Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\SA.DAT
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe' -k netsvcs
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
Сетевая активность:
Подключается к:
- '20#.#14.86.246':445
- '20#.#14.138.246':445
- '20#.#14.171.243':445
- '20#.#14.81.13':445
- '20#.#14.48.40':445
- '20#.#14.50.130':445
- '20#.#14.105.121':445
- '20#.#14.131.41':445
- '20#.#14.16.68':445
- '20#.#14.204.134':445
- '20#.#14.136.40':445
- '20#.#14.84.172':445
- '20#.#14.8.121':445
- '20#.#14.209.224':445
- '20#.#14.148.115':445
- '20#.#14.104.220':445
- '20#.#14.26.94':445
- '20#.#14.32.209':445
- '20#.#14.87.237':445
- '20#.#14.79.1':445
- '20#.#14.24.133':445
- '20#.#14.39.248':445
- '20#.#14.6.187':445
- '20#.#14.80.75':445
- '20#.#14.206.33':445
- '20#.#14.183.203':445
- '20#.#14.195.7':445
- '20#.#14.10.152':445
- '20#.#14.54.152':445
- '20#.#14.62.107':445
- '20#.#14.108.112':445
- '20#.#14.130.195':445
- '20#.#14.107.130':445
- '20#.#14.24.133':139
- '20#.#14.32.209':139
- '20#.#14.108.112':139
- '20#.#14.79.1':139
- '20#.#14.6.187':139
- '20#.#14.206.33':139
- '20#.#14.87.237':139
- '20#.#14.80.75':139
- '20#.#14.54.152':139
- '20#.#14.183.203':139
- '20#.#14.26.94':139
- '20#.#14.10.152':139
- '20#.#14.107.130':139
- '20#.#14.62.107':139
- '20#.#14.195.7':139
- '20#.#14.130.195':139
- '20#.#14.39.248':139
- '20#.#14.74.63':139
- '20#.#14.86.158':139
- '20#.#14.134.103':139
- '20#.#14.4.108':139
- '20#.#14.205.67':445
- '20#.#14.163.17':445
- '20#.#14.165.153':139
- '20#.#14.67.79':445
- '20#.#14.41.9':139
- '20#.#14.15.56':139
- '20#.#14.237.173':139
- '20#.#14.227.252':139
- '20#.#14.109.32':139
- '20#.#14.176.45':139
- '20#.#14.25.236':139
- '20#.#14.236.125':139
- '20#.#14.205.176':139
- '20#.#14.110.186':139
- '20#.#14.14.145':139
- '20#.#14.27.31':139
- '20#.#14.5.10':139
- '20#.#14.48.244':139
- '20#.#14.111.38':139
- '20#.#14.172.204':139
- '20#.#14.132.106':139
- '20#.#14.217.237':139
- '20#.#14.100.188':139
- '20#.#14.56.57':139
- '20#.#14.168.252':139
- '20#.#14.18.54':139
- '20#.#14.113.182':139
- '20#.#14.252.150':139
- '20#.#14.73.90':139
- '20#.#14.6.171':139
- '20#.#14.130.164':139
- '20#.#14.10.225':139
- '20#.#14.98.202':139
- '20#.#14.62.166':139
- '20#.#14.248.155':139
- '20#.#14.90.193':139
- '20#.#14.73.65':139
- '20#.#14.161.38':139
- '20#.#14.58.102':139
- '20#.#14.7.74':139
- '20#.#14.52.97':139
- '20#.#14.169.42':139
- '20#.#14.31.32':139
- '20#.#14.51.58':139
- '20#.#14.13.101':139
- '20#.#14.176.45':445
- '20#.#14.134.103':445
- '20#.#14.86.158':445
- '20#.#14.74.63':445
- '20#.#14.188.84':139
- '20#.#14.24.148':445
- '20#.#14.165.153':445
- '20#.#14.24.148':139
- '20#.#14.236.125':445
- '20#.#14.25.236':445
- '20#.#14.237.173':445
- '20#.#14.227.252':445
- '20#.#14.41.9':445
- '20#.#14.4.108':445
- '20#.#14.109.32':445
- '20#.#14.15.56':445
- '20#.#14.188.84':445
- '20#.#14.194.195':139
- '20#.#14.250.46':139
- '20#.#14.140.228':139
- '20#.#14.111.196':139
- '20#.#14.44.190':139
- '20#.#14.110.244':139
- '20#.#14.27.102':139
- '20#.#14.42.169':139
- '20#.#14.235.111':139
- '20#.#14.108.243':139
- '20#.#14.160.188':139
- '20#.#14.62.245':139
- '20#.#14.247.198':139
- '20#.#14.87.23':139
- '20#.#14.194.108':139
- '20#.#14.20.40':139
- '20#.#14.48.40':139
- '20#.#14.188.201':139
- '20#.#14.190.150':139
- '20#.#14.209.82':139
- '20#.#14.201.209':139
- '20#.#14.117.236':139
- '20#.#14.119.117':139
- '20#.#14.20.19':139
- '20#.#14.99.204':139
- '20#.#14.2.192':139
- '20#.#14.97.181':139
- '20#.#14.98.137':139
- '20#.#14.175.159':139
- '20#.#14.235.121':139
- '20#.#14.50.140':139
- '20#.#14.221.96':139
- '20#.#14.121.220':139
- '20#.#14.42.232':139
- '20#.#14.26.79':445
- '20#.#14.195.216':445
- '20#.#14.216.191':445
- '20#.#14.226.194':445
- '20#.#14.125.47':445
- '20#.#14.57.155':445
- '20#.#14.199.65':445
- '20#.#14.127.124':445
- '20#.#14.13.34':445
- '20#.#14.234.42':445
- '20#.#14.33.104':139
- '20#.#14.40.91':445
- '20#.#14.10.47':445
- '20#.#14.252.49':445
- '20#.#14.248.197':445
- '20#.#14.160.144':445
- '20#.#14.195.216':139
- '20#.#14.199.65':139
- '20#.#14.226.194':139
- '20#.#14.26.79':139
- '20#.#14.57.155':139
- '20#.#14.87.191':139
- '20#.#14.127.124':139
- '20#.#14.125.47':139
- '20#.#14.234.42':139
- '20#.#14.248.197':139
- '20#.#14.40.91':139
- '20#.#14.13.34':139
- '20#.#14.252.49':139
- '20#.#14.216.191':139
- '20#.#14.160.144':139
- '20#.#14.10.47':139
- '20#.#14.201.51':139
- '20#.#14.27.61':139
- '20#.#14.85.218':139
- '20#.#14.56.164':139
- '20#.#14.226.155':139
- '20#.#14.223.235':139
- '20#.#14.142.15':139
- '20#.#14.95.41':139
- '20#.#14.193.148':139
- '20#.#14.78.216':139
- '20#.#14.226.240':139
- '20#.#14.103.250':139
- '20#.#14.143.71':139
- '20#.#14.86.132':139
- '20#.#14.190.46':139
- '20#.#14.239.233':139
- '20#.#14.174.75':139
- '20#.#14.27.61':9988
- '20#.#14.193.148':9988
- '20#.#14.226.240':9988
- '20#.#14.143.71':9988
- '20#.#14.33.104':9988
- '20#.#14.67.79':139
- '20#.#14.235.121':9988
- '20#.#14.50.140':9988
- '20#.#14.33.104':445
- '20#.#14.125.47':9988
- '20#.#14.119.117':445
- '20#.#14.42.232':445
- '20#.#14.226.194':9988
- '20#.#14.57.155':9988
- '20#.#14.252.49':9988
- '20#.#14.160.144':9988
- '20#.#14.205.67':139
- '20#.#14.171.243':139
- '20#.#14.86.246':139
- '20#.#14.209.224':139
- '20#.#14.81.13':139
- '20#.#14.131.41':139
- '20#.#14.50.130':139
- '20#.#14.138.246':139
- '20#.#14.105.121':139
- '20#.#14.84.172':139
- '20#.#14.16.68':139
- '20#.#14.163.17':139
- '20#.#14.136.40':139
- '20#.#14.104.220':139
- '20#.#14.8.121':139
- '20#.#14.204.134':139
- '20#.#14.148.115':139
- '20#.#14.56.164':445
- '20#.#14.226.155':445
- '20#.#14.86.132':445
- '20#.#14.190.46':445
- '20#.#14.95.41':445
- '20#.#14.193.148':445
- '20#.#14.27.61':445
- '20#.#14.85.218':445
- '20#.#14.103.250':445
- '20#.#14.143.71':445
- '20#.#14.87.191':445
- '20#.#14.201.51':445
- '20#.#14.239.233':445
- '20#.#14.174.75':445
- '20#.#14.78.216':445
- '20#.#14.226.240':445
- '20#.#14.223.235':445
- '20#.#14.201.209':445
- '20#.#14.188.201':445
- '20#.#14.50.140':445
- '20#.#14.209.82':445
- '20#.#14.99.204':445
- '20#.#14.117.236':445
- '20#.#14.190.150':445
- '20#.#14.20.19':445
- '20#.#14.175.159':445
- '20#.#14.2.192':445
- '20#.#14.142.15':445
- '20#.#14.98.137':445
- '20#.#14.121.220':445
- '20#.#14.235.121':445
- '20#.#14.97.181':445
- '20#.#14.221.96':445
