Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'SonyAgent' = '<Полный путь к вирусу>'
Вредоносные функции:
Ищет ветки реестра, отвечающие за хранение паролей сторонними программами:
- [<HKLM>\Software\Ghisler\Total Commander]
- [<HKLM>\Software\Ghisler\Windows Commander]
- [<HKCU>\Software\Ghisler\Total Commander]
- [<HKCU>\Software\FlashFXP]
- [<HKLM>\Software\BPFTP]
- [<HKCU>\Software\BPFTP]
- [<HKLM>\Software\FlashFXP]
- [<HKCU>\SOFTWARE\Far\Plugins\FTP\Hosts]
- [<HKCU>\Software\FTPWare\COREFTP\Sites]
- [<HKCU>\SOFTWARE\Microsoft\MessengerService]
- [<HKCU>\SOFTWARE\Far2\Plugins\FTP\Hosts]
- [<HKCU>\Software\Ghisler\Windows Commander]
- [<HKCU>\SOFTWARE\Far2\SavedDialogHistory\FTPHost]
- [<HKCU>\SOFTWARE\Far\SavedDialogHistory\FTPHost]
Изменения в файловой системе:
Создает следующие файлы:
- <DRIVERS>\npf.sys
- <SYSTEM32>\Packet.dll
- <SYSTEM32>\wpcap.dll
Присваивает атрибут 'скрытый' для следующих файлов:
- <Полный путь к вирусу>
Сетевая активность:
Подключается к:
- '21#.#0.192.118':80
- '17#.#68.31.97':80
- '77.##1.91.98':80
- '79.##9.95.69':80
- '93.##.123.52':80
- '77.##.107.109':80
- '2.###.110.35':80
- '17#.#51.144.73':80
- '20#.#25.70.75':80
- 'localhost':1107
- '77.##1.126.81':80
- '85.##0.26.13':80
- 'localhost':1105
- '93.##.75.115':80
- '94.##3.63.54':80
- '87.##4.194.25':80
- '21#.#31.14.18':80
- '17#.#0.69.110':80
- '17#.#6.77.77':80
- '78.##.212.27':80
- '22#.#27.3.92':80
- '31.##.247.31':80
- '93.#9.59.34':80
- '17#.#58.186.24':80
- '95.##4.67.50':80
- '46.##8.93.49':80
- '46.#50.7.69':80
- '10#.#7.138.117':80
- '2.##3.6.57':80
- '17#.#0.237.24':80
- '77.##3.42.134':80
- '46.##9.105.136':80
- '79.##3.103.26':80
- '89.#8.52.30':80
- 'localhost':1102
- 'localhost':1057
- 'localhost':1060
- 'localhost':1054
- '46.#3.55.77':80
- 'localhost':1066
- '12#.6.5.23':80
- '37.##9.59.207':80
- 'localhost':1063
- 'localhost':1051
- 'localhost':1039
- 'localhost':1042
- 'localhost':1036
- '62.#4.37.48':80
- 'localhost':1048
- '89.##1.23.32':80
- '86.##0.126.48':80
- 'localhost':1045
- 'localhost':1092
- '77.##3.11.176':80
- 'localhost':1087
- 'localhost':1090
- 'localhost':1099
- '17#.#51.180.55':80
- 'localhost':1095
- '10#.#7.184.14':80
- '10#.#7.154.64':80
- '77.##6.132.22':80
- 'localhost':1075
- 'localhost':1069
- 'localhost':1072
- 'localhost':1081
- 'localhost':1084
- 'localhost':1078
- '31.##6.66.71':80
TCP:
Запросы HTTP GET:
- 46.##8.93.49/setup.htm
- 46.##9.105.136/install.htm
- 77.##3.42.134/search.htm
- 22#.#27.3.92/index.htm
- 22#.#27.3.92/start.htm
- 78.##.212.27/setup.htm
- 77.##3.42.134/default.htm
- 10#.#7.138.117/start.htm
- 46.#50.7.69/main.htm
- 17#.#0.237.24/start.htm
- 89.#8.52.30/index.htm
- 79.##3.103.26/index.htm
- 79.##3.103.26/file.htm
- 31.##.247.31/install.htm
- 31.##.247.31/search.htm
- 17#.#58.186.24/index.htm
- 10#.#7.154.64/main.htm
- 10#.#7.154.64/search.htm
- 93.#9.59.34/index.htm
- 17#.#58.186.24/home.htm
- 86.##0.126.48/default.htm
- 17#.#0.69.110/setup.htm
- 12#.6.5.23/file.htm
- 17#.#6.77.77/online.htm
- 17#.#6.77.77/search.htm
- 86.##0.126.48/install.htm
- 77.##1.91.98/start.htm
- 77.##1.91.98/login.htm
- 20#.#25.70.75/default.htm
- 21#.#0.192.118/start.htm
- 21#.#0.192.118/login.htm
- 79.##9.95.69/default.htm
- 94.##3.63.54/setup.htm
- 21#.#31.14.18/login.htm
- 87.##4.194.25/login.htm
- 77.##1.126.81/home.htm
- 94.##3.63.54/login.htm
- 93.##.75.115/index.htm
- 21#.#31.14.18/default.htm
- 77.##.107.109/install.htm
- 93.##.123.52/start.htm
- 93.##.123.52/file.htm
- 2.##3.6.57/setup.htm
- 2.##3.6.57/online.htm
- 77.##.107.109/online.htm
- 17#.#51.144.73/online.htm
- 2.###.110.35/file.htm
- 17#.#68.31.97/default.htm
- 17#.#68.31.97/online.htm
- 17#.#51.144.73/setup.htm
- 31.##6.66.71/setup.htm
- 2.###.110.35/setup.htm
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
