Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'BranchCache Encryption Base' = 'C:\fqtxcglcmoccvr\qgpxvge.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\COM Endpoint Image Coordinator] 'ImagePath' = 'C:\fqtxcglcmoccvr\qgpxvge.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\COM Endpoint Image Coordinator] 'Start' = '00000002'
Вредоносные функции:
Запускает на исполнение:
- 'C:\fqtxcglcmoccvr\afpsgnwjwib.exe' "c:\fqtxcglcmoccvr\qgpxvge.exe"
- 'C:\fqtxcglcmoccvr\qgpxvge.exe'
- 'C:\fqtxcglcmoccvr\xg2nt7ojlaedzhxp.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\fqtxcglcmoccvr\qgpxvge.exe
- C:\fqtxcglcmoccvr\afpsgnwjwib.exe
- C:\fqtxcglcmoccvr\enqp0lcbd8t
- %WINDIR%\fqtxcglcmoccvr\uixb0fyiyld
- C:\fqtxcglcmoccvr\uixb0fyiyld
- C:\fqtxcglcmoccvr\xg2nt7ojlaedzhxp.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\fqtxcglcmoccvr\afpsgnwjwib.exe
- C:\fqtxcglcmoccvr\qgpxvge.exe
Удаляет следующие файлы:
- C:\fqtxcglcmoccvr\xg2nt7ojlaedzhxp.exe
- %WINDIR%\fqtxcglcmoccvr\uixb0fyiyld
Подменяет следующие файлы:
- %WINDIR%\fqtxcglcmoccvr\uixb0fyiyld
Сетевая активность:
Подключается к:
- 'st###course.net':80
- 'mi###course.net':80
- 'st###paint.net':80
- 'mi###paint.net':80
- 'do###rclean.net':80
- 'pr###yclean.net':80
- 'st###women.net':80
- 'mi###women.net':80
- 'bu####ngcourse.net':80
- 'ev####gcourse.net':80
- 'bu####ngpaint.net':80
- 'ev####gpaint.net':80
- 'st###clean.net':80
- 'mi###clean.net':80
- 'bu####ngwomen.net':80
- 'ev####gwomen.net':80
- 'fe####course.net':80
- 'fe###wwomen.net':80
- 'fe###wpaint.net':80
- 'do###epaint.net':80
- 're###tclean.net':80
- 'br###npaint.net':80
- 'do###ewomen.net':80
- 'br###nclean.net':80
- 'do####course.net':80
- 'pr####course.net':80
- 'do###rpaint.net':80
- 'pr###ypaint.net':80
- 'fe###wclean.net':80
- 'do###eclean.net':80
- 'do###rwomen.net':80
- 'pr###ywomen.net':80
- 'ch####enpublic.net':80
- 'fa####public.net':80
- 'ch####eneearly.net':80
- 'fa####eearly.net':80
- 'ei###rcatch.net':80
- 'en####hcatch.net':80
- 'ch####endress.net':80
- 'fa###ydress.net':80
- 'pi####epublic.net':80
- 'ci####ttepublic.net':80
- 'pi####eeearly.net':80
- 'ci####tteeearly.net':80
- 'ch####encatch.net':80
- 'fa###ycatch.net':80
- 'pi####edress.net':80
- 'ci####ttedress.net':80
- 'mo####ntcourse.net':80
- 'ou####ecourse.net':80
- 'mo####ntpaint.net':80
- 'ou####epaint.net':80
- 'bu####ngclean.net':80
- 'ev####gclean.net':80
- 'mo####ntwomen.net':80
- 'ou####ewomen.net':80
- 'ei####public.net':80
- 'en####hpublic.net':80
- 'ei####eearly.net':80
- 'en####heearly.net':80
- 'mo####ntclean.net':80
- 'ou####eclean.net':80
- 'ei###rdress.net':80
- 'en####hdress.net':80
TCP:
Запросы HTTP GET:
- http://st###course.net/index.php?me########
- http://mi###course.net/index.php?me########
- http://st###paint.net/index.php?me########
- http://mi###paint.net/index.php?me########
- http://do###rclean.net/index.php?me########
- http://pr###yclean.net/index.php?me########
- http://st###women.net/index.php?me########
- http://mi###women.net/index.php?me########
- http://bu####ngcourse.net/index.php?me########
- http://ev####gcourse.net/index.php?me########
- http://bu####ngpaint.net/index.php?me########
- http://ev####gpaint.net/index.php?me########
- http://st###clean.net/index.php?me########
- http://mi###clean.net/index.php?me########
- http://bu####ngwomen.net/index.php?me########
- http://ev####gwomen.net/index.php?me########
- http://fe####course.net/index.php?me########
- http://fe###wwomen.net/index.php?me########
- http://fe###wpaint.net/index.php?me########
- http://do###epaint.net/index.php?me########
- http://re###tclean.net/index.php?me########
- http://br###npaint.net/index.php?me########
- http://do###ewomen.net/index.php?me########
- http://br###nclean.net/index.php?me########
- http://do####course.net/index.php?me########
- http://pr####course.net/index.php?me########
- http://do###rpaint.net/index.php?me########
- http://pr###ypaint.net/index.php?me########
- http://fe###wclean.net/index.php?me########
- http://do###eclean.net/index.php?me########
- http://do###rwomen.net/index.php?me########
- http://pr###ywomen.net/index.php?me########
- http://ch####enpublic.net/index.php?me########
- http://fa####public.net/index.php?me########
- http://ch####eneearly.net/index.php?me########
- http://fa####eearly.net/index.php?me########
- http://ei###rcatch.net/index.php?me########
- http://en####hcatch.net/index.php?me########
- http://ch####endress.net/index.php?me########
- http://fa###ydress.net/index.php?me########
- http://pi####epublic.net/index.php?me########
- http://ci####ttepublic.net/index.php?me########
- http://pi####eeearly.net/index.php?me########
- http://ci####tteeearly.net/index.php?me########
- http://ch####encatch.net/index.php?me########
- http://fa###ycatch.net/index.php?me########
- http://pi####edress.net/index.php?me########
- http://ci####ttedress.net/index.php?me########
- http://mo####ntcourse.net/index.php?me########
- http://ou####ecourse.net/index.php?me########
- http://mo####ntpaint.net/index.php?me########
- http://ou####epaint.net/index.php?me########
- http://bu####ngclean.net/index.php?me########
- http://ev####gclean.net/index.php?me########
- http://mo####ntwomen.net/index.php?me########
- http://ou####ewomen.net/index.php?me########
- http://ei####public.net/index.php?me########
- http://en####hpublic.net/index.php?me########
- http://ei####eearly.net/index.php?me########
- http://en####heearly.net/index.php?me########
- http://mo####ntclean.net/index.php?me########
- http://ou####eclean.net/index.php?me########
- http://ei###rdress.net/index.php?me########
- http://en####hdress.net/index.php?me########
UDP:
- DNS ASK mi###course.net
- DNS ASK st###women.net
- DNS ASK mi###paint.net
- DNS ASK st###course.net
- DNS ASK pr###yclean.net
- DNS ASK do###rpaint.net
- DNS ASK mi###women.net
- DNS ASK do###rclean.net
- DNS ASK ev####gcourse.net
- DNS ASK bu####ngwomen.net
- DNS ASK ev####gpaint.net
- DNS ASK bu####ngcourse.net
- DNS ASK mi###clean.net
- DNS ASK st###paint.net
- DNS ASK ev####gwomen.net
- DNS ASK st###clean.net
- DNS ASK fe###wwomen.net
- DNS ASK do###ewomen.net
- DNS ASK do###epaint.net
- DNS ASK fe####course.net
- DNS ASK br###npaint.net
- DNS ASK re###tpaint.net
- DNS ASK br###nclean.net
- DNS ASK re###tclean.net
- DNS ASK pr####course.net
- DNS ASK do###rwomen.net
- DNS ASK pr###ypaint.net
- DNS ASK do####course.net
- DNS ASK do###eclean.net
- DNS ASK fe###wpaint.net
- DNS ASK pr###ywomen.net
- DNS ASK fe###wclean.net
- DNS ASK bu####ngpaint.net
- DNS ASK ch####enpublic.net
- DNS ASK fa####public.net
- DNS ASK ch####eneearly.net
- DNS ASK fa####eearly.net
- DNS ASK ei###rcatch.net
- DNS ASK en####hcatch.net
- DNS ASK ch####endress.net
- DNS ASK fa###ydress.net
- DNS ASK pi####epublic.net
- DNS ASK ci####ttepublic.net
- DNS ASK pi####eeearly.net
- DNS ASK ci####tteeearly.net
- DNS ASK ch####encatch.net
- DNS ASK fa###ycatch.net
- DNS ASK pi####edress.net
- DNS ASK ci####ttedress.net
- DNS ASK mo####ntcourse.net
- DNS ASK ou####ecourse.net
- DNS ASK mo####ntpaint.net
- DNS ASK ou####epaint.net
- DNS ASK bu####ngclean.net
- DNS ASK ev####gclean.net
- DNS ASK mo####ntwomen.net
- DNS ASK ou####ewomen.net
- DNS ASK ei####public.net
- DNS ASK en####hpublic.net
- DNS ASK ei####eearly.net
- DNS ASK en####heearly.net
- DNS ASK mo####ntclean.net
- DNS ASK ou####eclean.net
- DNS ASK ei###rdress.net
- DNS ASK en####hdress.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
