Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'SonyAgent' = '<Полный путь к вирусу>'
Вредоносные функции:
Ищет ветки реестра, отвечающие за хранение паролей сторонними программами:
- [<HKLM>\Software\Ghisler\Total Commander]
- [<HKLM>\Software\Ghisler\Windows Commander]
- [<HKCU>\Software\Ghisler\Total Commander]
- [<HKCU>\Software\FlashFXP]
- [<HKLM>\Software\BPFTP]
- [<HKCU>\Software\BPFTP]
- [<HKLM>\Software\FlashFXP]
- [<HKCU>\SOFTWARE\Far\Plugins\FTP\Hosts]
- [<HKCU>\Software\FTPWare\COREFTP\Sites]
- [<HKCU>\SOFTWARE\Microsoft\MessengerService]
- [<HKCU>\SOFTWARE\Far2\Plugins\FTP\Hosts]
- [<HKCU>\Software\Ghisler\Windows Commander]
- [<HKCU>\SOFTWARE\Far2\SavedDialogHistory\FTPHost]
- [<HKCU>\SOFTWARE\Far\SavedDialogHistory\FTPHost]
Изменения в файловой системе:
Создает следующие файлы:
- <DRIVERS>\npf.sys
- <SYSTEM32>\Packet.dll
- <SYSTEM32>\wpcap.dll
Присваивает атрибут 'скрытый' для следующих файлов:
- <Полный путь к вирусу>
Сетевая активность:
Подключается к:
- '46.##8.43.90':80
- '19#.#7.160.38':80
- '46.##2.233.33':80
- '11#.#55.235.80':80
- '92.##.131.81':80
- '31.##.247.31':80
- '20#.#9.41.15':80
- '46.#50.7.69':80
- '46.##9.239.50':80
- '17#.8.36.4':80
- '5.##.112.33':80
- '31.##2.13.88':80
- '89.##1.23.32':80
- '17#.#24.13.33':80
- '95.#8.69.57':80
- '95.##0.83.57':80
- '17#.#11.146.70':80
- '46.#6.97.7':80
- '85.##0.26.13':80
- '77.##1.249.88':80
- '86.##0.126.48':80
- '17#.#6.77.77':80
- '88.##5.139.58':80
- '21#.#9.237.39':80
- '18#.#42.244.94':80
- '95.##4.67.50':80
- '87.##4.194.25':80
- '14#.#70.227.93':80
- '61.##0.114.40':80
- '17#.#9.182.58':80
- '91.##4.73.18':80
- '27.#.137.94':80
- '92.##.93.102':80
- '89.#8.106.6':80
- 'localhost':1056
- 'localhost':1050
- 'localhost':1053
- 'localhost':1062
- 'localhost':1065
- 'localhost':1059
- '14#.#55.91.19':80
- 'localhost':1038
- 'localhost':1041
- 'localhost':1035
- '77.##6.132.22':80
- 'localhost':1047
- '94.##3.63.162':80
- '10#.#7.234.41':80
- 'localhost':1044
- '89.##4.116.17':80
- 'localhost':1088
- '10#.#7.184.7':80
- '49.##6.156.196':80
- 'localhost':1086
- '77.##2.187.31':80
- '46.#3.55.77':80
- '10#.#7.184.14':80
- '37.##1.133.19':80
- '10#.#6.135.82':80
- 'localhost':1074
- 'localhost':1068
- 'localhost':1071
- 'localhost':1080
- 'localhost':1083
- 'localhost':1077
- '20#.#25.70.75':80
TCP:
Запросы HTTP GET:
- 92.##.93.102/index.htm
- 92.##.93.102/file.htm
- 27.#.137.94/login.htm
- 87.##4.194.25/file.htm
- 27.#.137.94/main.htm
- 91.##4.73.18/login.htm
- 20#.#25.70.75/login.htm
- 91.##4.73.18/file.htm
- 17#.#9.182.58/search.htm
- 17#.#9.182.58/default.htm
- 14#.#70.227.93/online.htm
- 14#.#70.227.93/default.htm
- 17#.#11.146.70/file.htm
- 10#.#7.234.41/default.htm
- 17#.#11.146.70/search.htm
- 95.##4.67.50/default.htm
- 87.##4.194.25/default.htm
- 95.##4.67.50/setup.htm
- 61.##0.114.40/install.htm
- 61.##0.114.40/welcome.htm
- 20#.#25.70.75/start.htm
- 21#.#9.237.39/index.htm
- 18#.#42.244.94/install.htm
- 21#.#9.237.39/online.htm
- 85.##0.26.13/default.htm
- 85.##0.26.13/online.htm
- 88.##5.139.58/default.htm
- 88.##5.139.58/online.htm
- 17#.#6.77.77/index.htm
- 18#.#42.244.94/online.htm
- 17#.#6.77.77/search.htm
- 89.#8.106.6/online.htm
- 77.##1.249.88/install.htm
- 89.#8.106.6/index.htm
- 10#.#6.135.82/welcome.htm
- 10#.#6.135.82/login.htm
- 46.#6.97.7/file.htm
- 46.#6.97.7/index.htm
- 86.##0.126.48/online.htm
- 77.##1.249.88/index.htm
- 86.##0.126.48/search.htm
- 10#.#7.234.41/login.htm
- 46.##9.239.50/main.htm
- 17#.8.36.4/install.htm
- 46.##9.239.50/index.htm
- 31.##2.13.88/search.htm
- 31.##2.13.88/welcome.htm
- 95.##0.83.57/file.htm
- 95.##0.83.57/login.htm
- 95.#8.69.57/main.htm
- 17#.8.36.4/file.htm
- 95.#8.69.57/search.htm
- 37.##1.133.19/main.htm
- 46.#3.55.77/home.htm
- 37.##1.133.19/default.htm
- 10#.#7.184.7/welcome.htm
- 10#.#7.184.14/default.htm
- 77.##6.132.22/install.htm
- 77.##6.132.22/home.htm
- 5.##.112.33/setup.htm
- 46.#3.55.77/install.htm
- 5.##.112.33/file.htm
- 89.##1.23.32/home.htm
- 19#.#7.160.38/online.htm
- 19#.#7.160.38/file.htm
- 46.##8.43.90/home.htm
- 11#.#55.235.80/start.htm
- 46.##8.43.90/search.htm
- 31.##.247.31/main.htm
- 31.##.247.31/search.htm
- 92.##.131.81/default.htm
- 20#.#9.41.15/home.htm
- 46.#50.7.69/welcome.htm
- 14#.#55.91.19/login.htm
- 14#.#55.91.19/index.htm
- 17#.#24.13.33/home.htm
- 89.##1.23.32/welcome.htm
- 17#.#24.13.33/online.htm
- 46.##2.233.33/login.htm
- 11#.#55.235.80/login.htm
- 46.##2.233.33/file.htm
- 89.##4.116.17/search.htm
- 89.##4.116.17/default.htm
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
