Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\SA.DAT
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe' -k netsvcs
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
Сетевая активность:
Подключается к:
- '13#.#01.40.246':445
- '13#.#01.206.108':445
- '13#.#01.147.121':445
- '13#.#01.233.229':445
- '13#.#01.218.158':445
- '13#.#01.180.29':445
- '13#.#01.166.248':445
- '13#.#01.209.148':445
- '13#.#01.148.33':445
- '13#.#01.147.250':9988
- '13#.#01.80.230':9988
- '13#.#01.213.241':9988
- '13#.#01.40.246':9988
- '13#.#01.14.230':9988
- '13#.#01.242.19':445
- '13#.#01.19.234':445
- '13#.#01.213.241':445
- '13#.#01.66.57':445
- '13#.#01.15.199':445
- '13#.#01.142.2':445
- '13#.#01.183.1':445
- '13#.#01.1.130':445
- '13#.#01.208.107':445
- '13#.#01.11.190':445
- '13#.#01.94.47':445
- '13#.#01.18.166':445
- '13#.#01.37.12':445
- '13#.#01.70.104':445
- '13#.#01.46.202':445
- '13#.#01.147.250':445
- '13#.#01.82.146':445
- '13#.#01.182.15':445
- '13#.#01.41.53':445
- '13#.#01.3.197':445
- '13#.#01.196.76':445
- '13#.#01.142.180':445
- '13#.#01.65.134':9988
- '13#.#01.180.29':9988
- '13#.#01.82.146':9988
- '13#.#01.1.130':9988
- '13#.#01.166.248':9988
- '13#.#01.142.2':9988
- '13#.#01.182.15':9988
- '13#.#01.208.107':9988
- '13#.#01.46.202':9988
- '13#.#01.142.180':9988
- '13#.#01.212.60':9988
- '13#.#01.147.121':9988
- '13#.#01.230.166':9988
- '13#.#01.227.0':9988
- '13#.#01.3.197':9988
- '13#.#01.233.229':9988
- '13#.#01.196.76':9988
- '13#.#01.242.19':9988
- '13#.#01.218.158':9988
- '13#.#01.26.138':9988
- '13#.#01.219.25':9988
- '13#.#01.28.36':9988
- '13#.#01.28.243':9988
- '13#.#01.45.8':9988
- '13#.#01.36.94':9988
- '13#.#01.22.13':9988
- '13#.#01.228.227':9988
- '13#.#01.70.94':9988
- '13#.#01.122.240':9988
- '13#.#01.254.58':9988
- '13#.#01.183.1':9988
- '13#.#01.11.190':9988
- '13#.#01.39.202':9988
- '13#.#01.83.142':9988
- '13#.#01.248.184':9988
- '13#.#01.94.47':9988
- '13#.#01.12.226':9988
- '13#.#01.18.166':139
- '13#.#01.37.12':139
- '13#.#01.142.2':139
- '13#.#01.208.107':139
- '13#.#01.11.190':139
- '13#.#01.122.240':139
- '13#.#01.14.230':139
- '13#.#01.39.202':139
- '13#.#01.94.47':139
- '13#.#01.196.76':139
- '13#.#01.142.180':139
- '13#.#01.46.202':139
- '13#.#01.182.15':139
- '13#.#01.3.197':139
- '13#.#01.1.130':139
- '13#.#01.15.199':139
- '13#.#01.41.53':139
- '13#.#01.183.1':139
- '13#.#01.36.94':139
- '13#.#01.70.94':139
- '13#.#01.228.227':139
- '13#.#01.45.8':139
- '13#.#01.80.230':139
- '13#.#01.65.134':139
- '13#.#01.28.243':139
- '13#.#01.230.166':139
- '13#.#01.212.60':139
- '13#.#01.83.142':139
- '13#.#01.254.58':139
- '13#.#01.219.25':139
- '13#.#01.26.138':139
- '13#.#01.248.184':139
- '13#.#01.22.13':139
- '13#.#01.12.226':139
- '13#.#01.28.36':139
- '13#.#01.227.0':139
- '13#.#01.70.104':139
- '13#.#01.80.230':445
- '13#.#01.12.226':445
- '13#.#01.227.0':445
- '13#.#01.22.13':445
- '13#.#01.230.166':445
- '13#.#01.36.94':445
- '13#.#01.228.227':445
- '13#.#01.70.94':445
- '13#.#01.28.243':445
- '13#.#01.14.230':445
- '13#.#01.219.25':445
- '13#.#01.122.240':445
- '13#.#01.39.202':445
- '13#.#01.26.138':445
- '13#.#01.248.184':445
- '13#.#01.28.36':445
- '13#.#01.83.142':445
- '13#.#01.254.58':445
- '13#.#01.218.158':139
- '13#.#01.209.148':139
- '13#.#01.40.246':139
- '13#.#01.206.108':139
- '13#.#01.148.33':139
- '13#.#01.147.250':139
- '13#.#01.82.146':139
- '13#.#01.180.29':139
- '13#.#01.166.248':139
- '13#.#01.45.8':445
- '13#.#01.66.57':139
- '13#.#01.212.60':445
- '13#.#01.65.134':445
- '13#.#01.213.241':139
- '13#.#01.233.229':139
- '13#.#01.147.121':139
- '13#.#01.242.19':139
- '13#.#01.19.234':139
