Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\SA.DAT
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe' -k netsvcs
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
Сетевая активность:
Подключается к:
- '67.##.211.73':445
- '67.##.109.241':445
- '67.##.147.83':445
- '67.#8.2.24':445
- '67.##.40.111':445
- '67.##.213.167':445
- '67.#8.204.4':445
- '67.##.61.118':445
- '67.##.134.26':445
- '67.##.179.164':445
- '67.##.21.172':445
- '67.##.67.134':445
- '67.##.127.204':445
- '67.##.166.24':445
- '67.##.191.250':445
- '67.##.188.40':445
- '67.##.67.228':445
- '67.##.221.114':445
- '67.#8.6.155':445
- '67.##.108.245':445
- '67.##.205.175':445
- '67.##.50.134':445
- '67.#8.79.11':445
- '67.##.115.146':445
- '67.#8.66.73':445
- '67.#8.41.25':445
- '67.#8.50.55':445
- '67.##.59.123':445
- '67.##.146.218':445
- '67.##.166.145':445
- '67.#8.181.8':445
- '67.##.133.186':445
- '67.##.166.145':139
- '67.#8.181.8':139
- '67.##.59.123':139
- '67.##.146.218':139
- '67.##.221.114':139
- '67.#8.6.155':139
- '67.##.115.146':139
- '67.#8.66.73':139
- '67.##.213.167':139
- '67.#8.204.4':139
- '67.#8.2.24':139
- '67.##.40.111':139
- '67.#8.41.25':139
- '67.#8.50.55':139
- '67.##.188.40':139
- '67.##.67.228':139
- '67.#8.2.209':445
- '67.#8.91.36':445
- '67.##.198.88':139
- '67.##.168.148':445
- '67.##.186.126':445
- '67.##.156.168':445
- '67.##.189.103':445
- '67.##.94.175':139
- '67.##.50.134':139
- '67.#8.79.11':139
- '67.##.108.245':139
- '67.##.205.175':139
- '67.##.254.231':139
- '67.##.61.175':139
- '67.#8.69.8':139
- '67.#8.69.8':445
- '67.##.161.23':139
- '67.##.218.147':139
- '67.##.147.229':139
- '67.##.250.78':139
- '67.##.103.254':139
- '67.##.190.76':139
- '67.##.25.160':139
- '67.##.17.124':139
- '67.#8.73.92':139
- '67.##.92.101':139
- '67.##.121.59':139
- '67.##.149.75':139
- '67.##.172.180':139
- '67.##.17.244':139
- '67.#8.40.55':139
- '67.##.106.104':139
- '67.##.240.227':139
- '67.##.118.169':139
- '67.##.134.244':139
- '67.#8.39.10':139
- '67.#8.1.193':139
- '67.##.211.114':139
- '67.#8.13.78':139
- '67.##.162.222':139
- '67.#8.26.88':139
- '67.##.225.144':139
- '67.##.94.243':139
- '67.##.111.103':139
- '67.##.70.169':139
- '67.#8.20.12':139
- '67.#8.57.83':139
- '67.##.230.234':139
- '67.##.180.232':139
- '67.##.60.108':139
- '67.##.45.111':139
- '67.##.125.66':139
- '67.##.30.239':445
- '67.##.210.85':445
- '67.##.161.141':445
- '67.##.54.146':139
- '67.##.94.175':445
- '67.##.254.231':445
- '67.##.61.175':445
- '67.##.198.88':445
- '67.##.30.239':139
- '67.##.210.85':139
- '67.##.161.141':139
- '67.##.54.146':445
- '67.##.192.141':139
- '67.##.141.178':139
- '67.##.178.235':139
- '67.##.148.68':139
- '67.##.234.129':139
- '67.##.245.252':139
- '67.##.174.198':139
- '67.#8.1.91':139
- '67.##.180.232':445
- '67.##.60.108':445
- '67.##.45.111':445
- '67.##.125.66':445
- '67.##.109.146':139
- '67.#8.95.93':139
- '67.##.218.24':139
- '67.#8.79.48':139
- '67.##.47.204':139
- '67.##.179.61':139
- '67.#8.26.79':139
- '67.##.11.138':139
- '67.##.109.189':139
- '67.#8.49.26':139
- '67.##.185.234':139
- '67.##.222.51':139
- '67.##.51.176':139
- '67.##.190.166':139
- '67.##.244.153':139
- '67.##.153.24':139
- '67.##.150.120':139
- '67.##.46.246':139
- '67.#8.93.11':139
- '67.##.29.214':445
- '67.##.119.221':445
- '67.##.76.238':445
- '67.#8.47.53':445
- '67.##.160.62':445
- '67.##.14.195':445
- '67.#8.9.240':445
- '67.##.225.43':445
- '67.##.247.199':139
- '67.##.17.140':139
- '67.##.128.91':139
- '67.#8.82.88':445
- '67.##.207.217':445
- '67.#8.26.51':445
- '67.##.217.96':445
- '67.#8.35.54':139
- '67.##.14.195':139
- '67.#8.9.240':139
- '67.#8.47.53':139
- '67.##.160.62':139
- '67.#8.22.29':139
- '67.##.201.88':139
- '67.##.141.156':139
- '67.##.119.221':139
- '67.#8.26.51':139
- '67.##.76.238':139
- '67.##.225.43':139
- '67.#8.82.88':139
- '67.##.29.214':139
- '67.##.207.217':139
- '67.##.217.96':139
- '67.##.246.147':139
- '67.#8.0.195':139
- '67.##.194.18':139
- '67.##.51.163':139
- '67.##.212.23':139
- '67.##.237.56':139
- '67.##.195.207':139
- '67.#8.79.42':139
- '67.##.123.85':139
- '67.##.187.67':139
- '67.##.198.202':139
- '67.##.203.18':139
- '67.##.249.217':139
- '67.#8.46.95':139
- '67.##.74.119':139
- '67.##.245.121':139
- '67.##.141.156':445
- '67.##.244.153':9988
- '67.##.190.166':9988
- '67.##.187.67':9988
- '67.##.179.61':9988
- '67.#8.2.209':139
- '67.#8.91.36':139
- '67.#8.93.11':9988
- '67.##.207.217':9988
- '67.#8.93.11':445
- '67.##.11.138':445
- '67.##.109.189':445
- '67.##.128.91':445
- '67.#8.82.88':9988
- '67.##.247.199':445
- '67.##.17.140':445
- '67.##.168.148':139
- '67.##.127.204':139
- '67.##.166.24':139
- '67.##.191.250':139
- '67.##.61.118':139
- '67.##.211.73':139
- '67.##.109.241':139
- '67.##.147.83':139
- '67.##.67.134':139
- '67.##.186.126':139
- '67.##.156.168':139
- '67.##.189.103':139
- '67.##.133.186':139
- '67.##.134.26':139
- '67.##.179.164':139
- '67.##.21.172':139
- '67.#8.49.26':445
- '67.##.123.85':445
- '67.#8.46.95':445
- '67.##.74.119':445
- '67.##.51.163':445
- '67.##.212.23':445
- '67.##.194.18':445
- '67.#8.0.195':445
- '67.##.245.121':445
- '67.##.246.147':445
- '67.#8.22.29':445
- '67.##.201.88':445
- '67.##.203.18':445
- '67.##.249.217':445
- '67.##.187.67':445
- '67.##.198.202':445
- '67.#8.79.42':445
- '67.##.185.234':445
- '67.##.153.24':445
- '67.##.150.120':445
- '67.##.179.61':445
- '67.#8.26.79':445
- '67.#8.79.48':445
- '67.##.47.204':445
- '67.##.46.246':445
- '67.#8.35.54':445
- '67.##.237.56':445
- '67.##.195.207':445
- '67.##.190.166':445
- '67.##.244.153':445
- '67.##.222.51':445
- '67.##.51.176':445
