Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\SA.DAT
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe' -k netsvcs
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
Сетевая активность:
Подключается к:
- '14.#.207.127':139
- '14.#.17.236':139
- '14.#.73.244':139
- '14.#.39.31':139
- '14.#.202.125':139
- '14.#.75.211':139
- '14.#.215.63':139
- '14.#.107.180':139
- '14.#.24.234':139
- '14.#.96.180':139
- '14.#.163.12':139
- '14.#.195.180':139
- '14.#.95.20':139
- '14.#.6.241':139
- '14.#.246.150':139
- '14.#.225.33':139
- '14.#.71.224':139
- '14.#.137.8':139
- '14.#.175.186':139
- '14.#.50.40':139
- '14.#.91.231':139
- '14.#.181.54':139
- '14.#.46.193':139
- '14.#.210.216':139
- '14.#.190.180':139
- '14.#.94.240':139
- '14.#.138.154':139
- '14.#.195.190':139
- '14.#.183.195':139
- '14.#.49.180':139
- '14.#.36.134':139
- '14.#.16.36':139
- '14.#.6.204':139
- '14.#.95.135':139
- '14.#.69.61':139
- '14.#.31.83':139
- '14.#.91.55':139
- '14.#.243.63':139
- '14.#.113.183':139
- '14.#.228.120':445
- '14.#.50.229':445
- '14.#.151.172':445
- '14.#.129.207':445
- '14.#.51.250':445
- '14.#.182.233':445
- '14.#.169.182':445
- '14.#.25.199':445
- '14.#.233.164':445
- '14.#.69.240':445
- '14.#.27.120':445
- '14.#.151.82':445
- '14.#.39.76':445
- '14.#.69.28':445
- '14.#.81.237':445
- '14.#.5.65':445
- '14.#.120.34':445
- '14.#.43.50':445
- '14.#.111.224':445
- '14.#.66.169':445
- '14.#.30.251':445
- '14.#.252.139':445
- '14.#.219.184':445
- '14.#.155.219':445
- '14.#.89.51':445
- '14.#.207.199':139
- '14.#.65.64':139
- '14.#.32.144':445
- '14.#.23.177':445
- '14.#.147.79':445
- '14.#.114.54':445
- '14.#.230.244':445
- '14.#.147.66':445
- '14.#.0.94':445
- '14.#.44.13':445
- '14.#.184.206':445
- '14.#.19.200':445
- '14.#.130.56':445
- '14.#.108.226':445
- '14.#.121.2':445
- '14.#.27.114':445
- '14.#.94.240':445
- '14.#.138.154':445
- '14.#.160.67':445
- '14.#.158.85':445
- '14.#.124.158':445
- '14.#.71.102':445
- '14.#.85.71':445
- '14.#.183.195':445
- '14.#.49.180':445
- '14.#.46.193':445
- '14.#.31.83':445
- '14.#.91.55':445
- '14.#.210.216':445
- '14.#.190.180':445
- '14.#.195.190':445
- '14.#.91.231':445
- '14.#.181.54':445
- '14.#.78.124':445
- '14.#.94.170':139
- '14.#.59.38':139
- '14.#.81.51':139
- '14.#.81.161':139
- '14.#.198.85':139
- '14.#.222.171':139
- '14.#.15.174':139
- '14.#.95.185':139
- '14.#.53.26':139
- '14.#.240.111':139
- '14.#.213.174':139
- '14.#.3.250':139
- '14.#.174.78':445
- '14.#.174.173':445
- '14.#.224.223':139
- '14.#.199.49':139
- '14.#.29.184':139
- '14.#.244.82':139
- '14.#.106.143':139
- '14.#.95.20':445
- '14.#.6.241':445
- '14.#.207.199':445
- '14.#.65.64':445
- '14.#.163.12':445
- '14.#.137.8':445
- '14.#.175.186':445
- '14.#.195.180':445
- '14.#.246.150':445
- '14.#.174.173':139
- '14.#.160.67':139
- '14.#.71.102':139
- '14.#.121.2':139
- '14.#.27.114':139
- '14.#.85.71':139
- '14.#.78.124':139
- '14.#.174.78':139
- '14.#.158.85':139
- '14.#.124.158':139
- '14.#.225.33':445
- '14.#.6.204':445
- '14.#.95.135':445
- '14.#.215.63':445
- '14.#.50.40':445
- '14.#.36.134':445
- '14.#.243.63':445
- '14.#.113.183':445
- '14.#.16.36':445
- '14.#.69.61':445
- '14.#.75.211':445
- '14.#.73.244':445
- '14.#.39.31':445
- '14.#.71.224':445
- '14.#.96.180':445
- '14.#.207.127':445
- '14.#.107.180':445
- '14.#.24.234':445
- '14.#.17.236':445
- '14.#.202.125':445
- '14.#.166.75':445
- '14.#.255.47':445
- '14.#.113.241':139
- '14.#.63.246':139
- '14.#.14.153':139
- '14.#.106.4':445
- '14.#.0.156':445
- '14.#.87.77':445
- '14.#.249.204':445
- '14.#.216.156':445
- '14.#.142.109':139
- '14.#.6.114':139
- '14.#.22.10':139
- '14.#.252.189':139
- '14.#.63.187':139
- '14.#.53.111':139
- '14.#.65.121':139
- '14.#.202.170':139
- '14.#.95.117':139
- '14.#.136.145':139
- '14.#.114.109':445
- '14.#.187.162':445
- '14.#.98.183':445
- '14.#.46.7':445
- '14.#.9.113':445
- '14.#.152.32':445
- '14.#.2.20':445
- '14.#.57.76':445
- '14.#.26.22':445
- '14.#.111.99':445
- '14.#.72.206':445
- '14.#.5.4':445
- '14.#.116.218':445
- '14.#.196.23':445
- '14.#.34.114':445
- '14.#.98.109':445
- '14.#.110.214':445
- '14.#.152.82':445
- '14.#.17.63':445
- '14.#.10.224':445
- '14.#.5.4':139
- '14.#.98.109':139
- '14.#.204.65':139
- '14.#.116.218':139
- '14.#.10.224':139
- '14.#.255.47':139
- '14.#.187.162':139
- '14.#.17.63':139
- '14.#.110.214':139
- '14.#.34.114':139
- '14.#.216.156':139
- '14.#.87.77':139
- '14.#.0.156':139
- '14.#.106.4':139
- '14.#.249.204':139
- '14.#.114.109':139
- '14.#.196.23':139
- '14.#.152.82':139
- '14.#.72.206':139
- '14.#.98.183':139
- '14.#.174.121':139
- '14.#.33.9':139
- '14.#.152.171':139
- '14.#.130.191':139
- '14.#.23.85':139
- '14.#.113.241':445
- '14.#.81.159':139
- '14.#.77.99':139
- '14.#.139.14':139
- '14.#.46.7':139
- '14.#.26.22':139
- '14.#.152.32':139
- '14.#.205.81':139
- '14.#.9.113':139
- '14.#.111.99':139
- '14.#.34.68':139
- '14.#.49.115':139
- '14.#.57.76':139
- '14.#.2.20':139
- '14.#.182.233':139
- '14.#.169.182':139
- '14.#.25.199':139
- '14.#.233.164':139
- '14.#.66.169':139
- '14.#.114.54':139
- '14.#.108.226':139
- '14.#.147.66':139
- '14.#.0.94':139
- '14.#.51.250':139
- '14.#.120.34':139
- '14.#.5.65':139
- '14.#.43.50':139
- '14.#.111.224':139
- '14.#.69.240':139
- '14.#.228.120':139
- '14.#.50.229':139
- '14.#.151.172':139
- '14.#.129.207':139
- '14.#.44.13':139
- '14.#.45.210':445
- '14.#.45.231':445
- '14.#.32.144':139
- '14.#.23.177':139
- '14.#.122.45':445
- '14.#.87.238':445
- '14.#.183.129':445
- '14.#.96.244':445
- '14.#.176.38':445
- '14.#.89.51':139
- '14.#.147.79':139
- '14.#.184.206':139
- '14.#.130.56':139
- '14.#.230.244':139
- '14.#.219.184':139
- '14.#.155.219':139
- '14.#.30.251':139
- '14.#.19.200':139
- '14.#.252.139':139
- '14.#.22.10':445
- '14.#.14.153':445
- '14.#.63.246':445
- '14.#.136.145':445
- '14.#.202.170':445
- '14.#.142.109':445
- '14.#.23.85':445
- '14.#.53.111':445
- '14.#.65.121':445
- '14.#.95.117':445
- '14.#.152.171':445
- '14.#.139.14':445
- '14.#.34.68':445
- '14.#.49.115':445
- '14.#.174.121':445
- '14.#.252.189':445
- '14.#.6.114':445
- '14.#.33.9':445
- '14.#.81.159':445
- '14.#.130.191':445
- '14.#.122.45':139
- '14.#.176.38':139
- '14.#.166.75':139
- '14.#.96.244':139
- '14.#.27.120':139
- '14.#.151.82':139
- '14.#.81.237':139
- '14.#.69.28':139
- '14.#.39.76':139
- '14.#.183.129':139
- '14.#.63.187':445
- '14.#.63.246':9988
- '14.#.77.99':445
- '14.#.205.81':445
- '14.#.136.145':9988
- '14.#.45.231':139
- '14.#.87.238':139
- '14.#.113.241':9988
- '14.#.45.210':139
