Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001] 'LibraryPath' = 'mswsock.dll'
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003] 'LibraryPath' = 'mswsock.dll'
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008] 'PackedCatalogItem' = ''
Вредоносные функции:
Внедряет код в
следующие системные процессы:
- <SYSTEM32>\cmd.exe
- <SYSTEM32>\services.exe
- %WINDIR%\Explorer.EXE
Изменения в файловой системе:
Создает следующие файлы:
- C:\RECYCLER\S-1-5-18\$2ebe1c2e2a38cb36436c4d1cb8c2630c\n
- %WINDIR%\assembly\GAC\Desktop.ini
- C:\RECYCLER\S-1-5-18\$2ebe1c2e2a38cb36436c4d1cb8c2630c\@
- C:\RECYCLER\S-1-5-21-2052111302-484763869-725345543-1003\$2ebe1c2e2a38cb36436c4d1cb8c2630c\@
- C:\RECYCLER\S-1-5-21-2052111302-484763869-725345543-1003\$2ebe1c2e2a38cb36436c4d1cb8c2630c\n
Самоудаляется.
Сетевая активность:
Подключается к:
- '21#.#08.252.185':80
- 'pr####.fling.com':80
TCP:
Запросы HTTP GET:
- 21#.#08.252.185/5699145-24B8EBEDAA47374020E664A2406FB684/counter.img?th###############################
- pr####.fling.com/geo/txt/city.php
UDP:
- DNS ASK ܡc#��w
- DNS ASK ܡc#k�
- DNS ASK ܡc#�
- DNS ASK ܡc#j-
- DNS ASK ܡc#2�
- DNS ASK ܡc#��E
- DNS ASK pr####.fling.com
- DNS ASK ܡc#G�G
- DNS ASK ܡc#��0
- DNS ASK ܡc#2��
- '10#.#5.171.233':16471
- '18#.#94.224.16':16471
- '89.#8.5.233':16471
- '77.##8.136.231':16471
- '78.##1.14.232':16471
- '18#.#67.65.16':16471
- '71.##.160.201':16471
- '94.##6.106.195':16471
- '72.##9.186.25':16471
- '87.#3.36.16':16471
- '69.##.223.203':16471
- '93.##5.65.220':16471
- '74.##0.81.21':16471
- '17#.#8.146.19':16471
- '64.##5.39.217':16471
- '66.##5.71.18':16471
- '67.##3.238.20':16471
- '82.##9.41.208':16471
- '85.##2.145.205':16471
- '37.##5.116.21':16471
- '74.##0.237.20':16471
- '70.##.109.218':16471
- '18#.#60.66.94':16471
- '71.##.124.154':16471
- '10#.#73.242.150':16471
- '18#.#6.213.91':16471
- '24.##.38.171':16471
- '85.##.194.160':16471
- '21#.#41.171.2':16471
- '22#.#09.236.116':16471
- '68.##9.132.107':16471
- '17#.#00.174.131':16471
- '70.##.178.150':16471
- '68.##4.184.148':16471
- '72.##0.158.247':16471
- '18#.#0.74.12':16471
- '5.##.92.190':16471
- '67.##3.60.193':16471
- '17#.#37.119.53':16471
- '98.##7.96.57':16471
- '10#.#8.221.70':16471
- '18#.#7.246.171':16471
- '24.##1.49.177':16471
- '77.##6.177.58':16471
- '18#.#3.74.60':16471
