Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'NetworkChecker' = '<Полный путь к вирусу>'
Вредоносные функции:
Ищет ветки реестра, отвечающие за хранение паролей сторонними программами:
- [<HKLM>\Software\BPFTP]
- [<HKCU>\Software\FTP Explorer\Profiles]
- [<HKCU>\Software\BPFTP]
- [<HKCU>\Software\FlashFXP]
- [<HKLM>\Software\FlashFXP]
- [<HKCU>\Software\South River Technologies\WebDrive\Connections]
- [<HKLM>\Software\South River Technologies\WebDrive\Connections]
- [<HKLM>\Software\Sota\FFFTP\Options]
- [<HKLM>\Software\FTP Explorer\Profiles]
- [<HKCU>\Software\Sota\FFFTP\Options]
- [<HKCU>\SOFTWARE\Far2\Plugins\FTP\Hosts]
- [<HKCU>\SOFTWARE\Far\SavedDialogHistory\FTPHost]
- [<HKCU>\SOFTWARE\Far\Plugins\FTP\Hosts]
- [<HKCU>\SOFTWARE\Microsoft\MessengerService]
- [<HKCU>\Software\FTPWare\COREFTP\Sites]
- [<HKLM>\Software\Ghisler\Windows Commander]
- [<HKLM>\Software\Ghisler\Total Commander]
- [<HKCU>\Software\Ghisler\Total Commander]
- [<HKCU>\SOFTWARE\Far2\SavedDialogHistory\FTPHost]
- [<HKCU>\Software\Ghisler\Windows Commander]
Изменения в файловой системе:
Создает следующие файлы:
- <DRIVERS>\npf.sys
- <SYSTEM32>\wpcap.dll
- <SYSTEM32>\Packet.dll
Присваивает атрибут 'скрытый' для следующих файлов:
- <Полный путь к вирусу>
Сетевая активность:
Подключается к:
- '21#.#60.38.252':80
- '94.##.69.141':80
- '17#.#7.114.141':80
- '93.##.100.250':80
- '77.##2.81.248':80
- '15#.#24.155.248':80
- '77.##1.88.249':80
- '21#.#.42.150':80
- '46.##9.31.151':80
- '21#.#96.173.172':80
- '31.##2.199.149':80
- '95.##.167.144':80
- '15#.#24.237.145':80
- '15#.#24.242.146':80
- '13#.#49.71.240':80
- '10#.#2.118.241':80
- '79.##2.133.243':80
- '86.##1.117.239':80
- '10#.#51.75.235':80
- '37.##9.167.236':80
- '49.##9.55.239':80
- '20#.#1.120.246':80
- '93.##.212.246':80
- '46.##8.105.247':80
- '17#.#20.115.245':80
- '46.##5.97.244':80
- '37.##5.184.244':80
- '17#.#94.225.244':80
- '17#.#65.13.108':80
- '17#.#01.8.110':80
- '94.##6.120.110':80
- '17#.#50.82.107':80
- '93.##.81.189':80
- '19#.#14.158.95':80
- '21#.#20.212.105':80
- '5.###.223.125':80
- '37.##5.15.128':80
- 'localhost':1195
- '46.##8.1.125':80
- '20#.#.123.110':80
- '62.##.47.112':80
- '17#.#36.49.124':80
- '5.###.217.178':80
- '17#.#.15.179':80
- '81.##0.245.179':80
- '10#.#91.145.177':80
- '10#.#06.5.176':80
- '50.##8.106.177':80
- '17#.#3.135.177':80
- '17#.#.12.186':80
- '87.##4.162.188':80
- '93.##.205.188':80
- '31.##8.71.184':80
- 'localhost':1164
- '37.##9.119.183':80
- '17#.#1.215.183':80
- '21#.#.133.234':80
- '5.###.234.234':80
- 'localhost':1056
- '46.##.54.234':80
- '21#.#0.202.228':80
- '17#.#37.29.233':80
- '37.#.44.233':80
- '17#.#51.37.196':80
- '18#.#21.197.197':80
- '83.##3.220.197':80
- '93.##.115.194':80
- '46.##3.73.192':80
- '21#.#8.247.193':80
- '88.##6.18.194':80
- '77.##1.121.211':80
- '17#.#65.115.212':80
- '46.##5.3.213':80
- '77.##3.20.211':80
- '5.###.35.207':80
- '91.##8.247.208':80
- '19#.#18.17.209':80
- '46.##9.223.223':80
- '17#.#65.102.225':80
- '93.##.198.227':80
- '92.##5.17.221':80
- '91.##9.158.213':80
- '95.##.175.217':80
- '17#.#02.201.220':80
- '22#.#67.176.159':80
- '46.##4.171.161':80
- '37.##9.61.162':80
- '31.##2.43.159':80
- '18#.#15.40.156':80
- '5.###.98.156':80
- '5.###.24.159':80
- '18#.#43.255.169':80
- '5.###.162.171':80
- 'localhost':1102
- '61.##6.219.168':80
- '21#.#30.117.162':80
- '17#.#51.133.162':80
- '77.##3.49.163':80
- '18#.#35.98.204':80
- '37.##.21.207':80
- 'localhost':1079
- '46.##2.241.203':80
- '17#.#58.132.198':80
- '17#.#65.53.201':80
- '92.##.168.201':80
- '17#.#00.160.153':80
- '10#.#54.54.155':80
- '18#.#30.101.155':80
- '78.##.130.153':80
- '18#.#2.108.151':80
- '11#.#4.210.151':80
- '77.##4.34.153':80
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
