Win32.HLLW.Autoruner1.10689

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001] 'LibraryPath' = 'mswsock.dll'
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003] 'LibraryPath' = 'mswsock.dll'
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008] 'PackedCatalogItem' = ''

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\.i8042prt] 'ImagePath' = '\?'

Вредоносные функции:

Внедряет код в

следующие системные процессы:

<SYSTEM32>\winlogon.exe
%WINDIR%\Explorer.EXE

Изменения в файловой системе:

Создает следующие файлы:

%WINDIR%\$NtUninstallKB27979$\4121336045\@
%WINDIR%\$NtUninstallKB27979$\4121336045\cfg.ini
%WINDIR%\$NtUninstallKB27979$\4121336045\Desktop.ini
%WINDIR%\$NtUninstallKB27979$\4121336045\L\alehhooo

Сетевая активность:

Подключается к:

'50.##.26.230':34354
'72.##.97.217':34354
'81.##3.6.181':34354
'71.##9.219.45':34354
'18#.#.73.121':34354
'17#.#03.14.224':34354
'10#.#.245.148':34354
'20#.#.200.79':34354
'69.##9.5.233':34354
'71.##6.233.119':34354
'24.##7.132.133':34354
'72.##1.78.219':34354
'17#.#18.245.121':34354
'12.##.245.130':34354
'75.##7.123.68':34354
'18#.#2.251.171':34354
'75.##6.72.136':34354
'98.##1.114.233':34354
'71.##9.117.142':34354
'98.##5.128.92':34354
'89.##9.208.102':34354
'68.##.131.47':34354
'50.#.143.196':34354
'76.##5.27.121':34354
'89.#4.58.90':34354
'24.##9.197.52':34354
'28.##0.34.181':34354
'17#.#02.119.164':34354
'79.##.72.206':34354
'76.##1.137.151':34354
'67.##5.38.159':34354
'68.##.233.103':34354
'76.##3.84.89':34354
'76.##9.175.104':34354
'17#.#2.32.74':34354
'76.##1.91.172':34354
'75.#1.79.75':34354
'82.##2.81.41':34354
'98.##2.107.43':34354
'74.##.85.186':34354
'96.#7.68.84':34354
'24.##6.151.192':34354
'15#.#0.96.255':34354
'17#.#8.88.219':34354
'76.##1.210.102':34354
'98.##4.36.38':34354
'18#.#2.62.51':34354
'17#.#1.113.66':34354
'24.##4.83.149':34354
'77.##.115.227':34354
'24.##.124.113':34354
'17#.#17.151.61':34354
'98.##4.188.24':34354
'18#.#87.191.58':34354
'98.##7.159.28':34354
'17#.#8.201.106':34354
'68.##7.34.154':34354
'72.##6.33.158':34354
'24.##7.188.14':34354
'10#.#5.20.154':34354
'68.##6.46.64':34354
'20#.#31.106.105':34354
'68.##1.118.233':34354
'68.#2.0.203':34354
'13#.#12.115.37':34354
'90.##1.68.140':34354
'92.##3.10.40':34354
'67.##.125.215':34354
'71.##.56.173':34354
'17#.#5.120.106':34354
'18#.#6.198.138':34354
'69.##4.91.106':34354
'69.##1.19.95':34354
'10#.#0.249.4':34354
'74.##0.145.17':34354
'71.##6.0.202':34354
'31.##.107.184':34354
'98.##.43.147':34354
'77.##0.174.116':34354
'21#.#31.10.172':34354
'98.##6.219.189':34354
'62.##5.36.107':34354
'50.##.236.51':34354
'20#.#32.251.236':34354
'75.##5.216.129':34354
'17#.#51.184.72':34354
'72.##0.72.69':34354
'98.##4.190.74':34354
'82.##5.224.225':34354
'99.##.202.212':34354
'72.##9.123.182':34354
'67.##9.208.204':34354
'66.##7.150.93':34354
'75.##1.226.120':34354
'68.##.19.132':34354
'98.##7.165.147':34354
'69.##7.6.245':34354
'76.##8.43.69':34354
'68.##2.109.137':34354
'67.##3.112.245':34354
'24.##.82.208':34354
'17#.#2.136.131':34354
'18#.#34.192.211':34354
'21#.#3.216.182':34354
'98.##3.98.254':34354
'24.#.203.209':34354
'98.##7.140.68':34354
'24.##2.71.254':34354
'50.##.92.229':34354
'70.##2.18.108':34354
'17#.#5.78.125':34354
'69.##9.100.125':34354
'18#.#.114.170':34354
'18#.#06.124.193':34354
'76.##.115.84':34354
'75.##3.101.169':34354
'10#.#24.40.155':34354
'74.##9.201.82':34354
'67.##6.241.190':34354
'17#.#09.19.242':34354
'12.##.70.196':34354
'68.##.173.165':34354
'68.##5.183.88':34354
'98.##.187.229':34354
'65.##.188.63':34354
'68.##.17.201':34354
'98.##5.114.61':34354
'13#.#4.241.85':34354
'98.##7.174.108':34354
'71.##.143.115':34354
'65.##.116.205':34354
'87.##5.24.88':34354
'74.##.205.123':34354
'17#.#34.194.111':34354
'24.##2.248.92':34354
'18#.#55.36.163':34354
'70.##2.47.33':34354
'76.##7.12.198':34354
'66.##.26.122':34354
'68.##.244.33':34354
'72.##9.182.133':34354
'10#.#3.94.45':34354
'65.##.210.29':34354
'92.##.207.124':34354
'24.##4.73.166':34354
'66.#.152.157':34354
'68.#.65.89':34354
'68.#05.1.42':34354
'68.##.175.211':34354
'18#.#9.135.91':34354
'70.##0.71.236':34354
'10#.#2.19.186':34354
'71.##.93.250':34354
'17#.#76.232.172':34354
'99.##1.133.232':34354
'20#.#4.180.94':34354
'2.##.205.142':34354
'68.##.21.245':34354
'71.##4.123.69':34354
'15#.#3.219.163':34354
'69.##6.55.99':34354
'75.#4.99.65':34354
'24.##7.217.9':34354
'75.#7.75.56':34354
'68.##2.19.136':34354
'68.##6.246.80':34354
'17#.#16.201.123':34354
'99.##9.172.176':34354
'24.##6.99.136':34354
'98.##9.92.210':34354
'70.##.88.130':34354
'pr####.fling.com':80
'67.##8.235.101':34354
'70.##2.251.158':34354
'74.##6.221.190':34354
'72.##0.53.146':34354
'75.##0.48.42':34354
'18#.#06.255.181':34354
'17#.#5.134.182':34354
'70.##.207.110':34354
'74.##7.242.181':34354
'72.##0.108.66':34354
'63.##8.142.217':34354
'10#.#0.84.11':34354
'71.##4.30.244':34354
'74.#8.91.92':34354
'75.##.179.157':34354
'17#.#86.239.22':34354
'71.##.247.49':34354
'24.##.101.147':34354
'76.##7.251.136':34354
'68.##5.51.190':34354
'12#.#49.71.125':34354
'24.##0.42.130':34354
'75.#4.5.184':34354
'74.##.136.195':34354
'19#.#00.48.129':34354
'94.##1.144.28':34354
'19#.#71.43.77':34354
'68.#.7.131':34354
'68.##9.229.237':34354
'76.##0.155.220':34354
'96.#9.43.22':34354
'98.#16.74.6':34354
'97.##0.4.102':34354
'70.##0.157.185':34354
'74.##6.236.187':34354
'20#.#6.64.68':34354
'97.##4.10.70':34354
'71.##.221.127':34354
'69.##6.74.87':34354
'10#.#3.165.206':34354
'64.##3.190.245':34354
'19#.#8.248.32':34354
'93.#5.33.70':34354
'71.##7.240.10':34354
'68.##.225.63':34354
'98.#3.4.72':34354
'69.##9.110.9':34354
'97.##.192.70':34354
'76.##.206.180':34354
'18#.#76.98.182':34354
'75.##5.195.54':34354
'98.##1.132.73':34354
'76.##8.130.66':34354
'69.##6.219.165':34354
'98.##8.86.165':34354
'78.##1.102.195':34354
'85.##7.138.99':34354
'10#.#4.211.86':34354
'95.##8.71.138':34354
'84.##8.77.61':34354
'74.##.12.147':34354
'67.##2.217.28':34354
'75.##.11.170':34354
'24.##6.142.149':34354
'24.##8.214.126':34354
'84.##2.27.181':34354
'68.##.153.24':34354
'69.##4.114.226':34354
'75.##.14.106':34354
'17#.#68.91.131':34354
'79.##.152.221':34354
'24.#.133.252':34354
'65.##9.57.102':34354
'18#.#9.34.33':34354
'24.##7.158.217':34354
'12#.#25.247.127':34354
'67.##0.64.144':34354
'68.##9.49.189':34354
'77.##.217.138':34354
'70.##1.26.214':34354
'66.##.210.145':34354
'18#.#6.125.11':34354
'76.##4.8.166':34354
'17#.#7.13.16':34354
'19#.#8.85.200':34354

TCP:

Запросы HTTP GET:

pr####.fling.com/geo/txt/city.php

UDP:

DNS ASK pr####.fling.com
'localhost':752
'8.#.8.8':1036

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация