Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\SA.DAT
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe' -k netsvcs
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
Сетевая активность:
Подключается к:
- '19#.#15.5.113':9988
- '19#.#15.73.234':9988
- '19#.#15.109.125':9988
- '19#.#15.128.13':9988
- '19#.#15.13.147':9988
- '19#.#15.203.137':9988
- '19#.#15.213.201':9988
- '19#.#15.63.75':9988
- '19#.#15.84.12':9988
- '19#.#15.55.90':9988
- '19#.#15.33.181':9988
- '19#.#15.234.135':9988
- '19#.#15.178.69':9988
- '19#.#15.136.124':9988
- '19#.#15.29.108':9988
- '19#.#15.217.21':9988
- '19#.#15.84.69':9988
- '19#.#15.37.110':9988
- '19#.#15.70.111':9988
- '19#.#15.59.170':9988
- '19#.#15.58.114':9988
- '19#.#15.75.155':445
- '19#.#15.31.153':445
- '19#.#15.63.75':445
- '19#.#15.184.36':445
- '19#.#15.183.62':445
- '19#.#15.36.36':445
- '19#.#15.84.12':445
- '19#.#15.30.168':445
- '19#.#15.35.62':445
- '19#.#15.76.228':445
- '19#.#15.223.31':445
- '19#.#15.121.171':9988
- '19#.#15.69.220':9988
- '19#.#15.48.19':9988
- '19#.#15.90.212':9988
- '19#.#15.127.14':9988
- '19#.#15.7.25':445
- '19#.#15.239.222':445
- '19#.#15.214.109':445
- '19#.#15.55.90':445
- '19#.#15.214.103':445
- '19#.#15.122.88':9988
- '19#.#15.91.67':139
- '19#.#15.36.47':139
- '19#.#15.108.93':139
- '19#.#15.105.220':139
- '19#.#15.208.30':139
- '19#.#15.42.139':9988
- '19#.#15.6.27':9988
- '19#.#15.30.168':9988
- '19#.#15.7.130':139
- '19#.#15.95.97':139
- '19#.#15.253.78':139
- '19#.#15.48.6':139
- '19#.#15.23.149':139
- '19#.#15.116.13':139
- '19#.#15.166.119':139
- '19#.#15.155.32':139
- '19#.#15.47.185':139
- '19#.#15.26.94':139
- '19#.#15.17.194':139
- '19#.#15.80.6':139
- '19#.#15.127.51':139
- '19#.#15.239.222':9988
- '19#.#15.214.109':9988
- '19#.#15.214.103':9988
- '19#.#15.76.228':9988
- '19#.#15.75.155':9988
- '19#.#15.35.62':9988
- '19#.#15.180.1':9988
- '19#.#15.31.153':9988
- '19#.#15.183.62':9988
- '19#.#15.223.31':9988
- '19#.#15.7.25':9988
- '19#.#15.192.29':9988
- '19#.#15.11.141':9988
- '19#.#15.98.149':9988
- '19#.#15.252.176':9988
- '19#.#15.196.0':9988
- '19#.#15.243.128':9988
- '19#.#15.184.36':9988
- '19#.#15.26.163':9988
- '19#.#15.36.36':9988
- '19#.#15.36.159':9988
- '19#.#15.243.128':445
- '19#.#15.33.181':139
- '19#.#15.42.139':139
- '19#.#15.122.88':139
- '19#.#15.252.176':139
- '19#.#15.58.114':139
- '19#.#15.70.111':139
- '19#.#15.5.113':139
- '19#.#15.196.0':139
- '19#.#15.73.234':139
- '19#.#15.234.135':139
- '19#.#15.109.125':139
- '19#.#15.76.228':139
- '19#.#15.30.168':139
- '19#.#15.35.62':139
- '19#.#15.75.155':139
- '19#.#15.31.153':139
- '19#.#15.128.13':139
- '19#.#15.98.149':139
- '19#.#15.243.128':139
- '19#.#15.84.12':139
- '19#.#15.36.36':139
- '19#.#15.121.171':139
- '19#.#15.36.159':139
- '19#.#15.69.220':139
- '19#.#15.59.170':139
- '19#.#15.178.69':139
- '19#.#15.84.69':139
- '19#.#15.127.14':139
- '19#.#15.11.141':139
- '19#.#15.203.137':139
- '19#.#15.13.147':139
- '19#.#15.26.163':139
- '19#.#15.90.212':139
- '19#.#15.37.110':139
- '19#.#15.213.201':139
- '19#.#15.136.124':139
- '19#.#15.180.1':139
- '19#.#15.217.21':139
- '19#.#15.6.27':139
- '19#.#15.29.108':139
- '19#.#15.48.19':139
- '19#.#15.192.29':139
- '19#.#15.63.75':139
- '19#.#15.180.1':445
- '19#.#15.90.212':445
- '19#.#15.136.124':445
- '19#.#15.70.111':445
- '19#.#15.5.113':445
- '19#.#15.192.29':445
- '19#.#15.29.108':445
- '19#.#15.48.19':445
- '19#.#15.213.201':445
- '19#.#15.37.110':445
- '19#.#15.196.0':445
- '19#.#15.252.176':445
- '19#.#15.58.114':445
- '19#.#15.98.149':445
- '19#.#15.128.13':445
- '19#.#15.109.125':445
- '19#.#15.73.234':445
- '19#.#15.234.135':445
- '19#.#15.42.139':445
- '19#.#15.33.181':445
- '19#.#15.122.88':445
- '19#.#15.214.103':139
- '19#.#15.214.109':139
- '19#.#15.55.90':139
- '19#.#15.84.69':445
- '19#.#15.127.14':445
- '19#.#15.184.36':139
- '19#.#15.183.62':139
- '19#.#15.223.31':139
- '19#.#15.7.25':139
- '19#.#15.239.222':139
- '19#.#15.11.141':445
- '19#.#15.59.170':445
- '19#.#15.178.69':445
- '19#.#15.26.163':445
- '19#.#15.217.21':445
- '19#.#15.6.27':445
- '19#.#15.203.137':445
- '19#.#15.13.147':445
- '19#.#15.36.159':445
- '19#.#15.69.220':445
- '19#.#15.121.171':445
