Техническая информация
Вредоносные функции:
Внедряет код в
следующие пользовательские процессы:
- iexplore.exe
Сетевая активность:
Подключается к:
- 'ma####et-minsky.com':80
- 'ba####massage.com':80
- '21#.#47.24.45':80
- 'tr#####rkfunding.com':80
- 'ad########participatingsites.com':80
- 'tr####tmobile.net':80
- 'ma#####embroidery.com':80
- 'www.ba###npeace.org':80
- 'sd####her-lace.com':80
- 'www.cu#####csolution.net':80
- 'ju####foryou.com':80
- 'ma###safire.com':80
- 'li##ere.com':80
- 'al###dawifi.net':80
- '74.##5.232.51':80
- '20#.#60.1.236':80
- 'am####a-virtual.net':80
- 'mc####ocks.m6.net':80
- 'za#####iajeromin.com':80
- 'ca###judo.com':80
- 'd1#####.u24.radicalv.com':80
TCP:
Запросы HTTP GET:
- ma####et-minsky.com/index.php
- ba####massage.com/index.php
- 21#.#47.24.45/index.html
- tr#####rkfunding.com/index.htm
- ad########participatingsites.com/index.php
- tr####tmobile.net/index.htm
- ma#####embroidery.com/index.php
- www.ba###npeace.org/index.htm
- sd####her-lace.com/index.htm
- www.cu#####csolution.net/index.htm
- ju####foryou.com/index.html
- ma###safire.com/index.html
- li##ere.com/index.html
- al###dawifi.net/index.html
- 74.##5.232.51/
- 20#.#60.1.236/index.php
- am####a-virtual.net/index.html
- mc####ocks.m6.net/index.php
- za#####iajeromin.com/index.php
- ca###judo.com/index.php
- d1#####.u24.radicalv.com/index.html
UDP:
- DNS ASK ma####et-minsky.com
- DNS ASK ba####massage.com
- DNS ASK tr#####rkfunding.com
- DNS ASK ad########participatingsites.com
- DNS ASK sd####her-lace.com
- DNS ASK tr####tmobile.net
- DNS ASK ma#####embroidery.com
- DNS ASK www.cu#####csolution.net
- DNS ASK www.ba###npeace.org
- DNS ASK ju####foryou.com
- DNS ASK ma###safire.com
- DNS ASK li##ere.com
- DNS ASK www.google.com
- DNS ASK al###dawifi.net
- DNS ASK ca###judo.com
- DNS ASK am####a-virtual.net
- DNS ASK mc####ocks.m6.net
- DNS ASK d1#####.u24.radicalv.com
- DNS ASK za#####iajeromin.com
