Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001] 'LibraryPath' = 'mswsock.dll'
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003] 'LibraryPath' = 'mswsock.dll'
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008] 'PackedCatalogItem' = ''
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\.mrxsmb] 'ImagePath' = '\?'
Вредоносные функции:
Внедряет код в
следующие системные процессы:
- <SYSTEM32>\winlogon.exe
- %WINDIR%\Explorer.EXE
Изменения в файловой системе:
Создает следующие файлы:
- %WINDIR%\$NtUninstallKB27979$\4121336045\@
- %WINDIR%\$NtUninstallKB27979$\4121336045\L\alehhooo
- %WINDIR%\$NtUninstallKB27979$\4121336045\Desktop.ini
Самоудаляется.
Сетевая активность:
Подключается к:
- '21#.#08.252.185':80
- 'pr####.fling.com':80
TCP:
Запросы HTTP GET:
- 21#.#08.252.185/5699002-2F6F334BF9ACF1B2401D3874A5B0C048/counter.img?th################################
- 21#.#08.252.185/5699002-2F6F334BF9ACF1B2401D3874A5B0C048/counter.img?th###############################
- pr####.fling.com/geo/txt/city.php
UDP:
- DNS ASK ^�#���
- DNS ASK ^�#�j�
- DNS ASK ^�#� &�
- DNS ASK ^�#�5
- DNS ASK ^�#v]_
- DNS ASK ^�#�Ol�
- DNS ASK ^�#�Z�7
- DNS ASK ^�#C���
- DNS ASK pr####.fling.com
- DNS ASK ^�#9�N,
- DNS ASK ^�#�(�
- DNS ASK ^�#Z�
- '99.##6.19.91':16471
- '18#.#6.148.85':16471
- '17#.#.189.81':16471
- '98.##8.148.203':16471
- '67.#6.87.92':16471
- '69.##3.180.91':16471
- '61.##.220.206':16471
- '10#.#70.144.210':16471
- '12#.#23.167.73':16471
- '24.##4.33.70':16471
- '10#.2.23.77':16471
- '96.##.217.76':16471
- '67.##9.152.75':16471
- '19#.#4.15.113':16471
- '11#.#59.2.111':16471
- '24.##5.144.194':16471
- '69.##.114.115':16471
- '68.##.61.114':16471
- '46.##7.141.113':16471
- '17#.#75.146.109':16471
- '31.##6.145.200':16471
- '72.##0.145.96':16471
- '11#.#54.13.93':16471
- '11#.#63.165.104':16471
- '88.##.157.100':16471
- '76.##7.146.99':16471
- '10#.#39.128.69':16471
- '64.##1.162.49':16471
- '69.##.102.49':16471
- '71.#0.48.46':16471
- '17#.#42.229.50':16471
- '18#.#62.68.50':16471
- '95.##5.21.235':16471
- '46.##.100.41':16471
- '11#.#74.148.24':16471
- '92.##5.28.14':16471
- '79.##4.236.11':16471
- '21#.#38.111.32':16471
- '98.##9.59.30':16471
- '64.##7.219.29':16471
- '17#.#5.81.222':16471
- '21#.#14.155.65':16471
- '67.##9.129.64':16471
- '68.##.157.68':16471
- '85.##6.147.67':16471
- '1.##5.16.67':16471
- '86.##.209.63':16471
- '97.##.173.52':16471
- '67.##5.98.230':16471
- '24.##1.87.232':16471
- '12#.#95.65.62':16471
- '92.##4.211.60':16471
- '69.##5.243.56':16471
