Техническая информация
Для обеспечения автозапуска и распространения:
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- '<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Полный путь к вирусу>
- '<SYSTEM32>\urdvxc.exe' /service
- '<SYSTEM32>\urdvxc.exe' /installservice
- '<SYSTEM32>\urdvxc.exe' /start
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1124 -dm 7 7 %TEMP%\WER9ab8.dir00\svchost.exe.mdmp 16325836412032672
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %TEMP%\WER9ab8.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- <SYSTEM32>\urdvxc.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
Самоудаляется.
Сетевая активность:
Подключается к:
- '21#.#14.155.11':9988
- '21#.#14.253.50':445
- '21#.#14.230.131':9988
- '21#.#14.46.69':9988
- '21#.#14.65.177':445
- '21#.#14.251.178':445
- '21#.#14.66.5':445
- '21#.#14.46.181':445
- '21#.#14.138.178':445
- '21#.#14.185.110':9988
- '21#.#14.106.236':9988
- '21#.#14.196.3':9988
- '21#.#14.162.232':9988
- '21#.#14.36.194':9988
- '21#.#14.246.23':9988
- '21#.#14.165.56':9988
- '21#.#14.3.176':9988
- '21#.#14.3.100':9988
- '21#.#14.14.238':9988
- '21#.#14.46.69':445
- '21#.#14.176.166':445
- '21#.#14.23.156':445
- '21#.#14.127.229':445
- '21#.#14.240.152':445
- '21#.#14.155.11':445
- '21#.#14.43.139':445
- '21#.#14.55.5':445
- '21#.#14.165.56':445
- '21#.#14.139.6':445
- '21#.#14.213.131':445
- '21#.#14.177.107':445
- '21#.#14.109.52':445
- '21#.#14.45.11':445
- '21#.#14.81.61':445
- '21#.#14.89.104':445
- '21#.#14.6.24':445
- '21#.#14.61.17':445
- '21#.#14.57.212':445
- '21#.#14.57.212':9988
- '21#.#14.59.185':9988
- '21#.#14.109.52':9988
- '21#.#14.66.5':9988
- '21#.#14.253.50':9988
- '21#.#14.45.11':9988
- '21#.#14.65.177':9988
- '21#.#14.251.178':9988
- '21#.#14.6.24':9988
- '21#.#14.43.139':9988
- '21#.#14.208.39':9988
- '21#.#14.195.158':9988
- '21#.#14.177.107':9988
- '21#.#14.81.61':9988
- '21#.#14.57.215':9988
- '21#.#14.138.178':9988
- '21#.#14.158.84':9988
- '21#.#14.213.131':9988
- '21#.#14.46.181':9988
- '21#.#14.61.17':9988
- '21#.#14.165.183':9988
- '21#.#14.150.213':9988
- '21#.#14.131.208':9988
- '21#.#14.127.88':9988
- '21#.#14.55.5':9988
- '21#.#14.25.197':9988
- '21#.#14.121.65':9988
- '21#.#14.39.195':9988
- '21#.#14.196.39':9988
- '21#.#14.84.185':9988
- '21#.#14.176.166':9988
- '21#.#14.127.229':9988
- '21#.#14.240.152':9988
- '21#.#14.23.156':9988
- '21#.#14.89.104':9988
- '21#.#14.139.6':9988
- '21#.#14.225.76':9988
- '21#.#14.30.12':9988
- '21#.#14.150.213':445
- '21#.#14.59.185':139
- '21#.#14.25.197':139
- '21#.#14.46.69':139
- '21#.#14.195.158':139
- '21#.#14.30.12':139
- '21#.#14.106.236':139
- '21#.#14.230.131':139
- '21#.#14.225.76':139
- '21#.#14.158.84':139
- '21#.#14.43.139':139
- '21#.#14.6.24':139
- '21#.#14.23.156':139
- '21#.#14.89.104':139
- '21#.#14.139.6':139
- '21#.#14.127.229':139
- '21#.#14.240.152':139
- '21#.#14.55.5':139
- '21#.#14.150.213':139
- '21#.#14.165.56':139
- '21#.#14.3.100':139
- '21#.#14.57.215':139
- '21#.#14.39.195':139
- '21#.#14.36.194':139
- '21#.#14.162.232':139
- '21#.#14.165.183':139
- '21#.#14.84.185':139
- '21#.#14.246.23':139
- '21#.#14.127.88':139
- '21#.#14.196.39':139
- '21#.#14.196.3':139
- '21#.#14.14.238':139
- '21#.#14.131.208':139
- '21#.#14.208.39':139
- '21#.#14.155.11':139
- '21#.#14.185.110':139
- '21#.#14.121.65':139
- '21#.#14.176.166':139
- '21#.#14.3.176':139
- '21#.#14.208.39':445
- '21#.#14.3.176':445
- '21#.#14.131.208':445
- '21#.#14.196.3':445
- '21#.#14.39.195':445
- '21#.#14.57.215':445
- '21#.#14.246.23':445
- '21#.#14.3.100':445
- '21#.#14.36.194':445
- '21#.#14.121.65':445
- '21#.#14.25.197':445
- '21#.#14.30.12':445
- '21#.#14.195.158':445
- '21#.#14.59.185':445
- '21#.#14.225.76':445
- '21#.#14.230.131':445
- '21#.#14.14.238':445
- '21#.#14.158.84':445
- '21#.#14.106.236':445
- '21#.#14.109.52':139
- '21#.#14.213.131':139
- '21#.#14.251.178':139
- '21#.#14.66.5':139
- '21#.#14.45.11':139
- '21#.#14.81.61':139
- '21#.#14.57.212':139
- '21#.#14.177.107':139
- '21#.#14.61.17':139
- '21#.#14.138.178':139
- '21#.#14.127.88':445
- '21#.#14.165.183':445
- '21#.#14.162.232':445
- '21#.#14.196.39':445
- '21#.#14.84.185':445
- '21#.#14.65.177':139
- '21#.#14.46.181':139
- '21#.#14.185.110':445
- '21#.#14.253.50':139
