Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'NetworkChecker' = '<Полный путь к вирусу>'
Изменения в файловой системе:
Присваивает атрибут 'скрытый' для следующих файлов:
- <Полный путь к вирусу>
Сетевая активность:
Подключается к:
- '95.##.217.53':80
- 'localhost':49201
- '46.##9.216.220':80
- '17#.#8.11.54':80
- '10#.#6.203.54':80
- '93.##.195.54':80
- '37.##5.148.54':80
- '21#.#6.58.220':80
- '17#.#4.203.215':80
- '62.##.46.215':80
- '18#.#90.24.215':80
- '5.###.183.217':80
- '18#.#30.50.220':80
- '93.##.146.219':80
- '46.##8.118.218':80
- '78.##.190.55':80
- '10#.#1.106.62':80
- '17#.#68.25.62':80
- '13#.#49.16.62':80
- '77.##2.209.62':80
- 'localhost':49224
- '27.##7.149.65':80
- '88.##2.158.64':80
- '89.##.221.61':80
- '21#.#9.92.59':80
- '17#.#9.123.57':80
- '61.##.137.56':80
- '10#.#85.66.60':80
- '93.##.153.61':80
- '17#.#51.87.61':80
- '17#.#.226.60':80
- '94.##.14.215':80
- '17#.#4.239.76':80
- '17#.#07.194.76':80
- '46.##9.179.76':80
- '77.##3.46.77':80
- '17#.#37.177.80':80
- '77.##2.88.80':80
- '37.##2.232.78':80
- '46.##8.63.76':80
- '46.##1.226.71':80
- '86.#6.57.71':80
- '17#.#72.198.70':80
- '10#.#7.59.72':80
- '21#.#97.252.74':80
- '18#.#24.89.74':80
- '17#.#37.70.72':80
- '93.##.207.80':80
- '46.##0.92.207':80
- '46.##2.12.207':80
- '21#.#2.210.205':80
- '5.###.103.208':80
- '37.##9.171.213':80
- '93.##.236.212':80
- '10#.#62.19.211':80
- '31.##8.184.205':80
- '77.##3.247.82':80
- '92.##.175.81':80
- '89.##9.116.81':80
- '21#.#11.210.84':80
- '93.##.85.205':80
- '31.##8.75.205':80
- 'localhost':49178
