Win32.HLLW.Autoruner1.15065

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001] 'LibraryPath' = 'mswsock.dll'
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003] 'LibraryPath' = 'mswsock.dll'
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008] 'PackedCatalogItem' = ''

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\.redbook] 'ImagePath' = '\?'

Вредоносные функции:

Внедряет код в

следующие системные процессы:

<SYSTEM32>\winlogon.exe
%WINDIR%\Explorer.EXE

Изменения в файловой системе:

Создает следующие файлы:

%WINDIR%\$NtUninstallKB27979$\4121336045\@
%WINDIR%\$NtUninstallKB27979$\4121336045\cfg.ini
%WINDIR%\$NtUninstallKB27979$\4121336045\Desktop.ini
%WINDIR%\$NtUninstallKB27979$\4121336045\L\alehhooo

Сетевая активность:

Подключается к:

'68.##.115.126':34354
'69.##8.71.155':34354
'20#.#4.248.73':34354
'13#.#0.117.6':34354
'10#.#28.163.171':34354
'75.##8.20.202':34354
'11#.#1.114.209':34354
'20#.#4.128.241':34354
'93.##8.89.82':34354
'19#.#6.200.97':34354
'20#.#2.170.163':34354
'20#.#41.197.193':34354
'68.##.76.213':34354
'19#.#.159.205':34354
'66.##1.18.247':34354
'41.##.135.230':34354
'18#.#29.192.49':34354
'10#.#37.41.6':34354
'18#.#7.137.56':34354
'67.##.113.180':34354
'71.#4.23.47':34354
'17#.#49.82.153':34354
'41.##4.153.222':34354
'37.#5.43.76':34354
'24.##.177.189':34354
'24.#.212.160':34354
'76.#08.1.64':34354
'93.##.218.76':34354
'67.##7.76.184':34354
'69.##4.194.254':34354
'18#.#5.104.218':34354
'92.#8.10.80':34354
'17#.#01.231.251':34354
'11#.#04.9.182':34354
'78.#30.0.15':34354
'18#.#4.87.174':34354
'62.##9.149.231':34354
'10#.#11.17.245':34354
'24.##.117.192':34354
'41.##1.168.99':34354
'18#.#5.143.171':34354
'78.##7.34.160':34354
'90.##4.169.77':34354
'19#.#0.37.154':34354
'21#.#9.23.88':34354
'18#.#80.164.58':34354
'11#.#19.186.239':34354
'94.##1.225.8':34354
'20#.#48.33.67':34354
'24.##8.133.9':34354
'24.##.100.111':34354
'10#.#00.240.139':34354
'24.##7.86.27':34354
'18#.#95.231.191':34354
'94.##6.130.29':34354
'71.##.56.173':34354
'74.##.100.211':34354
'97.##.120.17':34354
'10#.#3.211.179':34354
'20#.#5.6.117':34354
'82.##6.109.28':34354
'76.##.213.173':34354
'75.##.238.219':34354
'92.##5.143.129':34354
'93.##.122.56':34354
'66.##8.253.37':34354
'93.##6.233.64':34354
'87.##.27.239':34354
'74.##.64.151':34354
'95.##1.204.42':34354
'24.##9.221.195':34354
'19#.#2.198.147':34354
'19#.#63.167.179':34354
'46.##.89.112':34354
'82.##5.201.186':34354
'82.##.110.229':34354
'67.##9.160.133':34354
'18#.#86.85.106':34354
'18#.#8.187.63':34354
'69.##3.153.81':34354
'18#.#1.167.186':34354
'78.##.38.128':34354
'46.##0.241.244':34354
'11#.#49.82.202':34354
'98.##.220.241':34354
'15#.#1.105.246':34354
'24.##.176.251':34354
'24.##7.180.184':34354
'67.##2.110.164':34354
'24.#.200.185':34354
'41.##8.46.13':34354
'18#.#68.64.11':34354
'11#.#35.92.127':34354
'24.##.37.218':34354
'95.##6.133.208':34354
'71.##7.223.64':34354
'46.##9.49.11':34354
'20#.#34.164.28':34354
'69.##3.70.199':34354
'19#.#07.99.36':34354
'10#.#89.214.64':34354
'20#.#.100.177':34354
'89.##.151.226':34354
'59.##0.241.173':34354
'18#.#4.45.151':34354
'94.##9.85.135':34354
'10.##5.77.163':34354
'20#.#04.190.138':34354
'31.##3.84.106':34354
'19#.#00.2.196':34354
'37.##4.187.26':34354
'98.##5.138.233':34354
'2.###.10.199':34354
'21#.#48.105.12':34354
'18#.#.64.163':34354
'19#.#5.235.6':34354
'24.##0.84.180':34354
'10#.#4.236.79':34354
'18#.#45.143.155':34354
'69.#23.29.6':34354
'70.##0.74.113':34354
'67.##1.104.35':34354
'87.##0.120.204':34354
'17#.#9.145.29':34354
'89.##.194.212':34354
'24.#.57.110':34354
'87.#.243.13':34354
'78.#5.38.60':34354
'79.##0.88.145':34354
'80.##.151.14':34354
'95.##1.36.111':34354
'16#.#6.175.54':34354
'74.##.149.68':34354
'24.##.63.120':34354
'89.##9.150.164':34354
'24.##8.42.160':34354
'91.##.68.142':34354
'95.##.39.150':34354
'66.##.189.139':34354
'20#.#11.141.198':34354
'69.##9.78.232':34354
'66.##9.172.252':34354
'21#.#11.67.109':34354
'78.##.250.79':34354
'82.#9.213.3':34354
'97.#5.48.91':34354
'46.##8.162.9':34354
'19#.#00.11.225':34354
'17#.#8.97.90':34354
'76.##.107.162':34354
'37.##.227.165':34354
'69.##0.207.88':34354
'62.##1.107.207':34354
'97.##.187.108':34354
'93.##.15.172':34354
'18#.74.6.68':34354
'87.#28.2.73':34354
'74.##9.5.224':34354
'79.##6.164.99':34354
'10#.#85.58.188':34354
'72.##8.107.67':34354
'15#.#8.174.226':34354
'79.##6.37.56':34354
'81.##2.50.29':34354
'50.#36.8.81':34354
'93.##.92.251':34354
'85.##4.112.29':34354
'10#.#84.34.27':34354
'24.##6.12.196':34354
'67.##2.167.246':34354
'17#.#08.38.75':34354
'pr####.fling.com':80
'17#.#2.190.142':80
'17#.#7.137.67':34354
'24.##4.127.116':34354
'41.##.136.207':34354
'17#.#17.171.201':34354
'65.##.152.160':34354
'46.##3.152.122':34354
'11#.#2.137.3':34354
'80.##.11.118':34354
'99.##.18.104':34354
'18#.#15.54.30':34354
'12#.#01.206.7':34354
'94.##.76.210':34354
'18#.#84.15.213':34354
'86.##7.38.66':34354
'18#.#0.52.64':34354
'71.##8.184.36':34354
'19#.#00.140.112':34354
'74.##3.91.240':34354
'72.##8.156.173':34354
'18#.#0.25.98':34354
'68.#.220.115':34354
'18#.#52.73.175':34354
'90.#53.28.6':34354
'18#.#0.201.115':34354
'87.##8.88.155':34354
'15#.#7.237.98':34354
'17#.#37.86.114':34354
'72.##2.243.42':34354
'78.##9.140.180':34354
'75.##1.8.167':34354
'20#.#.252.27':34354
'67.##4.32.77':34354
'87.#.250.75':34354
'10#.#2.216.100':34354
'10.##5.62.215':34354
'69.##0.42.222':34354
'90.##4.14.231':34354
'99.##3.234.60':34354
'46.##.121.18':34354
'37.##.224.148':34354
'21#.#48.180.68':34354
'67.##1.41.226':34354
'24.##.254.97':34354
'67.##7.25.128':34354
'92.##.112.247':34354
'76.##3.112.114':34354
'74.#0.94.63':34354
'82.##.178.202':34354
'76.##6.157.204':34354
'72.##4.73.16':34354
'75.##4.253.174':34354
'71.##5.15.215':34354
'11#.#3.56.160':34354
'85.##5.100.254':34354
'2.##.63.79':34354
'18#.#4.158.132':34354
'24.##.125.87':34354
'92.##5.213.185':34354
'17#.#02.48.197':34354
'69.##3.254.46':34354
'20#.#05.24.154':34354
'68.##.152.144':34354
'91.##7.60.22':34354
'85.##5.151.127':34354
'98.##6.116.67':34354
'77.##6.188.170':34354
'16#.#84.204.41':34354
'20#.#1.103.91':34354
'17#.#16.48.245':34354
'16#.#9.209.248':34354
'46.##.28.122':34354
'46.##3.25.213':34354
'62.##5.192.165':34354
'20#.7.73.32':34354
'17#.#8.181.84':34354
'69.##8.233.63':34354
'69.##5.142.212':34354
'13#.#88.203.148':34354
'14#.#33.36.52':34354
'13#.#43.249.35':34354
'69.##8.82.155':34354
'41.##.213.188':34354
'17#.#5.226.222':34354
'92.##0.83.218':34354
'94.##4.171.197':34354

TCP:

Запросы HTTP GET:

17#.#2.190.142/stat2.php?w=#############################################
17#.#2.190.142/stat2.php?w=############################################
pr####.fling.com/geo/txt/city.php

UDP:

DNS ASK z#zhK
DNS ASK z#@�}
DNS ASK z#�Vl
DNS ASK z#�1��
DNS ASK z#��iT
DNS ASK z#,�N�
DNS ASK z#ў�
DNS ASK z##*�
DNS ASK z#�$z'
DNS ASK z# ?�F
DNS ASK pr####.fling.com
DNS ASK z#M�t
DNS ASK z#u��
DNS ASK z#�s̒
DNS ASK z#�<
'8.#.8.8':1035

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация