Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001] 'LibraryPath' = 'mswsock.dll'
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003] 'LibraryPath' = 'mswsock.dll'
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008] 'PackedCatalogItem' = ''
Вредоносные функции:
Внедряет код в
следующие системные процессы:
- <SYSTEM32>\cmd.exe
- <SYSTEM32>\services.exe
- %WINDIR%\Explorer.EXE
Изменения в файловой системе:
Создает следующие файлы:
- C:\RECYCLER\S-1-5-18\$2ebe1c2e2a38cb36436c4d1cb8c2630c\n
- %WINDIR%\assembly\GAC\Desktop.ini
- C:\RECYCLER\S-1-5-18\$2ebe1c2e2a38cb36436c4d1cb8c2630c\@
- C:\RECYCLER\S-1-5-21-2052111302-484763869-725345543-1003\$2ebe1c2e2a38cb36436c4d1cb8c2630c\@
- C:\RECYCLER\S-1-5-21-2052111302-484763869-725345543-1003\$2ebe1c2e2a38cb36436c4d1cb8c2630c\n
Самоудаляется.
Сетевая активность:
Подключается к:
- 'localhost':80
- 'pr####.fling.com':80
TCP:
Запросы HTTP GET:
- fo#####-counters.com/5699145-24B8EBEDAA47374020E664A2406FB684/counter.img?th###############################
- pr####.fling.com/geo/txt/city.php
UDP:
- DNS ASK �#��1
- DNS ASK �#0 ޭ
- DNS ASK �#)xȟ
- DNS ASK �#�{k
- DNS ASK �#�S
- DNS ASK �#���
- DNS ASK pr####.fling.com
- DNS ASK �#f&�
- DNS ASK �#�v
- DNS ASK �#6S�
- '18#.#8.190.232':16471
- '71.##.145.233':16471
- '68.##.87.234':16471
- '17#.#1.72.235':16471
- '92.##.100.230':16471
- '78.##.155.231':16471
- '36.##6.76.206':16471
- '21#.#.129.196':16471
- '37.##4.112.183':16471
- '68.##.166.234':16471
- '80.#6.73.2':16471
- '24.##4.136.228':16471
- '18#.#9.95.212':16471
- '86.##5.95.212':16471
- '27.#.113.215':16471
- '13#.#99.226.210':16471
- '21#.#2.71.211':16471
- '20#.#.95.211':16471
- '17#.#.158.222':16471
- '78.##.42.227':16471
- '68.##3.55.228':16471
- '17#.#27.44.216':16471
- '12#.#01.116.218':16471
- '12#.#96.137.219':16471
- '21#.#2.34.179':16471
- '74.##1.148.70':16471
- '69.##2.39.65':16471
- '94.##.242.62':16471
- '12#.#0.92.84':16471
- '67.##2.34.81':16471
- '17#.#4.123.75':16471
- '12#.#5.240.25':16471
- '69.##5.113.18':16471
- '11#.#1.135.14':16471
- '68.##.245.52':16471
- '12#.#4.206.45':16471
- '84.##2.63.33':16471
- '85.##.10.244':16471
- '76.##.50.149':16471
- '67.##0.34.139':16471
- '21#.#0.150.168':16471
- '99.##9.109.165':16471
- '93.##2.47.165':16471
- '18#.#15.155.109':16471
- '71.##4.186.98':16471
- '17#.#42.177.89':16471
- '24.##0.140.131':16471
- '95.##4.20.126':16471
- '27.##2.84.125':16471
