Win32.HLLW.Autoruner1.14896

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001] 'LibraryPath' = 'mswsock.dll'
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003] 'LibraryPath' = 'mswsock.dll'
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007] 'PackedCatalogItem' = ''
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008] 'PackedCatalogItem' = ''

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\.netbt] 'ImagePath' = '\?'

Malicious functions:

Injects code into

the following system processes:

<SYSTEM32>\winlogon.exe
%WINDIR%\Explorer.EXE

Modifies file system :

Creates the following files:

%WINDIR%\$NtUninstallKB27979$\4121336045\@
%WINDIR%\$NtUninstallKB27979$\4121336045\cfg.ini
%WINDIR%\$NtUninstallKB27979$\4121336045\Desktop.ini
%WINDIR%\$NtUninstallKB27979$\4121336045\L\alehhooo

Network activity:

Connects to:

'92.##.63.130':34354
'18#.#66.232.93':34354
'67.##2.243.95':34354
'18#.#84.95.40':34354
'69.#3.40.91':34354
'19#.#6.210.80':34354
'78.#6.93.1':34354
'68.##.193.128':34354
'75.##.245.239':34354
'93.#2.17.19':34354
'79.##3.61.188':34354
'75.##2.230.212':34354
'98.##7.173.250':34354
'18#.#2.136.97':34354
'10#.#3.193.3':34354
'11#.#02.164.8':34354
'98.##2.166.150':34354
'11#.#41.65.213':34354
'21#.#.235.154':34354
'99.##9.70.135':34354
'49.##5.64.113':34354
'2.###.148.255':34354
'71.#2.57.96':34354
'93.##7.181.220':34354
'99.##4.62.34':34354
'50.##.212.157':34354
'85.##7.38.129':34354
'71.##.195.173':34354
'18#.#3.205.85':34354
'71.#5.8.250':34354
'20#.#34.228.54':34354
'50.##2.200.202':34354
'19#.#6.46.133':34354
'68.#.70.126':34354
'75.##2.120.117':34354
'87.##2.169.54':34354
'92.##.100.224':34354
'76.##.205.139':34354
'24.#.219.38':34354
'18#.#55.83.251':34354
'65.#.155.118':34354
'66.##1.164.23':34354
'75.##1.3.178':34354
'10#.0.32.44':34354
'14.##.96.249':34354
'72.##9.30.251':34354
'11#.#11.165.161':34354
'84.##0.253.104':34354
'71.#.44.122':34354
'66.##9.229.69':34354
'17#.#08.19.12':34354
'15#.#4.143.112':34354
'19#.#03.46.246':34354
'24.##.213.190':34354
'59.##.126.254':34354
'95.#9.52.84':34354
'98.##6.217.166':34354
'75.##5.46.100':34354
'11#.#10.90.250':34354
'83.##.161.63':34354
'98.##9.63.212':34354
'11#.#2.149.182':34354
'14#.#10.22.160':34354
'77.##.175.97':34354
'82.##6.241.121':34354
'18#.#96.42.30':34354
'62.##5.101.172':34354
'75.##.120.46':34354
'37.##.81.218':34354
'66.##.187.153':34354
'12#.#20.44.134':34354
'20#.#07.30.132':34354
'72.##4.32.65':34354
'99.##0.84.19':34354
'2.###.223.191':34354
'12#.#18.197.143':34354
'41.##2.176.201':34354
'75.##1.68.105':34354
'68.##.185.136':34354
'17#.#0.25.74':34354
'46.##4.157.198':34354
'46.##.172.202':34354
'24.##.40.187':34354
'20#.#2.189.43':34354
'17#.#12.226.72':34354
'92.##.152.62':34354
'24.##.125.87':34354
'72.##1.181.0':34354
'2.###.58.167':34354
'11#.#03.228.187':34354
'2.###.139.56':34354
'17#.#42.118.148':34354
'72.##3.145.188':34354
'18#.#4.13.218':34354
'76.##0.212.247':34354
'79.##6.2.180':34354
'62.##9.136.70':34354
'21#.#8.133.197':34354
'18#.#55.22.201':34354
'91.##.145.208':34354
'98.##6.116.67':34354
'71.##.62.191':34354
'14.##.221.104':34354
'89.#6.56.45':34354
'74.#8.17.17':34354
'19#.#4.167.225':34354
'20#.#8.236.201':34354
'17#.#32.148.14':34354
'21#.#9.103.75':34354
'17#.#57.41.113':34354
'17#.#0.100.32':34354
'67.##.236.179':34354
'2.###.140.158':34354
'37.##.27.180':34354
'22#.#38.63.125':34354
'50.##.221.123':34354
'24.#0.24.25':34354
'17#.#39.25.194':34354
'20#.#64.225.56':34354
'67.##1.237.57':34354
'17#.#8.181.84':34354
'41.##.189.182':34354
'74.##0.162.87':34354
'67.#7.14.86':34354
'11#.#03.219.172':34354
'65.##.85.135':34354
'11#.#41.241.218':34354
'11#.#5.51.178':34354
'17#.#9.248.18':34354
'46.##8.56.28':34354
'92.##9.171.176':34354
'11#.#95.82.69':34354
'89.#9.28.85':34354
'61.#.143.3':34354
'11#.#04.52.62':34354
'97.##.129.113':34354
'70.#74.6.37':34354
'66.##9.172.252':34354
'11#.#7.238.13':34354
'18#.#9.137.147':34354
'2.###.81.206':34354
'11#.#36.80.178':34354
'71.##1.15.164':34354
'71.##.56.173':34354
'50.#2.12.90':34354
'95.##.16.214':34354
'20#.#03.250.221':34354
'98.##0.43.98':34354
'65.##.252.13':34354
'19#.#14.141.103':34354
'10#.#0.50.96':34354
'69.#.164.33':34354
'86.##.134.184':34354
'72.##.182.193':34354
'12#.#06.91.91':34354
'72.##7.200.244':34354
'58.##8.203.159':34354
'24.##8.95.77':34354
'10.##5.240.186':34354
'11#.#40.8.34':34354
'68.##6.95.91':34354
'68.##.185.149':34354
'11#.#38.154.40':34354
'18#.#7.4.143':34354
'21#.#0.121.163':34354
'17#.#2.190.142':80
'pr####.fling.com':80
'67.##1.69.166':34354
'12#.#53.73.143':34354
'46.##9.197.190':34354
'81.##8.145.234':34354
'14#.#3.138.226':34354
'21#.#47.193.101':34354
'46.##.163.83':34354
'98.##6.246.79':34354
'82.##4.27.114':34354
'11#.#95.34.157':34354
'2.###.27.127':34354
'10#.#85.169.137':34354
'91.##5.27.108':34354
'92.##4.159.28':34354
'10#.#0.41.125':34354
'14#.#02.154.73':34354
'41.##2.26.107':34354
'18#.#5.221.54':34354
'95.##.45.150':34354
'70.##.82.151':34354
'10#.#3.139.89':34354
'92.##0.102.112':34354
'2.###.16.140':34354
'71.##.179.44':34354
'11#.#07.30.28':34354
'19#.#14.86.120':34354
'75.##2.151.54':34354
'10#.#7.156.116':34354
'93.##4.98.45':34354
'11#.#02.87.201':34354
'49.##5.45.196':34354
'77.##.139.241':34354
'69.##4.200.176':34354
'69.##3.184.218':34354
'24.##3.200.71':34354
'76.##0.111.222':34354
'94.##.76.210':34354
'21#.#0.227.64':34354
'18#.#98.148.162':34354
'2.##7.39.2':34354
'21#.37.6.96':34354
'41.##.80.111':34354
'11#.#1.254.91':34354
'78.#9.140.6':34354
'11#.#03.234.85':34354
'74.##0.187.221':34354
'16#.#53.118.99':34354
'20#.#59.212.218':34354
'94.##3.106.11':34354
'76.##.22.193':34354
'95.#2.7.64':34354
'10#.#08.246.52':34354
'65.#1.43.73':34354
'89.##0.205.99':34354
'75.##6.22.180':34354
'85.##6.24.18':34354
'79.##9.90.13':34354
'75.#4.87.34':34354
'98.##3.182.16':34354
'98.##8.28.135':34354
'17#.#1.185.183':34354
'2.###.202.55':34354
'49.#.134.108':34354
'46.##2.68.137':34354
'89.##.124.239':34354
'92.##.99.127':34354
'97.##.199.12':34354
'12#.#6.190.132':34354
'17#.#1.85.169':34354
'70.##5.95.114':34354
'14.##.172.22':34354
'20#.#74.99.172':34354
'98.##7.113.93':34354
'68.##.217.164':34354
'69.##0.91.181':34354
'78.##9.106.30':34354
'46.##.89.112':34354
'18#.#51.29.10':34354
'11#.#07.200.18':34354
'24.##.72.170':34354
'83.##7.96.215':34354
'92.##4.113.180':34354

TCP:

HTTP GET requests:

17#.#2.190.142/stat2.php?w=#############################################
17#.#2.190.142/stat2.php?w=############################################
pr####.fling.com/geo/txt/city.php

UDP:

DNS ASK z#�[c
DNS ASK z#�<��
DNS ASK z#geD
DNS ASK z#]�j
DNS ASK z#1�A�
DNS ASK z#��fC
DNS ASK z#R��"
DNS ASK z#�)
DNS ASK z#~R
DNS ASK z#�շ
DNS ASK pr####.fling.com
DNS ASK z#�~Å
DNS ASK z#��,J
DNS ASK z#@�c
DNS ASK z#�ь
'8.#.8.8':1035

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical Information