Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001] 'LibraryPath' = 'mswsock.dll'
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003] 'LibraryPath' = 'mswsock.dll'
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008] 'PackedCatalogItem' = ''
Вредоносные функции:
Внедряет код в
следующие системные процессы:
- <SYSTEM32>\services.exe
Изменения в файловой системе:
Создает следующие файлы:
- %WINDIR%\Installer\{2ebe1c2e-2a38-cb36-436c-4d1cb8c2630c}\n
- %WINDIR%\assembly\GAC\Desktop.ini
- %WINDIR%\Installer\{2ebe1c2e-2a38-cb36-436c-4d1cb8c2630c}\@
- <LS_APPDATA>\{2ebe1c2e-2a38-cb36-436c-4d1cb8c2630c}\@
- <LS_APPDATA>\{2ebe1c2e-2a38-cb36-436c-4d1cb8c2630c}\n
Присваивает атрибут 'скрытый' для следующих файлов:
- %WINDIR%\Installer\{2ebe1c2e-2a38-cb36-436c-4d1cb8c2630c}\@
- %WINDIR%\Installer\{2ebe1c2e-2a38-cb36-436c-4d1cb8c2630c}\n
- <LS_APPDATA>\{2ebe1c2e-2a38-cb36-436c-4d1cb8c2630c}\@
- <LS_APPDATA>\{2ebe1c2e-2a38-cb36-436c-4d1cb8c2630c}\n
Самоудаляется.
Сетевая активность:
Подключается к:
- '18#.#72.204.122':80
- 'pr####.fling.com':80
TCP:
Запросы HTTP GET:
- 18#.#72.204.122/count.php?id#######################
- 18#.#72.204.122/count.php?id######################
- pr####.fling.com/geo/txt/city.php
- 18#.#72.204.122/count.php?id#####################
UDP:
- DNS ASK �##�C�
- DNS ASK �#�O+(
- DNS ASK �#d�r
- DNS ASK �#���
- DNS ASK �#:�U�
- DNS ASK �#�==
- DNS ASK pr####.fling.com
- DNS ASK �#�do
- DNS ASK �#l�
- '62.##7.212.234':16471
- '92.##9.207.236':16471
- '94.##8.188.234':16471
- '2.###.141.234':16471
- '83.##2.154.234':16471
- '95.##4.216.240':16471
- '17#.#4.101.242':16471
- '84.##.157.240':16471
- '21#.#00.145.239':16471
- '20#.#7.119.240':16471
- '74.##.65.234':16471
- '20#.#12.159.227':16471
- '17#.#19.31.228':16471
- '93.##.115.227':16471
- '69.##4.117.224':16471
- '18#.#46.71.226':16471
- '17#.#75.70.231':16471
- '95.##5.194.231':16471
- '24.##2.236.230':16471
- '67.##4.223.228':16471
- '11#.#2.46.230':16471
- '0.###.255.255':16471
- '32.##0.255.255':16471
- '20#.#94.255.255':16471
- '77.##3.255.255':16471
- '11#.#94.255.255':16471
- '77.##4.255.255':16471
- '25#.#54.255.255':16471
- '25#.#48.255.255':16471
- '21#.#22.255.255':16471
- '17#.#37.255.255':16471
- '85.##9.255.255':16471
- '78.##9.89.246':16471
- '27.##0.223.249':16471
- '17#.#48.163.244':16471
- '20#.#47.219.242':16471
- '18#.#99.145.244':16471
- '12#.#76.255.255':16471
- '21#.#78.255.255':16471
- '31.##6.255.255':16471
- '68.##.40.250':16471
- '12#.#73.255.255':16471
