Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001] 'LibraryPath' = 'mswsock.dll'
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003] 'LibraryPath' = 'mswsock.dll'
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008] 'PackedCatalogItem' = ''
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\.ipsec] 'ImagePath' = '\?'
Вредоносные функции:
Внедряет код в
следующие системные процессы:
- <SYSTEM32>\cmd.exe
- <SYSTEM32>\winlogon.exe
- %WINDIR%\Explorer.EXE
Изменения в файловой системе:
Создает следующие файлы:
- %WINDIR%\$NtUninstallKB27979$\4121336045\@
- %WINDIR%\$NtUninstallKB27979$\4121336045\L\alehhooo
- %WINDIR%\$NtUninstallKB27979$\4121336045\Desktop.ini
Самоудаляется.
Сетевая активность:
Подключается к:
- '21#.#08.252.185':80
- 'pr####.fling.com':80
TCP:
Запросы HTTP GET:
- 21#.#08.252.185/5699002-2F6F334BF9ACF1B2401D3874A5B0C048/counter.img?th################################
- 21#.#08.252.185/5699002-2F6F334BF9ACF1B2401D3874A5B0C048/counter.img?th###############################
- pr####.fling.com/geo/txt/city.php
UDP:
- DNS ASK �c#%�;
- DNS ASK �c#B1�
- DNS ASK �c# {�
- DNS ASK �c#�"
- DNS ASK �c#LJh
- DNS ASK �c#�Y
- DNS ASK �c#�
- DNS ASK pr####.fling.com
- DNS ASK �c#�
- DNS ASK �c#g�2
- DNS ASK �c#���
- '74.##.232.147':16471
- '20#.#17.225.142':16471
- '24.##3.185.241':16471
- '17#.#22.70.155':16471
- '66.#6.18.23':16471
- '97.##.65.246':16471
- '70.#5.68.13':16471
- '61.##.78.141':16471
- '2.###.48.134':16471
- '17#.#.159.230':16471
- '68.##.143.222':16471
- '17#.#2.200.227':16471
- '87.##0.143.228':16471
- '90.##1.81.209':16471
- '74.##.31.198':16471
- '98.##4.143.189':16471
- '68.##.129.206':16471
- '95.##.21.201':16471
- '69.##1.196.133':16471
- '11#.#0.150.43':16471
- '89.##3.19.253':16471
- '76.##5.111.252':16471
- '18#.#67.246.53':16471
- '82.#5.24.39':16471
- '69.##5.219.32':16471
- '82.#.76.31':16471
- '70.##.222.37':16471
- '18#.#74.137.37':16471
- '10#.#0.32.93':16471
- '85.##6.196.92':16471
- '18#.#0.254.125':16471
- '21#.#13.66.109':16471
- '69.##5.238.89':16471
- '11#.#98.87.61':16471
- '84.##5.128.55':16471
- '75.##7.166.66':16471
- '65.##0.46.62':16471
