Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'NetworkChecker' = '<Полный путь к вирусу>'
Вредоносные функции:
Ищет ветки реестра, отвечающие за хранение паролей сторонними программами:
- [<HKCU>\SOFTWARE\Microsoft\MessengerService]
- [<HKLM>\Software\Sota\FFFTP\Options]
- [<HKCU>\Software\Sota\FFFTP\Options]
- [<HKLM>\Software\FTP Explorer\Profiles]
- [<HKCU>\Software\FTP Explorer\Profiles]
- [<HKLM>\Software\BPFTP]
- [<HKCU>\Software\BPFTP]
- [<HKLM>\Software\FlashFXP]
- [<HKCU>\Software\FlashFXP]
- [<HKLM>\Software\Ghisler\Total Commander]
- [<HKLM>\Software\Ghisler\Windows Commander]
- [<HKCU>\Software\Ghisler\Total Commander]
- [<HKCU>\Software\Ghisler\Windows Commander]
- [<HKCU>\SOFTWARE\Far2\SavedDialogHistory\FTPHost]
- [<HKCU>\SOFTWARE\Far\SavedDialogHistory\FTPHost]
- [<HKCU>\SOFTWARE\Far2\Plugins\FTP\Hosts]
- [<HKCU>\SOFTWARE\Far\Plugins\FTP\Hosts]
- [<HKCU>\Software\FTPWare\COREFTP\Sites]
- [<HKCU>\Software\South River Technologies\WebDrive\Connections]
- [<HKLM>\Software\South River Technologies\WebDrive\Connections]
Изменения в файловой системе:
Создает следующие файлы:
- <SYSTEM32>\Packet.dll
- <SYSTEM32>\wpcap.dll
- <DRIVERS>\npf.sys
Присваивает атрибут 'скрытый' для следующих файлов:
- <Полный путь к вирусу>
Сетевая активность:
Подключается к:
- '2.###.232.11':80
- '92.##2.144.204':80
- '11#.#4.57.205':80
- '11#.#51.139.205':80
- '18#.#8.192.207':80
- '21#.#30.43.209':80
- '93.##.160.210':80
- '46.##3.166.211':80
- 'localhost':1078
- '12#.#.12.112':80
- '31.##9.119.112':80
- '15#.#.46.116':80
- '11#.#64.15.117':80
- '17#.#09.173.117':80
- '13#.#49.18.118':80
- '10#.#00.225.119':80
- '93.##.253.120':80
- '94.##3.100.121':80
- '21#.#.46.122':80
- '19#.#06.81.123':80
- '95.##.227.123':80
- '91.##0.183.124':80
- '17#.#06.205.124':80
- '46.##2.248.124':80
- '17#.#8.222.126':80
- '14#.#55.147.127':80
- '83.##3.237.127':80
- '95.##.87.128':80
- '77.##2.48.129':80
- 'localhost':1101
- '5.###.119.204':80
- '5.##.194.39':80
- '20#.#1.170.201':80
- '46.##2.252.199':80
- '46.##.132.12':80
- '21#.#15.158.12':80
- '78.##.222.12':80
- '89.##9.163.13':80
- '46.##4.117.14':80
- '11#.#69.177.14':80
- '94.##1.98.15':80
- '17#.#08.14.16':80
- '15#.0.47.16':80
- '46.##2.231.17':80
- '21#.#16.42.18':80
- '78.##9.73.19':80
- '46.##0.121.19':80
- '93.#7.95.22':80
- '18#.#31.228.24':80
- '31.##.145.26':80
- '10#.#6.76.29':80
- '18#.#30.1.30':80
- '93.##.230.31':80
- 'localhost':1055
- '10#.#62.118.191':80
- '93.##.79.192':80
- '18#.#3.211.192':80
- '77.##.226.193':80
- '77.##1.116.194':80
- '93.##.176.195':80
- '37.##9.51.197':80
- '12#.#4.83.199':80
- '18#.#5.251.199':80
- '21#.#31.18.201':80
- 'localhost':1124
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
