Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\SA.DAT
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe' -k netsvcs
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
Сетевая активность:
Подключается к:
- '12.##.169.135':445
- '12.##.143.110':445
- '12.#0.2.221':445
- '12.##.197.15':445
- '12.##.178.181':445
- '12.##.62.208':445
- '12.#0.43.65':445
- '12.#0.73.13':445
- '12.##.252.72':445
- '12.##.50.191':139
- '12.##.186.188':139
- '12.##.31.119':139
- '12.#0.10.31':139
- '12.#0.80.66':139
- '12.##.130.36':139
- '12.##.163.220':445
- '12.##.37.227':139
- '12.##.186.175':139
- '12.##.186.202':445
- '12.##.235.195':445
- '12.##.183.239':445
- '12.##.127.230':445
- '12.##.166.70':445
- '12.#0.12.29':445
- '12.##.180.216':445
- '12.##.151.165':445
- '12.##.192.151':445
- '12.##.139.185':445
- '12.##.226.28':445
- '12.#0.87.43':445
- '12.#0.39.17':445
- '12.##.78.226':445
- '12.##.10.241':445
- '12.##.160.11':445
- '12.#0.6.63':445
- '12.##.50.231':445
- '12.##.119.91':139
- '12.#0.43.65':139
- '12.#0.87.43':139
- '12.##.252.72':139
- '12.##.62.208':139
- '12.#0.39.17':139
- '12.##.78.226':139
- '12.#0.6.63':139
- '12.##.139.185':139
- '12.##.226.28':139
- '12.##.163.220':139
- '12.#0.2.221':139
- '12.##.133.152':445
- '12.##.215.133':445
- '12.##.197.15':139
- '12.##.178.181':139
- '12.#0.73.13':139
- '12.##.169.135':139
- '12.##.143.110':139
- '12.##.180.216':139
- '12.##.130.218':139
- '12.##.192.151':139
- '12.#0.12.29':139
- '12.##.62.221':139
- '12.#0.89.89':139
- '12.##.90.237':139
- '12.#0.21.62':139
- '12.##.197.102':139
- '12.##.160.11':139
- '12.##.183.239':139
- '12.##.50.231':139
- '12.##.10.241':139
- '12.##.127.230':139
- '12.##.166.70':139
- '12.##.151.165':139
- '12.##.186.202':139
- '12.##.235.195':139
- '12.##.130.218':445
- '12.##.16.170':139
- '12.##.58.110':139
- '12.##.206.31':139
- '12.##.39.133':139
- '12.#0.56.58':139
- '12.#0.33.92':139
- '12.##.109.163':139
- '12.##.103.32':139
- '12.#0.75.76':139
- '12.##.245.203':139
- '12.##.138.224':139
- '12.##.124.245':139
- '12.##.72.164':139
- '12.##.46.111':139
- '12.##.129.106':139
- '12.##.82.148':139
- '12.#0.183.8':139
- '12.##.173.101':139
- '12.#0.3.49':139
- '12.##.149.209':139
- '12.##.242.206':139
- '12.##.182.242':139
- '12.##.18.139':139
- '12.##.176.172':139
- '12.##.145.52':139
- '12.##.231.40':139
- '12.##.191.212':139
- '12.##.184.182':139
- '12.##.57.184':139
- '12.##.70.108':139
- '12.##.182.70':139
- '12.##.25.123':139
- '12.#0.2.31':139
- '12.##.82.164':139
- '12.##.33.193':139
- '12.##.64.197':139
- '12.##.208.152':139
- '12.##.37.227':445
- '12.##.186.175':445
- '12.##.186.188':445
- '12.#0.80.66':445
- '12.##.130.36':445
- '12.##.25.244':139
- '12.#0.87.74':139
- '12.##.211.247':139
- '12.##.10.243':139
- '12.##.197.102':445
- '12.#0.89.89':445
- '12.##.62.221':445
- '12.#0.21.62':445
- '12.##.90.237':445
- '12.#0.10.31':445
- '12.##.50.191':445
- '12.##.119.91':445
- '12.##.31.119':445
- '12.##.42.166':445
- '12.#0.2.230':139
- '12.##.163.223':445
- '12.##.116.142':445
- '12.##.111.58':139
- '12.#0.21.18':139
- '12.#0.39.68':139
- '12.##.161.226':139
- '12.##.166.24':139
- '12.##.116.142':139
- '12.##.42.166':139
- '12.##.161.139':139
- '12.##.163.223':139
- '12.##.211.247':445
- '12.#0.87.74':445
- '12.##.161.139':445
- '12.##.10.243':445
- '12.##.25.244':445
- '12.##.152.138':445
- '12.##.37.242':139
- '12.##.80.222':139
- '12.##.135.12':139
- '12.##.100.83':139
- '12.##.245.246':139
- '12.##.192.221':445
- '12.#0.54.45':445
- '12.##.118.63':445
- '12.##.221.151':445
- '12.#0.70.48':139
- '12.##.158.207':139
- '12.#0.42.64':139
- '12.#0.65.42':139
- '12.##.37.159':139
- '12.##.102.21':139
- '12.##.157.225':139
- '12.##.234.181':139
- '12.##.153.35':139
- '12.##.217.161':445
- '12.##.180.45':445
- '12.#0.66.42':445
- '12.##.44.121':445
- '12.##.91.180':445
- '12.#0.34.35':445
- '12.#0.90.19':445
- '12.##.209.65':445
- '12.##.14.178':445
- '12.##.191.166':445
- '12.##.199.53':445
- '12.##.180.27':445
- '12.##.229.28':445
- '12.##.95.199':445
- '12.##.41.145':445
- '12.##.121.23':445
- '12.#0.79.36':445
- '12.##.18.102':445
- '12.##.231.235':139
- '12.##.41.145':139
- '12.##.121.23':139
- '12.#0.79.36':139
- '12.##.18.102':139
- '12.#0.66.42':139
- '12.##.180.45':139
- '12.##.91.180':139
- '12.##.44.121':139
- '12.##.217.161':139
- '12.##.192.221':139
- '12.#0.54.45':139
- '12.##.118.63':139
- '12.##.221.151':139
- '12.##.180.27':139
- '12.##.199.53':139
- '12.##.95.199':139
- '12.##.229.28':139
- '12.##.191.166':139
- '12.##.100.97':139
- '12.#0.7.104':139
- '12.##.183.237':139
- '12.#0.97.63':139
- '12.##.55.118':139
- '12.##.120.227':139
- '12.##.196.133':139
- '12.##.122.141':139
- '12.##.227.92':139
- '12.#0.34.35':139
- '12.#0.90.19':139
- '12.##.209.65':139
- '12.##.14.178':139
- '12.##.216.18':139
- '12.##.184.150':139
- '12.##.160.184':139
- '12.##.77.222':139
- '12.##.150.60':139
- '12.##.216.18':445
- '12.##.58.212':139
- '12.#0.67.93':139
- '12.##.15.205':139
- '12.#0.20.19':139
- '12.##.225.93':139
- '12.##.15.205':445
- '12.#0.20.19':445
- '12.##.217.209':139
- '12.##.249.120':139
- '12.##.44.121':9988
- '12.##.77.222':9988
- '12.#0.34.35':9988
- '12.#0.66.42':9988
- '12.##.180.45':9988
- '12.##.216.18':9988
- '12.##.91.180':9988
- '12.##.121.23':9988
- '12.##.18.102':9988
- '12.##.133.152':139
- '12.##.215.133':139
- '12.#0.139.3':139
- '12.##.152.138':139
- '12.##.32.250':445
- '12.##.121.79':445
- '12.#0.139.3':445
- '12.#0.64.68':445
- '12.##.28.161':445
- '12.##.225.93':445
- '12.##.217.209':445
- '12.##.58.212':445
- '12.#0.67.93':445
- '12.##.249.120':445
- '12.##.28.161':139
- '12.##.121.79':139
- '12.##.32.250':139
- '12.#0.64.68':139
- '12.##.209.65':9988
- '12.##.120.227':445
- '12.##.196.133':445
- '12.##.122.141':445
- '12.##.227.92':445
- '12.##.231.235':445
- '12.#0.70.48':445
- '12.##.158.207':445
- '12.#0.42.64':445
- '12.#0.65.42':445
- '12.##.184.150':445
- '12.##.160.184':445
- '12.##.77.222':445
- '12.##.150.60':445
- '12.##.183.237':445
- '12.#0.7.104':445
- '12.##.55.118':445
- '12.#0.97.63':445
- '12.##.100.97':445
- '12.##.221.151':9988
- '12.##.229.28':9988
- '12.##.245.246':445
- '12.##.118.63':9988
- '12.##.191.166':9988
- '12.##.41.145':9988
- '12.#0.79.36':9988
- '12.##.199.53':9988
- '12.##.95.199':9988
- '12.##.153.35':445
- '12.##.102.21':445
- '12.##.37.159':445
- '12.##.234.181':445
- '12.##.157.225':445
- '12.##.37.242':445
- '12.##.80.222':445
- '12.##.135.12':445
- '12.##.100.83':445
