Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001] 'LibraryPath' = 'mswsock.dll'
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003] 'LibraryPath' = 'mswsock.dll'
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008] 'PackedCatalogItem' = ''
Вредоносные функции:
Внедряет код в
следующие системные процессы:
- <SYSTEM32>\cmd.exe
- <SYSTEM32>\services.exe
- %WINDIR%\Explorer.EXE
Изменения в файловой системе:
Создает следующие файлы:
- C:\RECYCLER\S-1-5-18\$2ebe1c2e2a38cb36436c4d1cb8c2630c\n
- %WINDIR%\assembly\GAC\Desktop.ini
- C:\RECYCLER\S-1-5-18\$2ebe1c2e2a38cb36436c4d1cb8c2630c\@
- C:\RECYCLER\S-1-5-21-2052111302-484763869-725345543-1003\$2ebe1c2e2a38cb36436c4d1cb8c2630c\@
- C:\RECYCLER\S-1-5-21-2052111302-484763869-725345543-1003\$2ebe1c2e2a38cb36436c4d1cb8c2630c\n
Самоудаляется.
Сетевая активность:
Подключается к:
- 'localhost':80
TCP:
Запросы HTTP GET:
- fo#####-counters.com/5699145-24B8EBEDAA47374020E664A2406FB684/counter.img?th###############################
UDP:
- DNS ASK L�#� �
- DNS ASK L�#R��I
- DNS ASK L�#K��{
- DNS ASK L�#g4f�
- DNS ASK L�#��!
- DNS ASK L�#�m�
- DNS ASK j.###mind.com
- DNS ASK L�#ж
- DNS ASK L�#�4��
- DNS ASK L�#T��<
- '71.#6.92.39':16471
- '89.##1.117.228':16471
- '79.##8.234.44':16471
- '95.##9.217.40':16471
- '95.##2.11.37':16471
- '94.##1.75.35':16471
- '46.##4.152.34':16471
- '18#.#4.147.36':16471
- '93.##3.50.36':16471
- '10#.#3.240.46':16471
- '96.##.222.50':16471
- '11#.#1.182.50':16471
- '24.#7.69.56':16471
- '79.##8.192.55':16471
- '17#.#29.9.222':16471
- '11#.#.110.50':16471
- '98.##8.19.47':16471
- '17#.#8.63.223':16471
- '70.##3.145.50':16471
- '24.##.112.33':16471
- '85.##9.142.11':16471
- '21#.#2.124.241':16471
- '18#.#29.189.14':16471
- '20#.#1.53.12':16471
- '98.#28.92.3':16471
- '77.##.220.245':16471
- '95.##.14.248':16471
- '18#.#9.152.1':16471
- '58.##2.197.243':16471
- '68.##6.14.239':16471
- '17#.#79.226.29':16471
- '85.#0.22.29':16471
- '98.##8.196.30':16471
- '18#.#1.35.234':16471
- '18#.#91.12.29':16471
- '24.##1.78.18':16471
- '99.##3.160.236':16471
- '22#.#2.79.28':16471
- '17#.#96.206.18':16471
