Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'NetworkChecker' = '<Полный путь к вирусу>'
Вредоносные функции:
Ищет ветки реестра, отвечающие за хранение паролей сторонними программами:
- [<HKLM>\Software\BPFTP]
- [<HKCU>\Software\FTP Explorer\Profiles]
- [<HKCU>\Software\BPFTP]
- [<HKCU>\Software\FlashFXP]
- [<HKLM>\Software\FlashFXP]
- [<HKCU>\Software\South River Technologies\WebDrive\Connections]
- [<HKLM>\Software\South River Technologies\WebDrive\Connections]
- [<HKLM>\Software\Sota\FFFTP\Options]
- [<HKLM>\Software\FTP Explorer\Profiles]
- [<HKCU>\Software\Sota\FFFTP\Options]
- [<HKCU>\SOFTWARE\Far2\Plugins\FTP\Hosts]
- [<HKCU>\SOFTWARE\Far\SavedDialogHistory\FTPHost]
- [<HKCU>\SOFTWARE\Far\Plugins\FTP\Hosts]
- [<HKCU>\SOFTWARE\Microsoft\MessengerService]
- [<HKCU>\Software\FTPWare\COREFTP\Sites]
- [<HKLM>\Software\Ghisler\Windows Commander]
- [<HKLM>\Software\Ghisler\Total Commander]
- [<HKCU>\Software\Ghisler\Total Commander]
- [<HKCU>\SOFTWARE\Far2\SavedDialogHistory\FTPHost]
- [<HKCU>\Software\Ghisler\Windows Commander]
Изменения в файловой системе:
Создает следующие файлы:
- <DRIVERS>\npf.sys
- <SYSTEM32>\wpcap.dll
- <SYSTEM32>\Packet.dll
Присваивает атрибут 'скрытый' для следующих файлов:
- <Полный путь к вирусу>
Сетевая активность:
Подключается к:
- '89.##9.238.163':80
- '46.##1.242.168':80
- '5.###.206.162':80
- '46.##8.94.163':80
- '13#.#55.135.171':80
- '93.##.199.171':80
- '17#.#37.4.169':80
- '17#.#07.89.171':80
- '17#.#32.125.160':80
- '11#.#63.38.238':80
- '12#.#4.171.239':80
- '17#.#50.164.236':80
- '46.##9.220.236':80
- 'localhost':1079
- '17#.#18.68.159':80
- '17#.#03.234.240':80
- '17#.#.194.241':80
- '78.##.147.247':80
- '77.##2.81.248':80
- '46.##9.181.183':80
- 'localhost':1102
- '37.##0.132.252':80
- 'localhost':1125
- '19#.#2.127.249':80
- '10#.#07.206.251':80
- '37.##9.119.183':80
- '46.##1.86.177':80
- '17#.#51.173.178':80
- '17#.#22.255.174':80
- '5.###.156.176':80
- '11#.#5.141.181':80
- '91.##8.35.183':80
- '15#.#66.189.179':80
- '17#.#96.199.179':80
- '37.##.194.232':80
- '19#.#42.125.95':80
- '11#.#7.18.97':80
- '95.##.202.94':80
- '94.##3.69.95':80
- '18#.#1.162.103':80
- '11#.#37.175.104':80
- '10#.#62.50.98':80
- '21#.#0.67.98':80
- '17#.#17.76.93':80
- '37.##2.228.88':80
- '91.##4.233.88':80
- '62.##.178.86':80
- '46.##8.231.86':80
- '11#.#54.115.92':80
- '19#.#3.227.92':80
- '46.#11.1.91':80
- '85.##1.73.91':80
- '92.##5.167.224':80
- '90.##7.113.226':80
- '46.##.38.221':80
- '77.##0.135.222':80
- '77.##2.128.231':80
- '21#.#11.226.231':80
- '21#.#31.23.228':80
- '10#.#60.112.228':80
- '77.##.61.220':80
- '58.#.136.110':80
- 'localhost':1056
- '31.##2.206.105':80
- '17#.#58.80.108':80
- '21#.#49.152.217':80
- '17#.#50.134.218':80
- '5.###.67.217':80
- '21#.#11.74.217':80
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
