Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\SA.DAT
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe' -k netsvcs
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
Сетевая активность:
Подключается к:
- '67.#.102.194':445
- '67.#.140.82':445
- '67.#.39.96':139
- '67.#.194.38':445
- '67.#.206.102':445
- '67.#.164.167':445
- '67.#.250.213':445
- '67.#.174.206':445
- '67.#.237.6':445
- '67.#.98.103':139
- '67.#.48.249':139
- '67.#.221.151':139
- '67.#.10.186':139
- '67.#.229.249':139
- '67.#.80.129':139
- '67.#.123.229':139
- '67.#.106.52':139
- '67.#.79.106':139
- '67.#.199.225':445
- '67.#.155.160':445
- '67.#.201.131':445
- '67.#.74.203':445
- '67.#.25.117':445
- '67.#.127.135':445
- '67.#.95.135':445
- '67.#.191.195':445
- '67.#.198.196':445
- '67.#.74.171':445
- '67.#.115.32':445
- '67.#.241.59':445
- '67.#.216.50':445
- '67.#.35.168':445
- '67.#.180.30':445
- '67.#.29.6':445
- '67.#.114.230':445
- '67.#.140.15':445
- '67.#.5.201':445
- '67.#.152.74':139
- '67.#.140.15':139
- '67.#.5.201':139
- '67.#.241.59':139
- '67.#.180.30':139
- '67.#.29.6':139
- '67.#.25.117':139
- '67.#.155.160':139
- '67.#.114.230':139
- '67.#.74.203':139
- '67.#.237.6':139
- '67.#.164.167':139
- '67.#.206.102':139
- '67.#.174.206':139
- '67.#.250.213':139
- '67.#.35.168':139
- '67.#.115.32':139
- '67.#.199.225':139
- '67.#.216.50':139
- '67.#.201.131':139
- '67.#.164.88':139
- '67.#.191.253':139
- '67.#.19.129':139
- '67.#.88.55':139
- '67.#.82.60':139
- '67.#.183.142':139
- '67.#.74.184':139
- '67.#.175.198':139
- '67.#.14.149':139
- '67.#.74.171':139
- '67.#.95.135':139
- '67.#.127.135':139
- '67.#.198.196':139
- '67.#.191.195':139
- '67.#.98.46':139
- '67.#.63.98':139
- '67.#.170.191':139
- '67.#.12.222':139
- '67.#.85.152':139
- '67.#.45.85':139
- '67.#.184.250':139
- '67.#.240.184':139
- '67.#.221.226':139
- '67.#.65.174':139
- '67.#.44.65':139
- '67.#.84.158':139
- '67.#.173.204':139
- '67.#.117.154':139
- '67.#.33.100':139
- '67.#.73.249':139
- '67.#.3.50':139
- '67.#.143.82':139
- '67.#.75.148':139
- '67.#.250.206':139
- '67.#.90.184':139
- '67.#.8.75':139
- '67.#.176.77':139
- '67.#.67.144':139
- '67.#.126.187':139
- '67.#.170.93':139
- '67.#.139.180':139
- '67.#.95.140':139
- '67.#.85.229':139
- '67.#.212.188':139
- '67.#.159.126':139
- '67.#.165.216':139
- '67.#.5.90':139
- '67.#.241.14':139
- '67.#.194.223':139
- '67.#.150.172':139
- '67.#.164.69':139
- '67.#.241.87':139
- '67.#.42.199':139
- '67.#.71.141':139
- '67.#.252.79':139
- '67.#.75.104':139
- '67.#.183.142':445
- '67.#.74.184':445
- '67.#.175.198':445
- '67.#.14.149':445
- '67.#.152.74':445
- '67.#.98.103':445
- '67.#.48.249':445
- '67.#.221.151':445
- '67.#.10.186':445
- '67.#.98.46':445
- '67.#.63.98':445
- '67.#.170.191':445
- '67.#.12.222':445
- '67.#.19.129':445
- '67.#.191.253':445
- '67.#.82.60':445
- '67.#.88.55':445
- '67.#.164.88':445
- '67.#.229.249':445
- '67.#.136.34':139
- '67.#.3.167':139
- '67.#.168.182':139
- '67.#.245.112':139
- '67.#.68.206':139
- '67.#.239.150':139
- '67.#.21.221':139
- '67.#.97.170':139
- '67.#.101.10':139
- '67.#.80.129':445
- '67.#.123.229':445
- '67.#.106.52':445
- '67.#.79.106':445
- '67.#.39.96':445
- '67.#.138.180':139
- '67.#.29.222':139
- '67.#.72.185':139
- '67.#.180.72':139
- '67.#.128.212':139
- '67.#.20.205':139
- '67.#.161.57':139
- '67.#.0.84':139
- '67.#.153.69':445
- '67.#.96.61':445
- '67.#.44.10':445
- '67.#.237.7':445
- '67.#.57.181':445
- '67.#.15.168':139
- '67.#.106.129':139
- '67.#.204.135':139
- '67.#.43.65':139
- '67.#.212.180':139
- '67.#.124.12':139
- '67.#.27.26':139
- '67.#.21.48':139
- '67.#.184.87':139
- '67.#.193.17':445
- '67.#.178.172':445
- '67.#.107.36':445
- '67.#.47.95':445
- '67.#.229.43':445
- '67.#.122.233':445
- '67.#.61.140':445
- '67.#.149.163':445
- '67.#.74.220':445
- '67.#.193.20':445
- '67.#.156.116':445
- '67.#.3.234':445
- '67.#.78.0':445
- '67.#.112.51':445
- '67.#.111.56':445
- '67.#.20.153':445
- '67.#.222.10':445
- '67.#.204.230':445
- '67.#.152.202':445
- '67.#.75.167':139
- '67.#.204.230':139
- '67.#.152.202':139
- '67.#.3.234':139
- '67.#.111.56':139
- '67.#.20.153':139
- '67.#.229.43':139
- '67.#.178.172':139
- '67.#.222.10':139
- '67.#.47.95':139
- '67.#.57.181':139
- '67.#.96.61':139
- '67.#.237.7':139
- '67.#.153.69':139
- '67.#.193.17':139
- '67.#.78.0':139
- '67.#.156.116':139
- '67.#.112.51':139
- '67.#.44.10':139
- '67.#.107.36':139
- '67.#.69.174':139
- '67.#.150.103':139
- '67.#.30.169':139
- '67.#.131.25':139
- '67.#.37.5':139
- '67.#.30.109':139
- '67.#.242.30':139
- '67.#.4.38':139
- '67.#.13.252':139
- '67.#.193.20':139
- '67.#.61.140':139
- '67.#.122.233':139
- '67.#.74.220':139
- '67.#.149.163':139
- '67.#.38.157':139
- '67.#.168.197':139
- '67.#.233.189':139
- '67.#.142.218':139
- '67.#.231.170':139
- '67.#.72.110':139
- '67.#.109.190':139
- '67.#.233.39':139
- '67.#.3.156':139
- '67.#.219.174':139
- '67.#.130.177':139
- '67.#.29.62':139
- '67.#.194.174':139
- '67.#.4.38':9988
- '67.#.38.157':9988
- '67.#.242.30':9988
- '67.#.142.218':9988
- '67.#.69.174':9988
- '67.#.37.5':9988
- '67.#.84.27':139
- '67.#.233.189':9988
- '67.#.13.252':9988
- '67.#.73.143':139
- '67.#.130.177':445
- '67.#.73.143':445
- '67.#.194.174':445
- '67.#.219.174':445
- '67.#.6.242':445
- '67.#.102.194':139
- '67.#.140.82':139
- '67.#.95.77':445
- '67.#.194.38':139
- '67.#.84.27':445
- '67.#.109.190':445
- '67.#.6.242':139
- '67.#.95.77':139
- '67.#.233.39':445
- '67.#.3.156':445
- '67.#.29.62':445
- '67.#.231.170':445
- '67.#.72.110':445
- '67.#.149.163':9988
- '67.#.30.109':445
- '67.#.242.30':445
- '67.#.4.38':445
- '67.#.13.252':445
- '67.#.75.167':445
- '67.#.15.168':445
- '67.#.106.129':445
- '67.#.204.135':445
- '67.#.43.65':445
- '67.#.38.157':445
- '67.#.168.197':445
- '67.#.233.189':445
- '67.#.142.218':445
- '67.#.30.169':445
- '67.#.150.103':445
- '67.#.37.5':445
- '67.#.131.25':445
- '67.#.69.174':445
- '67.#.212.180':445
- '67.#.193.17':9988
- '67.#.178.172':9988
- '67.#.112.51':9988
- '67.#.204.230':9988
- '67.#.107.36':9988
- '67.#.193.20':9988
- '67.#.61.140':9988
- '67.#.122.233':9988
- '67.#.74.220':9988
- '67.#.124.12':445
- '67.#.27.26':445
- '67.#.21.48':445
- '67.#.184.87':445
- '67.#.161.57':445
- '67.#.20.205':445
- '67.#.237.7':9988
- '67.#.0.84':445
- '67.#.128.212':445
