Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'shell' = 'Explorer.exe <SYSTEM32>\CISSI.exe'
Изменения в файловой системе:
Создает следующие файлы:
- <SYSTEM32>\CISSI.exe
Сетевая активность:
Подключается к:
- '80.##.141.107':139
- '19#.#.196.219':139
- '11#.#29.209.253':139
- '13#.#33.155.55':139
- '19#.#84.24.173':139
- '24#.#62.38.37':139
- '10#.#7.99.210':139
- '76.##.215.173':139
- '96.##0.239.98':139
- '23#.#18.136.84':139
- '25#.#2.154.108':139
- '11#.#24.198.252':139
- '11#.#71.180.79':139
- '13.##8.52.119':139
- '22#.#3.61.27':139
- '10#.#9.127.105':139
- '40.#0.5.57':139
- '80.##8.95.64':139
- '12#.#27.119.164':139
- '37.##5.125.241':139
- '92.#.112.236':139
- '35.##.185.128':139
- '69.##.210.160':139
- '20#.#0.59.240':139
- '14#.#91.140.221':139
- '48.##0.14.154':139
- '12#.#53.58.133':139
- '21#.#7.126.237':139
- '72.##.248.231':139
- '16.##1.14.178':139
- '18#.#9.62.169':139
- '85.##2.39.46':139
- '22#.#0.18.243':139
- '95.##4.58.94':139
- '14#.#82.37.185':139
- '65.##.25.254':139
- '91.##0.214.76':139
- '22#.#24.206.20':139
- '21#.#36.147.74':139
- '15.##.121.12':139
- '19#.#46.55.222':139
- '26.##.243.17':139
- '24#.#44.128.43':139
- '84.##.156.189':139
- '2.##.101.28':139
- '5.##.131.243':139
- '18#.#0.87.61':139
- '11#.#2.195.175':139
- '22#.#44.102.44':139
- '22#.#7.197.117':139
- '99.##6.207.52':139
- '11#.#78.114.123':139
- '11#.#24.52.102':139
- '74.##9.198.124':139
- '15#.#11.247.169':139
- '20#.#6.84.95':139
- '54.##9.219.169':139
- '21#.#8.109.55':139
- '34.##1.206.226':139
- '22#.#78.182.13':139
- '22#.#9.157.141':139
- '84.##.172.208':139
- '63.##6.220.233':139
- '1.###.145.220':139
- '72.##3.81.142':139
- '21#.#21.218.220':139
- '43.#7.91.10':139
- '15#.#89.151.82':139
- '22#.#23.112.149':139
- '16#.#7.23.142':139
- '11#.#06.65.56':139
- '64.##5.43.209':139
- '14#.#95.86.120':139
- '20#.#43.239.13':139
- '18#.#60.79.63':139
- '29.##8.37.130':139
- '25#.#04.29.101':139
- '24#.#28.44.75':139
- '25#.#37.25.192':139
- '19#.#16.210.253':139
- 'ir#.##dernet.org':6667
- '24#.#.85.207':139
- '2.##.107.195':139
- '73.##.27.214':139
- '18#.#30.73.69':139
- '25#.#26.64.142':139
- '17#.66.5.9':139
- '60.#.78.54':139
- '43.#34.21.8':139
- '4.###.155.74':139
- '22#.#00.192.169':139
- '15#.#71.119.126':139
- '13#.#15.74.5':139
- '10#.#47.225.253':139
- '20#.#42.245.64':139
- '41.##.229.73':139
- '12#.#8.147.195':139
- '10#.#42.196.199':139
- '81.##5.3.250':139
- '22.##2.89.152':139
- '18#.#49.21.201':139
- '23#.#0.111.129':139
- '7.###.79.210':139
- '16.##.211.160':139
- '55.##7.7.116':139
- '5.###.238.27':139
- '33.#.110.145':139
- '51.##.173.70':139
- '17#.#0.135.40':139
- '44.##6.221.176':139
- '23#.#93.54.149':139
- '14#.#5.99.64':139
- '53.##2.157.227':139
- '20#.#3.168.67':139
- '44.##4.173.105':139
- '21.##.249.60':139
- '17#.#2.120.3':139
- '69.##4.150.100':139
- '11#.#3.57.101':139
- '13#.#0.50.197':139
- '49.#1.62.81':139
- '21#.#70.181.171':139
- '98.##.125.194':139
- '11#.#78.99.182':139
- '17#.#51.93.232':139
- '24#.#.92.117':139
- '14#.#21.4.170':139
- '83.##3.119.24':139
- '18#.#1.95.143':139
- '12#.#09.93.254':139
- '22#.#35.75.174':139
UDP:
- DNS ASK ir#.##dernet.org
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
