- DNS ASK de####choose.net
- DNS ASK fo####dchoose.net
- DNS ASK de####although.net
- DNS ASK fo####dalthough.net
- DNS ASK de####period.net
- DNS ASK fo####dperiod.net
- DNS ASK de####however.net
- DNS ASK fo####dhowever.net
- DNS ASK an####choose.net
- DNS ASK gl###choose.net
- DNS ASK an####although.net
- DNS ASK gl####lthough.net
- DNS ASK an####period.net
- DNS ASK gl###period.net
- DNS ASK an####however.net
- DNS ASK gl####owever.net
- DNS ASK di####ultchoose.net
- DNS ASK he###choose.net
- DNS ASK di#####ltalthough.net
- DNS ASK he####lthough.net
- DNS ASK di####ultperiod.net
- DNS ASK he###period.net
- DNS ASK di#####lthowever.net
- DNS ASK he####owever.net
- DNS ASK pl####ntchoose.net
- DNS ASK ne####arychoose.net
- DNS ASK pl#####talthough.net
- DNS ASK ne#####ryalthough.net
- DNS ASK pl####ntperiod.net
- DNS ASK ne####aryperiod.net
- DNS ASK pl####nthowever.net
- DNS ASK ne#####ryhowever.net
- DNS ASK or###choose.net
- DNS ASK re####echoose.net
- DNS ASK or####lthough.net
- DNS ASK re####ealthough.net
- DNS ASK or###period.net
- DNS ASK re####eperiod.net
- DNS ASK or####owever.net
- DNS ASK re####ehowever.net
- DNS ASK le####choose.net
- DNS ASK he####choose.net
- DNS ASK le####although.net
- DNS ASK he####although.net
- DNS ASK le####period.net
- DNS ASK he####period.net
- DNS ASK le####however.net
- DNS ASK he####however.net
- DNS ASK ge####choose.net
- DNS ASK ge####although.net
- DNS ASK ge####period.net
- DNS ASK ge####however.net
- DNS ASK va####schoose.net
- DNS ASK re####choose.net
- DNS ASK va####salthough.net
- DNS ASK re####although.net
- DNS ASK va####speriod.net
- DNS ASK re####period.net
- DNS ASK va####showever.net
- DNS ASK re####however.net
- DNS ASK de####single.net
- DNS ASK fo####dsingle.net
- DNS ASK de####charge.net
- DNS ASK fo####dcharge.net
- DNS ASK de#####ifference.net
- DNS ASK fo#####difference.net
- DNS ASK de###eevery.net
- DNS ASK fo####devery.net
- DNS ASK an####single.net
- DNS ASK gl###single.net
- DNS ASK an####charge.net
- DNS ASK gl###charge.net
- DNS ASK an#####ifference.net
- DNS ASK gl####ifference.net
- DNS ASK an###revery.net
- DNS ASK gl###every.net
- DNS ASK di####ultsingle.net
- DNS ASK he###single.net
- DNS ASK di####ultcharge.net
- DNS ASK he###charge.net
- DNS ASK di#####ltdifference.net
- DNS ASK he####ifference.net
- DNS ASK di####ultevery.net
- DNS ASK he###every.net
- DNS ASK pl####ntsingle.net
- DNS ASK ne####arysingle.net
- DNS ASK pl####ntcharge.net
- DNS ASK ne####arycharge.net
- DNS ASK pl#####tdifference.net
- DNS ASK ne#####rydifference.net
- DNS ASK pl####ntevery.net
- DNS ASK ne####aryevery.net
- DNS ASK or###single.net
- DNS ASK re####esingle.net
- DNS ASK or###charge.net
- DNS ASK re####echarge.net
- DNS ASK or####ifference.net
- DNS ASK re#####difference.net
- DNS ASK or###every.net
- DNS ASK re####eevery.net
- DNS ASK le####single.net
- DNS ASK he####single.net
- DNS ASK le####charge.net
- DNS ASK he####charge.net
- DNS ASK le#####ifference.net
- DNS ASK he#####ifference.net
- DNS ASK le###revery.net
- DNS ASK he###nevery.net
- DNS ASK ge####single.net
- DNS ASK ge####charge.net
- DNS ASK ge#####ifference.net
- DNS ASK ge###eevery.net
- DNS ASK va####ssingle.net
- DNS ASK re####single.net
- DNS ASK va####scharge.net
- DNS ASK re####charge.net
- DNS ASK va#####difference.net
- DNS ASK re#####ifference.net
- DNS ASK va####severy.net
- DNS ASK re###nevery.net
- DNS ASK ag####tshould.net
Другое
Создает и запускает на исполнение
- 'C:\xhcxvkkmdkrszd\r8qlsjhyezp7ayflffg4t.exe'
- 'C:\xhcxvkkmdkrszd\gaosysners.exe'
- 'C:\xhcxvkkmdkrszd\bvoepnwb.exe' "c:\xhcxvkkmdkrszd\gaosysners.exe"
