Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\SA.DAT
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- '<SYSTEM32>\urdvxc.exe' /service
- '<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Полный путь к вирусу>
- '<SYSTEM32>\urdvxc.exe' /installservice
- '<SYSTEM32>\urdvxc.exe' /start
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1132 -dm 7 7 %TEMP%\WER8c7e.dir00\svchost.exe.mdmp 16325836412032084
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- <SYSTEM32>\urdvxc.exe
- %TEMP%\WER8c7e.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
Самоудаляется.
Сетевая активность:
Подключается к:
- '21#.#2.244.9':9988
- '21#.#2.131.7':9988
- '21#.#2.198.105':9988
- '21#.#2.254.237':9988
- '21#.#2.34.74':9988
- '21#.#2.85.36':9988
- '21#.#2.45.111':9988
- '21#.#2.247.123':9988
- '21#.#2.151.174':9988
- '21#.#2.128.73':9988
- '21#.#2.246.120':139
- '21#.52.17.1':139
- '21#.#2.248.59':139
- '21#.#2.43.140':139
- '21#.#2.126.248':139
- '21#.#2.195.230':139
- '21#.#2.38.45':9988
- '21#.#2.174.52':139
- '21#.#2.51.120':139
- '21#.52.96.7':139
- '21#.#2.246.134':9988
- '21#.#2.234.145':445
- '21#.52.6.42':445
- '21#.#2.127.152':445
- '21#.#2.60.244':445
- '21#.#2.161.47':445
- '21#.#2.117.198':445
- '21#.#2.198.105':445
- '21#.#2.43.118':445
- '21#.#2.34.74':445
- '21#.#2.26.108':445
- '21#.#2.153.68':445
- '21#.#2.40.78':445
- '21#.#2.38.45':445
- '21#.#2.116.137':9988
- '21#.#2.144.13':445
- '21#.#2.142.184':445
- '21#.#2.182.51':445
- '21#.#2.135.229':445
- '21#.#2.254.237':445
- '21#.#2.73.78':445
- '21#.#2.36.247':139
- '21#.#2.99.141':139
- '21#.#2.255.143':139
- '21#.#2.30.250':139
- '21#.#2.255.27':139
- '21#.#2.28.59':139
- '21#.#2.196.33':139
- '21#.#2.7.217':139
- '21#.#2.47.19':139
- '21#.#2.37.223':139
- '21#.#2.93.22':139
- '21#.#2.89.151':139
- '21#.#2.196.18':139
- '21#.#2.217.124':139
- '21#.#2.182.166':139
- '21#.#2.167.130':139
- '21#.#2.149.187':139
- '21#.#2.83.202':139
- '21#.#2.74.51':139
- '21#.#2.22.232':139
- '21#.#2.53.111':139
- '21#.#2.93.16':139
- '21#.#2.169.179':139
- '21#.#2.75.169':139
- '21#.#2.82.216':139
- '21#.#2.78.26':139
- '21#.#2.150.245':139
- '21#.#2.133.250':139
- '21#.#2.16.221':139
- '21#.#2.9.183':139
- '21#.#2.36.185':139
- '21#.#2.177.199':139
- '21#.#2.97.86':139
- '21#.#2.11.81':139
- '21#.#2.214.16':139
- '21#.#2.136.77':139
- '21#.52.7.16':139
- '21#.#2.37.143':139
- '21#.#2.142.77':139
- '21#.#2.96.80':139
- '21#.#2.25.165':139
- '21#.#2.171.230':139
- '21#.#2.217.128':139
- '21#.#2.107.22':139
- '21#.#2.131.7':139
- '21#.#2.8.246':139
- '21#.#2.116.130':139
- '21#.#2.175.93':139
- '21#.#2.93.207':139
- '21#.#2.151.174':139
- '21#.#2.172.250':139
- '21#.#2.135.167':139
- '21#.52.6.42':139
- '21#.#2.34.74':139
- '21#.#2.127.152':139
- '21#.#2.60.244':139
- '21#.#2.182.51':139
- '21#.#2.198.105':139
- '21#.#2.244.9':139
- '21#.#2.117.198':139
- '21#.#2.26.108':139
- '21#.#2.43.118':139
- '21#.#2.23.74':139
- '21#.#2.235.214':139
- '21#.#2.12.58':139
- '21#.#2.201.206':139
- '21#.#2.128.73':139
- '21#.#2.67.25':139
- '21#.#2.45.111':139
- '21#.#2.246.134':139
- '21#.#2.107.246':139
- '21#.#2.116.137':139
- '21#.#2.85.36':139
- '21#.#2.60.125':139
- '21#.#2.127.110':139
- '21#.#2.88.55':139
- '21#.#2.86.212':139
- '21#.#2.199.86':139
- '21#.#2.84.113':139
- '21#.#2.159.172':139
- '21#.#2.224.46':139
- '21#.#2.164.39':139
- '21#.#2.247.123':139
- '21#.#2.234.145':139
- '21#.#2.199.86':445
- '21#.#2.88.55':445
- '21#.#2.86.212':445
- '21#.#2.93.207':445
- '21#.#2.23.74':445
- '21#.#2.247.123':445
- '21#.#2.224.46':445
- '21#.#2.127.110':445
- '21#.#2.60.125':445
- '21#.#2.164.39':445
- '21#.#2.131.7':445
- '21#.#2.217.128':445
- '21#.#2.116.130':445
- '21#.#2.244.9':445
- '21#.#2.8.246':445
- '21#.#2.151.174':445
- '21#.#2.175.93':445
- '21#.#2.135.167':445
- '21#.#2.107.22':445
- '21#.#2.172.250':445
- '21#.#2.159.172':445
- '21#.#2.153.68':139
- '21#.#2.40.78':139
- '21#.#2.38.45':139
- '21#.#2.45.111':445
- '21#.#2.144.13':139
- '21#.#2.142.184':139
- '21#.#2.161.47':139
- '21#.#2.254.237':139
- '21#.#2.135.229':139
- '21#.#2.73.78':139
- '21#.#2.67.25':445
- '21#.#2.107.246':445
- '21#.#2.201.206':445
- '21#.#2.128.73':445
- '21#.#2.84.113':445
- '21#.#2.85.36':445
- '21#.#2.246.134':445
- '21#.#2.116.137':445
- '21#.#2.12.58':445
- '21#.#2.235.214':445
