Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'SonyAgent' = '<Полный путь к вирусу>'
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\wsqmcons.exe'
- '<SYSTEM32>\rundll32.exe' dfdts.dll,DfdGetDefaultPolicyAndSMART
- '<SYSTEM32>\schtasks.exe' /delete /f /TN "Microsoft\Windows\Customer Experience Improvement Program\Uploader"
- '<SYSTEM32>\sc.exe' start w32time task_started
- '<SYSTEM32>\sdclt.exe' /CONFIGNOTIFICATION
- '<SYSTEM32>\taskhost.exe' $(Arg0)
Изменения в файловой системе:
Создает следующие файлы:
- C:\ProgramData\Microsoft\RAC\Temp\sqlB117.tmp
- C:\ProgramData\Microsoft\RAC\Temp\sqlB0C8.tmp
Присваивает атрибут 'скрытый' для следующих файлов:
- <Полный путь к вирусу>
Удаляет следующие файлы:
- C:\ProgramData\Microsoft\RAC\Temp\sqlB0C8.tmp
- C:\ProgramData\Microsoft\RAC\Temp\sqlB117.tmp
- <SYSTEM32>\Tasks\Microsoft\Windows Defender\MP Scheduled Scan
Сетевая активность:
Подключается к:
- '91.##7.100.28':80
- '91.##4.168.65':80
- '94.##.106.36':80
- '81.##.191.30':80
- '37.##5.99.25':80
- '31.##9.116.61':80
- '77.##3.75.16':80
- '46.#9.58.51':80
- '31.##3.92.21':80
- '94.##3.80.66':80
- '59.##1.197.26':80
- '18#.#40.254.52':80
- 'localhost':49215
- '10#.#62.44.20':80
- '11#.#52.41.32':80
- '89.##0.227.15':80
- '10#.#51.126.26':80
- '10#.#7.125.18':80
- '91.##4.72.69':80
- '11#.#4.194.60':80
- '17#.#4.98.33':80
- '77.##2.69.16':80
- '17#.#.194.72':80
- '17#.#50.170.64':80
- '19#.#07.132.19':80
- '77.##1.239.59':80
- '17#.#09.232.61':80
- '10#.#54.50.71':80
- '10#.#54.152.65':80
- '18#.#30.9.64':80
- '94.##.120.24':80
- '20#.#47.220.15':80
- '46.##9.85.20':80
- '77.##8.199.45':80
- '78.##.108.48':80
- '94.##4.131.67':80
- '85.##8.81.26':80
- '17#.#60.190.22':80
- 'localhost':49176
- '17#.8.12.7':80
- 'localhost':49173
- '78.##.114.49':80
- 'localhost':49179
- '94.##1.184.135':80
- 'localhost':49185
- '91.##3.34.52':80
- 'localhost':49182
- '46.#11.46.3':80
- 'localhost':49161
- '77.#22.95.5':80
- 'localhost':49158
- '31.##8.186.43':80
- 'localhost':49164
- '98.##6.138.139':80
- 'localhost':49170
- '17#.#50.55.54':80
- 'localhost':49167
- '46.##5.52.95':80
- 'localhost':49206
- '18#.#35.187.14':80
- 'localhost':49203
- '2.###.188.183':80
- 'localhost':49212
- '17#.#.183.82':80
- 'localhost':49209
- '37.#29.8.20':80
- 'localhost':49200
- '18#.#54.163.37':80
- 'localhost':49191
- '93.##3.230.11':80
- 'localhost':49188
- '10#.#7.184.14':80
- 'localhost':49197
- '10#.#6.139.132':80
- 'localhost':49194
- '5.##8.69.50':80
TCP:
Запросы HTTP GET:
- 85.##8.81.26/file.htm
- 77.##8.199.45/install.htm
- 94.##.120.24/install.htm
- 17#.8.12.7/setup.htm
- 78.##.108.48/welcome.htm
- 17#.#60.190.22/index.htm
- 18#.#35.187.14/main.htm
- 77.#22.95.5/setup.htm
- 77.##3.75.16/welcome.htm
- 18#.#30.9.64/home.htm
- 46.##9.85.20/home.htm
- 20#.#47.220.15/main.htm
- 94.##4.131.67/main.htm
- 17#.#09.232.61/main.htm
- 18#.#54.163.37/main.htm
- 17#.#50.170.64/welcome.htm
- 77.##1.239.59/login.htm
- 19#.#07.132.19/home.htm
- 10#.#54.50.71/home.htm
- 77.##2.69.16/home.htm
- 10#.#54.152.65/home.htm
- 10#.#62.44.20/main.htm
- 17#.#4.98.33/welcome.htm
- 11#.#4.194.60/file.htm
- 17#.#.194.72/install.htm
- 11#.#52.41.32/setup.htm
- 5.##8.69.50/welcome.htm
- 17#.#50.55.54/index.htm
- 37.#29.8.20/home.htm
- 91.##4.72.69/online.htm
- 10#.#7.125.18/main.htm
- 18#.#40.254.52/online.htm
- 10#.#7.184.14/install.htm
- 59.##1.197.26/install.htm
- 93.##3.230.11/install.htm
- 31.##8.186.43/install.htm
- 78.##.114.49/home.htm
- 89.##0.227.15/install.htm
- 37.##5.99.25/install.htm
- 46.#11.46.3/install.htm
- 91.##4.168.65/home.htm
- 31.##9.116.61/index.htm
- 31.##3.92.21/file.htm
- 46.#9.58.51/file.htm
- 94.##.106.36/index.htm
- 94.##3.80.66/index.htm
- 10#.#51.126.26/install.htm
- 91.##7.100.28/home.htm
- 81.##.191.30/main.htm
- 91.##3.34.52/setup.htm
UDP:
- DNS ASK ti##.#indows.com
- 'ti##.#indows.com':123
