Техническая информация
Для обеспечения автозапуска и распространения:
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\wxpdrivers] 'Start' = '00000002'
Вредоносные функции:
Запускает на исполнение:
- <SYSTEM32>\reg.exe add HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\wxpdrivers /v "" /t REG_SZ /d Service /f
- <SYSTEM32>\reg.exe add HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\wxpdrivers /v "" /t REG_SZ /d Service /f
- <SYSTEM32>\reg.exe add HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot /v AlternateShell /t REG_SZ /d services32.exe /f
- <SYSTEM32>\reg.exe add HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\SafeBoot\Network\wxpdrivers /v "" /t REG_SZ /d Service /f
- <SYSTEM32>\reg.exe add HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\SafeBoot\Minimal\wxpdrivers /v "" /t REG_SZ /d Service /f
- <SYSTEM32>\reg.exe add HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\SafeBoot /v AlternateShell /t REG_SZ /d services32.exe /f
- <SYSTEM32>\reg.exe add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot /v AlternateShell /t REG_SZ /d services32.exe /f
- <SYSTEM32>\chcp.com 1251
- <SYSTEM32>\cmd.exe /c """%TEMP%\8372238.bat"""
- <SYSTEM32>\reg.exe add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\wxpdrivers /v "" /t REG_SZ /d Service /f
- <SYSTEM32>\reg.exe add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon /v AutoAdminLogon /t REG_SZ /d 1 /f
- <SYSTEM32>\reg.exe add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\wxpdrivers /v "" /t REG_SZ /d Service /f
Изменения в файловой системе:
Создает следующие файлы:
- %WINDIR%\services32.exe
- %TEMP%\8372238.bat
- %WINDIR%\proc_list1.log
Сетевая активность:
Подключается к:
- '95.##0.224.6':8080
- '77.##2.26.107':8080
- '95.##.225.144':8080
- '10#.#08.254.85':8080
- '81.##.185.27':8080
- '17#.#65.13.72':8080
- '80.##.46.101':8080
- '46.##8.191.151':8080
- '17#.#65.26.138':8080
- '17#.#11.99.2':8080
- '94.#7.65.85':8080
- '46.##1.198.142':8080
- '77.##2.89.90':8080
- '17#.#50.189.228':8080
- '21#.#.145.62':8080
- '91.##4.16.211':8080
- '93.##.164.188':8080
- '18#.#63.70.43':8080
- '78.##.252.194':8080
- '95.##.11.235':8080
- '46.##.65.190':8080
- '89.##9.161.168':8080
- '95.##.101.166':8080
- '89.##2.64.48':8080
- '46.#3.8.79':8080
- '10#.#51.34.12':8080
- '17#.#51.47.190':8080
- '94.##4.136.119':8080
- '21#.#0.41.187':8080
- '46.##8.177.51':8080
- '17#.#4.71.166':8080
- 'dr#####portal-x86.com':80
- '93.##0.19.181':8080
- '17#.#58.89.188':8080
- '17#.#50.193.146':8080
- '17#.#0.190.121':8080
- '10#.#5.204.129':8080
- '17#.#50.231.163':8080
- '91.##5.125.162':8080
- '18#.#63.101.239':8080
- '91.##5.223.123':8080
- '95.##0.165.50':8080
- '17#.#50.117.170':8080
- '19#.#4.169.21':8080
- '10#.#6.53.52':8080
- '94.##4.184.215':8080
- '31.##.130.78':8080
- '17#.#51.65.199':8080
UDP:
- DNS ASK dr#####portal-x86.com
- DNS ASK google.com
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
