Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\SA.DAT
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe' -k netsvcs
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
- %PROGRAM_FILES%\NetMeeting\rsewzjqn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
Сетевая активность:
Подключается к:
- '72.#4.83.8':445
- '72.##.105.253':445
- '72.##.236.35':139
- '72.##.157.119':445
- '72.##.243.105':445
- '72.##.201.147':445
- '72.##.149.175':445
- '72.##.200.242':445
- '72.##.73.201':445
- '72.#4.2.84':139
- '72.##.153.170':139
- '72.##.67.182':139
- '72.#4.32.15':139
- '72.#4.68.27':139
- '72.##.125.128':139
- '72.##.227.24':139
- '72.##.119.17':139
- '72.##.128.110':139
- '72.##.139.63':445
- '72.##.155.73':445
- '72.##.70.118':445
- '72.##.166.232':445
- '72.#4.5.112':445
- '72.#4.2.238':445
- '72.##.153.228':445
- '72.#4.96.12':445
- '72.#4.94.28':445
- '72.#4.94.27':445
- '72.##.153.18':445
- '72.#4.71.76':445
- '72.##.66.205':445
- '72.##.42.100':445
- '72.##.113.159':445
- '72.##.189.51':445
- '72.##.18.159':445
- '72.##.108.106':445
- '72.##.172.75':445
- '72.##.42.100':139
- '72.##.153.18':139
- '72.##.139.63':139
- '72.##.66.205':139
- '72.#4.71.76':139
- '72.##.172.75':139
- '72.##.189.51':139
- '72.##.113.159':139
- '72.##.108.106':139
- '72.#4.83.8':139
- '72.##.105.253':139
- '72.#4.27.53':445
- '72.##.157.119':139
- '72.##.243.105':139
- '72.##.201.147':139
- '72.##.149.175':139
- '72.##.200.242':139
- '72.##.73.201':139
- '72.##.18.159':139
- '72.##.125.150':139
- '72.##.10.119':139
- '72.##.75.186':139
- '72.##.33.225':139
- '72.##.47.203':139
- '72.##.191.216':139
- '72.##.115.159':139
- '72.##.236.47':139
- '72.##.215.236':139
- '72.##.155.73':139
- '72.##.70.118':139
- '72.##.166.232':139
- '72.#4.5.112':139
- '72.#4.2.238':139
- '72.##.153.228':139
- '72.#4.96.12':139
- '72.#4.94.28':139
- '72.#4.94.27':139
- '72.##.75.186':445
- '72.##.172.213':139
- '72.##.99.154':139
- '72.##.211.219':139
- '72.##.130.127':139
- '72.#4.3.182':139
- '72.##.188.63':139
- '72.##.111.92':139
- '72.##.114.160':139
- '72.##.211.114':139
- '72.##.30.147':139
- '72.#4.71.37':139
- '72.#4.231.0':139
- '72.##.14.103':139
- '72.##.73.134':139
- '72.##.179.219':139
- '72.##.219.156':139
- '72.##.196.46':139
- '72.##.229.206':139
- '72.#4.62.8':139
- '72.##.112.77':139
- '72.##.225.179':139
- '72.#4.86.7':139
- '72.##.250.251':139
- '72.##.74.225':139
- '72.#4.14.48':139
- '72.##.104.86':139
- '72.#4.18.74':139
- '72.##.251.170':139
- '72.#4.237.5':139
- '72.##.254.224':139
- '72.##.109.245':139
- '72.#4.28.49':139
- '72.##.113.181':139
- '72.#4.155.2':139
- '72.#4.91.14':139
- '72.##.246.153':139
- '72.##.30.121':139
- '72.##.153.170':445
- '72.#4.68.27':445
- '72.#4.32.15':445
- '72.#4.2.84':445
- '72.##.119.17':445
- '72.##.227.24':445
- '72.##.236.35':445
- '72.##.128.110':445
- '72.##.125.128':445
- '72.##.10.119':445
- '72.##.47.203':445
- '72.##.33.225':445
- '72.##.125.150':445
- '72.##.236.47':445
- '72.##.115.159':445
- '72.##.67.182':445
- '72.##.215.236':445
- '72.##.191.216':445
- '72.##.224.129':139
- '72.#4.46.87':139
- '72.##.109.68':139
- '72.#4.188.0':139
- '72.#4.248.8':139
- '72.##.195.113':139
- '72.##.194.107':139
- '72.#4.83.56':139
- '72.##.220.228':139
- '72.##.160.72':139
- '72.#4.39.7':139
- '72.#4.225.9':139
- '72.##.70.248':139
- '72.#4.90.55':139
- '72.##.224.129':445
- '72.#4.39.7':445
- '72.#4.225.9':445
- '72.##.70.248':445
- '72.#4.90.55':445
- '72.##.52.202':445
- '72.##.150.32':139
- '72.##.207.136':139
- '72.##.108.58':139
- '72.#4.33.9':139
- '72.#4.94.65':139
- '72.##.123.247':445
- '72.##.49.163':445
- '72.#4.31.33':445
- '72.##.229.85':445
- '72.#4.54.46':139
- '72.##.119.117':139
- '72.##.161.98':139
- '72.##.164.37':139
- '72.##.160.131':139
- '72.##.61.254':139
- '72.##.89.244':139
- '72.##.208.209':139
- '72.##.242.248':139
- '72.#4.20.30':445
- '72.##.147.82':445
- '72.##.221.237':445
- '72.##.254.179':445
- '72.##.81.254':445
- '72.##.228.13':445
- '72.##.64.122':445
- '72.#4.33.73':445
- '72.#4.75.15':445
- '72.##.239.74':445
- '72.##.65.137':445
- '72.##.250.10':445
- '72.#4.84.45':445
- '72.##.254.239':445
- '72.##.221.64':445
- '72.#4.96.83':445
- '72.##.123.131':445
- '72.##.216.23':445
- '72.##.133.41':445
- '72.##.133.41':139
- '72.#4.96.83':139
- '72.##.221.64':139
- '72.##.216.23':139
- '72.##.123.131':139
- '72.##.147.82':139
- '72.##.221.237':139
- '72.##.254.179':139
- '72.##.81.254':139
- '72.##.123.247':139
- '72.##.49.163':139
- '72.#4.20.30':139
- '72.#4.31.33':139
- '72.##.229.85':139
- '72.##.65.137':139
- '72.##.250.10':139
- '72.#4.84.45':139
- '72.##.254.239':139
- '72.##.228.13':139
- '72.##.207.15':139
- '72.##.196.109':139
- '72.##.80.163':139
- '72.##.183.206':139
- '72.##.178.242':139
- '72.#4.47.43':139
- '72.##.144.47':139
- '72.#4.66.11':139
- '72.#4.43.65':139
- '72.##.64.122':139
- '72.#4.33.73':139
- '72.#4.75.15':139
- '72.##.239.74':139
- '72.##.49.216':139
- '72.##.228.236':139
- '72.##.197.140':139
- '72.#4.12.1':139
- '72.##.211.132':139
- '72.##.49.216':445
- '72.##.24.245':139
- '72.##.108.111':139
- '72.##.254.179':9988
- '72.##.228.236':9988
- '72.##.46.238':139
- '72.##.24.245':445
- '72.##.108.111':445
- '72.##.95.241':139
- '72.##.26.150':139
- '72.##.221.237':9988
- '72.#4.20.30':9988
- '72.##.65.137':9988
- '72.#4.47.43':9988
- '72.##.216.23':9988
- '72.#4.75.15':9988
- '72.#4.12.1':9988
- '72.##.239.74':9988
- '72.##.221.64':9988
- '72.##.46.238':445
- '72.##.193.129':139
- '72.##.201.192':139
- '72.##.191.231':445
- '72.##.90.233':139
- '72.##.52.202':139
- '72.##.193.129':445
- '72.##.201.192':445
- '72.#4.27.53':139
- '72.##.90.233':445
- '72.##.107.200':139
- '72.##.35.124':139
- '72.##.95.241':445
- '72.##.26.150':445
- '72.#4.66.32':139
- '72.##.35.124':445
- '72.#4.66.32':445
- '72.##.191.231':139
- '72.##.107.200':445
- '72.#4.47.43':445
- '72.##.144.47':445
- '72.#4.66.11':445
- '72.#4.43.65':445
- '72.##.161.98':445
- '72.##.119.117':445
- '72.##.160.131':445
- '72.##.164.37':445
- '72.#4.54.46':445
- '72.##.228.236':445
- '72.##.197.140':445
- '72.#4.12.1':445
- '72.##.211.132':445
- '72.##.80.163':445
- '72.##.196.109':445
- '72.##.178.242':445
- '72.##.183.206':445
- '72.##.207.15':445
- '72.##.208.209':445
- '72.##.147.82':9988
- '72.##.228.13':9988
- '72.##.81.254':9988
- '72.##.133.41':9988
- '72.##.123.131':9988
- '72.##.49.216':9988
- '72.#4.31.33':9988
- '72.#4.43.65':9988
- '72.#4.33.73':9988
- '72.##.89.244':445
- '72.##.108.58':445
- '72.##.242.248':445
- '72.##.61.254':445
- '72.#4.33.9':445
- '72.#4.94.65':445
- '72.##.211.132':9988
- '72.##.150.32':445
- '72.##.207.136':445
