Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'NetworkChecker' = '<Полный путь к вирусу>'
Вредоносные функции:
Ищет ветки реестра, отвечающие за хранение паролей сторонними программами:
- [<HKLM>\Software\BPFTP]
- [<HKCU>\Software\FTP Explorer\Profiles]
- [<HKCU>\Software\BPFTP]
- [<HKCU>\Software\FlashFXP]
- [<HKLM>\Software\FlashFXP]
- [<HKCU>\Software\South River Technologies\WebDrive\Connections]
- [<HKLM>\Software\South River Technologies\WebDrive\Connections]
- [<HKLM>\Software\Sota\FFFTP\Options]
- [<HKLM>\Software\FTP Explorer\Profiles]
- [<HKCU>\Software\Sota\FFFTP\Options]
- [<HKCU>\SOFTWARE\Far2\Plugins\FTP\Hosts]
- [<HKCU>\SOFTWARE\Far\SavedDialogHistory\FTPHost]
- [<HKCU>\SOFTWARE\Far\Plugins\FTP\Hosts]
- [<HKCU>\SOFTWARE\Microsoft\MessengerService]
- [<HKCU>\Software\FTPWare\COREFTP\Sites]
- [<HKLM>\Software\Ghisler\Windows Commander]
- [<HKLM>\Software\Ghisler\Total Commander]
- [<HKCU>\Software\Ghisler\Total Commander]
- [<HKCU>\SOFTWARE\Far2\SavedDialogHistory\FTPHost]
- [<HKCU>\Software\Ghisler\Windows Commander]
Изменения в файловой системе:
Создает следующие файлы:
- <DRIVERS>\npf.sys
- <SYSTEM32>\wpcap.dll
- <SYSTEM32>\Packet.dll
Присваивает атрибут 'скрытый' для следующих файлов:
- <Полный путь к вирусу>
Сетевая активность:
Подключается к:
- '17#.#.199.221':80
- '15#.#49.101.221':80
- '37.##5.2.222':80
- '17#.#.228.221':80
- '77.##1.45.163':80
- '89.##5.2.163':80
- '10#.#41.19.221':80
- '46.##9.180.163':80
- '21#.#08.40.6':80
- '95.##4.107.199':80
- '10#.#60.52.7':80
- '76.#11.9.7':80
- '17#.#.40.197':80
- '13#.#49.96.196':80
- '21#.#56.113.198':80
- '18#.#21.197.197':80
- '10#.#62.35.162':80
- '78.##8.253.59':80
- '17#.#41.136.205':80
- '46.##.228.60':80
- '46.##8.26.60':80
- '17#.#04.233.204':80
- '17#.#11.180.204':80
- '89.##.105.205':80
- '77.##2.20.205':80
- '17#.#68.25.62':80
- '37.##9.204.61':80
- '94.##3.8.158':80
- '5.###.102.62':80
- '82.##1.149.61':80
- '46.##8.38.61':80
- '84.##2.56.59':80
- '81.##.128.57':80
- '94.##4.70.116':80
- '21#.#35.169.109':80
- '27.##5.43.117':80
- '15#.#24.9.117':80
- '85.##.139.104':80
- '17#.#92.137.104':80
- '46.##1.91.109':80
- '12#.#8.191.104':80
- '17#.#37.191.192':80
- '17#.#65.98.191':80
- '10#.#08.239.132':80
- '17#.#03.4.193':80
- '93.##3.254.117':80
- '10#.#07.80.117':80
- '5.#.86.190':80
- '46.##1.107.185':80
- '46.##.71.254':80
- '77.##2.63.86':80
- '31.##8.173.85':80
- '46.##8.78.157':80
- '11#.#29.126.86':80
- '18#.#13.89.8':80
- '83.#30.48.8':80
- '80.##3.22.84':80
- '17#.#14.194.83':80
- '17#.#4.250.250':80
- '89.##.203.250':80
- '20#.#3.117.252':80
- '46.##0.109.251':80
- '17#.#50.139.157':80
- '46.##0.98.157':80
- '18#.#2.170.157':80
- '37.##5.148.157':80
- '95.##.146.183':80
- '67.##7.193.181':80
- '46.##1.216.184':80
- '94.##7.181.183':80
- '63.##6.57.115':80
- '18#.#09.239.114':80
- '19#.#14.159.115':80
- '89.##.95.115':80
- '15#.#24.116.226':80
- '17#.#50.180.225':80
- '21#.#33.171.55':80
- '37.##8.122.55':80
- '77.##1.240.223':80
- '18#.#6.254.184':80
- '77.##0.168.225':80
- '46.##1.104.225':80
- '93.##.70.114':80
- 'localhost':1040
- '77.##1.250.72':80
- '46.#5.9.152':80
- '10#.#6.46.150':80
- '68.##.229.71':80
- '46.##8.99.71':80
- '49.##1.211.72':80
- '17#.#22.178.72':80
- '10#.#6.13.245':80
- '87.##0.83.244':80
- '77.##4.34.247':80
- '12#.#.224.246':80
- '37.##5.61.152':80
- '21#.#67.29.152':80
- '46.##0.64.243':80
- '95.##.111.154':80
- '77.##2.240.180':80
- '17#.#4.233.180':80
- '17#.#.60.105':80
- '5.###.35.105':80
- '17#.#40.42.179':80
- '37.##9.156.161':80
- '10#.#51.27.180':80
- '14#.#70.243.179':80
- '5.##8.64.94':80
- '46.##2.125.93':80
- '94.#0.64.95':80
- '10#.#51.73.94':80
- '85.##6.190.108':80
- '11#.#4.151.106':80
- '24.##9.153.92':80
- '17#.#24.213.108':80
- '89.##.41.161':80
- '17#.#6.140.234':80
- '77.##2.42.233':80
- '10#.#51.75.235':80
- '89.##2.182.234':80
- '18#.#35.19.56':80
- '10#.#6.192.55':80
- '18#.#27.26.233':80
- '20#.#3.197.56':80
- '13#.#49.50.158':80
- '98.##.231.38':80
- '21#.#4.135.159':80
- '37.#.208.158':80
- '17#.#51.87.37':80
- '17#.#41.146.36':80
- '92.##9.115.38':80
- '31.##3.68.38':80
