Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001] 'LibraryPath' = 'mswsock.dll'
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003] 'LibraryPath' = 'mswsock.dll'
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008] 'PackedCatalogItem' = ''
Вредоносные функции:
Внедряет код в
следующие системные процессы:
- <SYSTEM32>\cmd.exe
- <SYSTEM32>\services.exe
- %WINDIR%\Explorer.EXE
Изменения в файловой системе:
Создает следующие файлы:
- C:\RECYCLER\S-1-5-18\$2ebe1c2e2a38cb36436c4d1cb8c2630c\n
- %WINDIR%\assembly\GAC\Desktop.ini
- C:\RECYCLER\S-1-5-18\$2ebe1c2e2a38cb36436c4d1cb8c2630c\@
- C:\RECYCLER\S-1-5-21-2052111302-484763869-725345543-1003\$2ebe1c2e2a38cb36436c4d1cb8c2630c\@
- C:\RECYCLER\S-1-5-21-2052111302-484763869-725345543-1003\$2ebe1c2e2a38cb36436c4d1cb8c2630c\n
Самоудаляется.
Сетевая активность:
Подключается к:
- 'localhost':80
- 'pr####.fling.com':80
TCP:
Запросы HTTP GET:
- fo#####-counters.com/5699145-24B8EBEDAA47374020E664A2406FB684/counter.img?th###############################
- pr####.fling.com/geo/txt/city.php
UDP:
- DNS ASK �#��
- DNS ASK �#Z=�
- DNS ASK �#CO�<
- DNS ASK �#o�0
- DNS ASK �#�dXf
- DNS ASK �#ˬ��
- DNS ASK pr####.fling.com
- DNS ASK �#
- DNS ASK �#���
- DNS ASK �#\d�{
- '71.#8.2.92':16471
- '83.##3.238.89':16471
- '17#.#52.51.87':16471
- '98.##.238.96':16471
- '97.#6.8.224':16471
- '19#.#19.105.96':16471
- '10#.#71.66.84':16471
- '24.##7.180.67':16471
- '36.##4.89.230':16471
- '50.#.216.66':16471
- '67.##7.85.77':16471
- '18#.#1.23.75':16471
- '17#.#4.94.70':16471
- '98.##1.191.129':16471
- '71.##9.225.120':16471
- '98.##0.155.120':16471
- '94.##8.237.133':16471
- '79.##6.113.131':16471
- '20#.#05.26.217':16471
- '61.##.130.117':16471
- '76.##.116.109':16471
- '20#.#27.100.103':16471
- '17#.#22.31.97':16471
- '14#.#1.102.219':16471
- '19#.#40.33.114':16471
- '24.##9.146.112':16471
- '98.##8.197.29':16471
- '70.##.198.28':16471
- '76.##4.76.239':16471
- '24.#4.46.37':16471
- '71.##5.115.36':16471
- '13#.#9.197.30':16471
- '98.##3.67.26':16471
- '11#.#4.136.241':16471
- '88.##4.125.243':16471
- '77.##9.248.245':16471
- '12#.#75.7.25':16471
- '67.##5.96.19':16471
- '11#.#30.67.17':16471
- '75.##0.180.231':16471
- '67.##0.68.61':16471
- '2.##9.80.58':16471
- '24.##1.11.231':16471
- '74.##1.161.66':16471
- '76.##9.120.66':16471
- '69.#7.15.57':16471
- '98.##0.53.45':16471
- '17#.#8.196.43':16471
- '17#.#5.96.236':16471
- '74.#61.2.51':16471
- '67.##7.145.50':16471
- '70.##.162.46':16471
