Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\SA.DAT
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe' -k netsvcs
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
- %PROGRAM_FILES%\NetMeeting\rsewzjqn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
Сетевая активность:
Подключается к:
- '65.#.196.136':445
- '65.#.129.1':445
- '65.#.157.26':445
- '65.#.203.248':445
- '65.#.204.24':445
- '65.#.73.148':445
- '65.#.8.111':445
- '65.#.24.204':445
- '65.#.148.24':445
- '65.#.17.28':445
- '65.#.50.96':139
- '65.#.86.119':139
- '65.#.80.212':139
- '65.#.96.42':139
- '65.#.100.128':139
- '65.#.197.249':445
- '65.#.135.56':445
- '65.#.107.167':445
- '65.#.208.187':445
- '65.#.150.30':445
- '65.#.61.194':445
- '65.#.33.121':445
- '65.#.167.111':445
- '65.#.192.207':445
- '65.#.34.151':445
- '65.#.20.204':445
- '65.#.168.77':445
- '65.#.67.111':445
- '65.#.216.30':445
- '65.#.194.51':445
- '65.#.39.229':445
- '65.#.183.11':445
- '65.#.164.109':445
- '65.#.229.2':445
- '65.#.69.59':445
- '65.#.176.72':445
- '65.#.46.61':445
- '65.#.21.211':445
- '65.#.100.71':445
- '65.#.69.59':139
- '65.#.21.211':139
- '65.#.39.229':139
- '65.#.183.11':139
- '65.#.100.71':139
- '65.#.194.51':139
- '65.#.167.111':139
- '65.#.176.72':139
- '65.#.46.61':139
- '65.#.229.2':139
- '65.#.204.24':139
- '65.#.24.204':139
- '65.#.196.136':139
- '65.#.129.1':139
- '65.#.148.24':139
- '65.#.150.30':139
- '65.#.164.109':139
- '65.#.73.148':139
- '65.#.8.111':139
- '65.#.192.207':139
- '65.#.240.182':139
- '65.#.205.41':139
- '65.#.141.176':139
- '65.#.5.128':139
- '65.#.78.204':139
- '65.#.110.98':139
- '65.#.111.22':139
- '65.#.54.78':139
- '65.#.141.221':139
- '65.#.196.113':139
- '65.#.34.151':139
- '65.#.67.111':139
- '65.#.61.194':139
- '65.#.33.121':139
- '65.#.216.30':139
- '65.#.89.73':139
- '65.#.156.6':139
- '65.#.20.204':139
- '65.#.168.77':139
- '65.#.55.244':139
- '65.#.163.234':139
- '65.#.65.10':139
- '65.#.95.64':139
- '65.#.67.105':139
- '65.#.82.47':139
- '65.#.211.51':139
- '65.#.3.155':139
- '65.#.104.248':139
- '65.#.9.231':139
- '65.#.15.121':139
- '65.#.33.15':139
- '65.#.172.211':139
- '65.#.121.58':139
- '65.#.68.32':139
- '65.#.102.228':139
- '65.#.157.104':139
- '65.#.24.68':139
- '65.#.79.130':139
- '65.#.206.90':139
- '65.#.114.218':445
- '65.#.99.200':445
- '65.#.131.86':445
- '65.#.13.139':445
- '65.#.190.12':445
- '65.#.55.170':445
- '65.#.150.163':445
- '65.#.66.6':445
- '65.#.29.159':445
- '65.#.40.100':445
- '65.#.40.201':139
- '65.#.216.184':139
- '65.#.163.127':139
- '65.#.82.193':139
- '65.#.59.196':139
- '65.#.239.223':139
- '65.#.43.252':139
- '65.#.45.24':139
- '65.#.201.94':139
- '65.#.80.212':445
- '65.#.96.42':445
- '65.#.110.98':445
- '65.#.111.22':445
- '65.#.50.96':445
- '65.#.40.100':139
- '65.#.131.86':139
- '65.#.86.119':445
- '65.#.100.128':445
- '65.#.141.221':445
- '65.#.196.113':445
- '65.#.141.176':445
- '65.#.89.73':445
- '65.#.156.6':445
- '65.#.5.128':445
- '65.#.78.204':445
- '65.#.54.78':445
- '65.#.240.182':445
- '65.#.205.41':445
- '65.#.13.139':139
- '65.#.89.137':139
- '65.#.251.0':139
- '65.#.23.88':139
- '65.#.53.213':139
- '65.#.228.250':139
- '65.#.11.249':139
- '65.#.32.219':139
- '65.#.113.160':139
- '65.#.30.207':139
- '65.#.255.25':139
- '65.#.190.12':139
- '65.#.66.6':139
- '65.#.114.218':139
- '65.#.99.200':139
- '65.#.29.159':139
- '65.#.242.150':139
- '65.#.61.142':139
- '65.#.55.170':139
- '65.#.150.163':139
- '65.#.203.248':139
- '65.#.90.10':445
- '65.#.33.122':445
- '65.#.198.132':139
- '65.#.232.74':139
- '65.#.195.152':445
- '65.#.158.128':445
- '65.#.25.160':445
- '65.#.231.251':445
- '65.#.142.49':445
- '65.#.112.145':139
- '65.#.27.116':139
- '65.#.197.115':139
- '65.#.65.205':139
- '65.#.40.101':139
- '65.#.23.3':139
- '65.#.71.232':139
- '65.#.47.179':139
- '65.#.73.232':139
- '65.#.215.59':139
- '65.#.84.180':445
- '65.#.170.177':445
- '65.#.187.32':445
- '65.#.123.240':445
- '65.#.100.158':445
- '65.#.58.132':445
- '65.#.18.165':445
- '65.#.7.201':445
- '65.#.151.35':445
- '65.#.9.18':445
- '65.#.162.116':445
- '65.#.18.7':445
- '65.#.154.130':445
- '65.#.1.140':445
- '65.#.6.156':445
- '65.#.188.237':445
- '65.#.189.147':445
- '65.#.167.188':445
- '65.#.225.238':445
- '65.#.147.20':445
- '65.#.188.237':139
- '65.#.225.238':139
- '65.#.18.7':139
- '65.#.154.130':139
- '65.#.147.20':139
- '65.#.162.116':139
- '65.#.123.240':139
- '65.#.189.147':139
- '65.#.167.188':139
- '65.#.6.156':139
- '65.#.90.10':139
- '65.#.231.251':139
- '65.#.195.152':139
- '65.#.33.122':139
- '65.#.142.49':139
- '65.#.84.180':139
- '65.#.1.140':139
- '65.#.158.128':139
- '65.#.25.160':139
- '65.#.100.158':139
- '65.#.100.196':139
- '65.#.30.22':139
- '65.#.107.44':139
- '65.#.160.89':139
- '65.#.85.178':139
- '65.#.43.19':139
- '65.#.230.44':139
- '65.#.78.149':139
- '65.#.78.78':139
- '65.#.132.241':139
- '65.#.58.132':139
- '65.#.151.35':139
- '65.#.170.177':139
- '65.#.187.32':139
- '65.#.9.18':139
- '65.#.240.166':139
- '65.#.141.45':139
- '65.#.18.165':139
- '65.#.7.201':139
- '65.#.33.82':139
- '65.#.215.33':139
- '65.#.155.149':139
- '65.#.82.77':139
- '65.#.151.126':139
- '65.#.168.10':139
- '65.#.77.224':445
- '65.#.172.140':139
- '65.#.33.72':139
- '65.#.212.170':139
- '65.#.107.44':9988
- '65.#.77.224':139
- '65.#.230.44':9988
- '65.#.123.240':9988
- '65.#.37.246':139
- '65.#.0.93':139
- '65.#.140.158':139
- '65.#.96.129':139
- '65.#.37.220':139
- '65.#.37.246':445
- '65.#.168.10':445
- '65.#.107.167':139
- '65.#.172.140':445
- '65.#.33.72':445
- '65.#.208.187':139
- '65.#.17.28':139
- '65.#.157.26':139
- '65.#.197.249':139
- '65.#.135.56':139
- '65.#.151.126':445
- '65.#.0.93':445
- '65.#.140.158':445
- '65.#.96.129':445
- '65.#.37.220':445
- '65.#.212.170':445
- '65.#.33.82':445
- '65.#.215.33':445
- '65.#.155.149':445
- '65.#.82.77':445
- '65.#.65.205':445
- '65.#.40.101':445
- '65.#.43.19':445
- '65.#.230.44':445
- '65.#.27.116':445
- '65.#.73.232':445
- '65.#.215.59':445
- '65.#.197.115':445
- '65.#.23.3':445
- '65.#.78.78':445
- '65.#.132.241':445
- '65.#.107.44':445
- '65.#.240.166':445
- '65.#.141.45':445
- '65.#.160.89':445
- '65.#.85.178':445
- '65.#.78.149':445
- '65.#.100.196':445
- '65.#.30.22':445
- '65.#.71.232':445
- '65.#.85.178':9988
- '65.#.78.149':9988
- '65.#.197.115':9988
- '65.#.160.89':9988
- '65.#.147.20':9988
- '65.#.73.232':9988
- '65.#.162.116':9988
- '65.#.100.196':9988
- '65.#.58.132':9988
- '65.#.30.22':9988
- '65.#.198.132':445
- '65.#.232.74':445
- '65.#.47.179':445
- '65.#.112.145':445
- '65.#.33.122':9988
- '65.#.154.130':9988
- '65.#.225.238':9988
- '65.#.90.10':9988
- '65.#.142.49':9988
