Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\SA.DAT
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- '<SYSTEM32>\urdvxc.exe' /service
- '<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Полный путь к вирусу>
- '<SYSTEM32>\urdvxc.exe' /installservice
- '<SYSTEM32>\urdvxc.exe' /start
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1120 -dm 7 7 %TEMP%\WERf8aa.dir00\svchost.exe.mdmp 16325836412032068
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- <SYSTEM32>\urdvxc.exe
- %TEMP%\WERf8aa.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
Самоудаляется.
Сетевая активность:
Подключается к:
- '21#.#61.25.97':9988
- '21#.#61.225.235':9988
- '21#.#61.107.117':9988
- '21#.#61.160.150':9988
- '21#.#61.73.5':445
- '21#.#61.86.66':445
- '21#.#61.123.124':445
- '21#.#61.106.49':445
- '21#.#61.233.139':445
- '21#.#61.205.150':9988
- '21#.#61.189.152':9988
- '21#.#61.67.236':9988
- '21#.#61.79.228':9988
- '21#.#61.134.86':9988
- '21#.#61.132.61':9988
- '21#.#61.232.125':9988
- '21#.#61.64.218':9988
- '21#.#61.150.178':9988
- '21#.#61.11.226':9988
- '21#.#61.196.38':445
- '21#.#61.83.193':445
- '21#.#61.61.12':445
- '21#.#61.232.125':445
- '21#.#61.4.120':445
- '21#.#61.222.140':445
- '21#.#61.34.166':445
- '21#.#61.105.114':445
- '21#.#61.64.218':445
- '21#.#61.197.85':445
- '21#.#61.73.90':445
- '21#.#61.140.238':445
- '21#.#61.150.178':445
- '21#.#61.158.147':445
- '21#.#61.132.61':445
- '21#.#61.17.98':445
- '21#.#61.11.226':445
- '21#.#61.27.48':445
- '21#.#61.205.150':445
- '21#.#61.26.69':445
- '21#.#61.20.142':9988
- '21#.#61.17.98':9988
- '21#.#61.197.85':9988
- '21#.#61.222.140':9988
- '21#.#61.26.69':9988
- '21#.#61.154.222':9988
- '21#.#61.105.167':9988
- '21#.#61.143.10':9988
- '21#.#61.83.193':9988
- '21#.#61.123.124':9988
- '21#.#61.13.19':9988
- '21#.#61.131.151':139
- '21#.#61.4.120':9988
- '21#.#61.235.61':139
- '21#.#61.197.94':139
- '21#.#61.106.49':9988
- '21#.#61.158.147':9988
- '21#.#61.34.166':9988
- '21#.#61.140.238':9988
- '21#.#61.73.5':9988
- '21#.#61.138.1':9988
- '21#.#61.253.93':9988
- '21#.#61.150.218':9988
- '21#.#61.130.149':9988
- '21#.#61.109.148':9988
- '21#.#61.153.179':9988
- '21#.#61.149.203':9988
- '21#.#61.10.131':9988
- '21#.#61.207.238':9988
- '21#.#61.41.157':9988
- '21#.#61.108.29':9988
- '21#.#61.27.48':9988
- '21#.#61.196.38':9988
- '21#.#61.233.139':9988
- '21#.#61.105.114':9988
- '21#.#61.154.248':9988
- '21#.#61.86.66':9988
- '21#.#61.73.90':9988
- '21#.#61.9.127':9988
- '21#.#61.18.4':9988
- '21#.#61.18.4':139
- '21#.#61.222.140':139
- '21#.#61.140.238':139
- '21#.#61.64.218':139
- '21#.#61.11.226':139
- '21#.#61.9.127':139
- '21#.#61.108.29':139
- '21#.#61.205.150':139
- '21#.#61.154.248':139
- '21#.#61.232.125':139
- '21#.#61.83.193':139
- '21#.#61.26.69':139
- '21#.#61.27.48':139
- '21#.#61.132.61':139
- '21#.#61.61.12':139
- '21#.#61.107.117':139
- '21#.#61.197.85':139
- '21#.#61.105.114':139
- '21#.#61.73.90':139
- '21#.#61.41.157':139
- '21#.#61.134.86':139
- '21#.#61.79.228':139
- '21#.#61.109.148':139
- '21#.#61.25.97':139
- '21#.#61.143.10':139
- '21#.#61.153.179':139
- '21#.#61.150.218':139
- '21#.#61.10.131':139
- '21#.#61.160.150':139
- '21#.#61.207.238':139
- '21#.#61.154.222':139
- '21#.#61.138.1':139
- '21#.#61.253.93':139
- '21#.#61.105.167':139
- '21#.#61.189.152':139
- '21#.#61.225.235':139
- '21#.#61.20.142':139
- '21#.#61.149.203':139
- '21#.#61.130.149':139
- '21#.#61.34.166':139
- '21#.#61.189.152':445
- '21#.#61.149.203':445
- '21#.#61.105.167':445
- '21#.#61.138.1':445
- '21#.#61.130.149':445
- '21#.#61.207.238':445
- '21#.#61.109.148':445
- '21#.#61.225.235':445
- '21#.#61.20.142':445
- '21#.#61.154.222':445
- '21#.#61.107.117':445
- '21#.#61.18.4':445
- '21#.#61.13.19':445
- '21#.#61.67.236':445
- '21#.#61.154.248':445
- '21#.#61.41.157':445
- '21#.#61.253.93':445
- '21#.#61.9.127':445
- '21#.#61.108.29':445
- '21#.#61.25.97':445
- '21#.#61.158.147':139
- '21#.#61.233.139':139
- '21#.#61.196.38':139
- '21#.#61.106.49':139
- '21#.#61.4.120':139
- '21#.#61.150.178':139
- '21#.#61.67.236':139
- '21#.#61.17.98':139
- '21#.#61.13.19':139
- '21#.#61.73.5':139
- '21#.#61.143.10':445
- '21#.#61.160.150':445
- '21#.#61.134.86':445
- '21#.#61.79.228':445
- '21#.#61.10.131':445
- '21#.#61.86.66':139
- '21#.#61.123.124':139
- '21#.#61.150.218':445
- '21#.#61.153.179':445
