Техническая информация
Для обеспечения автозапуска и распространения:
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- <SYSTEM32>\urdvxc.exe /service
- <SYSTEM32>\urdvxc.exe /uninstallservice patch:<Полный путь к вирусу>
- <SYSTEM32>\urdvxc.exe /installservice
- <SYSTEM32>\urdvxc.exe /start
Запускает на исполнение:
- <SYSTEM32>\svchost.exe -k netsvcs
- <SYSTEM32>\dumprep.exe 1136 -dm 7 7 %TEMP%\WER6e85.dir00\svchost.exe.mdmp 16325836412032332
Изменения в файловой системе:
Создает следующие файлы:
- %PROGRAM_FILES%\NetMeeting\rsewzjqn.exe
- %TEMP%\WER6e85.dir00\svchost.exe.mdmp
- <SYSTEM32>\urdvxc.exe
Самоудаляется.
Сетевая активность:
Подключается к:
- '83.#.187.221':139
- '83.#.122.212':445
- '83.#.7.48':445
- '83.#.194.167':139
- '83.#.24.44':139
- '83.#.219.128':139
- '83.#.11.5':139
- '83.#.69.246':445
- '83.#.119.105':445
- '83.#.105.98':445
- '83.#.98.81':445
- '83.#.198.118':445
- '83.#.148.105':445
- '83.#.71.155':445
- '83.#.126.198':445
- '83.#.38.9':139
- '83.#.182.23':139
- '83.#.56.93':139
- '83.#.240.91':139
- '83.#.231.193':139
- '83.#.160.246':139
- '83.#.10.61':139
- '83.#.32.244':139
- '83.#.2.205':139
- '83.#.132.174':139
- '83.#.174.92':139
- '83.#.47.15':139
- '83.#.211.248':139
- '83.#.219.81':139
- '83.#.22.58':139
- '83.#.3.189':445
- '83.#.198.118':139
- '83.#.119.105':139
- '83.#.105.98':139
- '83.#.126.198':139
- '83.#.69.246':139
- '83.#.148.105':139
- '83.#.71.155':139
- '83.#.98.81':139
- '83.#.79.12':139
- '83.#.12.218':139
- '83.#.16.122':139
- '83.#.132.79':139
- '83.#.198.200':139
- '83.#.3.189':139
- '83.#.189.132':139
- '83.#.12.218':445
- '83.#.16.122':445
- '83.#.145.129':445
- '83.#.79.12':445
- '83.#.198.200':445
- '83.#.189.132':445
- '83.#.132.79':445
- '83.#.75.254':445
- '83.#.167.22':445
- '83.#.122.212':139
- '83.#.7.48':139
- '83.#.60.144':445
- '83.#.137.148':445
- '83.#.144.120':445
- '83.#.116.16':445
- '83.#.136.148':139
- '83.#.182.135':139
- '83.#.197.27':139
- '83.#.172.182':139
- '83.#.169.78':139
- '83.#.69.193':139
- '83.#.196.172':139
- '83.#.21.28':139
- '83.#.127.141':139
- '83.#.187.56':139
- '83.#.137.56':445
- '83.#.74.185':139
- '83.#.44.154':139
- '83.#.186.236':139
- '83.#.127.141':445
- '83.#.0.246':139
- '83.#.9.84':139
- '83.#.41.196':139
- '83.#.5.157':139
- '83.#.11.205':139
- '83.#.27.233':139
- '83.#.244.198':139
- '83.#.185.137':139
- '83.#.13.223':139
- '83.#.133.133':139
- '83.#.28.248':139
- '83.#.72.175':139
- '83.#.165.162':139
- '83.#.149.110':139
- '83.#.162.168':139
- '83.#.66.48':445
- '83.#.194.167':445
- '83.#.187.221':445
- '83.#.137.56':139
- '83.#.11.5':445
- '83.#.174.92':445
- '83.#.24.44':445
- '83.#.219.128':445
- '83.#.53.66':139
- '83.#.160.0':139
- '83.#.220.159':139
- '83.#.222.39':139
- '83.#.160.0':445
- '83.#.66.48':139
- '83.#.48.226':139
- '83.#.35.140':139
- '83.#.231.193':445
- '83.#.160.246':445
- '83.#.10.61':445
- '83.#.220.159':445
- '83.#.53.66':445
- '83.#.48.226':445
- '83.#.35.140':445
- '83.#.240.91':445
- '83.#.22.58':445
- '83.#.2.205':445
- '83.#.132.174':445
- '83.#.219.81':445
- '83.#.182.23':445
- '83.#.56.93':445
- '83.#.32.244':445
- '83.#.145.129':139
- '83.#.181.224':139
- '83.#.224.144':139
- '83.#.10.227':139
- '83.#.202.181':139
- '83.#.113.102':139
- '83.#.103.9':139
- '83.#.8.202':139
- '83.#.236.178':139
- '83.#.75.222':139
- '83.#.102.46':139
- '83.#.44.18':139
- '83.#.38.90':139
- '83.#.116.138':139
- '83.#.252.23':139
- '83.#.13.145':139
- '83.#.12.88':445
- '83.#.188.176':445
- '83.#.114.167':445
- '83.#.69.12':445
- '83.#.189.87':445
- '83.#.139.145':445
- '83.#.151.231':445
- '83.#.49.184':445
- '83.#.189.4':139
- '83.#.206.201':139
- '83.#.201.112':139
- '83.#.97.0':139
- '83.#.202.102':445
- '83.#.237.85':445
- '83.#.48.208':139
- '83.#.46.38':139
- '83.#.103.189':139
- '83.#.189.87':139
- '83.#.139.145':139
- '83.#.124.170':139
- '83.#.3.239':139
- '83.#.115.181':139
- '83.#.187.138':139
- '83.#.151.231':139
- '83.#.49.184':139
- '83.#.202.102':139
- '83.#.237.85':139
- '83.#.114.167':139
- '83.#.69.12':139
- '83.#.12.88':139
- '83.#.188.176':139
- '83.#.228.130':139
- '83.#.130.22':139
- '83.#.23.31':139
- '83.#.38.75':139
- '83.#.38.129':139
- '83.#.129.98':139
- '83.#.139.163':139
- '83.#.207.115':139
- '83.#.216.204':139
- '83.#.74.119':139
- '83.#.235.22':139
- '83.#.39.59':139
- '83.#.19.11':139
- '83.#.17.115':139
- '83.#.114.247':139
- '83.#.115.181':9988
- '83.#.48.208':445
- '83.#.97.0':445
- '83.#.124.170':9988
- '83.#.187.138':9988
- '83.#.237.85':9988
- '83.#.216.204':9988
- '83.#.189.4':445
- '83.#.8.202':445
- '83.#.202.181':445
- '83.#.181.224':445
- '83.#.103.9':445
- '83.#.206.201':445
- '83.#.201.112':445
- '83.#.113.102':445
- '83.#.144.120':139
- '83.#.116.16':139
- '83.#.60.144':139
- '83.#.137.148':139
- '83.#.75.254':139
- '83.#.61.1':445
- '83.#.61.1':139
- '83.#.167.22':139
- '83.#.207.115':9988
- '83.#.103.189':9988
- '83.#.139.145':9988
- '83.#.129.98':9988
- '83.#.38.90':9988
- '83.#.188.176':9988
- '83.#.39.59':9988
- '83.#.224.144':445
- '83.#.17.115':445
- '83.#.114.247':445
- '83.#.39.59':445
- '83.#.19.11':445
- '83.#.130.22':445
- '83.#.23.31':445
- '83.#.207.115':445
- '83.#.216.204':445
- '83.#.187.138':445
- '83.#.124.170':445
- '83.#.103.189':445
- '83.#.115.181':445
- '83.#.74.119':445
- '83.#.235.22':445
- '83.#.3.239':445
- '83.#.13.145':445
- '83.#.38.90':445
- '83.#.75.222':445
- '83.#.252.23':445
- '83.#.10.227':445
- '83.#.236.178':445
- '83.#.116.138':445
- '83.#.102.46':445
- '83.#.139.163':445
- '83.#.38.75':445
- '83.#.228.130':445
- '83.#.129.98':445
- '83.#.44.18':445
- '83.#.46.38':445
- '83.#.38.129':445
