Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001] 'LibraryPath' = 'mswsock.dll'
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003] 'LibraryPath' = 'mswsock.dll'
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008] 'PackedCatalogItem' = ''
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\.mrxsmb] 'ImagePath' = '\?'
Вредоносные функции:
Внедряет код в
следующие системные процессы:
- <SYSTEM32>\winlogon.exe
- %WINDIR%\Explorer.EXE
Изменения в файловой системе:
Создает следующие файлы:
- %WINDIR%\$NtUninstallKB27979$\4121336045\@
- %WINDIR%\$NtUninstallKB27979$\4121336045\L\alehhooo
- %WINDIR%\$NtUninstallKB27979$\4121336045\Desktop.ini
Самоудаляется.
Сетевая активность:
Подключается к:
- '21#.#08.252.185':80
- 'pr####.fling.com':80
TCP:
Запросы HTTP GET:
- 21#.#08.252.185/5699002-2F6F334BF9ACF1B2401D3874A5B0C048/counter.img?th################################
- 21#.#08.252.185/5699002-2F6F334BF9ACF1B2401D3874A5B0C048/counter.img?th###############################
- pr####.fling.com/geo/txt/city.php
UDP:
- DNS ASK ޡc#A*�
- DNS ASK ޡc#�BU
- DNS ASK ޡc/��
- DNS ASK ޡc#(��
- DNS ASK ޡc#�
- DNS ASK ޡc#��
- DNS ASK ޡc#� n
- DNS ASK ޡc#qv�
- DNS ASK pr####.fling.com
- DNS ASK ޡc#&�u
- DNS ASK ޡc#�\
- DNS ASK ޡc#`
- '76.##5.160.14':16471
- '20#.#6.253.222':16471
- '67.##5.194.14':16471
- '76.##6.146.219':16471
- '20#.#1.12.15':16471
- '76.##4.136.14':16471
- '68.##4.32.11':16471
- '17#.#3.122.228':16471
- '98.##9.62.228':16471
- '11#.#73.141.224':16471
- '77.#.122.14':16471
- '24.##8.143.216':16471
- '98.##7.145.216':16471
- '69.##.252.215':16471
- '75.##8.119.214':16471
- '78.##1.63.20':16471
- '50.##.162.216':16471
- '17#.#3.197.15':16471
- '61.##.162.15':16471
- '86.##7.137.218':16471
- '89.##.125.16':16471
- '21#.#02.52.217':16471
- '20#.#8.247.228':16471
- '24.#28.78.6':16471
- '19#.#9.251.240':16471
- '76.##0.184.6':16471
- '85.##0.188.6':16471
- '59.##.199.237':16471
- '71.##8.119.241':16471
- '17#.#15.146.243':16471
- '11#.#51.149.243':16471
- '11#.154.0.3':16471
- '79.#19.56.5':16471
- '76.#0.97.4':16471
- '78.##9.149.9':16471
- '18#.#5.133.9':16471
- '21#.#24.143.231':16471
- '70.##6.210.10':16471
- '12.##3.139.10':16471
- '66.##9.67.234':16471
- '18#.#4.215.236':16471
- '12#.#2.240.6':16471
- '12#.#44.47.9':16471
- '80.##7.188.234':16471
- '70.##9.106.235':16471
