Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'SonyAgent' = '<Полный путь к вирусу>'
Вредоносные функции:
Ищет ветки реестра, отвечающие за хранение паролей сторонними программами:
- [<HKLM>\Software\Ghisler\Total Commander]
- [<HKLM>\Software\Ghisler\Windows Commander]
- [<HKCU>\Software\Ghisler\Total Commander]
- [<HKCU>\Software\FlashFXP]
- [<HKLM>\Software\BPFTP]
- [<HKCU>\Software\BPFTP]
- [<HKLM>\Software\FlashFXP]
- [<HKCU>\SOFTWARE\Far\Plugins\FTP\Hosts]
- [<HKCU>\Software\FTPWare\COREFTP\Sites]
- [<HKCU>\SOFTWARE\Microsoft\MessengerService]
- [<HKCU>\SOFTWARE\Far2\Plugins\FTP\Hosts]
- [<HKCU>\Software\Ghisler\Windows Commander]
- [<HKCU>\SOFTWARE\Far2\SavedDialogHistory\FTPHost]
- [<HKCU>\SOFTWARE\Far\SavedDialogHistory\FTPHost]
Изменения в файловой системе:
Создает следующие файлы:
- <DRIVERS>\npf.sys
- <SYSTEM32>\wpcap.dll
- <SYSTEM32>\Packet.dll
Присваивает атрибут 'скрытый' для следующих файлов:
- <Полный путь к вирусу>
Сетевая активность:
Подключается к:
- '93.##.236.122':80
- 'localhost':1127
- 'localhost':1121
- 'localhost':1124
- 'localhost':1133
- '46.##.49.140':80
- 'localhost':1130
- '11#.#65.251.113':80
- '15#.0.54.40':80
- '37.##9.32.27':80
- 'localhost':1109
- '37.##9.186.120':80
- 'localhost':1106
- 'localhost':1115
- 'localhost':1118
- 'localhost':1112
- '20#.#31.57.33':80
- '92.##4.248.164':80
- '18#.#38.154.163':80
- '18#.#6.223.150':80
- '92.##5.133.86':80
- '81.##3.115.103':80
- '20#.#5.231.137':80
- '17#.#50.223.33':80
- '31.##3.65.93':80
- '95.##4.31.69':80
- '46.##1.59.59':80
- '93.##.109.76':80
- '17#.#03.208.159':80
- '93.##5.199.177':80
- '31.##9.110.93':80
- '17#.#65.83.157':80
- '21#.#9.237.39':80
- '87.##4.194.25':80
- 'localhost':1103
- 'localhost':1056
- 'localhost':1059
- 'localhost':1053
- '95.##.141.12':80
- 'localhost':1065
- '91.##6.63.27':80
- '86.##0.243.29':80
- 'localhost':1062
- 'localhost':1050
- 'localhost':1038
- 'localhost':1041
- 'localhost':1035
- '46.##9.178.1':80
- 'localhost':1047
- '17#.#51.63.5':80
- '5.###.86.136':80
- 'localhost':1044
- 'localhost':1089
- '89.##4.116.17':80
- 'localhost':1086
- '12#.6.5.23':80
- '10#.#7.184.14':80
- 'localhost':1098
- 'localhost':1092
- 'localhost':1095
- '89.##0.245.117':80
- '86.##0.126.48':80
- 'localhost':1074
- 'localhost':1068
- 'localhost':1071
- 'localhost':1080
- 'localhost':1082
- 'localhost':1077
- '94.##.68.163':80
TCP:
Запросы HTTP GET:
- 91.##6.63.27/default.htm
- 92.##5.133.86/main.htm
- 92.##5.133.86/setup.htm
- 92.##4.248.164/home.htm
- 92.##4.248.164/search.htm
- 91.##6.63.27/index.htm
- 18#.#6.223.150/index.htm
- 93.##.236.122/index.htm
- 93.##.236.122/search.htm
- 20#.#31.57.33/home.htm
- 18#.#6.223.150/main.htm
- 95.##4.31.69/home.htm
- 95.##4.31.69/index.htm
- 18#.#38.154.163/file.htm
- 11#.#65.251.113/home.htm
- 81.##3.115.103/main.htm
- 81.##3.115.103/default.htm
- 20#.#5.231.137/welcome.htm
- 20#.#5.231.137/file.htm
- 11#.#65.251.113/install.htm
- 31.##3.65.93/install.htm
- 17#.#50.223.33/home.htm
- 17#.#50.223.33/start.htm
- 18#.#38.154.163/index.htm
- 31.##3.65.93/search.htm
- 37.##9.186.120/welcome.htm
- 37.##9.186.120/login.htm
- 46.##1.59.59/setup.htm
- 46.##1.59.59/home.htm
- 93.##5.199.177/install.htm
- 21#.#9.237.39/setup.htm
- 93.##.109.76/search.htm
- 93.##.109.76/online.htm
- 93.##5.199.177/file.htm
- 5.###.86.136/online.htm
- 46.##.49.140/start.htm
- 46.##.49.140/login.htm
- 17#.#03.208.159/online.htm
- 17#.#03.208.159/search.htm
- 5.###.86.136/index.htm
- 21#.#9.237.39/index.htm
- 15#.0.54.40/online.htm
- 15#.0.54.40/file.htm
- 17#.#65.83.157/start.htm
- 20#.#31.57.33/login.htm
- 12#.6.5.23/index.htm
- 12#.6.5.23/start.htm
- 17#.#65.83.157/search.htm
- 87.##4.194.25/online.htm
- 17#.#51.63.5/home.htm
- 17#.#51.63.5/default.htm
- 31.##9.110.93/online.htm
- 31.##9.110.93/login.htm
- 87.##4.194.25/index.htm
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
