Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'SPP' = '%WINDIR%\winsxx\srnss.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'SPP' = '%WINDIR%\winsxx\srnss.exe'
Вредоносные функции:
Для затруднения выявления своего присутствия в системе
блокирует:
- Средство контроля пользовательских учетных записей (UAC)
Запускает на исполнение:
- '<SYSTEM32>\taskkill.exe' /f /im hproc64.exe
Внедряет код в
следующие системные процессы:
- <SYSTEM32>\ctfmon.exe
Изменения в файловой системе:
Создает следующие файлы:
- %WINDIR%\msic.dll
- %WINDIR%\mmc.dll
- %WINDIR%\AeroS.exe
- %ProgramFiles%\newgdi32.dll
- %WINDIR%\mtemp.db
- %WINDIR%\kmon.dll
Сетевая активность:
Подключается к:
- '10#.#.250.149':8889
- 'ta###.kro.kr':80
- 'localhost':1036
TCP:
Запросы HTTP GET:
- http://ta###.kro.kr/
UDP:
- DNS ASK ta###.kro.kr
Другое:
Ищет следующие окна:
- ClassName: '' WindowName: '???? ??????????'
- ClassName: '' WindowName: 'ЗЗёБ ·Оїм№ЩµПАМ'
- ClassName: '' WindowName: '???? 7????'
- ClassName: '' WindowName: 'ЗС°ФАУ ёВЖчДї'
- ClassName: '' WindowName: '?????? ????????'
- ClassName: '' WindowName: 'ЗС°ФАУ ЖДЖјИЗ¶у'
- ClassName: '' WindowName: 'ЗЗёБ 7ЖчДї'
- ClassName: '' WindowName: 'ЗЗёБ ЗПАМ·Оїм'
- ClassName: '' WindowName: '???? ????'
- ClassName: '' WindowName: 'ЗЗёБ ИЗ¶у'
- ClassName: '' WindowName: '???? ??????'
- ClassName: '' WindowName: 'ЗЗёБ ґєЖчДї'
- ClassName: '' WindowName: '???? ????????'
- ClassName: 'IEFrame' WindowName: ''
- ClassName: '' WindowName: '?????? ??????????'
- ClassName: '' WindowName: 'ЗС°ФАУ ·Оїм№ЩµПАМ'
- ClassName: '' WindowName: '????? ???'
- ClassName: '' WindowName: '팟스타게임 대기실'
- ClassName: '' WindowName: '바이크게임'
- ClassName: '' WindowName: '?????? 7????'
- ClassName: '' WindowName: '????????2'
- ClassName: '' WindowName: 'ЗПАМ·Оїм2'
- ClassName: '' WindowName: '?????? ??????'
- ClassName: '' WindowName: 'ЗС°ФАУ 7ЖчДї'
- ClassName: '' WindowName: '?????? ?????????? ????'
- ClassName: '' WindowName: 'ЗС°ФАУ ¶уЅєєЈ°ЎЅє ЖчДї'
- ClassName: '' WindowName: 'ЗЗёБ ёВ°н'
- ClassName: '' WindowName: '№ЩАМЕ©°ФАУ'
- ClassName: '' WindowName: '?????????? ??????'
- ClassName: '' WindowName: 'ЖМЅєЕё°ФАУ ґл±вЅЗ'
- ClassName: '' WindowName: '????????'
- ClassName: '' WindowName: 'ЖчДї°ФАУ'
- ClassName: '' WindowName: 'ёВ°н°ФАУ'
- ClassName: '' WindowName: '???????? ????'
- ClassName: '' WindowName: 'ЖчДї'
- ClassName: '#32770' WindowName: '??????'
- ClassName: '#32770' WindowName: 'ёЮёрАе'
- ClassName: '' WindowName: 'їГЅєЕёБо °ФАУ'
- ClassName: '' WindowName: '·Оїм №ЩµПАМ'
- ClassName: '' WindowName: 'ёВ°н'
- ClassName: '' WindowName: 'іЭё¶єн 7ЖчДї'
- ClassName: '' WindowName: 'іЭё¶єн ·Оїм№ЩµПАМ'
- ClassName: '' WindowName: 'іЭё¶єн ґєЖчДї'
- ClassName: '' WindowName: 'ЗЗёБ ґєёВ°н'
- ClassName: '' WindowName: 'ЗЗёБ јёґЩ'
- ClassName: '' WindowName: 'ЗЗёБ °нЅєЕй'
- ClassName: '' WindowName: 'іЭё¶єн ЗПАМ·Оїм'
- ClassName: '' WindowName: '°ФАУ Е¬¶уАМѕрЖ®'
- ClassName: '' WindowName: '??????????'
- ClassName: '' WindowName: '№ЩµПАМ°ФАУ'
- ClassName: '' WindowName: '?????? ????'
- ClassName: '' WindowName: 'іЭё¶єн јёґЩ'
- ClassName: '' WindowName: 'іЭё¶єн ИЗ¶у'
- ClassName: '' WindowName: '피망 7포커'
- ClassName: '' WindowName: '?? ???'
- ClassName: '' WindowName: '피망 뉴포커'
- ClassName: '' WindowName: '?? ?????'
- ClassName: '' WindowName: '피망 로우바둑이'
- ClassName: '' WindowName: '?? 7??'
- ClassName: '' WindowName: '?? ????'
- ClassName: '' WindowName: '피망 맞고'
- ClassName: '' WindowName: '피망 뉴맞고'
- ClassName: '' WindowName: '피망 섯다'
- ClassName: '' WindowName: '피망 하이로우'
- ClassName: '' WindowName: '?? ??'
- ClassName: '' WindowName: '피망 훌라'
- ClassName: '' WindowName: '??? 7??'
- ClassName: '' WindowName: '한게임 7포커'
- ClassName: '' WindowName: '??? ????? ??'
- ClassName: '' WindowName: ''
- ClassName: '' WindowName: '??? ?????'
- ClassName: '' WindowName: '한게임 로우바둑이'
- ClassName: '' WindowName: '한게임 라스베가스 포커'
- ClassName: '' WindowName: '한게임 맞포커'
- ClassName: '' WindowName: '??? ????'
- ClassName: '' WindowName: '한게임 파티훌라'
- ClassName: '' WindowName: '????2'
- ClassName: '' WindowName: '하이로우2'
- ClassName: '' WindowName: '??? ???'
- ClassName: '' WindowName: '피망 고스톱'
- ClassName: '' WindowName: 'Baduki'
- ClassName: '' WindowName: 'PlusPoker'
- ClassName: '' WindowName: 'Matgo'
- ClassName: '' WindowName: '맞고게임'
- ClassName: '' WindowName: 'NEW VONGVONG BADUKI'
- ClassName: '' WindowName: 'NEW VONGVONG MATGO'
- ClassName: '' WindowName: 'Vanilla'
- ClassName: '' WindowName: '??'
- ClassName: '' WindowName: '맞고'
- ClassName: '' WindowName: '포커'
- ClassName: '' WindowName: '???? ??'
- ClassName: '' WindowName: '올스타즈 게임'
- ClassName: '' WindowName: '로우 바둑이'
- ClassName: '' WindowName: '넷마블 하이로우'
- ClassName: '' WindowName: '??? ??'
- ClassName: '' WindowName: '넷마블 섯다'
- ClassName: '' WindowName: '넷마블 7포커'
- ClassName: '' WindowName: '넷마블 로우바둑이'
- ClassName: '' WindowName: '넷마블 뉴포커'
- ClassName: '' WindowName: '넷마블 훌라'
- ClassName: '' WindowName: '바둑이게임'
- ClassName: '' WindowName: '????'
- ClassName: '' WindowName: '포커게임'
- ClassName: '' WindowName: '게임 클라이언트'
- ClassName: 'CXG_WNDCLASS' WindowName: ''
- ClassName: '' WindowName: '?????'
Запускает на исполнение:
- '<SYSTEM32>\ipconfig.exe' /all
- '<SYSTEM32>\ctfmon.exe'
