Техническая информация
Вредоносные функции:
Создает и запускает на исполнение:
- '%TEMP%\Fed-796366'
- '%TEMP%\Fed-875366'
- '%TEMP%\Fed-843366'
- '%TEMP%\Fed-671366'
- '%TEMP%\Fed-187366'
- '%TEMP%\Fed-390366'
- '%TEMP%\Fed-218366'
- '%TEMP%\Fed-31366'
- '%TEMP%\Fed-296356'
- '%TEMP%\Fed-312356'
- '%TEMP%\Fed-765346' /pid=3100
- '%TEMP%\Fed-281356'
- '%TEMP%\Fed-109366'
- '%TEMP%\Fed-281366'
- '%TEMP%\Fed-125356'
- '%TEMP%\Fed-171356'
- '%TEMP%\Fed-234376'
- '%TEMP%\Fed-671376'
- '%TEMP%\Fed-593346' /pid=2912
- '%TEMP%\Fed-781376'
- '%TEMP%\Fed-453376'
- '%TEMP%\Fed-625376'
- '%TEMP%\Fed-796376'
- '%TEMP%\Fed-203376'
- '%TEMP%\Fed-484366'
- '%TEMP%\Fed-921376'
- '%TEMP%\Fed-687366'
- '%TEMP%\Fed-93366'
- '%TEMP%\Fed-218376'
- '%TEMP%\Fed-531376'
- '%TEMP%\Fed-265376'
- '%TEMP%\Fed-78376'
- '%TEMP%\Fed-375346'
- '%TEMP%\Fed-828346'
- '%TEMP%\Fed-406346'
- '%TEMP%\Fed-31346'
- '%TEMP%\Fed-843346'
- '%TEMP%\Fed-890346'
- '%TEMP%\Fed-187346'
- '%TEMP%\Fed-593346'
- '%TEMP%\Fed-796346'
- '%TEMP%\Fed-453346'
- '%TEMP%\Fed-578336'
- '%TEMP%\Fed-500346'
- '%TEMP%\Fed-921346'
- '%TEMP%\Fed-734346'
- '%TEMP%\Fed-765346'
- '%TEMP%\Fed-265346'
- '%TEMP%\Fed-968356'
- '%TEMP%\Fed-921356'
- '%TEMP%\Fed-734356'
- '%TEMP%\Fed-343356'
- '%TEMP%\Fed-687356'
- '%TEMP%\Fed-937356'
- '%TEMP%\Fed-109356'
- '%TEMP%\Fed-359356'
- '%TEMP%\Fed-328346'
- '%TEMP%\Fed-671346'
- '%TEMP%\Fed-125346'
- '%TEMP%\Fed-578346'
- '%TEMP%\Fed-78356'
- '%TEMP%\Fed-437356'
- '%TEMP%\Fed-296346'
- '%TEMP%\Fed-218356'
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\Fed-796366
- %TEMP%\Fed-875366
- %TEMP%\Fed-843366
- %TEMP%\Fed-671366
- %TEMP%\Fed-234366
- %TEMP%\Fed-187366
- %TEMP%\Fed-218366
- %TEMP%\Fed-31366
- %TEMP%\Fed-312356
- %TEMP%\Fed-125356
- %TEMP%\Fed-796356
- %TEMP%\Fed-296356
- %TEMP%\Fed-171366
- %TEMP%\Fed-281366
- %TEMP%\Fed-171356
- %TEMP%\Fed-109366
- %TEMP%\Fed-390366
- %TEMP%\Fed-671376
- %TEMP%\Fed-796376
- %TEMP%\Fed-781376
- %TEMP%\Fed-234376
- %TEMP%\Fed-625376
- %TEMP%\Fed-984376
- %TEMP%\Fed-203376
- %TEMP%\Fed-453376
- %TEMP%\Fed-484366
- %TEMP%\Fed-921376
- %TEMP%\Fed-687366
- %TEMP%\Fed-93366
- %TEMP%\Fed-531376
- %TEMP%\Fed-218376
- %TEMP%\Fed-265376
- %TEMP%\Fed-78376
- %TEMP%\Fed-593356
- %TEMP%\Fed-375346
- %TEMP%\Fed-828346
- %TEMP%\Fed-406346
- %TEMP%\Fed-31346
- %TEMP%\Fed-843346
- %TEMP%\Fed-890346
- %TEMP%\Fed-187346
- %TEMP%\Fed-593346
- %TEMP%\Fed-796346
- %TEMP%\Fed-453346
- %TEMP%\Fed-578336
- %TEMP%\Fed-500346
- %TEMP%\Fed-921346
- %TEMP%\Fed-734346
- %TEMP%\Fed-765346
- %TEMP%\Fed-265346
- %TEMP%\Fed-125346
- %TEMP%\Fed-921356
- %TEMP%\Fed-109356
- %TEMP%\Fed-343356
- %TEMP%\Fed-968356
- %TEMP%\Fed-937356
- %TEMP%\Fed-281356
- %TEMP%\Fed-359356
- %TEMP%\Fed-687356
- %TEMP%\Fed-671346
- %TEMP%\Fed-296346
- %TEMP%\Fed-578346
- %TEMP%\Fed-328346
- %TEMP%\Fed-437356
- %TEMP%\Fed-734356
- %TEMP%\Fed-218356
- %TEMP%\Fed-78356
