Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000012] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000015] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000014] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000013] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005] 'PackedCatalogItem' = ''
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\PfService] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- %PROGRAM_FILES%\Pf\PfServer.exe /install /SILENT
- %PROGRAM_FILES%\Pf\PfServer.exe
- %TEMP%\is-RPICF.tmp\Sogou.tmp /SL5="$20136,101351,53248,%PROGRAM_FILES%\SogouExplorer\Sogou.exe"
- %TEMP%\is-PBJUT.tmp\<Имя вируса>.tmp /SL5="$40036,1569065,53248,<Полный путь к вирусу>"
- %PROGRAM_FILES%\SogouExplorer\Sogou.exe
Запускает на исполнение:
- <SYSTEM32>\taskkill.exe /F /im Pf.exe
- <SYSTEM32>\rsvp.exe
- <SYSTEM32>\taskkill.exe /F /im MgIe.exe
- <SYSTEM32>\taskkill.exe /F /im PfServer.exe
Изменения в файловой системе:
Создает следующие файлы:
- %PROGRAM_FILES%\SogouExplorer\is-3PP4M.tmp
- %PROGRAM_FILES%\Pf\unins000.dat
- %TEMP%\is-RPICF.tmp\Sogou.tmp
- %PROGRAM_FILES%\Pf\images\is-UB1O5.tmp
- %PROGRAM_FILES%\Pf\images\is-1SNGH.tmp
- %PROGRAM_FILES%\Pf\images\is-UL33Q.tmp
- %PROGRAM_FILES%\Pf\images\is-MTVHG.tmp
- %TEMP%\is-FTIJ2.tmp\_isetup\_RegDLL.tmp
- %PROGRAM_FILES%\Pf\crsing.dll
- %PROGRAM_FILES%\Pf\SPIS.dll
- %PROGRAM_FILES%\Pf\Ad.ini
- %TEMP%\is-FTIJ2.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-FTIJ2.tmp\ftp.dll
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\GetUserID[1].asp
- %PROGRAM_FILES%\Pf\is-VI031.tmp
- %PROGRAM_FILES%\Pf\is-N6AGJ.tmp
- %PROGRAM_FILES%\Pf\is-NER2M.tmp
- %TEMP%\is-MIFEV.tmp\urlnetGet.dll
- %TEMP%\is-PBJUT.tmp\<Имя вируса>.tmp
- %TEMP%\is-MIFEV.tmp\_isetup\_RegDLL.tmp
- %TEMP%\is-MIFEV.tmp\_isetup\_shfoldr.dll
- %PROGRAM_FILES%\Pf\is-PU44D.tmp
- %PROGRAM_FILES%\Pf\images\is-7KK9I.tmp
- %PROGRAM_FILES%\Pf\images\is-R2EVA.tmp
- %PROGRAM_FILES%\Pf\images\is-1KEIA.tmp
- %PROGRAM_FILES%\Pf\images\is-93TOM.tmp
- %PROGRAM_FILES%\Pf\is-TH8H8.tmp
- %PROGRAM_FILES%\Pf\images\is-2UQ6K.tmp
- %PROGRAM_FILES%\Pf\images\is-454RO.tmp
Удаляет следующие файлы:
- %TEMP%\is-MIFEV.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-PBJUT.tmp\<Имя вируса>.tmp
- %TEMP%\is-MIFEV.tmp\_isetup\_RegDLL.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\GetUserID[1].asp
- %TEMP%\is-MIFEV.tmp\urlnetGet.dll
Сетевая активность:
Подключается к:
- 'any':21000
- 'nh####o.xz19.com':21000
- 'cf.#toot.cn':80
TCP:
Запросы HTTP GET:
- cf.#toot.cn/code/LL_count.asp?TI##########
- cf.#toot.cn/code/LL_count.asp?TI############
- cf.#toot.cn/code/GetUserID.asp
UDP:
- DNS ASK c1.###e.cnnuo.com
- DNS ASK ma##.##rvice.cnnuo.com
- DNS ASK c1.####ice.cnnuo.com
- DNS ASK NH####O.xz19.com
- DNS ASK cf.#toot.cn
- DNS ASK ma##.#yie.cnnuo.com
- 'c1.####ice.cnnuo.com':6743
- 'ma##.##rvice.cnnuo.com':6743
- 'ma##.#yie.cnnuo.com':7788
Другое:
Ищет следующие окна:
- ClassName: 'TT_WebCtrl' WindowName: ''
- ClassName: 'SE_AxControl' WindowName: ''
- ClassName: 'XFrame_Wnd' WindowName: ''
- ClassName: 'Container' WindowName: ''
- ClassName: 'Maxthon2_View' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: '' WindowName: '????'
- ClassName: 'IEFrame' WindowName: ''
- ClassName: 'TCnNuoIEBrowser' WindowName: ''
