Техническая информация
Для обеспечения автозапуска и распространения:
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- '<SYSTEM32>\urdvxc.exe' /service
- '<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Полный путь к вирусу>
- '<SYSTEM32>\urdvxc.exe' /installservice
- '<SYSTEM32>\urdvxc.exe' /start
Изменения в файловой системе:
Создает следующие файлы:
- <SYSTEM32>\urdvxc.exe
Самоудаляется.
Сетевая активность:
Подключается к:
- '21#.#18.28.224':445
- '21#.#18.209.44':445
- '21#.#18.108.18':445
- '21#.#18.30.73':445
- '21#.#18.212.245':445
- '21#.#18.104.66':445
- '21#.#18.60.165':445
- '21#.#18.167.88':445
- '21#.#18.88.180':445
- '21#.#18.5.248':445
- '21#.#18.22.209':445
- '21#.#18.158.157':445
- '21#.#18.94.75':445
- '21#.#18.107.165':445
- '21#.#18.70.227':445
- '21#.#18.89.88':445
- '21#.#18.86.151':445
- '21#.#18.178.135':445
- '21#.#18.188.123':445
- '21#.#18.200.154':445
- '21#.#18.96.237':445
- '21#.#18.79.240':445
- '21#.#18.158.123':445
- '21#.#18.104.187':445
- '21#.#18.81.14':445
- '21#.#18.66.150':445
- '21#.#18.94.182':445
- '21#.#18.143.188':445
- '21#.#18.6.62':445
- '21#.#18.210.47':445
- '21#.#18.193.16':445
- '21#.#18.92.153':445
- '21#.#18.148.167':445
- '21#.#18.253.30':445
- '21#.#18.59.21':445
- '21#.#18.8.14':445
- '21#.#18.137.28':445
- '21#.#18.165.82':445
- '21#.#18.172.37':445
- '21#.#18.220.64':445
- '21#.#18.214.153':445
- '21#.#18.210.144':445
- '21#.#18.46.127':445
- '21#.#18.38.212':445
- '21#.#18.7.217':445
- '21#.#18.17.77':445
- '21#.#18.30.33':445
- '21#.#18.88.57':445
- '21#.#18.16.121':445
- '21#.#18.142.248':445
- '21#.#18.117.190':445
- '21#.#18.113.225':445
- '21#.#18.246.248':445
- '21#.#18.225.42':445
- '21#.#18.32.58':445
- '21#.#18.229.142':445
- '21#.#18.1.173':445
- '21#.#18.222.179':445
- '21#.#18.82.61':445
- '21#.#18.217.51':445
- '21#.#18.51.44':445
- '21#.#18.118.34':445
- '21#.#18.25.171':445
- '21#.#18.41.16':445
- '21#.#18.33.223':445
- '21#.#18.31.242':445
- '21#.#18.221.90':445
- '21#.#18.29.64':445
- '21#.#18.184.250':445
- '21#.#18.133.6':445
- '21#.#18.17.160':445
- '21#.#18.82.119':445
- '21#.#18.92.153':139
- '21#.#18.148.167':139
- '21#.#18.6.62':139
- '21#.#18.88.180':139
- '21#.#18.167.88':139
- '21#.#18.104.66':139
- '21#.#18.86.151':139
- '21#.#18.8.14':139
- '21#.#18.143.188':139
- '21#.#18.5.248':139
- '21#.#18.22.209':139
- '21#.#18.29.64':139
- '21#.#18.209.44':139
- '21#.#18.30.73':139
- '21#.#18.212.245':139
- '21#.#18.222.179':139
- '21#.#18.178.135':139
- '21#.#18.107.165':139
- '21#.#18.96.237':139
- '21#.#18.104.187':139
- '21#.#18.81.14':139
- '21#.#18.188.123':139
- '21#.#18.66.150':139
- '21#.#18.79.240':139
- '21#.#18.94.182':139
- '21#.#18.210.47':139
- '21#.#18.158.123':139
- '21#.#18.193.16':139
- '21#.#18.89.88':139
- '21#.#18.70.227':139
- '21#.#18.59.21':139
- '21#.#18.60.165':139
- '21#.#18.28.224':139
- '21#.#18.200.154':139
- '21#.#18.253.30':139
- '21#.#18.108.18':139
- '21#.#18.210.144':139
- '21#.#18.137.28':139
- '21#.#18.165.82':139
- '21#.#18.7.217':139
- '21#.#18.41.16':139
- '21#.#18.46.127':139
- '21#.#18.31.242':139
- '21#.#18.33.223':139
- '21#.#18.38.212':139
- '21#.#18.30.33':139
- '21#.#18.142.248':139
- '21#.#18.117.190':139
- '21#.#18.225.42':139
- '21#.#18.172.37':139
- '21#.#18.214.153':139
- '21#.#18.220.64':139
- '21#.#18.113.225':139
- '21#.#18.246.248':139
- '21#.#18.51.44':139
- '21#.#18.229.142':139
- '21#.#18.25.171':139
- '21#.#18.217.51':139
- '21#.#18.82.61':139
- '21#.#18.158.157':139
- '21#.#18.17.77':139
- '21#.#18.118.34':139
- '21#.#18.94.75':139
- '21#.#18.16.121':139
- '21#.#18.184.250':139
- '21#.#18.221.90':139
- '21#.#18.88.57':139
- '21#.#18.17.160':139
- '21#.#18.1.173':139
- '21#.#18.32.58':139
- '21#.#18.82.119':139
- '21#.#18.133.6':139
