Для обеспечения автозапуска и распространения:
- Модифицирует следующие ключи реестра:
[<HKLM>\SYSTEM\ControlSet001\Control\Print\Providers\1337204160] 'Name' = '"%TEMP%\srvAD0.tmp"'
- Создает следующие сервисы:
[<HKLM>\SYSTEM\ControlSet001\Services\srvAD0] 'Start' = '00000002'
Вредоносные функции:
Внедряет код в следующие системные процессы:
<SYSTEM32>\spoolsv.exe
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\srvAD0.tmp
- %TEMP%\srvAD0.ini
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\GBA9G3U1\desktop.ini
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\EXQVN7YN\desktop.ini
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\PZR1B3DE\desktop.ini
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\67Q9ATUD\desktop.ini
- %WINDIR%\Temp\2.tmp
- %WINDIR%\Temp\3.tmp
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\GBA9G3U1\X[1]
<SYSTEM32>\a.exe
- %WINDIR%\Temp\4.tmp
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\0J2LM5OP\wpad[1].dat
Присваивает атрибут 'скрытый' для следующих файлов:
- %TEMP%\srvAD0.tmp
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\GBA9G3U1\desktop.ini
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\EXQVN7YN\desktop.ini
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\PZR1B3DE\desktop.ini
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\67Q9ATUD\desktop.ini
Самоперемещается:
из <Полный путь к вирусу> в %TEMP%\1.tmp
Сетевая активность:
Подключается к:
- '19#.#68.190.5':445
- '19#.#68.190.2':445
- '19#.#68.190.12':445
- '19#.#68.190.4':445
- '19#.#68.190.24':445
- '19#.#68.190.30':445
- '19#.#68.190.15':445
- '19#.#68.190.28':445
- '19#.#68.190.27':445
- '19#.#68.190.23':445
- '19#.#68.190.18':445
- '19#.#68.190.29':445
- '19#.#68.190.1':445
- '19#.#68.190.20':445
- '19#.#68.190.21':445
- '19#.#68.190.26':445
- '19#.#68.190.13':445
- '19#.#68.190.25':445
- '19#.#68.190.17':445
- '19#.#68.190.8':445
- '19#.#68.190.7':445
- '19#.#68.190.22':445
- '19#.#68.190.11':445
- '19#.#68.190.6':445
- '19#.#68.190.9':445
- '19#.#68.190.16':445
- '19#.#68.190.14':445
- '19#.#68.190.10':445
- '19#.#68.190.19':445
- '19#.#68.190.3':445
- '19#.#68.190.46':445
- '19#.#68.190.51':445
- '19#.#68.190.35':445
- '19#.#68.190.33':445
- '19#.#68.190.38':445
- '19#.#68.190.45':445
- '19#.#68.190.48':445
- '19#.#68.190.34':445
- '19#.#68.190.32':445
- '19#.#68.190.42':445
- '19#.#68.190.44':445
- '19#.#68.190.37':445
- '19#.#68.190.39':445
- '19#.#68.190.43':445
- '19#.#68.190.40':445
- '19#.#68.190.49':445
- '19#.#68.190.60':445
- '19#.#68.190.55':445
- '19#.#68.190.58':445
- '19#.#68.190.47':445
- '19#.#68.190.64':445
- '19#.#68.190.62':445
- '19#.#68.190.66':445
- '19#.#68.190.56':445
- '19#.#68.190.52':445
- '19#.#68.190.70':445
- '19#.#68.190.80':445
- '19#.#68.190.41':445
- '19#.#68.190.53':445
- '19#.#68.190.71':445
- '19#.#68.190.67':445
- '19#.#68.190.61':445
- '19#.#68.190.69':445
- '19#.#68.190.84':445
- '19#.#68.190.77':445
- '19#.#68.190.92':445
- '19#.#68.190.88':445
- '19#.#68.190.68':445
- '19#.#68.190.74':445
- '19#.#68.190.72':445
- '19#.#68.190.76':445
- '19#.#68.190.78':445
- '19#.#68.190.54':445
- '19#.#68.190.82':445
- '19#.#68.190.87':445
- '19#.#68.190.85':445
- '19#.#68.190.83':445
- '19#.#68.190.81':445
- '19#.#68.190.75':445
- '19#.#68.190.73':445
- '19#.#68.190.63':445
- '19#.#68.190.79':445
- '19#.#68.190.65':445
- '19#.#68.190.59':445
- '19#.#68.190.89':445
- '19#.#68.190.86':445
- '19#.#68.190.90':445
- '19#.#68.190.91':445
- '19#.#68.190.96':445
- '19#.#68.190.94':445
- '19#.#68.190.95':445
- '19#.#68.190.93':445
- '19#.#68.190.100':445
- '19#.#68.190.98':445
- '19#.#68.190.99':445
- '19#.#68.190.113':445
- '19#.#68.190.104':445
- '19#.#68.190.106':445
- '19#.#68.190.110':445
- '19#.#68.190.115':445
- '19#.#68.190.111':445
- '19#.#68.190.107':445
- '19#.#68.190.97':445
- '19#.#68.190.118':445
- '19#.#68.190.120':445
- '19#.#68.190.101':445
- '19#.#68.190.103':445
- '19#.#68.190.105':445
- '19#.#68.190.109':445
- '19#.#68.190.119':445
- '19#.#68.190.114':445
- '19#.#68.190.112':445
- '19#.#68.190.121':445
- '19#.#68.190.117':445
- '19#.#68.190.123':445
- '19#.#68.190.108':445
- '19#.#68.190.125':445
- '19#.#68.190.102':445
- '19#.#68.190.127':445
- '19#.#68.190.116':445
- '19#.#68.190.124':445
- '19#.#68.190.122':445
- '19#.#68.190.126':445
- '19#.#68.190.128':445
- '19#.#68.190.130':445
- '19#.#68.190.137':445
- '19#.#68.190.132':445
- '19#.#68.190.135':445
- '19#.#68.190.143':445
- '19#.#68.190.136':445
- '19#.#68.190.141':445
- '19#.#68.190.140':445
- '19#.#68.190.131':445
- '19#.#68.190.142':445
- '19#.#68.190.129':445
- '19#.#68.190.133':445
- '19#.#68.190.139':445
- '19#.#68.190.145':445
- '19#.#68.190.149':445
- '19#.#68.190.146':445
- '19#.#68.190.144':445
- '19#.#68.190.138':445
- '19#.#68.190.150':445
- '19#.#68.190.147':445
- '19#.#68.190.158':445
- '19#.#68.190.151':445
- '19#.#68.190.153':445
- '19#.#68.190.152':445
- '19#.#68.190.160':445
- '19#.#68.190.156':445
- '19#.#68.190.154':445
- '19#.#68.190.148':445
- '19#.#68.190.163':445
- '19#.#68.190.165':445
- '19#.#68.190.161':445
- '19#.#68.190.155':445
- '19#.#68.190.157':445
- '19#.#68.190.159':445
- '19#.#68.190.167':445
- '19#.#68.190.164':445
- '19#.#68.190.168':445
- '19#.#68.190.170':445
- '19#.#68.190.162':445
- '19#.#68.190.166':445
- '19#.#68.190.173':445
- '19#.#68.190.171':445
- '19#.#68.190.169':445
- '19#.#68.190.175':445
- '19#.#68.190.172':445
- '19#.#68.190.177':445
- '19#.#68.190.203':445
- '19#.#68.190.201':445
- '19#.#68.190.187':445
- '19#.#68.190.179':445
- '19#.#68.190.189':445
- '19#.#68.190.183':445
- '19#.#68.190.181':445
- '19#.#68.190.199':445
- '19#.#68.190.185':445
- '19#.#68.190.191':445
- '19#.#68.190.205':445
- '19#.#68.190.195':445
- '19#.#68.190.197':445
- '19#.#68.190.193':445
- '19#.#68.190.180':445
- '19#.#68.190.182':445
- '19#.#68.190.207':445
- '19#.#68.190.209':445
- '19#.#68.190.192':445
- '19#.#68.190.196':445
- '19#.#68.190.198':445
- '19#.#68.190.211':445
- '19#.#68.190.186':445
- '19#.#68.190.213':445
- '19#.#68.190.227':445
- '19#.#68.190.223':445
- '19#.#68.190.219':445
- '19#.#68.190.221':445
- '19#.#68.190.229':445
- '19#.#68.190.217':445
- '19#.#68.190.218':445
- '19#.#68.190.247':445
- '19#.#68.190.235':445
- '19#.#68.190.208':445
- '19#.#68.190.220':445
- '19#.#68.190.215':445
- '19#.#68.190.225':445
- '19#.#68.190.178':445
- '19#.#68.190.176':445
- '19#.#68.190.239':445
- '19#.#68.190.237':445
- '19#.#68.190.240':445
- '19#.#68.190.214':445
- '19#.#68.190.251':445
- '19#.#68.190.253':445
- '19#.#68.190.249':445
- '19#.#68.190.254':445
- '19#.#68.190.206':445
- '19#.#68.190.212':445
- '19#.#68.190.216':445
- '19#.#68.190.224':445
- '19#.#68.190.226':445
- '19#.#68.190.233':445
- '19#.#68.190.231':445
- '19#.#68.190.252':445
- '19#.#68.190.246':445
- '19#.#68.190.245':445
- '19#.#68.190.228':445
- '19#.#68.190.243':445
- '19#.#68.190.248':445
- '19#.#68.190.241':445
- '19#.#68.190.222':445
- '19#.#68.190.244':445
- '19#.#68.190.250':445
- '19#.#68.190.230':445
- '19#.#68.190.236':445
- '19#.#68.190.234':445
- '19#.#68.190.232':445
- '19#.#68.190.242':445
- '19#.#68.190.238':445
- '19#.#68.190.190':445
- '19#.#68.190.204':445
- '19#.#68.190.202':445
- '19#.#68.190.188':445
- '19#.#68.190.194':445
- '19#.#68.190.184':445
- '19#.#68.190.174':445
- '19#.#68.190.200':445
- '19#.#68.190.210':445
- '19#.#68.190.175':139
- '19#.#68.190.68':139
- '86.##.210.55':80
- '86.##.210.72':80
- '19#.#68.190.2':80
- '19#.#68.190.177':80
- 'localhost':1303
- '19#.#68.190.173':80
- '19#.#68.190.154':80
- '19#.#68.190.68':80
- 'wpad.localdomain':80
TCP:
- Запросы HTTP GET:
- 86.##.210.55/service/scripts/files/aff_50120.dll
- 86.##.210.72//srv
- 86.##.210.72/service/listener.php?af#########
- 86.##.210.72/X
- wpad.localdomain/wpad.dat
UDP:
- DNS ASK wpad.localdomain