Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001] 'LibraryPath' = 'mswsock.dll'
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003] 'LibraryPath' = 'mswsock.dll'
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008] 'PackedCatalogItem' = ''
Вредоносные функции:
Внедряет код в
следующие системные процессы:
- <SYSTEM32>\services.exe
Изменения в файловой системе:
Создает следующие файлы:
- %WINDIR%\Installer\{2ebe1c2e-2a38-cb36-436c-4d1cb8c2630c}\n
- %WINDIR%\assembly\GAC\Desktop.ini
- %WINDIR%\Installer\{2ebe1c2e-2a38-cb36-436c-4d1cb8c2630c}\@
- <LS_APPDATA>\{2ebe1c2e-2a38-cb36-436c-4d1cb8c2630c}\@
- <LS_APPDATA>\{2ebe1c2e-2a38-cb36-436c-4d1cb8c2630c}\n
Присваивает атрибут 'скрытый' для следующих файлов:
- %WINDIR%\Installer\{2ebe1c2e-2a38-cb36-436c-4d1cb8c2630c}\@
- %WINDIR%\Installer\{2ebe1c2e-2a38-cb36-436c-4d1cb8c2630c}\n
- <LS_APPDATA>\{2ebe1c2e-2a38-cb36-436c-4d1cb8c2630c}\@
- <LS_APPDATA>\{2ebe1c2e-2a38-cb36-436c-4d1cb8c2630c}\n
Самоудаляется.
Сетевая активность:
Подключается к:
- '18#.#72.204.122':80
- 'pr####.fling.com':80
TCP:
Запросы HTTP GET:
- 18#.#72.204.122/count.php?id#######################
- 18#.#72.204.122/count.php?id######################
- pr####.fling.com/geo/txt/city.php
- 18#.#72.204.122/count.php?id#####################
UDP:
- DNS ASK �#��;
- DNS ASK �#=|
- DNS ASK �#�W1
- DNS ASK �#�Ya
- DNS ASK �#���
- DNS ASK �#$��
- DNS ASK pr####.fling.com
- DNS ASK �#"W�
- DNS ASK �#�
- '95.##.217.33':16471
- '66.##1.205.27':16471
- '98.##5.11.34':16471
- '12#.#37.31.233':16471
- '12#.#01.89.34':16471
- '42.#.170.27':16471
- '84.##7.248.25':16471
- '21#.#24.218.242':16471
- '83.##.137.240':16471
- '10#.#8.28.27':16471
- '19#.#18.92.240':16471
- '69.##1.10.38':16471
- '70.##7.34.227':16471
- '19#.#13.18.38':16471
- '50.##.114.41':16471
- '89.##0.110.40':16471
- '71.##.230.227':16471
- '18#.#99.43.35':16471
- '97.##.217.34':16471
- '20#.#14.50.231':16471
- '19#.#78.234.35':16471
- '65.##4.63.35':16471
- '75.#1.154.2':16471
- '85.##9.255.255':16471
- '50.##9.20.254':16471
- '22#.10.64.5':16471
- '61.##8.214.3':16471
- '77.##3.255.255':16471
- '25#.#48.255.255':16471
- '25#.#54.255.255':16471
- '17#.#37.255.255':16471
- '11#.#94.255.255':16471
- '0.###.255.255':16471
- '17#.#63.13.19':16471
- '75.##6.182.16':16471
- '89.##.193.21':16471
- '72.##.146.25':16471
- '18#.#5.34.25':16471
- '87.##.225.13':16471
- '75.#5.45.8':16471
- '12.#7.26.7':16471
- '71.##.152.249':16471
- '91.##4.24.249':16471
- '68.##4.120.9':16471
