Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'NetworkChecker' = '<Полный путь к вирусу>'
Изменения в файловой системе:
Присваивает атрибут 'скрытый' для следующих файлов:
- <Полный путь к вирусу>
Сетевая активность:
Подключается к:
- '14#.#25.35.131':80
- 'localhost':49201
- '5.###.223.125':80
- '91.##3.147.131':80
- '37.##5.188.132':80
- '21#.#.153.131':80
- '93.##.152.131':80
- '17#.#01.210.125':80
- '95.##.13.123':80
- '94.##3.87.122':80
- '17#.#50.3.122':80
- '46.##9.45.123':80
- '17#.#7.178.124':80
- '77.##1.126.124':80
- '17#.#9.120.124':80
- '5.###.218.132':80
- '89.##2.136.139':80
- '20#.#3.117.138':80
- '21#.#11.238.137':80
- '94.##3.38.140':80
- 'localhost':49224
- '17#.#37.69.140':80
- '46.##2.57.140':80
- '89.##9.124.137':80
- '46.##1.195.134':80
- '12#.#0.137.134':80
- '10#.#62.49.134':80
- '17#.#03.22.136':80
- '95.##4.54.137':80
- '84.##.34.137':80
- '5.###.198.136':80
- '89.##6.66.120':80
- '17#.#4.239.76':80
- '17#.#07.194.76':80
- '46.##9.179.76':80
- '77.##3.46.77':80
- '17#.#37.177.80':80
- '77.##2.88.80':80
- '37.##2.232.78':80
- '46.##8.63.76':80
- '46.##1.226.71':80
- '86.#6.57.71':80
- '17#.#72.198.70':80
- '10#.#7.59.72':80
- '21#.#97.252.74':80
- '18#.#24.89.74':80
- '17#.#37.70.72':80
- '93.##.207.80':80
- '37.##9.36.118':80
- '31.##8.187.117':80
- '17#.#.205.116':80
- '37.##9.102.118':80
- '17#.#12.18.120':80
- '81.##.14.119':80
- '5.###.214.118':80
- '62.##.180.115':80
- '77.##3.247.82':80
- '92.##.175.81':80
- '89.##9.116.81':80
- '21#.#11.210.84':80
- '21#.#15.242.114':80
- '91.##6.7.114':80
- 'localhost':49178
