Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'afada6b1a5b6b0eca7baa7' = '%ALLUSERSPROFILE%\sgtr.exe'
Изменения в файловой системе:
Самоперемещается:
- из <Полный путь к вирусу> в %ALLUSERSPROFILE%\sgtr.exe
Сетевая активность:
UDP:
- DNS ASK ap#.#soft69.com
- DNS ASK ap#.#soft70.com
- DNS ASK ap#.#soft71.com
- DNS ASK ap#.#soft66.com
- DNS ASK ap#.#soft67.com
- DNS ASK ap#.#soft68.com
- DNS ASK ap#.#soft75.com
- DNS ASK ap#.#soft76.com
- DNS ASK ap#.#soft77.com
- DNS ASK ap#.#soft72.com
- DNS ASK ap#.#soft73.com
- DNS ASK ap#.#soft74.com
- DNS ASK ap#.#soft65.com
- DNS ASK ap#.#soft56.com
- DNS ASK ap#.#soft57.com
- DNS ASK ap#.#soft58.com
- DNS ASK ap#.#soft53.com
- DNS ASK ap#.#soft54.com
- DNS ASK ap#.#soft55.com
- DNS ASK ap#.#soft62.com
- DNS ASK ap#.#soft63.com
- DNS ASK ap#.#soft64.com
- DNS ASK ap#.#soft59.com
- DNS ASK ap#.#soft60.com
- DNS ASK ap#.#soft61.com
- DNS ASK ap#.#soft78.com
- DNS ASK ap#.#soft95.com
- DNS ASK ap#.#soft96.com
- DNS ASK ap#.#soft97.com
- DNS ASK ap#.#soft92.com
- DNS ASK ap#.#soft93.com
- DNS ASK ap#.#soft94.com
- DNS ASK ap#.#soft0.com
- DNS ASK p.###ft3.com
- DNS ASK s.###id.co.kr
- DNS ASK ap#.#soft98.com
- DNS ASK ap#.#soft99.com
- DNS ASK ap#.##oft100.com
- DNS ASK ap#.#soft91.com
- DNS ASK ap#.#soft82.com
- DNS ASK ap#.#soft83.com
- DNS ASK ap#.#soft84.com
- DNS ASK ap#.#soft79.com
- DNS ASK ap#.#soft80.com
- DNS ASK ap#.#soft81.com
- DNS ASK ap#.#soft88.com
- DNS ASK ap#.#soft89.com
- DNS ASK ap#.#soft90.com
- DNS ASK ap#.#soft85.com
- DNS ASK ap#.#soft86.com
- DNS ASK ap#.#soft87.com
- DNS ASK ap#.#soft52.com
- DNS ASK ap#.#soft17.com
- DNS ASK ap#.#soft18.com
- DNS ASK ap#.#soft19.com
- DNS ASK ap#.#soft14.com
- DNS ASK ap#.#soft15.com
- DNS ASK ap#.#soft16.com
- DNS ASK ap#.#soft23.com
- DNS ASK ap#.#soft24.com
- DNS ASK ap#.#soft25.com
- DNS ASK ap#.#soft20.com
- DNS ASK ap#.#soft21.com
- DNS ASK ap#.#soft22.com
- DNS ASK ap#.#soft13.com
- DNS ASK ap#.#soft4.com
- DNS ASK ap#.#soft5.com
- DNS ASK ap#.#soft6.com
- DNS ASK ap#.#soft1.com
- DNS ASK ap#.#soft2.com
- DNS ASK ap#.#soft3.com
- DNS ASK ap#.#soft10.com
- DNS ASK ap#.#soft11.com
- DNS ASK ap#.#soft12.com
- DNS ASK ap#.#soft7.com
- DNS ASK ap#.#soft8.com
- DNS ASK ap#.#soft9.com
- DNS ASK ap#.#soft26.com
- DNS ASK ap#.#soft43.com
- DNS ASK ap#.#soft44.com
- DNS ASK ap#.#soft45.com
- DNS ASK ap#.#soft40.com
- DNS ASK ap#.#soft41.com
- DNS ASK ap#.#soft42.com
- DNS ASK ap#.#soft49.com
- DNS ASK ap#.#soft50.com
- DNS ASK ap#.#soft51.com
- DNS ASK ap#.#soft46.com
- DNS ASK ap#.#soft47.com
- DNS ASK ap#.#soft48.com
- DNS ASK ap#.#soft39.com
- DNS ASK ap#.#soft30.com
- DNS ASK ap#.#soft31.com
- DNS ASK ap#.#soft32.com
- DNS ASK ap#.#soft27.com
- DNS ASK ap#.#soft28.com
- DNS ASK ap#.#soft29.com
- DNS ASK ap#.#soft36.com
- DNS ASK ap#.#soft37.com
- DNS ASK ap#.#soft38.com
- DNS ASK ap#.#soft33.com
- DNS ASK ap#.#soft34.com
- DNS ASK ap#.#soft35.com
- '18#.#50.229.209':1024
Другое:
Ищет следующие окна:
- ClassName: 'Indicator' WindowName: '(null)'
