Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\SA.DAT
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe' -k netsvcs
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
Сетевая активность:
Подключается к:
- '83.##3.188.88':445
- '83.##3.100.57':445
- '83.##3.143.188':445
- '83.##3.88.100':445
- '83.##3.76.170':445
- '83.##3.112.56':445
- '83.##3.118.134':445
- '83.##3.249.195':445
- '83.##3.68.65':445
- '83.##3.71.165':9988
- '83.##3.19.62':9988
- '83.##3.164.153':9988
- '83.##3.68.65':9988
- '83.##3.40.234':9988
- '83.#03.34.7':9988
- '83.##3.22.242':445
- '83.##3.84.192':9988
- '83.##3.70.48':9988
- '83.##3.108.128':445
- '83.##3.84.192':445
- '83.#03.5.72':445
- '83.##3.19.62':445
- '83.#03.55.3':445
- '83.##3.97.139':445
- '83.##3.96.160':445
- '83.##3.70.48':445
- '83.##3.119.203':445
- '83.##3.167.162':445
- '83.##3.71.165':445
- '83.##3.129.75':445
- '83.##3.203.72':445
- '83.##3.9.170':445
- '83.##3.134.234':445
- '83.##3.163.180':445
- '83.##3.229.129':445
- '83.##3.230.171':445
- '83.##3.228.160':9988
- '83.#03.5.72':9988
- '83.##3.167.162':9988
- '83.##3.9.170':9988
- '83.##3.108.128':9988
- '83.##3.134.234':9988
- '83.##3.225.128':9988
- '83.##3.129.75':9988
- '83.##3.229.129':9988
- '83.##3.230.171':9988
- '83.##3.249.195':9988
- '83.##3.188.88':9988
- '83.##3.100.57':9988
- '83.##3.22.242':9988
- '83.##3.88.100':9988
- '83.##3.76.170':9988
- '83.##3.112.56':9988
- '83.##3.118.134':9988
- '83.##3.203.72':9988
- '83.##3.18.24':9988
- '83.##3.204.46':9988
- '83.##3.156.13':9988
- '83.##3.52.93':9988
- '83.##3.160.9':9988
- '83.##3.109.101':9988
- '83.##3.197.222':9988
- '83.##3.93.17':9988
- '83.##3.96.160':9988
- '83.##3.171.70':9988
- '83.##3.175.212':9988
- '83.##3.163.180':9988
- '83.#03.55.3':9988
- '83.##3.14.250':9988
- '83.##3.97.139':9988
- '83.##3.128.214':9988
- '83.##3.66.186':9988
- '83.##3.223.142':9988
- '83.##3.160.9':445
- '83.##3.97.139':139
- '83.##3.96.160':139
- '83.##3.70.48':139
- '83.##3.119.203':139
- '83.##3.160.9':139
- '83.##3.23.176':139
- '83.##3.175.212':139
- '83.##3.156.13':139
- '83.##3.18.24':139
- '83.##3.134.234':139
- '83.##3.163.180':139
- '83.##3.229.129':139
- '83.##3.230.171':139
- '83.#03.5.72':139
- '83.##3.84.192':139
- '83.#03.55.3':139
- '83.##3.19.62':139
- '83.##3.108.128':139
- '83.##3.14.250':139
- '83.##3.93.17':139
- '83.##3.110.83':139
- '83.##3.111.164':139
- '83.##3.141.36':139
- '83.##3.109.101':139
- '83.##3.164.153':139
- '83.##3.52.93':139
- '83.##3.40.234':139
- '83.##3.128.214':139
- '83.##3.66.186':139
- '83.##3.204.46':139
- '83.##3.225.128':139
- '83.##3.197.222':139
- '83.##3.171.70':139
- '83.#03.34.7':139
- '83.##3.223.142':139
- '83.##3.228.160':139
- '83.##3.9.170':139
- '83.##3.171.70':445
- '83.##3.52.93':445
- '83.##3.223.142':445
- '83.##3.228.160':445
- '83.##3.14.250':445
- '83.##3.110.83':445
- '83.#03.34.7':445
- '83.##3.109.101':445
- '83.##3.164.153':445
- '83.##3.23.176':445
- '83.##3.175.212':445
- '83.##3.156.13':445
- '83.##3.18.24':445
- '83.##3.204.46':445
- '83.##3.66.186':445
- '83.##3.197.222':445
- '83.##3.225.128':445
- '83.##3.128.214':445
- '83.##3.249.195':139
- '83.##3.112.56':139
- '83.##3.76.170':139
- '83.##3.68.65':139
- '83.##3.118.134':139
- '83.##3.167.162':139
- '83.##3.71.165':139
- '83.##3.129.75':139
- '83.##3.203.72':139
- '83.##3.93.17':445
- '83.##3.40.234':445
- '83.##3.111.164':445
- '83.##3.141.36':445
- '83.##3.22.242':139
- '83.##3.88.100':139
- '83.##3.100.57':139
- '83.##3.143.188':139
- '83.##3.188.88':139
