Техническая информация
Вредоносные функции:
Внедряет код в
следующие системные процессы:
- <SYSTEM32>\services.exe
- %WINDIR%\Explorer.EXE
Изменения в файловой системе:
Создает следующие файлы:
- %WINDIR%\Installer\{2ebe1c2e-2a38-cb36-436c-4d1cb8c2630c}\@
- %WINDIR%\Installer\{2ebe1c2e-2a38-cb36-436c-4d1cb8c2630c}\n
- <LS_APPDATA>\{2ebe1c2e-2a38-cb36-436c-4d1cb8c2630c}\@
- <LS_APPDATA>\{2ebe1c2e-2a38-cb36-436c-4d1cb8c2630c}\n
Присваивает атрибут 'скрытый' для следующих файлов:
- %WINDIR%\Installer\{2ebe1c2e-2a38-cb36-436c-4d1cb8c2630c}\@
- %WINDIR%\Installer\{2ebe1c2e-2a38-cb36-436c-4d1cb8c2630c}\n
- <LS_APPDATA>\{2ebe1c2e-2a38-cb36-436c-4d1cb8c2630c}\@
- <LS_APPDATA>\{2ebe1c2e-2a38-cb36-436c-4d1cb8c2630c}\n
Самоудаляется.
Сетевая активность:
Подключается к:
- '20#.#08.79.128':80
- 'pr####.fling.com':80
TCP:
Запросы HTTP GET:
- 20#.#08.79.128/count.php?id##################
- 20#.#08.79.128/count.php?id#################
- pr####.fling.com/geo/txt/city.php
- 20#.#08.79.128/count.php?id################
UDP:
- DNS ASK sz#VZ2
- DNS ASK sz#��$�
- DNS ASK sz#��2�
- DNS ASK sz#�}�h
- DNS ASK sz#S��
- DNS ASK sz#f$L
- DNS ASK pr####.fling.com
- DNS ASK sz#��Q
- DNS ASK sz#`}yu
- DNS ASK sz#��
- '18#.#3.170.89':16464
- '83.##.128.169':16464
- '18#.#2.122.241':16464
- '78.##.138.169':16464
- '17#.#40.95.170':16464
- '89.##5.220.88':16464
- '79.##4.91.89':16464
- '11#.#68.176.168':16464
- '46.##0.110.95':16464
- '17#.#54.185.167':16464
- '79.##9.252.94':16464
- '74.#6.39.91':16464
- '24.##.125.92':16464
- '21#.#37.108.94':16464
- '17#.#7.134.83':16464
- '24.##.200.83':16464
- '13#.#94.220.85':16464
- '67.##1.25.83':16464
- '10#.#07.75.172':16464
- '68.#.61.80':16464
- '17#.#37.175.171':16464
- '24.##2.109.87':16464
- '82.##2.149.88':16464
- '89.##4.169.88':16464
- '79.##3.255.86':16464
- '18#.#02.126.171':16464
- '21#.#55.45.86':16464
- '79.##3.58.86':16464
- '24.##0.84.96':16464
- '76.##.12.110':16464
- '67.##7.88.114':16464
- '11#.#3.6.115':16464
- '11#.#8.109.107':16464
- '12#.#54.56.1':16464
- '12.##4.210.104':16464
- '59.##1.25.107':16464
- '17#.#3.129.129':16464
- '74.##.86.132':16464
- '17#.#0.61.139':16464
- '17#.#78.214.123':16464
- '1.##.190.117':16464
- '85.##4.98.119':16464
- '79.##3.238.119':16464
- '66.##9.172.165':16464
- '18#.#6.166.99':16464
- '10#.#1.46.100':16464
- '82.##.236.98':16464
- '94.##5.99.97':16464
- '69.##2.202.97':16464
- '78.##.74.166':16464
- '76.##9.157.103':16464
- '70.##.52.104':16464
- '64.##1.87.104':16464
- '50.#.31.102':16464
- '78.##.194.155':16464
- '10#.#08.22.155':16464
- '12#.#4.217.152':16464
- '17#.#77.81.174':16464
- '21#.#10.115.197':16464
- '77.##9.127.55':16464
- '98.##4.236.55':16464
- '21#.#6.231.52':16464
- '24.##.246.50':16464
- '13#.#04.13.52':16464
- '90.##7.145.52':16464
- '20#.#44.245.60':16464
- '92.##8.202.192':16464
- '78.#5.61.62':16464
- '89.##.222.60':16464
- '18#.#6.132.56':16464
- '92.#14.9.57':16464
- '18#.#6.249.192':16464
- '70.##.137.209':16464
- '95.##.168.43':16464
- '11#.#1.35.209':16464
- '78.##0.232.211':16464
- '20#.#11.71.42':16464
- '98.##5.73.42':16464
- '18#.#15.44.212':16464
- '24.##8.160.199':16464
- '18#.2.0.198':16464
- '68.##2.159.50':16464
- '11#.#41.251.202':16464
- '12#.#32.72.44':16464
- '18#.#9.124.203':16464
- '96.##.209.47':16464
- '66.##0.18.191':16464
- '11#.#71.116.73':16464
- '89.##6.167.73':16464
- '67.##3.38.177':16464
- '24.#.11.73':16464
- '98.##3.115.72':16464
- '72.##.171.72':16464
- '98.##4.124.177':16464
- '17#.#49.42.79':16464
- '46.##7.72.79':16464
- '19#.#4.178.175':16464
- '69.##6.34.79':16464
- '46.##4.249.74':16464
- '10#.#22.78.77':16464
- '75.##.118.77':16464
- '18#.#7.93.66':16464
- '94.##.151.67':16464
- '10#.#0.237.68':16464
- '75.#7.31.65':16464
- '68.##.174.188':16464
- '20#.#34.47.64':16464
- '18#.#21.92.64':16464
- '72.##3.148.70':16464
- '18#.#30.195.187':16464
- '79.##6.176.179':16464
- '18#.#06.9.70':16464
- '18#.#.75.188':16464
- '94.##.40.188':16464
- '18#.#0.224.69':16464
- '67.##9.208.213':16464
- '14.##.125.37':16464
- '79.##4.23.37':16464
- '39.##3.117.39':16464
- '18#.#6.192.42':16464
- '96.#3.77.42':16464
- '16#.#2.104.40':16464
- '94.##8.82.216':16464
- '17#.#48.144.216':16464
- '17#.#7.4.217':16464
- '72.##1.162.31':16464
- '64.##.194.35':16464
- '98.##3.184.215':16464
- '18#.#4.11.32':16464
- '85.##0.229.48':16464
- '17#.#9.205.45':16464
- '11#.#9.148.203':16464
- '20#.#32.113.200':16464
- '11#.#68.234.198':16464
- '74.##.105.199':16464
- '19#.#80.96.49':16464
- '94.##6.244.43':16464
- '76.##8.15.43':16464
- '74.##.178.211':16464
- '69.##4.190.208':16464
- '21#.#08.179.203':16464
- '20#.#.185.203':16464
- '95.##.221.205':16464
- '11#.#94.72.28':16464
- '94.##5.29.10':16464
- '85.#9.98.8':16464
- '18#.#11.39.8':16464
- '20#.#52.155.237':16464
- '78.##2.90.232':16464
- '19#.#47.7.234':16464
- '74.##.161.16':16464
- '90.##7.149.245':16464
- '69.##.70.246':16464
- '24.##.236.246':16464
- '71.##4.116.245':16464
- '69.#1.223.4':16464
- '12#.#37.250.3':16464
- '81.##4.254.243':16464
- '68.##.51.223':16464
- '93.##3.141.25':16464
- '74.##3.177.23':16464
- '13#.#04.39.223':16464
- '14.##.131.217':16464
- '24.#8.54.27':16464
- '24.#5.90.26':16464
- '20#.#8.210.20':16464
- '11#.#84.96.20':16464
- '67.##7.228.16':16464
- '11#.#6.58.230':16464
- '71.##0.252.22':16464
- '18#.#1.21.22':16464
- '12#.#35.112.21':16464
- '20#.#7.65.50':16464
- '18#.#07.88.167':16464
- '75.##3.137.95':16464
- '14.#8.9.95':16464
- '85.##2.128.98':16464
- '77.##2.242.161':16464
- '70.##8.58.163':16464
- '68.##.112.99':16464
- '12#.#49.58.170':16464
- '17#.#4.210.88':16464
- '20#.#34.1.86':16464
- '68.#.152.89':16464
- '76.##2.24.91':16464
- '10#.#.223.168':16464
- '17#.#79.249.90':16464
- '11#.#5.233.150':16464
- '79.##8.252.150':16464
- '18#.#4.57.101':16464
- '11#.#42.131.150':16464
- '79.##8.83.139':16464
- '19#.#7.21.141':16464
- '85.##.48.146':16464
- '10#.#3.208.157':16464
- '17#.#3.41.158':16464
- '88.##2.117.158':16464
- '17#.#77.86.157':16464
- '24.##9.34.154':16464
- '14#.#40.190.100':16464
- '20#.#50.162.100':16464
- '2.##4.53.81':16464
- '82.##8.62.71':16464
- '75.##7.123.69':16464
- '89.##6.58.69':16464
- '15#.#08.193.187':16464
- '99.##8.247.183':16464
- '17#.#9.10.185':16464
- '17#.#17.236.186':16464
- '24.##0.169.60':16464
- '14.##.64.193':16464
- '19#.#91.196.53':16464
- '17#.#54.188.61':16464
- '18#.#0.43.63':16464
- '75.##.240.189':16464
- '79.##6.32.63':16464
- '24.#41.5.74':16464
- '72.##3.198.72':16464
- '18#.#61.82.178':16464
- '17#.#8.129.79':16464
- '18#.#9.59.80':16464
- '18#.#18.164.172':16464
- '24.#4.30.80':16464
- '46.##7.248.181':16464
- '10#.#0.120.182':16464
- '46.##0.128.183':16464
- '19#.#4.142.181':16464
- '79.##7.114.178':16464
- '18#.#6.225.178':16464
- '18#.#66.30.72':16464
