Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'csrss' = '<SYSTEM32>\wbem\csrss.exe'
Вредоносные функции:
Создает и запускает на исполнение:
- '<SYSTEM32>\wbem\csrss.exe'
Запускает на исполнение:
- '<SYSTEM32>\cmd.exe' /c %TEMP%\temp.bat
Изменяет следующие настройки браузера Windows Internet Explorer:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '2500' = '00000003'
Изменения в файловой системе:
Создает следующие файлы:
- <SYSTEM32>\wbem\csrss.exe
- %TEMP%\temp.bat
- <SYSTEM32>\n.ini
- <LS_APPDATA>\n.ini
Самоудаляется.
Сетевая активность:
Подключается к:
- 'localhost':1038
- '20#.#4.117.62':80
- 'localhost':1036
TCP:
Запросы HTTP POST:
- 20#.#4.117.62/server/npopup/upd.php
- 20#.#4.117.62/server/npopup/ins.php
Другое:
Ищет следующие окна:
- ClassName: '220304' WindowName: ''
- ClassName: '220788' WindowName: ''
- ClassName: '221304' WindowName: ''
- ClassName: '218788' WindowName: ''
- ClassName: '219304' WindowName: ''
- ClassName: '219788' WindowName: ''
- ClassName: '221788' WindowName: ''
- ClassName: '223788' WindowName: ''
- ClassName: '224304' WindowName: ''
- ClassName: '224788' WindowName: ''
- ClassName: '222304' WindowName: ''
- ClassName: '222788' WindowName: ''
- ClassName: '223304' WindowName: ''
- ClassName: '213648' WindowName: ''
- ClassName: '214242' WindowName: ''
- ClassName: '214648' WindowName: ''
- ClassName: '212242' WindowName: ''
- ClassName: '212648' WindowName: ''
- ClassName: '213242' WindowName: ''
- ClassName: '215257' WindowName: ''
- ClassName: '217288' WindowName: ''
- ClassName: '217788' WindowName: ''
- ClassName: '218288' WindowName: ''
- ClassName: '215648' WindowName: ''
- ClassName: '216273' WindowName: ''
- ClassName: '216788' WindowName: ''
- ClassName: '233382' WindowName: ''
- ClassName: '233788' WindowName: ''
- ClassName: '234398' WindowName: ''
- ClassName: '231788' WindowName: ''
- ClassName: '232367' WindowName: ''
- ClassName: '232788' WindowName: ''
- ClassName: '234788' WindowName: ''
- ClassName: '236788' WindowName: ''
- ClassName: '237445' WindowName: ''
- ClassName: '237788' WindowName: ''
- ClassName: '235413' WindowName: ''
- ClassName: '235788' WindowName: ''
- ClassName: '236429' WindowName: ''
- ClassName: '226788' WindowName: ''
- ClassName: '227351' WindowName: ''
- ClassName: '227788' WindowName: ''
- ClassName: '225320' WindowName: ''
- ClassName: '225788' WindowName: ''
- ClassName: '226335' WindowName: ''
- ClassName: '228351' WindowName: ''
- ClassName: '230367' WindowName: ''
- ClassName: '230788' WindowName: ''
- ClassName: '231367' WindowName: ''
- ClassName: '228788' WindowName: ''
- ClassName: '229367' WindowName: ''
- ClassName: '229788' WindowName: ''
- ClassName: '211648' WindowName: ''
- ClassName: '193632' WindowName: ''
- ClassName: '194023' WindowName: ''
- ClassName: '194632' WindowName: ''
- ClassName: '191867' WindowName: ''
- ClassName: '192632' WindowName: ''
- ClassName: '193007' WindowName: ''
- ClassName: '195085' WindowName: ''
- ClassName: '197179' WindowName: ''
- ClassName: '197632' WindowName: ''
- ClassName: '198195' WindowName: ''
- ClassName: '195632' WindowName: ''
- ClassName: '196117' WindowName: ''
- ClassName: '196632' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: '157797' WindowName: ''
- ClassName: '106' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: '188507' WindowName: ''
- ClassName: '190632' WindowName: ''
- ClassName: '190757' WindowName: ''
- ClassName: '191632' WindowName: ''
- ClassName: '188523' WindowName: ''
- ClassName: '189632' WindowName: ''
- ClassName: '189695' WindowName: ''
- ClassName: '206632' WindowName: ''
- ClassName: '207226' WindowName: ''
- ClassName: '207632' WindowName: ''
- ClassName: '205226' WindowName: ''
- ClassName: '205632' WindowName: ''
- ClassName: '206226' WindowName: ''
- ClassName: '208226' WindowName: ''
- ClassName: '210226' WindowName: ''
- ClassName: '210648' WindowName: ''
- ClassName: '211242' WindowName: ''
- ClassName: '208632' WindowName: ''
- ClassName: '209226' WindowName: ''
- ClassName: '209648' WindowName: ''
- ClassName: '200195' WindowName: ''
- ClassName: '200632' WindowName: ''
- ClassName: '201195' WindowName: ''
- ClassName: '198632' WindowName: ''
- ClassName: '199195' WindowName: ''
- ClassName: '199632' WindowName: ''
- ClassName: '201632' WindowName: ''
- ClassName: '203632' WindowName: ''
- ClassName: '204226' WindowName: ''
- ClassName: '204632' WindowName: ''
- ClassName: '202210' WindowName: ''
- ClassName: '202632' WindowName: ''
- ClassName: '203226' WindowName: ''
