Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = '<LS_APPDATA>\a72a1ac3\X'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\a72a1ac3] 'ImagePath' = '%WINDIR%\3273271975:1490412860.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\.serial] 'ImagePath' = '\?'
Вредоносные функции:
Создает и запускает на исполнение:
- <LS_APPDATA>\a72a1ac3\X
Запускает на исполнение:
- %WINDIR%\explorer.exe
Внедряет код в
следующие системные процессы:
- <SYSTEM32>\winlogon.exe
- %WINDIR%\Explorer.EXE
Изменения в файловой системе:
Создает следующие файлы:
- %WINDIR%\$NtUninstallKB16918$\2804554435\L\acbrwqkz
- %WINDIR%\$NtUninstallKB16918$\2804554435\@
- %WINDIR%\3273271975:1490412860.exe
- <LS_APPDATA>\a72a1ac3\@
- <LS_APPDATA>\a72a1ac3\X
Самоудаляется.
Сетевая активность:
Подключается к:
- '18#.#5.59.136':21810
- '11#.#84.220.133':21810
- '58.##2.218.135':21810
- '19#.#8.150.72':21810
- '20#.#39.98.215':21810
- '18#.#75.141.63':21810
- '75.##.186.72':21810
- '14.##.115.141':21810
- '20#.#47.91.170':21810
- '86.##3.42.90':21810
- '2.###.16.207':21810
- '31.##3.138.253':21810
- '41.##.114.61':21810
- '11#.#42.15.224':21810
- '21#.#35.162.228':21810
- '18#.#4.96.104':21810
- '46.##5.97.90':21810
- '46.##.53.184':21810
- '12#.#38.82.26':21810
- '11#.#66.251.239':21810
- '11#.#05.106.46':21810
- '11#.#40.145.1':21810
- '19#.#34.35.173':21810
- '41.##1.103.74':21810
- '12#.#25.30.181':21810
- '17#.#.111.127':21810
- '11#.#42.156.128':21810
- '12#.#02.231.227':21810
- '21#.#9.209.23':21810
- '82.##7.50.179':21810
- '75.##3.232.227':21810
- '11#.#70.32.233':21810
- '11#.35.52.2':21810
- '11#.#46.7.212':21810
- '19#.#60.50.91':21810
- '14.##.126.132':21810
- '79.##9.39.50':21810
- '93.##2.64.150':21810
- '93.##.23.162':21810
- '89.#4.85.76':21810
- '17#.#16.150.141':21810
- '62.##.117.172':21810
- '91.##5.112.50':21810
- '89.##2.128.232':21810
- '93.##0.177.105':21810
- '18#.#15.237.106':21810
- '18#.#2.21.53':21810
- '18#.#65.149.97':21810
- '18#.#1.67.52':21810
- '18#.#33.124.162':21810
- '76.##7.195.10':21810
- '12#.#38.18.114':21810
- '18#.#4.70.15':21810
- '50.#.53.152':21810
- '49.#.136.125':21810
- '89.##3.105.22':21810
- '83.##0.112.196':21810
- '78.#0.90.89':21810
- '17#.#9.84.16':21810
- '31.##2.109.196':21810
- '72.##2.230.99':21810
- '31.##.104.91':21810
- '10#.#28.238.169':21810
- '18#.#15.139.158':21810
- '41.##3.187.7':21810
- '21#.#70.212.47':21810
- '19#.#38.52.250':21810
- '91.##.223.83':21810
- '20#.#6.26.49':21810
- '94.##6.216.236':21810
- '18#.#8.229.127':21810
- '19#.#1.124.60':21810
- '79.##2.176.168':21810
- '60.##.75.145':21810
- '95.##.200.249':21810
- '12#.#83.220.85':21810
- '20#.#65.205.201':21810
- '77.#1.8.201':21810
- '46.##.198.41':21810
- '59.##.195.72':21810
- '18#.#5.236.243':21810
- '98.##4.39.212':21810
- '10#.#87.92.220':21810
- '11#.#41.217.134':21810
- '89.##2.241.117':21810
- '11#.#6.22.125':21810
- '17#.#9.45.122':21810
- '99.##7.139.113':21810
- '79.##4.236.160':21810
- '95.##.108.111':21810
- '77.##5.173.59':21810
- '95.#.144.49':21810
- '98.##9.241.22':21810
- '10#.#94.126.244':21810
- '85.##.113.154':21810
- '2.###.179.185':21810
- '10#.#8.25.125':21810
- '90.##7.17.13':21810
- '90.##9.176.187':21810
- '17#.#1.237.100':21810
- '18#.#32.55.206':21810
- '11#.#50.119.191':21810
- '95.#1.20.79':21810
- '11#.#42.216.234':21810
- '10#.#1.51.235':21810
- '79.##9.86.185':21810
- '87.#.138.185':21810
- '92.##0.219.2':21810
- '17#.#71.100.29':21810
- '95.##.182.125':21810
- '93.##5.146.24':21810
- '41.##2.136.10':21810
- '18#.#00.128.169':21810
- '11#.#8.53.198':21810
- '17#.#76.23.98':21810
- '20#.#31.78.198':21810
- '18#.#36.114.197':21810
- '16#.#46.100.248':21810
- '92.#14.59.7':21810
- '92.#2.155.6':21810
- '31.##0.3.182':21810
- '92.##.69.196':21810
- '92.##2.85.107':21810
- '46.#4.32.6':21810
- '94.##9.141.29':21810
- '78.##0.210.126':21810
- '76.##5.74.125':21810
- '11#.#70.70.242':21810
- '17#.#06.217.56':21810
- '46.##6.202.61':21810
- '17#.#26.29.68':21810
- '17#.#75.102.225':21810
- '18#.#53.10.143':21810
- '17#.#27.40.173':21810
- '19#.#.194.143':21810
- '17#.#57.90.89':21810
- '21#.#6.141.250':21810
- '19#.#35.228.41':21810
- '21#.#00.124.73':21810
- '17#.#15.202.70':21810
- '18#.#9.102.135':21810
- '68.##0.202.146':21810
- '92.##4.117.87':21810
- '18#.#3.222.117':21810
- '18#.#55.78.128':21810
- '99.##5.196.114':21810
- '19#.#.193.200':21810
- '81.##2.68.163':21810
- '87.##.184.189':21810
- '19#.#77.93.33':21810
- '72.##7.66.34':21810
- '19#.#05.154.210':80
- '83.##3.206.49':21810
- '1.##.254.5':21810
- '19#.#21.54.104':21810
- '19#.#05.135.219':21810
- '18#.#5.96.24':21810
- '92.##2.186.25':21810
- '78.##.120.245':21810
- '18#.#3.3.122':21810
- '11#.#9.164.117':21810
- '95.##1.211.157':21810
- '94.##7.153.160':21810
- '94.##.65.232':21810
- '77.##.127.191':21810
- '49.##8.167.230':21810
- '11#.#02.68.181':21810
- '31.##8.200.164':21810
- '17#.#48.66.33':21810
- '11#.#42.72.58':21810
- '74.#2.71.26':21810
- '1.##.241.207':21810
- '11#.#42.148.35':21810
- '21#.#9.11.95':21810
- '17#.#8.254.95':21810
- '18#.#15.154.147':21810
- '14.##.52.235':21810
- '18#.#5.233.188':21810
- '18#.#44.134.87':21810
- '89.##5.194.205':21810
- '18#.#73.50.8':21810
- '60.#43.11.5':21810
- '12#.#23.161.53':21810
- '18#.#9.172.146':21810
- '11#.97.28.8':21810
- '41.##4.195.125':21810
- '92.##.179.32':21810
- '81.##3.188.241':21810
- '11#.#41.28.66':21810
- '27.##.219.112':21810
- '46.##8.207.173':21810
- '85.##.139.66':21810
- '11#.#00.241.15':21810
- '46.##9.125.48':21810
- '21#.#18.173.158':21810
- '18#.#2.176.193':21810
- '18#.#6.167.245':21810
- '18#.#1.127.17':21810
- '17#.#6.240.173':21810
- '91.##7.103.162':21810
- '94.##0.120.188':21810
- '17#.#26.131.59':21810
- '11#.#42.82.113':21810
- '83.#.12.64':21810
- '18#.#3.33.110':21810
- '94.##.101.136':21810
- '12#.#42.224.191':21810
- '18#.#43.41.151':21810
- '20#.#09.163.115':21810
- '42.##1.136.114':21810
- '10#.#39.128.160':21810
- '78.##9.160.230':21810
- '11#.#9.53.137':21810
- '20#.#29.25.92':21810
- '10#.#10.166.96':21810
- '89.##2.220.33':21810
- '81.##8.26.184':21810
- '20#.#8.112.45':21810
- '94.##.171.244':21810
- '20#.#2.225.75':21810
- '89.##.118.197':21810
- '11#.#0.153.28':21810
- '72.##7.152.26':21810
- '18#.#35.176.105':21810
- '89.##.96.136':21810
- '89.##2.76.71':21810
- '93.##8.208.19':21810
TCP:
Запросы HTTP GET:
- 19#.#05.154.210/stat2.php?w=##########################################
- 19#.#05.154.210/stat2.php?w=###########################################
