Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'NetworkChecker' = '<Полный путь к вирусу>'
Вредоносные функции:
Ищет ветки реестра, отвечающие за хранение паролей сторонними программами:
- [<HKLM>\Software\BPFTP]
- [<HKCU>\Software\FTP Explorer\Profiles]
- [<HKCU>\Software\BPFTP]
- [<HKCU>\Software\FlashFXP]
- [<HKLM>\Software\FlashFXP]
- [<HKCU>\Software\South River Technologies\WebDrive\Connections]
- [<HKLM>\Software\South River Technologies\WebDrive\Connections]
- [<HKLM>\Software\Sota\FFFTP\Options]
- [<HKLM>\Software\FTP Explorer\Profiles]
- [<HKCU>\Software\Sota\FFFTP\Options]
- [<HKCU>\SOFTWARE\Far2\Plugins\FTP\Hosts]
- [<HKCU>\SOFTWARE\Far\SavedDialogHistory\FTPHost]
- [<HKCU>\SOFTWARE\Far\Plugins\FTP\Hosts]
- [<HKCU>\SOFTWARE\Microsoft\MessengerService]
- [<HKCU>\Software\FTPWare\COREFTP\Sites]
- [<HKLM>\Software\Ghisler\Windows Commander]
- [<HKLM>\Software\Ghisler\Total Commander]
- [<HKCU>\Software\Ghisler\Total Commander]
- [<HKCU>\SOFTWARE\Far2\SavedDialogHistory\FTPHost]
- [<HKCU>\Software\Ghisler\Windows Commander]
Изменения в файловой системе:
Создает следующие файлы:
- <DRIVERS>\npf.sys
- <SYSTEM32>\wpcap.dll
- <SYSTEM32>\Packet.dll
Присваивает атрибут 'скрытый' для следующих файлов:
- <Полный путь к вирусу>
Сетевая активность:
Подключается к:
- '17#.#50.90.238':80
- '10#.#62.8.239':80
- '46.##1.227.240':80
- '12#.#6.252.236':80
- '10#.#08.244.234':80
- '19#.#22.245.234':80
- '31.##9.0.236':80
- '93.##0.192.180':80
- '95.##.234.23':80
- '94.##3.101.24':80
- '79.##6.120.27':80
- '17#.#37.82.19':80
- '11#.#9.60.15':80
- '37.##4.192.15':80
- '21#.#16.42.18':80
- '88.##2.3.224':80
- '42.#.135.225':80
- '90.##7.113.226':80
- '11#.#05.165.222':80
- '46.##1.225.204':80
- 'localhost':1102
- '77.##0.135.222':80
- '15#.#24.116.226':80
- '18#.#98.45.232':80
- '94.##3.118.232':80
- '70.##4.17.233':80
- '17#.#03.213.230':80
- '18#.#0.93.228':80
- '59.##2.169.229':80
- '15#.#24.98.230':80
- '91.##1.182.129':80
- '21#.#31.43.207':80
- '11#.#37.112.93':80
- '10#.#6.179.129':80
- '89.##4.57.44':80
- '72.##9.149.97':80
- '62.##.253.122':80
- '14.##8.120.131':80
- '46.##9.241.163':80
- '11#.#34.247.127':80
- '21#.#.148.155':80
- '18#.#38.154.163':80
- '60.##1.126.176':80
- '95.##1.251.179':80
- '11#.#44.92.155':80
- '18#.#90.18.34':80
- '5.###.209.35':80
- 'localhost':1158
- '17#.#51.137.32':80
- '10#.#6.76.29':80
- '21#.#36.119.31':80
- '37.##9.184.31':80
- '11#.#4.117.241':80
- '17#.#14.146.35':80
- '17#.#94.6.36':80
- '94.##3.58.39':80
- '10#.94.3.35':80
- '77.##1.88.249':80
- '21#.#60.38.252':80
- '94.##8.18.253':80
- '93.##.95.203':80
- '1.###.173.153':80
- 'localhost':1056
- '10#.87.8.45':80
- '46.##7.81.153':80
- '37.##5.4.151':80
- '15#.#24.2.152':80
- '21#.#67.29.152':80
- '92.##5.41.45':80
- '37.##5.161.48':80
- '10#.#.163.48':80
- '46.##8.139.50':80
- '10#.#6.129.47':80
- '5.###.157.45':80
- '17#.#18.42.47':80
- '46.##0.108.47':80
- '5.###.94.137':80
- '17#.#09.243.137':80
- '17#.#2.174.138':80
- '37.##4.132.135':80
- '17#.#.143.131':80
- '17#.#50.202.131':80
- '77.##1.117.132':80
- '17#.#0.55.140':80
- '17#.#37.97.146':80
- '46.##8.30.150':80
- '17#.#4.198.150':80
- '11#.#18.101.145':80
- '11#.#7.124.142':80
- '1.###.136.142':80
- '42.##7.250.142':80
- '37.##5.7.188':80
- '27.#.37.188':80
- '37.##9.24.189':80
- '59.##1.196.187':80
- '17#.#80.37.183':80
- '12#.#65.38.183':80
- '37.##9.119.183':80
- '77.##2.110.189':80
- '91.##0.180.202':80
- '37.##.41.203':80
- '77.##1.93.203':80
- '21#.#.196.201':80
- '14#.#01.16.190':80
- '93.##.13.192':80
- '12#.#0.198.197':80
- '20#.#03.39.57':80
- '17#.#37.106.57':80
- '81.##.128.57':80
- '19#.#11.252.56':80
- '31.##9.22.51':80
- '46.##9.158.51':80
- '17#.#33.110.56':80
- '91.##4.73.60':80
- '77.##2.240.180':80
- '87.##7.58.182':80
- '37.##9.108.182':80
- 'localhost':1079
- '46.##.240.64':80
- '10#.#39.37.67':80
- '11#.#8.37.68':80
TCP:
Запросы HTTP GET:
- 21#.#.148.155/file.htm
- 60.##1.126.176/default.htm
- 11#.#37.112.93/search.htm
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
