Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\SA.DAT
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe' -k netsvcs
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
Сетевая активность:
Подключается к:
- '61.#.220.115':445
- '61.#.234.146':445
- '61.#.8.61':139
- '61.#.115.237':445
- '61.#.143.149':445
- '61.#.149.52':445
- '61.#.41.97':445
- '61.#.112.143':445
- '61.#.104.113':445
- '61.#.112.143':139
- '61.#.104.113':139
- '61.#.234.146':139
- '61.#.143.149':139
- '61.#.149.52':139
- '61.#.47.113':139
- '61.#.36.192':139
- '61.#.41.97':139
- '61.#.112.189':139
- '61.#.112.189':445
- '61.#.160.153':139
- '61.#.43.116':139
- '61.#.147.195':139
- '61.#.5.149':139
- '61.#.12.221':139
- '61.#.224.251':139
- '61.#.77.174':139
- '61.#.169.134':139
- '61.#.220.254':139
- '61.#.8.61':445
- '61.#.185.167':139
- '61.#.47.113':445
- '61.#.36.192':445
- '61.#.242.48':139
- '61.#.194.7':139
- '61.#.216.56':139
- '61.#.173.242':139
- '61.#.7.174':139
- '61.#.51.119':445
- '61.#.1.35':445
- '61.#.221.120':445
- '61.#.216.99':445
- '61.#.243.0':445
- '61.#.8.162':445
- '61.#.245.141':445
- '61.#.217.114':445
- '61.#.58.73':445
- '61.#.66.252':445
- '61.#.178.63':445
- '61.#.217.131':445
- '61.#.149.100':445
- '61.#.144.135':445
- '61.#.169.200':445
- '61.#.86.59':445
- '61.#.134.234':445
- '61.#.162.200':445
- '61.#.137.253':445
- '61.#.228.221':445
- '61.#.174.229':445
- '61.#.35.204':445
- '61.#.41.76':445
- '61.#.224.75':445
- '61.#.115.237':139
- '61.#.220.115':139
- '61.#.32.213':445
- '61.#.238.32':445
- '61.#.4.219':445
- '61.#.57.45':445
- '61.#.111.244':445
- '61.#.209.49':445
- '61.#.161.217':445
- '61.#.240.195':445
- '61.#.83.103':445
- '61.#.19.192':445
- '61.#.55.31':445
- '61.#.63.240':139
- '61.#.199.6':445
- '61.#.29.38':445
- '61.#.141.133':445
- '61.#.28.130':445
- '61.#.128.119':445
- '61.#.128.42':445
- '61.#.130.157':445
- '61.#.87.165':445
- '61.#.42.28':445
- '61.#.57.200':445
- '61.#.238.44':445
- '61.#.77.174':445
- '61.#.63.240':445
- '61.#.195.221':445
- '61.#.162.93':445
- '61.#.133.162':445
- '61.#.38.32':445
- '61.#.126.53':445
- '61.#.14.155':445
- '61.#.152.109':139
- '61.#.8.121':139
- '61.#.237.146':139
- '61.#.116.78':139
- '61.#.196.34':139
- '61.#.238.65':139
- '61.#.63.238':139
- '61.#.58.144':139
- '61.#.190.182':139
- '61.#.51.190':445
- '61.#.65.47':445
- '61.#.248.13':445
- '61.#.27.204':445
- '61.#.144.114':445
- '61.#.141.27':139
- '61.#.92.141':139
- '61.#.12.7':445
- '61.#.254.55':139
- '61.#.128.119':139
- '61.#.87.165':139
- '61.#.199.6':139
- '61.#.29.38':139
- '61.#.42.28':139
- '61.#.14.155':139
- '61.#.248.13':139
- '61.#.128.42':139
- '61.#.130.157':139
- '61.#.195.221':139
- '61.#.38.32':139
- '61.#.57.200':139
- '61.#.238.44':139
- '61.#.126.53':139
- '61.#.141.133':139
- '61.#.28.130':139
- '61.#.162.93':139
- '61.#.133.162':139
- '61.#.27.204':139
- '61.#.5.149':445
- '61.#.160.153':445
- '61.#.216.56':445
- '61.#.147.195':445
- '61.#.43.116':445
- '61.#.220.254':445
- '61.#.224.251':445
- '61.#.12.221':445
- '61.#.169.134':445
- '61.#.144.114':139
- '61.#.12.7':139
- '61.#.51.190':139
- '61.#.65.47':139
- '61.#.185.167':445
- '61.#.7.174':445
- '61.#.194.7':445
- '61.#.242.48':445
- '61.#.173.242':445
- '61.#.80.87':445
- '61.#.140.132':139
- '61.#.42.19':139
- '61.#.45.78':139
- '61.#.149.28':139
- '61.#.0.236':139
- '61.#.96.205':445
- '61.#.158.151':445
- '61.#.109.1':445
- '61.#.162.247':445
- '61.#.89.11':139
- '61.#.82.20':139
- '61.#.226.37':139
- '61.#.0.69':139
- '61.#.139.53':139
- '61.#.11.56':139
- '61.#.49.231':139
- '61.#.142.243':139
- '61.#.197.114':139
- '61.#.118.220':445
- '61.#.5.72':445
- '61.#.135.111':445
- '61.#.57.149':445
- '61.#.72.58':445
- '61.#.12.165':445
- '61.#.212.239':445
- '61.#.229.212':445
- '61.#.127.251':445
- '61.#.61.239':445
- '61.#.6.45':445
- '61.#.28.227':445
- '61.#.185.140':445
- '61.#.25.96':445
- '61.#.228.33':445
- '61.#.41.201':445
- '61.#.163.198':445
- '61.#.10.248':445
- '61.#.161.78':445
- '61.#.161.78':139
- '61.#.41.201':139
- '61.#.228.33':139
- '61.#.10.248':139
- '61.#.163.198':139
- '61.#.5.72':139
- '61.#.135.111':139
- '61.#.57.149':139
- '61.#.72.58':139
- '61.#.109.1':139
- '61.#.118.220':139
- '61.#.96.205':139
- '61.#.162.247':139
- '61.#.25.96':139
- '61.#.6.45':139
- '61.#.28.227':139
- '61.#.158.151':139
- '61.#.185.140':139
- '61.#.12.165':139
- '61.#.201.152':139
- '61.#.76.18':139
- '61.#.26.37':139
- '61.#.100.179':139
- '61.#.116.181':139
- '61.#.151.147':139
- '61.#.205.100':139
- '61.#.81.103':139
- '61.#.154.47':139
- '61.#.212.239':139
- '61.#.229.212':139
- '61.#.127.251':139
- '61.#.61.239':139
- '61.#.21.162':139
- '61.#.59.110':139
- '61.#.254.228':139
- '61.#.165.10':139
- '61.#.10.127':139
- '61.#.21.162':445
- '61.#.1.35':139
- '61.#.243.0':139
- '61.#.216.99':139
- '61.#.51.119':139
- '61.#.217.114':139
- '61.#.245.141':139
- '61.#.137.253':139
- '61.#.58.73':139
- '61.#.8.162':139
- '61.#.178.63':139
- '61.#.144.135':139
- '61.#.149.100':139
- '61.#.66.252':139
- '61.#.134.234':139
- '61.#.86.59':139
- '61.#.221.120':139
- '61.#.162.200':139
- '61.#.169.200':139
- '61.#.111.244':139
- '61.#.174.229':139
- '61.#.224.75':139
- '61.#.41.76':139
- '61.#.228.221':139
- '61.#.32.213':139
- '61.#.51.41':445
- '61.#.126.216':445
- '61.#.238.32':139
- '61.#.41.1':445
- '61.#.57.45':139
- '61.#.161.217':139
- '61.#.209.49':139
- '61.#.4.219':139
- '61.#.19.192':139
- '61.#.83.103':139
- '61.#.35.204':139
- '61.#.55.31':139
- '61.#.240.195':139
- '61.#.151.147':445
- '61.#.205.100':445
- '61.#.81.103':445
- '61.#.154.47':445
- '61.#.226.37':445
- '61.#.82.20':445
- '61.#.139.53':445
- '61.#.0.69':445
- '61.#.89.11':445
- '61.#.59.110':445
- '61.#.254.228':445
- '61.#.165.10':445
- '61.#.10.127':445
- '61.#.26.37':445
- '61.#.76.18':445
- '61.#.116.181':445
- '61.#.100.179':445
- '61.#.201.152':445
- '61.#.142.243':445
- '61.#.76.18':9988
- '61.#.0.236':9988
- '61.#.161.78':9988
- '61.#.25.96':9988
- '61.#.41.1':139
- '61.#.80.87':139
- '61.#.217.131':139
- '61.#.51.41':139
- '61.#.126.216':139
- '61.#.49.231':445
- '61.#.45.78':445
- '61.#.197.114':445
- '61.#.11.56':445
- '61.#.149.28':445
- '61.#.0.236':445
- '61.#.228.33':9988
- '61.#.140.132':445
- '61.#.42.19':445
