Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001] 'LibraryPath' = 'mswsock.dll'
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003] 'LibraryPath' = 'mswsock.dll'
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008] 'PackedCatalogItem' = ''
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\.mrxsmb] 'ImagePath' = '\?'
Вредоносные функции:
Внедряет код в
следующие системные процессы:
- <SYSTEM32>\winlogon.exe
- %WINDIR%\Explorer.EXE
Изменения в файловой системе:
Создает следующие файлы:
- %WINDIR%\$NtUninstallKB27979$\4121336045\@
- %WINDIR%\$NtUninstallKB27979$\4121336045\L\alehhooo
- %WINDIR%\$NtUninstallKB27979$\4121336045\Desktop.ini
Самоудаляется.
Сетевая активность:
Подключается к:
- '20#.#08.79.128':80
- 'pr####.fling.com':80
TCP:
Запросы HTTP GET:
- 20#.#08.79.128/count.php?id########################
- 20#.#08.79.128/count.php?id#########################
- pr####.fling.com/geo/txt/city.php
- 20#.#08.79.128/count.php?id#######################
UDP:
- DNS ASK N�#Tq�
- DNS ASK N�#n}�
- DNS ASK N�#7T7�
- DNS ASK N�#!�n�
- DNS ASK N�#�Y
- DNS ASK N�#��*
- DNS ASK N�#�У�
- DNS ASK pr####.fling.com
- DNS ASK N�#A�1
- DNS ASK N�# 3�
- DNS ASK N�#����
- '60.##6.142.218':16471
- '11#.#71.147.219':16471
- '24.##.12.220':16471
- '11#.#84.76.209':16471
- '98.##8.228.209':16471
- '69.##4.30.215':16471
- '58.#.86.226':16471
- '20#.#61.201.226':16471
- '12#.#25.190.227':16471
- '92.##0.116.221':16471
- '69.##6.86.225':16471
- '71.##4.221.225':16471
- '75.##7.218.194':16471
- '17#.#5.169.197':16471
- '67.##2.46.199':16471
- '11#.#9.28.193':16471
- '12#.#36.123.193':16471
- '18#.#77.190.193':16471
- '42.##.81.203':16471
- '68.##.33.205':16471
- '46.##7.32.209':16471
- '67.##7.197.199':16471
- '24.##.29.201':16471
- '16#.#15.87.201':16471
- '19#.#22.251.231':16471
- '67.##4.154.247':16471
- '71.##3.245.249':16471
- '71.##.134.250':16471
- '22#.#08.138.245':16471
- '75.##5.154.245':16471
- '68.##.184.245':16471
- '98.##.225.251':16471
- '46.##4.13.253':16471
- '12#.#96.177.253':16471
- '18#.#41.70.251':16471
- '18#.#.75.251':16471
- '37.##3.98.251':16471
- '87.##3.13.235':16471
- '61.##5.253.237':16471
- '62.##4.8.238':16471
- '21#.#06.240.232':16471
- '93.##5.63.234':16471
- '69.##3.248.234':16471
- '42.##1.146.242':16471
- '59.##3.199.242':16471
- '11#.#03.212.242':16471
- '10#.#40.174.239':16471
- '95.##4.225.239':16471
- '22#.#56.220.240':16471
Другое:
Ищет следующие окна:
- ClassName: 'gbhfjhgfjhgfjhgjhgkghkhgjkjhg' WindowName: 'fjdshgksdfhgfkugiudfgjhdflkjgfd'
