Техническая информация
Для обеспечения автозапуска и распространения:
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- '<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Полный путь к вирусу>
- '<SYSTEM32>\urdvxc.exe' /service
- '<SYSTEM32>\urdvxc.exe' /installservice
- '<SYSTEM32>\urdvxc.exe' /start
Запускает на исполнение:
- '<SYSTEM32>\dumprep.exe' 1140 -dm 7 7 %TEMP%\WER80c6.dir00\svchost.exe.mdmp 16325836412032376
Изменения в файловой системе:
Создает следующие файлы:
- <SYSTEM32>\urdvxc.exe
Самоудаляется.
Сетевая активность:
Подключается к:
- '66.##.58.194':445
- '66.##.162.241':445
- '66.#5.147.1':9988
- '66.##.21.227':445
- '66.##.245.86':445
- '66.##.212.45':445
- '66.##.17.103':445
- '66.##.179.200':445
- '66.#5.65.14':445
- '66.##.93.244':9988
- '66.#5.58.17':9988
- '66.##.150.154':9988
- '66.#5.21.17':9988
- '66.##.68.188':9988
- '66.##.86.129':9988
- '66.##.179.200':9988
- '66.#5.65.14':9988
- '66.##.65.101':9988
- '66.##.35.245':9988
- '66.##.86.129':445
- '66.##.223.251':445
- '66.##.136.227':445
- '66.##.114.217':445
- '66.#5.4.105':445
- '66.#5.58.17':445
- '66.##.192.76':445
- '66.##.225.206':445
- '66.##.11.116':445
- '66.##.103.247':445
- '66.#5.27.70':445
- '66.##.99.120':445
- '66.##.244.199':445
- '66.##.251.132':445
- '66.##.76.104':445
- '66.##.68.188':445
- '66.#5.133.5':445
- '66.#5.7.217':445
- '66.##.18.137':445
- '66.#5.21.17':445
- '66.##.210.58':9988
- '66.##.129.253':9988
- '66.##.149.72':9988
- '66.##.38.157':9988
- '66.##.225.206':9988
- '66.##.244.199':9988
- '66.#5.99.25':9988
- '66.##.223.251':9988
- '66.#5.4.105':9988
- '66.##.99.120':9988
- '66.##.192.76':9988
- '66.#5.71.2':9988
- '66.##.220.160':9988
- '66.##.251.132':9988
- '66.#5.7.217':9988
- '66.##.21.227':9988
- '66.##.119.116':9988
- '66.##.115.241':9988
- '66.#5.51.90':9988
- '66.##.105.207':9988
- '66.##.103.163':9988
- '66.#5.133.5':9988
- '66.##.114.217':9988
- '66.##.76.104':9988
- '66.##.116.70':9988
- '66.##.58.194':9988
- '66.#5.32.17':9988
- '66.##.136.227':9988
- '66.##.103.247':9988
- '66.##.11.116':9988
- '66.##.18.137':9988
- '66.#5.73.7':9988
- '66.##.121.134':9988
- '66.#5.27.70':9988
- '66.##.245.86':9988
- '66.##.157.141':9988
- '66.##.127.74':9988
- '66.##.72.119':9988
- '66.##.186.127':9988
- '66.#5.4.105':139
- '66.##.103.163':139
- '66.##.192.76':139
- '66.##.65.101':139
- '66.##.220.160':139
- '66.##.105.207':139
- '66.##.116.70':139
- '66.##.149.72':139
- '66.##.225.206':139
- '66.#5.133.5':139
- '66.##.114.217':139
- '66.##.21.227':139
- '66.##.179.200':139
- '66.##.251.132':139
- '66.##.11.116':139
- '66.##.103.247':139
- '66.##.17.103':139
- '66.##.223.251':139
- '66.##.136.227':139
- '66.#5.32.17':139
- '66.##.93.244':139
- '66.#5.51.90':139
- '66.##.121.134':139
- '66.##.186.127':139
- '66.#5.99.25':139
- '66.#5.147.1':139
- '66.##.129.253':139
- '66.##.127.74':139
- '66.##.38.157':139
- '66.##.115.241':139
- '66.##.119.116':139
- '66.#5.27.70':139
- '66.##.35.245':139
- '66.##.150.154':139
- '66.##.72.119':139
- '66.##.210.58':139
- '66.#5.71.2':139
- '66.##.157.141':139
- '66.#5.73.7':139
- '66.#5.71.2':445
- '66.##.210.58':445
- '66.##.119.116':445
- '66.##.150.154':445
- '66.#5.73.7':445
- '66.##.121.134':445
- '66.##.127.74':445
- '66.##.115.241':445
- '66.##.186.127':445
- '66.##.35.245':445
- '66.##.149.72':445
- '66.#5.32.17':445
- '66.##.65.101':445
- '66.##.103.163':445
- '66.##.220.160':445
- '66.##.72.119':445
- '66.##.105.207':445
- '66.##.157.141':445
- '66.##.116.70':445
- '66.#5.99.25':445
- '66.##.18.137':139
- '66.#5.21.17':139
- '66.##.99.120':139
- '66.##.212.45':139
- '66.#5.7.217':139
- '66.#5.58.17':139
- '66.##.244.199':139
- '66.##.245.86':139
- '66.##.162.241':139
- '66.##.68.188':139
- '66.##.129.253':445
- '66.##.93.244':445
- '66.##.38.157':445
- '66.#5.147.1':445
- '66.#5.51.90':445
- '66.##.58.194':139
- '66.##.86.129':139
- '66.#5.65.14':139
- '66.##.76.104':139
