Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001] 'LibraryPath' = 'mswsock.dll'
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003] 'LibraryPath' = 'mswsock.dll'
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008] 'PackedCatalogItem' = ''
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\.<Служебное имя>] 'ImagePath' = '\?'
Вредоносные функции:
Внедряет код в
следующие системные процессы:
- <SYSTEM32>\cmd.exe
- <SYSTEM32>\winlogon.exe
- %WINDIR%\Explorer.EXE
Изменения в файловой системе:
Создает следующие файлы:
- %WINDIR%\$NtUninstallKB27979$\4121336045\@
- %WINDIR%\$NtUninstallKB27979$\4121336045\L\alehhooo
- %WINDIR%\$NtUninstallKB27979$\4121336045\Desktop.ini
Самоудаляется.
Сетевая активность:
Подключается к:
- 'localhost':80
- 'pr####.fling.com':80
TCP:
Запросы HTTP GET:
- le#####eecounters.com/5699002-2F6F334BF9ACF1B2401D3874A5B0C048/counter.img?th################################
- le#####eecounters.com/5699002-2F6F334BF9ACF1B2401D3874A5B0C048/counter.img?th###############################
- pr####.fling.com/geo/txt/city.php
UDP:
- DNS ASK ޡc#� n
- DNS ASK ޡc#��
- DNS ASK ޡc#w�
- DNS ASK ޡc#z
- DNS ASK ޡc#�=
- DNS ASK ޡc#t�N
- DNS ASK ޡc##+�
- DNS ASK pr####.fling.com
- DNS ASK ޡc#�CU
- DNS ASK ޡc#�
- DNS ASK ޡc#Q=
- '98.##.33.217':16471
- '76.##.85.217':16471
- '19#.#34.241.12':16471
- '17#.#1.37.213':16471
- '24.##0.113.13':16471
- '18#.#11.100.217':16471
- '20#.#86.186.10':16471
- '69.##2.125.10':16471
- '21#.#86.221.11':16471
- '10#.#2.78.220':16471
- '68.##.231.220':16471
- '21#.#11.122.13':16471
- '68.#.57.208':16471
- '68.##.59.208':16471
- '98.##2.150.18':16471
- '88.##5.175.18':16471
- '76.##.166.205':16471
- '20#.#18.199.208':16471
- '97.##.203.210':16471
- '66.##.209.210':16471
- '69.##0.46.14':16471
- '24.##4.122.17':16471
- '85.##4.103.210':16471
- '88.##4.125.243':16471
- '68.##4.155.3':16471
- '10#.#76.101.4':16471
- '71.##2.209.235':16471
- '87.##1.131.236':16471
- '19#.#13.108.244':16471
- '24.#.190.247':16471
- '17#.81.16.3':16471
- '46.#0.20.3':16471
- '80.##.130.244':16471
- '17#.#26.221.244':16471
- '76.#9.106.4':16471
- '50.##.57.228':16471
- '17#.#0.145.229':16471
- '69.##3.162.227':16471
- '24.##.150.226':16471
- '18#.#6.203.226':16471
- '92.#7.23.10':16471
- '98.#44.58.5':16471
- '49.##4.23.235':16471
- '69.#37.57.8':16471
- '17#.#7.228.229':16471
- '21#.#0.246.230':16471
