Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001] 'LibraryPath' = 'mswsock.dll'
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003] 'LibraryPath' = 'mswsock.dll'
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008] 'PackedCatalogItem' = ''
Вредоносные функции:
Внедряет код в
следующие системные процессы:
- <SYSTEM32>\cmd.exe
- <SYSTEM32>\services.exe
- %WINDIR%\Explorer.EXE
Изменения в файловой системе:
Создает следующие файлы:
- C:\RECYCLER\S-1-5-18\$2ebe1c2e2a38cb36436c4d1cb8c2630c\n
- %WINDIR%\assembly\GAC\Desktop.ini
- C:\RECYCLER\S-1-5-18\$2ebe1c2e2a38cb36436c4d1cb8c2630c\@
- C:\RECYCLER\S-1-5-21-2052111302-484763869-725345543-1003\$2ebe1c2e2a38cb36436c4d1cb8c2630c\@
- C:\RECYCLER\S-1-5-21-2052111302-484763869-725345543-1003\$2ebe1c2e2a38cb36436c4d1cb8c2630c\n
Самоудаляется.
Сетевая активность:
Подключается к:
- 'localhost':80
- 'j.###mind.com':80
TCP:
Запросы HTTP GET:
- fo#####-counters.com/5699145-24B8EBEDAA47374020E664A2406FB684/counter.img?th###############################
- j.###mind.com/app/geoip.js
UDP:
- DNS ASK ��#O��
- DNS ASK ��#�Z�s
- DNS ASK ��#�(�A
- DNS ASK ��#�{�
- DNS ASK ��#c
- DNS ASK ��#V˶
- DNS ASK j.###mind.com
- DNS ASK ��#�v�
- DNS ASK ��#P���
- DNS ASK ��#��
- '75.##.117.43':16471
- '68.#4.183.9':16471
- '77.#9.62.40':16471
- '76.##0.57.10':16471
- '84.##4.241.48':16471
- '24.##5.46.49':16471
- '18#.#4.21.209':16471
- '15#.34.55.6':16471
- '68.##0.240.216':16471
- '71.##.37.224':16471
- '71.##.154.223':16471
- '12#.#71.215.228':16471
- '50.##2.134.243':16471
- '68.##4.57.244':16471
- '79.##.236.38':16471
- '72.##.163.32':16471
- '17#.#23.140.222':16471
- '18#.#13.166.205':16471
- '11#.#53.253.254':16471
- '67.##2.51.193':16471
- '98.##.98.194':16471
- '10#.#67.16.65':16471
- '46.##.208.190':16471
- '58.##4.182.190':16471
- '46.##1.220.192':16471
- '58.##.107.67':16471
- '71.##3.253.254':16471
- '92.#6.90.52':16471
- '75.##5.123.200':16471
- '88.##1.68.205':16471
- '67.#75.73.4':16471
- '12#.#40.218.195':16471
- '18#.#52.253.254':16471
- '63.##0.154.199':16471
- '17#.#52.253.254':16471
- '11#.#58.141.66':16471
- '75.##.244.64':16471
- '24.##.17.102':16471
- '69.##8.244.71':16471
- '78.##6.194.253':16471
- '18#.#45.241.50':16471
- '68.##.146.58':16471
- '16#.#41.103.55':16471
- '17#.#0.122.78':16471
- '27.##5.200.94':16471
- '49.#.197.145':16471
- '69.##2.239.104':16471
- '17#.#14.152.110':16471
- '76.##.41.171':16471
- '75.##1.10.80':16471
- '68.#9.78.91':16471
- '68.#6.40.85':16471
- '78.#5.87.47':16471
- '13#.#92.200.22':16471
- '68.##.107.235':16471
- '71.##.242.241':16471
- '75.##8.43.236':16471
- '20#.#79.3.32':16471
- '71.##2.70.230':16471
- '21#.#51.60.23':16471
- '71.##5.109.24':16471
- '70.#6.44.13':16471
- '24.##2.165.245':16471
- '21#.#10.131.36':16471
- '21#.#10.242.44':16471
- '22#.#31.33.214':16471
- '74.##0.85.14':16471
- '18#.#5.153.239':16471
- '74.##2.126.32':16471
- '69.##2.221.20':16471
