Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001] 'LibraryPath' = 'mswsock.dll'
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003] 'LibraryPath' = 'mswsock.dll'
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008] 'PackedCatalogItem' = ''
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\.<Служебное имя>] 'ImagePath' = '\?'
Вредоносные функции:
Внедряет код в
следующие системные процессы:
- <SYSTEM32>\cmd.exe
- <SYSTEM32>\winlogon.exe
- %WINDIR%\Explorer.EXE
Изменения в файловой системе:
Создает следующие файлы:
- %WINDIR%\$NtUninstallKB27979$\4121336045\@
- %WINDIR%\$NtUninstallKB27979$\4121336045\L\alehhooo
- %WINDIR%\$NtUninstallKB27979$\4121336045\Desktop.ini
Самоудаляется.
Сетевая активность:
Подключается к:
- '21#.#08.252.185':80
- 'pr####.fling.com':80
TCP:
Запросы HTTP GET:
- 21#.#08.252.185/5699002-2F6F334BF9ACF1B2401D3874A5B0C048/counter.img?th################################
- 21#.#08.252.185/5699002-2F6F334BF9ACF1B2401D3874A5B0C048/counter.img?th###############################
- pr####.fling.com/geo/txt/city.php
UDP:
- DNS ASK �c#7GP
- DNS ASK �c#�/�
- DNS ASK �c#��p
- DNS ASK �c#^�
- DNS ASK �c#Ͼ�
- DNS ASK �c#��y
- DNS ASK �c#�s
- DNS ASK �c#k
- DNS ASK pr####.fling.com
- DNS ASK �c#P�
- DNS ASK �c#(�
- DNS ASK �c#u Y
- '24.#0.66.18':16471
- '24.##6.220.16':16471
- '12#.#37.121.18':16471
- '2.###.51.217':16471
- '17#.#4.84.20':16471
- '75.##8.46.13':16471
- '70.##2.225.223':16471
- '98.##6.123.15':16471
- '17#.#2.85.222':16471
- '68.##.161.222':16471
- '20#.#11.25.27':16471
- '69.##3.125.26':16471
- '70.#5.94.27':16471
- '18#.#13.166.205':16471
- '24.##0.2.206':16471
- '71.##6.137.216':16471
- '12#.#17.84.21':16471
- '92.##.41.215':16471
- '21#.#18.59.23':16471
- '71.##2.162.22':16471
- '11#.#80.225.223':16471
- '65.##.41.233':16471
- '64.##3.49.234':16471
- '17#.#1.4.233':16471
- '98.##8.130.231':16471
- '18#.58.43.3':16471
- '68.##.156.246':16471
- '98.##6.179.249':16471
- '17#.#01.106.246':16471
- '70.##.156.242':16471
- '98.##.165.243':16471
- '68.##7.203.226':16471
- '75.##6.28.11':16471
- '17#.#6.165.12':16471
- '69.##7.38.13':16471
- '21#.#51.21.13':16471
- '69.##7.119.230':16471
- '70.#80.84.3':16471
- '24.#9.42.4':16471
- '71.#5.105.6':16471
- '20#.92.49.5':16471
