Техническая информация
Для обеспечения автозапуска и распространения:
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- '<SYSTEM32>\urdvxc.exe' /service
- '<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Полный путь к вирусу>
- '<SYSTEM32>\urdvxc.exe' /installservice
- '<SYSTEM32>\urdvxc.exe' /start
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1136 -dm 7 7 %TEMP%\WER053e.dir00\svchost.exe.mdmp 16325836412032224
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- <SYSTEM32>\urdvxc.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %TEMP%\WER053e.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
Самоудаляется.
Сетевая активность:
Подключается к:
- '21#.#16.81.146':445
- '21#.#16.4.149':445
- '21#.#16.94.32':445
- '21#.#16.5.251':445
- '21#.#16.150.250':445
- '21#.#16.89.23':445
- '21#.#16.120.67':445
- '21#.#16.207.16':445
- '21#.#16.140.106':445
- '21#.#16.29.10':445
- '21#.#16.130.206':445
- '21#.#16.203.87':445
- '21#.#16.132.84':445
- '21#.#16.94.178':445
- '21#.#16.19.242':445
- '21#.#16.237.176':445
- '21#.#16.170.105':445
- '21#.#16.22.70':445
- '21#.#16.126.45':445
- '21#.#16.230.114':445
- '21#.#16.114.196':445
- '21#.#16.74.242':445
- '21#.#16.142.162':445
- '21#.#16.179.249':445
- '21#.#16.62.58':445
- '21#.#16.162.230':445
- '21#.#16.67.175':445
- '21#.#16.175.94':445
- '21#.#16.23.136':445
- '21#.#16.136.67':445
- '21#.#16.155.254':445
- '21#.#16.124.106':445
- '21#.#16.69.121':445
- '21#.#16.53.156':445
- '21#.#16.29.10':9988
- '21#.#16.150.250':9988
- '21#.#16.67.175':9988
- '21#.#16.230.114':9988
- '21#.#16.62.58':9988
- '21#.#16.142.162':9988
- '21#.#16.12.161':9988
- '21#.#16.74.242':9988
- '21#.#16.119.87':9988
- '21#.#16.130.206':9988
- '21#.#16.124.106':9988
- '21#.#16.114.196':9988
- '21#.#16.136.67':9988
- '21#.#16.81.146':9988
- '21#.#16.237.176':9988
- '21#.#16.94.32':9988
- '21#.#16.69.121':9988
- '21#.#16.166.34':9988
- '21#.#16.104.172':9988
- '21#.#16.4.149':9988
- '21#.#16.179.249':9988
- '21#.#16.133.236':9988
- '21#.#16.1.198':9988
- '21#.#16.102.22':9988
- '21#.#16.180.35':9988
- '21#.#16.22.70':9988
- '21#.#16.162.230':9988
- '21#.#16.53.156':9988
- '21#.#16.89.23':9988
- '21#.#16.23.136':9988
- '21#.#16.83.18':9988
- '21#.#16.132.84':9988
- '21#.#16.5.251':9988
- '21#.#16.185.31':9988
- '21#.#16.22.70':139
- '21#.#16.126.45':139
- '21#.#16.230.114':139
- '21#.#16.114.196':139
- '21#.#16.74.242':139
- '21#.#16.142.162':139
- '21#.#16.179.249':139
- '21#.#16.62.58':139
- '21#.#16.162.230':139
- '21#.#16.67.175':139
- '21#.#16.175.94':139
- '21#.#16.23.136':139
- '21#.#16.136.67':139
- '21#.#16.155.254':139
- '21#.#16.124.106':139
- '21#.#16.69.121':139
- '21#.#16.53.156':139
- '21#.#16.133.236':139
- '21#.#16.48.33':139
- '21#.#16.102.22':139
- '21#.#16.1.198':139
- '21#.#16.47.240':139
- '21#.#16.91.84':139
- '21#.#16.180.35':139
- '21#.#16.12.161':139
- '21#.#16.104.172':139
- '21#.#16.179.212':139
- '21#.#16.119.87':139
- '21#.#16.83.18':139
- '21#.#16.18.202':139
- '21#.#16.133.19':139
- '21#.#16.185.31':139
- '21#.#16.105.34':139
- '21#.#16.166.34':139
- '21#.#16.133.236':445
- '21#.#16.48.33':445
- '21#.#16.102.22':445
- '21#.#16.1.198':445
- '21#.#16.12.161':445
- '21#.#16.47.240':445
- '21#.#16.180.35':445
- '21#.#16.91.84':445
- '21#.#16.104.172':445
- '21#.#16.179.212':445
- '21#.#16.119.87':445
- '21#.#16.83.18':445
- '21#.#16.18.202':445
- '21#.#16.133.19':445
- '21#.#16.185.31':445
- '21#.#16.105.34':445
- '21#.#16.166.34':445
- '21#.#16.81.146':139
- '21#.#16.4.149':139
- '21#.#16.94.32':139
- '21#.#16.5.251':139
- '21#.#16.150.250':139
- '21#.#16.89.23':139
- '21#.#16.120.67':139
- '21#.#16.207.16':139
- '21#.#16.140.106':139
- '21#.#16.29.10':139
- '21#.#16.130.206':139
- '21#.#16.203.87':139
- '21#.#16.132.84':139
- '21#.#16.94.178':139
- '21#.#16.19.242':139
- '21#.#16.237.176':139
- '21#.#16.170.105':139
