Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\SA.DAT
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe' -k netsvcs
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
Сетевая активность:
Подключается к:
- '83.##.121.15':139
- '83.#8.4.111':139
- '83.##.163.244':139
- '83.##.101.58':139
- '83.##.217.144':139
- '83.##.122.248':139
- '83.#8.81.36':139
- '83.##.152.104':139
- '83.#8.74.59':139
- '83.##.240.96':139
- '83.##.96.249':139
- '83.##.249.176':139
- '83.#8.6.1':139
- '83.##.237.225':139
- '83.##.205.158':139
- '83.##.155.168':139
- '83.##.142.111':445
- '83.##.120.208':139
- '83.##.149.179':139
- '83.##.197.121':139
- '83.##.191.96':139
- '83.##.62.185':139
- '83.##.98.103':139
- '83.##.12.232':139
- '83.##.26.195':139
- '83.##.207.216':139
- '83.#8.6.196':139
- '83.##.142.111':139
- '83.##.27.197':139
- '83.##.57.132':139
- '83.##.141.147':139
- '83.##.94.224':9988
- '83.##.200.23':445
- '83.##.67.136':445
- '83.#8.65.18':9988
- '83.#8.50.54':9988
- '83.##.232.46':9988
- '83.##.169.223':139
- '83.#8.70.98':139
- '83.#8.98.53':139
- '83.##.217.98':139
- '83.##.71.167':139
- '83.##.166.210':139
- '83.##.166.142':139
- '83.#8.28.32':139
- '83.##.116.210':139
- '83.#8.68.11':139
- '83.##.153.114':139
- '83.##.132.72':139
- '83.##.102.51':139
- '83.##.197.121':445
- '83.##.191.96':445
- '83.##.62.185':445
- '83.##.98.103':445
- '83.##.12.232':445
- '83.##.26.195':445
- '83.##.122.248':445
- '83.##.121.15':445
- '83.#8.4.111':445
- '83.#8.6.1':445
- '83.##.101.58':445
- '83.##.217.144':445
- '83.##.155.168':445
- '83.##.202.91':139
- '83.##.60.166':139
- '83.##.165.219':139
- '83.#8.38.43':139
- '83.##.237.137':139
- '83.#8.44.30':139
- '83.##.149.179':445
- '83.##.237.225':445
- '83.##.205.158':445
- '83.##.156.247':139
- '83.##.168.52':139
- '83.##.120.208':445
- '83.#8.28.32':445
- '83.##.116.210':445
- '83.#8.68.11':445
- '83.##.153.114':445
- '83.##.132.72':445
- '83.##.102.51':445
- '83.##.141.147':445
- '83.##.207.216':445
- '83.#8.6.196':445
- '83.##.169.223':445
- '83.##.27.197':445
- '83.##.57.132':445
- '83.##.217.98':445
- '83.##.249.176':445
- '83.#8.81.36':445
- '83.##.152.104':445
- '83.##.163.244':445
- '83.##.240.96':445
- '83.##.96.249':445
- '83.##.166.142':445
- '83.#8.70.98':445
- '83.#8.98.53':445
- '83.#8.74.59':445
- '83.##.71.167':445
- '83.##.166.210':445
- '83.##.107.141':139
- '83.##.163.17':139
- '83.#8.9.46':139
- '83.#8.52.44':139
- '83.##.147.236':139
- '83.##.25.152':139
- '83.##.179.170':139
- '83.##.149.48':139
- '83.##.115.152':139
- '83.##.130.59':139
- '83.##.18.227':139
- '83.##.125.130':139
- '83.##.76.217':139
- '83.##.146.172':139
- '83.#8.172.6':139
- '83.#8.5.253':139
- '83.##.83.240':139
- '83.##.67.136':139
- '83.#8.6.146':139
- '83.##.82.121':139
- '83.##.105.94':139
- '83.#8.69.77':139
- '83.##.252.125':139
- '83.##.125.94':139
- '83.##.94.224':139
- '83.##.184.183':139
- '83.#8.30.98':139
- '83.##.124.247':139
- '83.##.232.46':139
- '83.##.250.189':139
- '83.#8.1.81':139
- '83.##.211.70':139
- '83.#8.65.18':139
- '83.##.116.102':139
- '83.##.62.153':139
- '83.##.38.148':139
- '83.#8.71.64':139
- '83.##.79.232':139
- '83.##.131.156':139
- '83.##.156.23':139
- '83.##.140.26':139
- '83.##.152.163':139
- '83.##.163.141':139
- '83.##.103.165':139
- '83.##.62.126':139
- '83.#8.50.54':139
- '83.##.253.79':139
- '83.##.195.25':139
- '83.##.254.235':139
- '83.##.43.202':139
- '83.##.163.17':445
- '83.#8.9.46':445
- '83.##.130.59':445
- '83.##.147.236':445
- '83.##.25.152':445
- '83.##.107.141':445
- '83.##.179.170':445
- '83.##.115.152':445
- '83.##.152.163':445
- '83.##.18.227':445
- '83.##.125.130':445
- '83.##.149.48':445
- '83.#8.52.44':445
- '83.#8.172.6':445
- '83.##.252.125':445
- '83.#8.5.253':445
- '83.##.83.240':445
- '83.#8.6.146':445
- '83.##.146.172':445
- '83.##.105.94':445
- '83.#8.69.77':445
- '83.##.76.217':445
- '83.##.125.94':445
- '83.##.94.224':445
- '83.##.82.121':445
- '83.#8.30.98':445
- '83.##.116.102':445
- '83.##.124.247':445
- '83.##.250.189':445
- '83.#8.1.81':445
- '83.##.184.183':445
- '83.##.211.70':445
- '83.##.38.148':445
- '83.##.200.23':139
- '83.##.62.153':445
- '83.#8.65.18':445
- '83.#8.71.64':445
- '83.##.232.46':445
- '83.##.131.156':445
- '83.##.140.26':445
- '83.##.195.25':445
- '83.##.163.141':445
- '83.##.103.165':445
- '83.##.156.23':445
- '83.#8.50.54':445
- '83.##.253.79':445
- '83.##.79.232':445
- '83.##.254.235':445
- '83.##.43.202':445
- '83.##.62.126':445
