Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\SA.DAT
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- '<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Полный путь к вирусу>
- '<SYSTEM32>\urdvxc.exe' /service
- '<SYSTEM32>\urdvxc.exe' /installservice
- '<SYSTEM32>\urdvxc.exe' /start
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1120 -dm 7 7 %TEMP%\WERe324.dir00\svchost.exe.mdmp 16325836412032868
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- <SYSTEM32>\urdvxc.exe
- %TEMP%\WERe324.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
Самоудаляется.
Сетевая активность:
Подключается к:
- '14.##.110.113':139
- '14.##.44.172':139
- '14.##.111.90':139
- '14.##.94.225':139
- '14.#8.92.89':139
- '14.##.65.181':139
- '14.##.177.53':139
- '14.##.53.162':139
- '14.##.70.177':139
- '14.#8.84.86':139
- '14.##.21.171':139
- '14.##.118.92':139
- '14.#8.216.1':9988
- '14.##.27.175':9988
- '14.##.169.13':9988
- '14.##.43.159':9988
- '14.#8.80.94':9988
- '14.##.201.43':139
- '14.##.170.11':139
- '14.#8.11.49':139
- '14.##.215.211':139
- '14.##.117.224':139
- '14.##.85.174':139
- '14.#8.3.220':445
- '14.##.11.231':445
- '14.##.90.149':445
- '14.##.60.182':9988
- '14.#8.3.220':9988
- '14.##.47.230':445
- '14.#8.18.6':445
- '14.#8.60.30':445
- '14.##.14.227':445
- '14.##.62.148':445
- '14.#8.23.6':445
- '14.##.166.199':9988
- '14.##.113.233':9988
- '14.##.24.192':9988
- '14.##.226.105':9988
- '14.##.241.194':139
- '14.##.146.73':9988
- '14.##.108.191':9988
- '14.##.254.23':9988
- '14.##.40.232':9988
- '14.##.58.111':9988
- '14.#8.23.6':9988
- '14.##.62.148':9988
- '14.##.253.93':9988
- '14.##.121.122':445
- '14.##.34.221':445
- '14.##.141.199':445
- '14.#8.3.151':139
- '14.##.173.29':139
- '14.##.141.199':139
- '14.##.215.211':445
- '14.##.65.181':445
- '14.##.85.174':445
- '14.##.121.122':139
- '14.##.34.221':139
- '14.##.168.81':139
- '14.#8.52.50':139
- '14.##.102.52':139
- '14.##.114.81':139
- '14.##.153.24':139
- '14.##.193.167':139
- '14.##.119.34':139
- '14.#8.15.17':139
- '14.##.75.168':139
- '14.#8.12.4':139
- '14.##.34.106':139
- '14.##.106.12':139
- '14.##.53.162':445
- '14.##.181.47':9988
- '14.##.177.53':445
- '14.##.241.194':445
- '14.##.70.177':445
- '14.##.225.166':9988
- '14.##.83.241':9988
- '14.##.207.83':9988
- '14.##.207.84':9988
- '14.##.36.215':9988
- '14.#8.51.95':9988
- '14.##.110.113':445
- '14.##.117.224':445
- '14.##.201.43':445
- '14.##.44.172':445
- '14.##.94.225':445
- '14.##.21.171':445
- '14.#8.11.49':445
- '14.#8.92.89':445
- '14.#8.84.86':445
- '14.##.118.92':445
- '14.##.170.11':445
- '14.##.111.90':445
- '14.##.170.253':139
- '14.##.24.192':139
- '14.##.130.170':139
- '14.#8.49.63':139
- '14.##.232.129':139
- '14.##.253.93':139
- '14.##.43.159':139
- '14.#8.51.95':139
- '14.##.36.215':139
- '14.##.169.13':139
- '14.##.105.85':139
- '14.#8.14.92':139
- '14.#8.18.6':139
- '14.##.62.148':139
- '14.##.121.16':139
- '14.##.14.227':139
- '14.#8.60.30':139
- '14.#8.24.13':139
- '14.##.144.156':139
- '14.##.107.14':139
- '14.##.108.191':139
- '14.##.130.217':139
- '14.##.217.40':139
- '14.#8.51.75':139
- '14.##.58.111':139
- '14.##.75.111':139
- '14.##.113.233':139
- '14.##.226.105':139
- '14.##.91.197':139
- '14.##.176.208':139
- '14.##.25.184':139
- '14.##.254.23':139
- '14.##.166.199':139
- '14.#8.80.94':139
- '14.##.83.241':139
- '14.##.194.146':139
- '14.##.225.166':139
- '14.##.181.47':139
- '14.##.207.84':139
- '14.##.27.175':139
- '14.##.60.182':139
- '14.##.146.73':139
- '14.##.40.232':139
- '14.#8.216.1':139
- '14.##.149.210':139
- '14.##.207.83':139
- '14.##.11.231':139
- '14.##.105.85':445
- '14.##.36.215':445
- '14.##.169.13':445
- '14.##.130.170':445
- '14.##.253.93':445
- '14.##.43.159':445
- '14.#8.51.95':445
- '14.##.207.84':445
- '14.##.27.175':445
- '14.##.194.146':445
- '14.##.181.47':445
- '14.##.24.192':445
- '14.##.144.156':445
- '14.##.108.191':445
- '14.##.217.40':445
- '14.##.121.16':445
- '14.##.130.217':445
- '14.#8.24.13':445
- '14.##.170.253':445
- '14.##.232.129':445
- '14.#8.49.63':445
- '14.##.107.14':445
- '14.#8.14.92':445
- '14.##.226.105':445
- '14.##.254.23':445
- '14.##.166.199':445
- '14.##.83.241':445
- '14.##.113.233':445
- '14.#8.80.94':445
- '14.##.90.149':139
- '14.##.47.230':139
- '14.#8.3.220':139
- '14.##.176.208':445
- '14.#8.23.6':139
- '14.##.75.111':445
- '14.##.207.83':445
- '14.##.149.210':445
- '14.##.60.182':445
- '14.##.225.166':445
- '14.##.40.232':445
- '14.#8.216.1':445
- '14.##.91.197':445
- '14.##.25.184':445
- '14.##.58.111':445
- '14.##.146.73':445
- '14.#8.51.75':445
