Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\SA.DAT
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe' -k netsvcs
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
Сетевая активность:
Подключается к:
- '64.##3.24.55':9988
- '64.##3.218.88':9988
- '64.#53.8.18':9988
- '64.##3.94.65':9988
- '64.##3.155.11':9988
- '64.##3.191.129':9988
- '64.##3.247.42':9988
- '64.##3.95.152':9988
- '64.##3.219.114':9988
- '64.##3.161.135':9988
- '64.##3.138.37':9988
- '64.##3.173.0':139
- '64.##3.25.14':139
- '64.##3.167.76':139
- '64.##3.202.248':139
- '64.##3.154.36':139
- '64.##3.177.110':9988
- '64.##3.2.218':9988
- '64.##3.116.61':9988
- '64.##3.112.250':9988
- '64.##3.110.54':9988
- '64.#53.9.36':9988
- '64.##3.154.91':9988
- '64.##3.97.146':445
- '64.##3.219.114':445
- '64.##3.58.15':445
- '64.##3.22.159':9988
- '64.##3.116.61':445
- '64.##3.218.88':445
- '64.##3.220.179':445
- '64.##3.138.37':445
- '64.##3.67.142':445
- '64.##3.52.160':445
- '64.##3.192.220':445
- '64.##3.118.210':9988
- '64.##3.234.183':9988
- '64.##3.160.118':9988
- '64.##3.109.212':9988
- '64.##3.168.92':9988
- '64.##3.58.15':9988
- '64.##3.185.21':9988
- '64.##3.53.36':9988
- '64.##3.22.202':9988
- '64.##3.66.105':9988
- '64.##3.255.31':9988
- '64.##3.28.38':139
- '64.##3.191.111':139
- '64.##3.17.239':139
- '64.##3.179.168':139
- '64.##3.0.117':139
- '64.#53.35.0':139
- '64.##3.136.170':139
- '64.##3.131.192':139
- '64.##3.192.126':139
- '64.##3.225.161':139
- '64.##3.214.201':139
- '64.##3.13.34':139
- '64.##3.79.121':139
- '64.##3.195.16':139
- '64.##3.7.165':139
- '64.##3.144.77':139
- '64.##3.196.61':139
- '64.##3.227.203':139
- '64.##3.125.45':139
- '64.##3.13.168':139
- '64.##3.68.230':139
- '64.##3.204.59':139
- '64.##3.14.240':139
- '64.##3.2.141':139
- '64.##3.114.219':139
- '64.##3.129.191':139
- '64.##3.15.74':139
- '64.##3.224.141':139
- '64.##3.43.150':139
- '64.##3.219.74':139
- '64.##3.244.205':139
- '64.##3.97.121':139
- '64.##3.98.152':139
- '64.##3.200.190':139
- '64.##3.76.167':139
- '64.##3.251.15':139
- '64.##3.128.49':139
- '64.##3.131.250':139
- '64.##3.84.252':139
- '64.##3.127.92':139
- '64.##3.247.148':139
- '64.#53.14.5':139
- '64.##3.87.175':139
- '64.##3.149.122':139
- '64.##3.28.145':139
- '64.##3.135.98':139
- '64.##3.145.139':445
- '64.##3.37.155':139
- '64.##3.52.192':139
- '64.##3.22.159':139
- '64.#53.8.18':139
- '64.##3.66.105':139
- '64.##3.24.55':139
- '64.##3.14.68':139
- '64.##3.102.61':139
- '64.##3.151.185':139
- '64.##3.144.38':139
- '64.##3.180.101':139
- '64.##3.220.179':139
- '64.##3.135.79':139
- '64.##3.27.163':139
- '64.##3.219.114':139
- '64.##3.145.139':139
- '64.##3.138.37':139
- '64.##3.23.96':139
- '64.##3.67.142':139
- '64.##3.247.42':139
- '64.##3.161.135':139
- '64.##3.255.31':139
- '64.##3.168.92':139
- '64.##3.160.118':139
- '64.##3.53.36':139
- '64.##3.191.129':139
- '64.##3.186.170':139
- '64.##3.94.65':139
- '64.##3.118.210':139
- '64.##3.95.152':139
- '64.##3.15.130':139
- '64.##3.177.110':139
- '64.##3.2.218':139
- '64.##3.155.11':139
- '64.##3.234.183':139
- '64.##3.50.205':139
- '64.##3.112.250':139
- '64.#53.9.36':139
- '64.##3.110.54':139
- '64.##3.109.212':139
- '64.##3.200.237':139
- '64.##3.161.41':139
- '64.##3.22.202':139
- '64.##3.154.91':139
- '64.##3.185.21':139
- '64.##3.218.88':139
- '64.##3.14.68':445
- '64.##3.151.185':445
- '64.##3.144.38':445
- '64.##3.52.192':445
- '64.##3.180.101':445
- '64.#53.9.36':445
- '64.##3.112.250':445
- '64.##3.234.183':445
- '64.##3.110.54':445
- '64.##3.102.61':445
- '64.##3.168.92':445
- '64.##3.23.96':445
- '64.##3.66.105':445
- '64.##3.247.42':445
- '64.##3.27.163':445
- '64.##3.135.79':445
- '64.##3.161.135':445
- '64.##3.22.159':445
- '64.##3.24.55':445
- '64.##3.255.31':445
- '64.#53.8.18':445
- '64.##3.37.155':445
- '64.##3.50.205':445
- '64.##3.15.130':445
- '64.##3.177.110':445
- '64.##3.95.152':445
- '64.##3.118.210':445
- '64.##3.2.218':445
- '64.##3.155.11':445
- '64.##3.52.160':139
- '64.##3.97.146':139
- '64.##3.192.220':139
- '64.##3.58.15':139
- '64.##3.116.61':139
- '64.##3.22.202':445
- '64.##3.200.237':445
- '64.##3.154.91':445
- '64.##3.109.212':445
- '64.##3.185.21':445
- '64.##3.94.65':445
- '64.##3.191.129':445
- '64.##3.53.36':445
- '64.##3.160.118':445
- '64.##3.161.41':445
- '64.##3.186.170':445
