Техническая информация
Для обеспечения автозапуска и распространения:
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- '<SYSTEM32>\urdvxc.exe' /service
- '<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Полный путь к вирусу>
- '<SYSTEM32>\urdvxc.exe' /installservice
- '<SYSTEM32>\urdvxc.exe' /start
Запускает на исполнение:
- '<SYSTEM32>\dumprep.exe' 1112 -dm 7 7 %TEMP%\WER9402.dir00\svchost.exe.mdmp 16325836412033108
Скрывает следующие процессы:
- <SYSTEM32>\svchost.exe
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
- %PROGRAM_FILES%\NetMeeting\rsewzjqn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- <SYSTEM32>\urdvxc.exe
- %TEMP%\WER9402.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
Самоудаляется.
Сетевая активность:
Подключается к:
- '21#.#0.211.61':445
- '21#.#0.28.193':445
- '21#.#0.105.135':9988
- '21#.#0.47.42':9988
- '21#.#0.140.131':445
- '21#.#0.112.67':445
- '21#.#0.63.175':445
- '21#.#0.195.221':445
- '21#.#0.142.227':445
- '21#.#0.95.192':9988
- '21#.#0.5.129':9988
- '21#.#0.74.194':9988
- '21#.#0.250.230':9988
- '21#.#0.19.155':9988
- '21#.#0.191.211':9988
- '21#.#0.140.131':9988
- '21#.#0.28.110':9988
- '21#.#0.53.201':9988
- '21#.#0.74.52':445
- '21#.#0.137.198':445
- '21#.#0.190.239':445
- '21#.#0.38.199':445
- '21#.#0.53.201':445
- '21#.#0.98.142':445
- '21#.60.8.96':445
- '21#.#0.95.192':445
- '21#.#0.160.37':445
- '21#.#0.240.55':445
- '21#.#0.214.146':445
- '21#.#0.28.110':445
- '21#.#0.111.230':445
- '21#.#0.38.183':445
- '21#.#0.5.129':445
- '21#.#0.20.169':445
- '21#.#0.22.215':445
- '21#.#0.250.230':445
- '21#.#0.185.147':445
- '21#.#0.56.39':9988
- '21#.#0.61.198':9988
- '21#.#0.74.52':9988
- '21#.#0.47.93':9988
- '21#.#0.240.55':9988
- '21#.#0.221.152':9988
- '21#.#0.122.189':9988
- '21#.#0.38.199':9988
- '21#.#0.214.146':9988
- '21#.#0.50.64':9988
- '21#.#0.56.19':9988
- '21#.#0.79.110':9988
- '21#.#0.142.227':9988
- '21#.#0.160.37':9988
- '21#.#0.211.61':9988
- '21#.#0.185.147':9988
- '21#.#0.189.161':9988
- '21#.#0.51.188':9988
- '21#.#0.113.175':9988
- '21#.#0.111.230':9988
- '21#.#0.112.67':9988
- '21#.#0.38.183':9988
- '21#.#0.190.239':9988
- '21#.#0.239.130':9988
- '21#.#0.22.215':9988
- '21#.#0.195.221':9988
- '21#.#0.28.193':9988
- '21#.#0.63.175':9988
- '21#.#0.98.142':9988
- '21#.60.8.96':9988
- '21#.#0.165.178':9988
- '21#.60.81.2':9988
- '21#.#0.137.198':9988
- '21#.#0.127.43':9988
- '21#.#0.149.85':9988
- '21#.#0.20.169':9988
- '21#.#0.196.62':9988
- '21#.#0.172.41':9988
- '21#.#0.221.152':445
- '21#.#0.149.85':139
- '21#.#0.47.93':139
- '21#.#0.240.55':139
- '21#.#0.160.37':139
- '21#.#0.51.188':139
- '21#.#0.211.61':139
- '21#.#0.61.198':139
- '21#.#0.28.193':139
- '21#.#0.47.42':139
- '21#.#0.142.227':139
- '21#.#0.137.198':139
- '21#.#0.20.169':139
- '21#.#0.38.199':139
- '21#.#0.214.146':139
- '21#.#0.95.192':139
- '21#.#0.221.152':139
- '21#.#0.56.19':139
- '21#.60.8.96':139
- '21#.#0.122.189':139
- '21#.#0.19.155':139
- '21#.60.81.2':139
- '21#.#0.56.39':139
- '21#.#0.196.62':139
- '21#.#0.191.211':139
- '21#.#0.127.43':139
- '21#.#0.131.106':139
- '21#.#0.172.41':139
- '21#.#0.189.161':139
- '21#.#0.112.67':139
- '21#.#0.74.194':139
- '21#.#0.239.130':139
- '21#.#0.79.110':139
- '21#.#0.165.178':139
- '21#.#0.50.64':139
- '21#.#0.105.135':139
- '21#.#0.250.26':139
- '21#.#0.113.175':139
- '21#.#0.111.230':139
- '21#.#0.165.178':445
- '21#.#0.105.135':445
- '21#.#0.239.130':445
- '21#.#0.250.26':445
- '21#.#0.196.62':445
- '21#.#0.50.64':445
- '21#.#0.191.211':445
- '21#.#0.56.39':445
- '21#.#0.113.175':445
- '21#.#0.47.93':445
- '21#.#0.56.19':445
- '21#.#0.74.194':445
- '21#.#0.51.188':445
- '21#.#0.47.42':445
- '21#.#0.79.110':445
- '21#.#0.61.198':445
- '21#.#0.149.85':445
- '21#.#0.122.189':445
- '21#.#0.19.155':445
- '21#.#0.53.201':139
- '21#.#0.28.110':139
- '21#.#0.5.129':139
- '21#.#0.63.175':139
- '21#.#0.38.183':139
- '21#.#0.22.215':139
- '21#.#0.185.147':139
- '21#.#0.98.142':139
- '21#.#0.250.230':139
- '21#.#0.127.43':445
- '21#.#0.131.106':445
- '21#.60.81.2':445
- '21#.#0.189.161':445
- '21#.#0.172.41':445
- '21#.#0.195.221':139
- '21#.#0.190.239':139
- '21#.#0.74.52':139
- '21#.#0.140.131':139
