Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'explorer.exe' = '%APPDATA%\explorer.exe'
Вредоносные функции:
Для затруднения выявления своего присутствия в системе
блокирует отображение:
- скрытых файлов
Изменения в файловой системе:
Создает следующие файлы:
- %APPDATA%\explorer.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- %APPDATA%\explorer.exe
Сетевая активность:
Подключается к:
- '72.##3.225.40':3389
- '18#.#78.115.48':3389
- '81.##.86.137':3389
- '88.##.168.21':3389
- '15#.#8.76.46':3389
- '95.##5.96.116':3389
- '18#.#18.112.244':3389
- '25#.#43.12.194':3389
- '59.##2.142.118':3389
- '21#.#94.138.238':3389
- '26.##5.12.163':3389
- '64.##3.141.155':3389
- '20#.#1.145.109':3389
- '27.##.100.114':3389
- '15#.#77.71.135':3389
- '73.##1.58.246':3389
- '19#.#16.29.80':3389
- '16#.#9.81.181':3389
- '21#.#.233.122':3389
- '12#.#79.29.36':3389
- '16#.#81.162.219':3389
- '12#.#8.123.49':3389
- '20#.#51.52.96':3389
- '88.##3.7.101':3389
- '11#.#.32.126':3389
- '22#.#22.153.247':3389
- '11#.#17.191.81':3389
- '83.##8.175.182':3389
- '22#.#.82.213':3389
- '12#.#09.133.60':3389
- '16#.#07.7.239':3389
- '20#.#9.217.50':3389
- '56.##.139.22':3389
- '10#.#60.30.30':3389
- '60.##.50.107':3389
- '17#.#3.195.115':3389
- '68.##8.233.203':3389
- '21#.#02.58.233':3389
- '11#.#2.29.254':3389
- '17#.#6.184.17':3389
- '23#.#6.3.147':3389
- '20#.#04.55.62':3389
- '18#.#03.184.241':3389
- '12#.#8.227.72':3389
- '10#.#14.101.252':3389
- '97.##0.111.124':3389
- '21#.#52.59.197':3389
- '36.##.204.205':3389
- '16#.#07.175.226':3389
- '11#.#49.112.200':3389
- '15#.#83.244.127':3389
- '20#.#94.132.132':3389
- '19#.#21.202.5':3389
- '24#.#33.90.10':3389
- '14#.#3.60.31':3389
- '14#.#08.158.171':3389
- '35.#8.129.5':3389
- '17#.#56.180.107':3389
- '96.##.103.153':3389
- '64.##0.154.255':3389
- '44.##4.31.182':3389
- '81.##.241.87':3389
- '12#.#31.118.14':3389
- '17#.#42.5.19':3389
- '16#.#4.76.146':3389
- '49.##.218.151':3389
- '17#.#21.189.240':3389
- '12#.#6.47.142':3389
- '25#.#12.18.163':3389
- '21#.#20.70.77':3389
- '67.##.231.108':3389
- '35.#.28.209':3389
- '75.#.160.137':3389
- '21#.#57.58.34':3389
- '17#.#19.19.63':3389
- '22#.#30.229.255':3389
- '12#.#25.200.89':3389
- '10#.#69.187.200':3389
- '23#.#.158.221':3389
- '19#.#85.209.68':3389
- '76.##7.242.212':3389
- '44.##8.38.59':3389
- '25#.#09.103.241':3389
- '90.##6.251.191':3389
- '13#.#0.61.118':3389
- '18#.#59.16.123':3389
- '10#.#19.100.157':3389
- '21#.#30.242.162':3389
- '11#.#26.26.251':3389
- '32.##9.200.39':3389
- '15#.#.239.128':3389
- '12#.#85.222.230':3389
- '47.##.116.99':3389
- '24#.#56.167.13':3389
- '55.##7.232.195':3389
- '24#.#46.10.97':3389
- '59.##.142.25':3389
- '15#.#07.77.78':3389
- '23#.#55.68.51':3389
- '30.##3.185.31':3389
- '18#.#6.121.84':3389
- '11#.#84.202.216':3389
- '61.##.144.27':3389
- '55.##0.225.225':3389
- '16#.#75.243.226':3389
- '96.##9.83.110':3389
- '10#.#06.180.70':3389
- '19#.#.106.46':3389
- '21#.#46.140.203':3389
- '69.##.66.179':3389
- '16#.#01.2.46':3389
- '98.#4.99.25':3389
- '13#.#6.231.208':3389
- '19#.#0.121.216':3389
- '18#.#7.189.85':3389
- '69.##9.79.93':3389
- '19#.#21.47.179':3389
- '14#.#2.163.83':3389
- '11#.#27.27.253':3389
- '13#.#0.138.226':3389
- '84.##3.157.46':3389
- '52.##3.141.148':3389
- '32.#7.18.75':3389
- '11#.#1.42.99':3389
- '21#.#40.221.23':3389
- '16#.#42.254.106':3389
- '19#.#27.115.85':3389
- '15#.#42.86.180':3389
- '18#.#24.199.88':3389
- '22#.#6.141.148':3389
- '28.##4.27.78':3389
- '92.##.253.99':3389
- 'localhost':1033
- '72.##9.70.90':3389
- '19#.#0.102.172':3389
- '21#.#13.150.83':3389
- '23#.#9.83.221':3389
- '16#.#27.164.97':3389
- '17#.#93.6.57':3389
- '48.##.124.231':3389
- '57.##6.221.191':3389
- '14#.#16.147.167':3389
- '13#.#53.47.111':3389
- '24#.#35.5.186':3389
- '12#.#6.212.1':3389
- '33.##6.187.33':3389
- '18#.#9.123.87':3389
- '12#.#87.205.218':3389
- '14#.#53.221.17':3389
- '10#.#.17.118':3389
- '14#.4.79.43':3389
- '23#.#0.246.11':3389
- '20#.#9.53.191':3389
- '24#.#8.250.183':3389
- '22#.#73.73.118':3389
- '11#.#88.31.126':3389
- '23#.#8.2.147':3389
- '20#.#9.37.51':3389
- '66.##.231.40':3389
- '13#.#20.144.71':3389
- '18#.#17.110.174':3389
- '15#.#38.162.21':3389
- '13#.#8.224.13':3389
- '20#.#08.120.221':3389
- '24#.#07.182.145':3389
- '62.##1.140.153':3389
- '86.#0.11.68':3389
- '13#.#12.224.76':3389
- '33.##9.195.165':3389
- '18#.#3.182.208':3389
- '80.##8.153.42':3389
- '48.##.204.144':3389
- '14#.#01.51.58':3389
- '14#.#38.243.251':3389
- '11#.#24.105.162':3389
- '16#.#38.250.170':3389
- '23#.#78.79.55':3389
- '54.##3.224.63':3389
- '17#.#0.192.81':3389
- '11#.#00.37.38':3389
- '23#.#92.5.56':3389
- '20#.#13.57.158':3389
- '55.##1.218.188':3389
- '25#.#52.15.102':3389
- '63.##.147.30':3389
- '12#.#02.133.153':3389
- '10#.#04.10.81':3389
- '22#.#18.156.89':3389
- '16#.#86.167.225':3389
- '19#.#69.26.133':3389
- '17#.#13.100.70':3389
- '10#.#64.182.195':3389
- '22#.#.150.26':3389
- '19#.#77.201.128':3389
- '11#.#8.127.177':3389
- '23#.#15.159.5':3389
- '48.##9.37.187':3389
Другое:
Ищет следующие окна:
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'Indicator' WindowName: ''
