Техническая информация
Для обеспечения автозапуска и распространения
Модифицирует следующие ключи реестра
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'NetworkSaver' = '<Полный путь к файлу>'
Вредоносные функции
Ищет ветки реестра, отвечающие за хранение паролей сторонними программами
- [HKCU\SOFTWARE\Ghisler\Total Commander]
- [HKLM\Software\Wow6432Node\BPFTP]
- [HKCU\Software\BPFTP]
- [HKLM\Software\Wow6432Node\FlashFXP]
- [HKCU\Software\FlashFXP]
- [HKLM\Software\Wow6432Node\SimonTatham\PuTTY\Sessions]
- [HKCU\Software\SimonTatham\PuTTY\Sessions]
- [HKCU\Software\Cryer\WebSitePublisher]
- [HKCU\Software\LinasFTP\Site Manager]
- [HKLM\Software\Wow6432Node\NCH Software\Fling\Accounts]
- [HKCU\Software\NCH Software\Fling\Accounts]
- [HKLM\Software\Wow6432Node\NCH Software\ClassicFTP\FTPAccounts]
- [HKCU\Software\NCH Software\ClassicFTP\FTPAccounts]
- [HKLM\SOFTWARE\Wow6432Node\Robo-FTP 3.7\FTPServers]
- [HKCU\SOFTWARE\Robo-FTP 3.7\FTPServers]
- [HKLM\Software\Wow6432Node\FlashPeak\BlazeFtp\Settings]
- [HKCU\Software\FlashPeak\BlazeFtp\Settings]
- [HKLM\Software\Wow6432Node\Ghisler\Total Commander]
- [HKLM\Software\Wow6432Node\Ghisler\Windows Commander]
- [HKCU\Software\Ghisler\Windows Commander]
- [HKCU\SOFTWARE\Far2\SavedDialogHistory\FTPHost]
- [HKCU\SOFTWARE\Far\SavedDialogHistory\FTPHost]
- [HKCU\SOFTWARE\Far2\Plugins\FTP\Hosts]
- [HKCU\SOFTWARE\Far\Plugins\FTP\Hosts]
- [HKCU\Software\FTPWare\COREFTP\Sites]
- [HKLM\Software\Wow6432Node\Martin Prikryl]
- [HKCU\Software\Martin Prikryl]
- [HKCU\SOFTWARE\Microsoft\Windows Mail]
- [HKCU\Software\TurboFTP]
- [HKLM\Software\Wow6432Node\TurboFTP]
Читает файлы, отвечающие за хранение паролей сторонними программами
- %APPDATA%\mozilla\firefox\profiles.ini
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %LOCALAPPDATA%\google\chrome\user data\default\login data
Изменения в файловой системе
Присваивает атрибут 'скрытый' для следующих файлов
- <Полный путь к файлу>
Сетевая активность
Подключается к
- '62.##.178.86':80
- '14#.#0.94.82':80
- '31.##.187.85':80
- '89.##5.128.86':80
- '5.###.133.111':80
- '10#.#60.120.112':80
- '37.##0.101.113':80
- '46.##7.80.82':80
- '94.##4.84.82':80
- '77.##3.33.114':80
- '17#.#09.173.117':80
- '22#.#8.254.118':80
- '18#.#37.108.119':80
- '93.##.253.120':80
- '19#.#3.161.121':80
- '93.##7.178.124':80
- '21#.#7.119.115':80
- '11#.#64.15.117':80
- '18#.#90.5.82':80
- '58.#.136.110':80
- '17#.#58.80.108':80
- '37.##2.228.88':80
- '91.##4.233.88':80
- '46.#11.1.91':80
- '85.##1.73.91':80
- '11#.#54.115.92':80
- '19#.#3.227.92':80
- '17#.#17.76.93':80
- '46.##8.231.86':80
- '95.##.202.94':80
- '19#.#42.125.95':80
- '11#.#7.18.97':80
- '10#.#62.50.98':80
- '21#.#0.67.98':80
- '18#.#1.162.103':80
- '11#.#37.175.104':80
- '31.##2.206.105':80
- '94.##3.69.95':80
- '17#.#.199.126':80
- '17#.#24.26.127':80
