Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = '<LS_APPDATA>\f5a698ed\X'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\.afd] 'ImagePath' = '\?'
Вредоносные функции:
Создает и запускает на исполнение:
- <LS_APPDATA>\f5a698ed\X
Внедряет код в
следующие системные процессы:
- <SYSTEM32>\winlogon.exe
- %WINDIR%\Explorer.EXE
Изменения в файловой системе:
Создает следующие файлы:
- <LS_APPDATA>\f5a698ed\@
- <LS_APPDATA>\f5a698ed\X
- %WINDIR%\$NtUninstallKB37556$\4121336045\L\alehhooo
- %WINDIR%\$NtUninstallKB37556$\4121336045\@
Сетевая активность:
Подключается к:
- '76.##0.95.207':21810
- '12#.#66.127.242':21810
- '18#.#9.240.40':21810
- '12#.#25.38.219':21810
- '89.##4.251.139':21810
- '20#.#04.220.152':21810
- '11#.#30.14.146':21810
- '17#.#9.148.11':21810
- '62.#3.68.93':21810
- '10#.#35.29.1':21810
- '11#.#9.18.191':21810
- '80.##2.60.61':21810
- '95.##.19.241':21810
- '50.##3.83.102':21810
- '12#.#99.174.155':21810
- '89.##4.93.53':21810
- '91.##8.170.108':21810
- '89.##6.91.178':21810
- '77.##2.102.74':21810
- '19#.#98.82.192':21810
- '58.##.72.168':21810
- '21#.#9.52.144':21810
- '95.##.66.118':21810
- '4.###.248.143':21810
- '58.##6.116.209':21810
- '12#.#37.202.73':21810
- '17#.#3.142.90':21810
- '19#.#05.135.93':21810
- '89.##5.89.150':21810
- '11#.#03.147.165':21810
- '11#.#6.191.145':21810
- '95.##.37.244':21810
- '24.#1.74.15':21810
- '93.#7.24.66':21810
- '68.##.111.118':21810
- '18#.#0.181.71':21810
- '11#.#4.86.240':21810
- '92.##.91.212':21810
- '62.##0.254.151':21810
- '11#.#00.178.135':21810
- '11#.#10.153.85':21810
- '83.##2.93.34':21810
- '18#.#15.65.234':21810
- '11#.#71.137.212':21810
- '86.#26.83.9':21810
- '79.##3.150.219':21810
- '11#.#8.114.53':21810
- '11#.#06.153.199':21810
- '46.##7.162.31':21810
- '11#.#9.144.172':21810
- '17#.#3.111.40':21810
- '49.##1.220.108':21810
- '11#.#04.145.7':21810
- '31.##.214.188':21810
- '11#.#65.163.185':21810
- '76.##3.133.156':21810
- '18#.#11.12.124':21810
- '79.##2.149.25':21810
- '17#.#2.13.149':21810
- '10.##5.58.30':21810
- '11#.#52.223.128':21810
- '10#.#01.160.209':21810
- '95.##8.134.232':21810
- '99.##.146.80':21810
- '91.##7.198.26':21810
- '10.##9.224.9':21810
- '11#.#5.25.110':21810
- '11#.#94.207.18':21810
- '11#.#34.13.15':21810
- '11#.#04.249.245':21810
- '17#.#22.254.154':21810
- '17#.#95.127.147':21810
- '2.###.38.191':21810
- '12#.#46.9.110':21810
- '2.###.12.250':21810
- '17#.#7.218.137':21810
- '99.##.18.122':21810
- '59.##1.71.171':21810
- '18#.#4.53.188':21810
- '20#.#13.109.202':21810
- '46.##0.111.7':21810
- '46.#6.9.76':21810
- '94.##6.211.84':21810
- '11#.#51.247.84':21810
- '95.#8.9.22':21810
- '80.##4.218.61':21810
- '18#.#73.50.8':21810
- '27.#.57.78':21810
- '11#.#42.147.145':21810
- '12#.#37.74.72':21810
- '11#.#95.51.208':21810
- '10#.#51.36.48':21810
- '11#.#00.156.196':21810
- '20#.#4.188.167':21810
- '49.##9.188.42':21810
- '11#.#9.146.140':21810
- '21#.#7.254.200':21810
- '11#.#9.131.174':21810
- '11#.#00.140.24':21810
- '89.##5.56.249':21810
- '24.##9.145.82':21810
- '21#.#40.206.147':21810
- '68.##5.52.233':21810
- '89.##2.207.163':21810
- '17#.#8.196.215':21810
- '11#.#93.125.127':21810
- '76.##6.160.39':21810
- '96.##.143.170':21810
- '21#.#0.32.216':21810
- '18#.#9.45.67':21810
- '85.##1.169.211':21810
- '14.##.192.165':21810
- '14.##.53.176':21810
- '11#.#02.40.254':21810
- '46.##4.101.20':21810
- '85.##.230.78':21810
- '88.#9.57.33':21810
- '11#.#54.22.233':21810
- '79.##6.44.151':21810
- '11#.#97.127.234':21810
- '17#.#69.151.72':21810
- '95.##6.18.255':21810
- '66.##0.181.220':21810
- '95.##.133.40':21810
- '11#.#2.59.134':21810
- '46.##2.200.30':21810
- '11#.#84.205.148':21810
- '14.##.111.189':21810
- '11#.#00.47.45':21810
- '11#.#84.215.182':21810
- '18#.#1.84.251':21810
- '89.##.246.57':21810
- '17#.#68.205.179':21810
- '11#.#23.131.99':21810
- '11#.#54.4.135':21810
- '95.##4.66.32':21810
- '95.##9.255.230':21810
- '89.##4.130.34':21810
- '19#.#6.6.158':21810
- '89.##6.238.150':21810
- '17#.#3.17.23':80
- '86.##4.63.83':21810
- '11#.#03.23.192':21810
- '94.##2.153.25':21810
- '59.##.218.182':21810
- '81.#98.9.26':21810
- '93.##.16.140':21810
- '20#.#92.230.104':21810
- '12#.#38.121.142':21810
- '94.##9.216.179':21810
- '18#.48.5.21':21810
- '46.##4.243.231':21810
- '83.##2.27.73':21810
- '46.##4.23.77':21810
- '62.##.142.50':21810
- '19#.#11.157.13':21810
- '78.##0.137.8':21810
- '18#.#2.138.81':21810
- '17#.#6.32.193':21810
- '10#.#73.29.47':21810
- '11#.#42.155.60':21810
- '80.##0.50.71':21810
- '46.##.152.158':21810
- '12#.#37.211.210':21810
- '41.##.149.253':21810
- '20#.#20.170.102':21810
- '11#.#36.113.59':21810
- '70.##3.138.54':21810
- '69.##4.222.10':21810
- '95.##.88.170':21810
- '11#.#02.185.102':21810
- '11#.#8.53.107':21810
- '84.##0.207.190':21810
- '91.##.186.24':21810
- '19#.#91.143.229':21810
- '19#.#01.40.153':21810
- '31.##7.201.67':21810
- '39.##9.166.157':21810
- '10.##0.104.115':21810
- '14.##.130.13':21810
- '11#.#98.241.146':21810
- '18#.#.82.162':21810
- '79.##6.127.252':21810
- '69.##.210.140':21810
- '11#.#35.54.144':21810
- '12#.#38.226.234':21810
- '18#.#60.56.157':21810
- '18#.#4.145.252':21810
- '19#.#19.158.40':21810
- '99.##.69.247':21810
- '92.##.162.245':21810
- '18#.#42.37.166':21810
- '89.##3.8.173':21810
- '41.#8.10.6':21810
- '11#.#94.99.180':21810
- '90.##4.99.34':21810
- '20#.#65.223.48':21810
- '20#.#3.195.47':21810
- '11#.#06.197.78':21810
- '17#.#41.45.78':21810
- '18#.2.29.23':21810
- '18#.#4.69.123':21810
- '11#.#4.226.215':21810
- '1.##.252.144':21810
- '12#.#25.244.52':21810
- '61.##7.142.207':21810
- '11#.#09.238.190':21810
- '59.##.193.52':21810
- '80.##1.202.115':21810
- '19#.#80.135.116':21810
TCP:
Запросы HTTP GET:
- 17#.#3.17.23/bad.php?w=######################
- 17#.#3.17.23/stat2.php?w=##########################################
- 17#.#3.17.23/stat2.php?w=#########################################
