Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001] 'LibraryPath' = 'mswsock.dll'
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003] 'LibraryPath' = 'mswsock.dll'
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008] 'PackedCatalogItem' = ''
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\.redbook] 'ImagePath' = '\?'
Вредоносные функции:
Внедряет код в
следующие системные процессы:
- <SYSTEM32>\winlogon.exe
- %WINDIR%\Explorer.EXE
Изменения в файловой системе:
Создает следующие файлы:
- %WINDIR%\$NtUninstallKB27979$\4121336045\@
- %WINDIR%\$NtUninstallKB27979$\4121336045\L\alehhooo
- %WINDIR%\$NtUninstallKB27979$\4121336045\Desktop.ini
Самоудаляется.
Сетевая активность:
Подключается к:
- '20#.#08.79.128':80
- 'pr####.fling.com':80
TCP:
Запросы HTTP GET:
- 20#.#08.79.128/count.php?id########################
- 20#.#08.79.128/count.php?id#########################
- pr####.fling.com/geo/txt/city.php
- 20#.#08.79.128/count.php?id#######################
UDP:
- DNS ASK ��#o2X1
- DNS ASK ��#��0�
- DNS ASK ��#���
- DNS ASK ��#�[�b
- DNS ASK ��#ʡ
- DNS ASK ��#���
- DNS ASK ��#��l�
- DNS ASK ��#/
- DNS ASK pr####.fling.com
- DNS ASK ��#UU��
- DNS ASK ��#��z�
- DNS ASK ��#6p8
- '20#.#07.134.54':16471
- '24.##3.37.234':16471
- '77.##1.140.54':16471
- '18#.#58.95.55':16471
- '17#.#74.245.230':16471
- '71.##3.128.50':16471
- '79.##6.114.239':16471
- '18#.#26.215.51':16471
- '98.##8.165.53':16471
- '12#.#25.28.52':16471
- '17#.#0.148.58':16471
- '71.##6.94.57':16471
- '78.##7.222.227':16471
- '21#.#03.206.225':16471
- '17#.#6.60.59':16471
- '17#.#38.53.230':16471
- '14#.#96.205.55':16471
- '89.##3.35.230':16471
- '97.#9.28.56':16471
- '24.##.185.228':16471
- '66.##1.169.20':16471
- '16#.#8.140.20':16471
- '18#.#1.201.20':16471
- '94.##5.148.24':16471
- '17#.#3.118.23':16471
- '76.##5.244.248':16471
- '65.##.110.250':16471
- '67.##4.154.247':16471
- '78.##9.89.246':16471
- '98.##6.215.246':16471
- '96.##.157.40':16471
- '20#.#11.161.29':16471
- '21#.#31.143.42':16471
- '17#.#5.216.45':16471
- '96.##.126.45':16471
- '68.##0.137.27':16471
- '81.##4.224.26':16471
- '85.##7.221.27':16471
- '12#.#01.91.241':16471
- '46.##6.116.29':16471
