Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices] 'regscan' = '<Полный путь к вирусу>'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'regscan' = '<Полный путь к вирусу>'
Вредоносные функции:
Внедряет код в
следующие системные процессы:
- <SYSTEM32>\svchost.exe
Завершает или пытается завершить
следующие системные процессы:
- <SYSTEM32>\ctfmon.exe
следующие пользовательские процессы:
- NAVAPW32.EXE
- mpftray.exe
- outpost.exe
- ZONEALARM.EXE
- smc.exe
- ccapp.exe
- AVP.EXE
- AVGCTRL.EXE
- AVP32.EXE
- AVPM.EXE
- AVPCC.EXE
Сетевая активность:
Подключается к:
- '65.#2.0.53':445
- '65.#2.0.10':80
- '65.#2.0.8':80
- '65.#2.0.54':139
- '65.#2.0.54':445
- '65.#2.0.51':445
- '65.#2.0.7':80
- '65.#2.0.9':80
- '65.#2.0.52':139
- '65.#2.0.52':445
- '65.#2.0.57':445
- '65.#2.0.13':80
- '65.#2.0.14':80
- '65.#2.0.58':139
- '65.#2.0.58':445
- '65.#2.0.55':445
- '65.#2.0.11':80
- '65.#2.0.55':139
- '65.#2.0.56':445
- '65.#2.0.12':80
- '65.#2.0.44':445
- '65.#2.0.43':139
- '65.#2.0.44':139
- '65.#2.0.45':139
- '65.#2.0.45':445
- '65.#2.0.41':445
- '65.#2.0.40':139
- '65.#2.0.41':139
- '65.#2.0.43':445
- '65.#2.0.42':445
- '65.#2.0.49':445
- '65.#2.0.48':139
- '65.#2.0.49':139
- '65.#2.0.50':139
- '65.#2.0.50':445
- '65.#2.0.46':139
- '65.#2.0.46':445
- '65.#2.0.47':445
- '65.#2.0.48':445
- '65.#2.0.47':139
- '65.#2.0.15':80
- '65.#2.0.25':80
- '65.#2.0.67':139
- '65.#2.0.68':445
- '65.#2.0.26':80
- '65.#2.0.68':139
- '65.#2.0.66':445
- '65.#2.0.23':80
- '65.#2.0.66':139
- '65.#2.0.67':445
- '65.#2.0.24':80
- '65.#2.0.71':445
- '65.#2.0.28':80
- '65.#2.0.29':80
- '65.#2.0.72':139
- '65.#2.0.72':445
- '65.#2.0.69':139
- '65.#2.0.69':445
- '65.#2.0.27':80
- '65.#2.0.70':139
- '65.#2.0.70':445
- '65.#2.0.61':445
- '65.#2.0.18':80
- '65.#2.0.61':139
- '65.#2.0.62':445
- '65.#2.0.19':80
- '65.#2.0.59':445
- '65.#2.0.16':80
- '65.#2.0.17':80
- '65.#2.0.60':139
- '65.#2.0.60':445
- '65.#2.0.64':139
- '65.#2.0.64':445
- '65.#2.0.22':80
- '65.#2.0.65':139
- '65.#2.0.65':445
- '65.#2.0.20':80
- '65.#2.0.62':139
- '65.#2.0.63':445
- '65.#2.0.21':80
- '65.#2.0.63':139
- '65.#2.0.13':139
- '65.#2.0.13':445
- '65.#2.0.0':80
- '65.#2.0.3':80
- '65.#2.0.14':445
- '65.#2.0.11':445
- 'ir#.###hersys.com.ar':6667
- '65.#2.0.12':445
- '65.#2.0.1':80
- '65.#2.0.12':139
- '65.#2.0.17':139
- '65.#2.0.17':445
- '65.#2.0.18':445
- '65.#2.0.19':445
- '65.#2.0.18':139
- '65.#2.0.15':139
- '65.#2.0.15':445
- '65.#2.0.2':80
- '65.#2.0.16':139
- '65.#2.0.16':445
- '65.#2.0.3':445
- '65.#2.0.2':139
- '65.#2.0.3':139
- '65.#2.0.4':139
- '65.#2.0.4':445
- '65.#2.0.0':139
- '65.#2.0.0':445
- '65.#2.0.1':445
- '65.#2.0.2':445
- '65.#2.0.1':139
- '65.#2.0.8':445
- '65.#2.0.7':139
- '65.#2.0.9':445
- '65.#2.0.10':139
- '65.#2.0.10':445
- '65.#2.0.5':139
- '65.#2.0.5':445
- '65.#2.0.6':445
- '65.#2.0.7':445
- '65.#2.0.6':139
- '65.#2.0.19':139
- '65.#2.0.33':445
- '65.#2.0.32':139
- '65.#2.0.33':139
- '65.#2.0.34':139
- '65.#2.0.34':445
- '65.#2.0.30':139
- '65.#2.0.30':445
- '65.#2.0.31':445
- '65.#2.0.32':445
- '65.#2.0.31':139
- '65.#2.0.37':139
- '65.#2.0.37':445
- '65.#2.0.38':445
- '65.#2.0.40':445
- '65.#2.0.39':445
- '65.#2.0.35':139
- '65.#2.0.35':445
- '65.#2.0.36':445
- '65.#2.0.6':80
- '65.#2.0.36':139
- '65.#2.0.23':445
- '65.#2.0.22':139
- '65.#2.0.23':139
- '65.#2.0.25':445
- '65.#2.0.24':445
- '65.#2.0.20':445
- '65.#2.0.4':80
- '65.#2.0.21':445
- '65.#2.0.22':445
- '65.#2.0.21':139
- '65.#2.0.28':445
- '65.#2.0.27':139
- '65.#2.0.28':139
- '65.#2.0.29':139
- '65.#2.0.29':445
- '65.#2.0.26':445
- '65.#2.0.25':139
- '65.#2.0.26':139
- '65.#2.0.27':445
- '65.#2.0.5':80
UDP:
- DNS ASK ra###.#xtr3me.com.ar
- DNS ASK ra####.damaged.com.ar
- DNS ASK ir#.###hersys.com.ar
- '<IP-адрес в локальной сети>':1036
