Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\SA.DAT
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe' -k netsvcs
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
Сетевая активность:
Подключается к:
- '19#.#87.190.116':445
- '19#.#87.183.193':445
- '19#.#87.35.245':445
- '19#.#87.209.200':445
- '19#.#87.141.183':445
- '19#.#87.210.232':445
- '19#.#87.163.183':445
- '19#.#87.52.63':445
- '19#.#87.107.101':445
- '19#.#87.156.187':9988
- '19#.#87.155.70':9988
- '19#.#87.208.40':9988
- '19#.#87.216.65':9988
- '19#.#87.170.195':9988
- '19#.#87.30.208':445
- '19#.#87.249.217':445
- '19#.#87.252.107':9988
- '19#.#87.83.139':9988
- '19#.#87.31.248':445
- '19#.#87.14.14':445
- '19#.#87.79.57':445
- '19#.#87.122.3':445
- '19#.#87.65.43':445
- '19#.#87.123.22':445
- '19#.#87.11.98':445
- '19#.#87.82.18':445
- '19#.#87.85.81':445
- '19#.#87.120.96':445
- '19#.#87.77.21':445
- '19#.#87.178.181':445
- '19#.#87.190.84':445
- '19#.#87.114.109':445
- '19#.#87.69.237':445
- '19#.#87.45.213':445
- '19#.#87.137.15':445
- '19#.#87.249.117':445
- '19#.#87.126.116':9988
- '19#.#87.178.181':9988
- '19#.#87.79.57':9988
- '19#.#87.36.227':9988
- '19#.#87.149.59':9988
- '19#.#87.163.183':9988
- '19#.#87.123.22':9988
- '19#.#87.69.237':9988
- '19#.#87.77.21':9988
- '19#.#87.137.15':9988
- '19#.#87.87.194':9988
- '19#.#87.31.248':9988
- '19#.#87.30.208':9988
- '19#.#87.209.200':9988
- '19#.#87.82.18':9988
- '19#.#87.107.101':9988
- '19#.#87.85.81':9988
- '19#.#87.210.232':9988
- '19#.#87.52.63':9988
- '19#.#87.51.62':9988
- '19#.#87.35.245':9988
- '19#.#87.83.204':9988
- '19#.#87.59.33':9988
- '19#.#87.183.193':9988
- '19#.#87.123.28':9988
- '19#.#87.7.146':9988
- '19#.#87.190.84':9988
- '19#.#87.11.98':9988
- '19#.#87.22.75':9988
- '19#.#87.120.96':9988
- '19#.#87.45.213':9988
- '19#.#87.14.14':9988
- '19#.#87.122.3':9988
- '19#.#87.220.109':9988
- '19#.#87.145.170':9988
- '19#.#87.249.117':9988
- '19#.#87.110.23':9988
- '19#.#87.85.81':139
- '19#.#87.11.98':139
- '19#.#87.65.43':139
- '19#.#87.82.18':139
- '19#.#87.123.22':139
- '19#.#87.7.146':139
- '19#.#87.36.227':139
- '19#.#87.22.75':139
- '19#.#87.123.28':139
- '19#.#87.249.117':139
- '19#.#87.69.237':139
- '19#.#87.114.109':139
- '19#.#87.137.15':139
- '19#.#87.45.213':139
- '19#.#87.31.248':139
- '19#.#87.14.14':139
- '19#.#87.79.57':139
- '19#.#87.122.3':139
- '19#.#87.252.107':139
- '19#.#87.220.109':139
- '19#.#87.156.187':139
- '19#.#87.83.204':139
- '19#.#87.110.23':139
- '19#.#87.145.170':139
- '19#.#87.83.139':139
- '19#.#87.216.65':139
- '19#.#87.170.195':139
- '19#.#87.137.251':139
- '19#.#87.87.194':139
- '19#.#87.64.70':139
- '19#.#87.149.59':139
- '19#.#87.126.116':139
- '19#.#87.51.62':139
- '19#.#87.155.70':139
- '19#.#87.59.33':139
- '19#.#87.208.40':139
- '19#.#87.77.21':139
- '19#.#87.51.62':445
- '19#.#87.155.70':445
- '19#.#87.59.33':445
- '19#.#87.208.40':445
- '19#.#87.156.187':445
- '19#.#87.220.109':445
- '19#.#87.110.23':445
- '19#.#87.83.204':445
- '19#.#87.252.107':445
- '19#.#87.7.146':445
- '19#.#87.36.227':445
- '19#.#87.22.75':445
- '19#.#87.123.28':445
- '19#.#87.64.70':445
- '19#.#87.87.194':445
- '19#.#87.126.116':445
- '19#.#87.149.59':445
- '19#.#87.137.251':445
- '19#.#87.52.63':139
- '19#.#87.107.101':139
- '19#.#87.141.183':139
- '19#.#87.183.193':139
- '19#.#87.210.232':139
- '19#.#87.178.181':139
- '19#.#87.120.96':139
- '19#.#87.163.183':139
- '19#.#87.190.84':139
- '19#.#87.216.65':445
- '19#.#87.170.195':445
- '19#.#87.145.170':445
- '19#.#87.83.139':445
- '19#.#87.30.208':139
- '19#.#87.209.200':139
- '19#.#87.190.116':139
- '19#.#87.35.245':139
- '19#.#87.249.217':139
