Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'shell' = 'explorer.exe stubbish.exe'
Изменения в файловой системе:
Создает следующие файлы:
- <SYSTEM32>\stubbish.exe
- <Текущая директория>\136578.exe
Удаляет следующие файлы:
- <Текущая директория>\136578.exe
Сетевая активность:
Подключается к:
- '17#.#05.43.33':3127
- '13#.#06.103.104':3140
- '12#.#79.205.181':3127
- '16#.#68.137.65':3140
- '54.#8.19.33':3140
- '10#.#28.51.207':3140
- '8.##.161.19':3140
- '17#.#71.110.164':3140
- '32.##2.200.131':3127
- '15#.#16.218.255':3127
- '16#.#1.253.196':3127
- '16#.#8.155.1':3140
- '72.##0.234.89':3127
- '11.##0.49.101':3127
- '17#.#.165.174':3127
- '43.##.45.189':3140
- '61.##9.95.197':3127
- '14#.85.5.74':3140
- '28.#81.13.5':3127
- '44.##.177.140':3127
- '86.##9.97.164':3127
- '11#.#16.172.19':3127
- '93.#2.23.62':3127
- '95.##.174.194':3127
- '15#.#46.59.252':3127
- '17#.#62.57.225':3140
- '10#.#6.2.152':3127
- '98.##0.226.11':3127
- '54.##8.125.105':3127
- '10#.#65.109.147':3127
- '92.##0.208.164':3127
- '10#.#49.149.238':3140
- '13#.#4.225.99':3127
- '9.###.248.75':3127
- '58.##2.166.94':3127
- '18#.#78.180.78':3127
- '15#.#47.243.38':3127
- '16#.#9.222.241':3127
- '15#.#37.177.180':3127
- '96.##.202.70':3127
- '76.#6.80.60':3127
- '24.##1.69.200':3127
- '87.#.155.141':3127
- '37.#.214.50':3127
- '19#.#8.200.18':3127
- '12#.#06.166.14':3127
- '21#.#0.109.250':3127
- '18#.#42.216.118':3140
- '65.##1.247.132':3140
- '20#.#1.39.171':3140
- '24.##2.113.190':3127
- '1.###.179.88':3127
- '17#.#40.221.155':3127
- '13#.#6.75.117':3127
- '71.##2.97.86':3140
- '10#.#62.158.137':3127
- '29.##.198.132':3127
- '10#.#96.54.68':3127
- '10#.#08.230.215':3127
- '89.##8.225.232':3140
- '9.##.94.77':3127
- '25.##1.144.118':3127
- '16#.#84.171.57':3127
- '50.##.159.211':3127
- '13#.#3.41.177':3127
- '69.##.173.169':3127
- '56.#5.46.28':3127
- '25.##5.22.132':3127
- '15#.#9.40.178':3127
- '19#.#07.64.117':3127
- '14#.#6.195.39':3127
- '14#.#30.11.82':3127
- '72.##.146.179':3140
- '20#.#42.204.200':3127
- '18#.#0.87.96':3127
- '35.##9.106.68':3127
- '76.##.237.33':3127
- '70.#7.74.38':3127
- '18#.#19.28.147':3140
- '81.##6.238.68':3127
- '10#.#60.243.54':3127
- '68.#9.6.52':3127
- '22#.#4.211.80':3127
- '22#.#4.237.33':3127
- '74.##8.25.145':3127
- '17#.#89.75.214':3127
- '<IP-адрес в локальной сети>':0
- '3.###.88.169':3127
- '22#.#0.150.124':3127
- '20#.#6.226.1':3127
- '19#.#07.89.144':3127
- '53.##2.16.110':3140
- '82.##4.212.123':3127
- '21#.#4.189.11':3127
- '13#.#47.108.80':3127
- '27.##8.36.88':3140
- '72.##9.129.162':3127
- '80.##1.195.221':3127
- '16#.#9.217.165':3127
- '86.##4.193.161':3127
- '15#.#9.93.209':3127
- '21#.#25.97.217':3127
- '34.##4.67.193':3127
- '21#.#1.80.43':3140
- '13#.#46.1.186':3127
- '11#.#85.22.128':3140
- '14#.7.74.25':3140
- '56.##2.92.96':3127
- '82.##6.185.187':3127
- '17.#5.44.81':3127
- '24.##.219.213':3140
- '18#.#.159.171':3127
- '14#.#5.17.253':3127
- '69.##.70.197':3127
- '69.##8.252.232':3140
- '30.##.215.48':3127
- '13#.#21.228.93':3127
- '73.##1.222.107':3127
- '16#.#76.161.102':27347
- '66.##.245.226':3127
- '22#.#37.194.62':903
- '63.##7.148.24':27347
- '15#.#21.68.95':3127
- '19#.#65.238.38':3127
- '14.##0.2.230':3127
- '11#.#3.3.195':3127
- '98.#7.76.30':903
- '52.#40.19.1':3127
- '73.##6.33.216':3127
- '36.##1.24.173':3127
- '23#.#9.62.207':903
- '18#.#35.222.219':27347
- '81.##6.207.140':3140
- '12#.#7.134.199':3127
- '80.##0.214.79':3127
- '10#.#54.77.201':3127
- '19#.#26.187.215':3127
- '11#.#49.225.156':3127
- '26.##.78.225':3127
- '18#.#27.135.40':3127
- '58.##6.24.134':27347
- '14#.#3.29.152':2745
- '19.#5.16.74':2745
- '15#.#6.3.251':2745
- '13#.#07.179.198':2745
- '18#.#34.221.218':3140
- '13#.#2.161.7':2745
- '6.##.43.230':2745
- '45.##1.200.80':2745
- '17#.#01.81.48':2745
- '51.##2.68.225':2745
- '23#.#09.44.16':903
- '31.##.244.172':2745
- '10#.#39.181.239':903
- '18#.#49.239.154':3140
- '80.##3.125.221':3127
- '20#.#86.142.218':3127
- '19.##.202.12':3127
- '21#.#04.105.71':3127
- '13#.#49.212.161':3127
- '92.##.140.86':903
- '16#.#59.119.200':3127
- '16#.#13.242.223':3127
- '92.##6.207.140':903
- '52.##5.174.180':27347
- '92.##1.81.243':903
- '18#.#4.116.10':27347
- '16#.#45.38.212':27347
- '69.##9.253.233':27347
- '12#.#1.56.53':2745
- '11#.#33.100.145':2745
- '92.#3.16.69':903
- '11#.#8.188.54':3127
- '92.#6.86.63':903
- '13#.#04.155.158':3127
- '63.#7.97.98':3127
- '14#.#8.142.106':3127
- '92.##.207.178':903
- '18#.#55.120.182':3127
- '10#.#3.175.127':3127
- '24#.#9.69.131':2745
- '35.##4.108.208':3127
- '20#.#6.196.202':3127
- '92.##.253.81':903
- '17#.#42.192.110':3127
- '7.##9.91.67':3140
- '9.##9.62.84':3127
- '35.##6.144.219':3140
- '25.##5.191.251':3127
- '21.##.213.200':3127
- '17#.#42.116.143':3127
- '20#.#98.3.72':3127
- '63.##.196.116':3140
- '16#.#05.86.49':3140
- '75.##4.243.209':3127
- '48.##5.41.91':3127
- '69.##0.140.177':3127
- '12#.#1.201.134':3140
- '13#.#.129.244':3127
- '46.##.141.180':3127
- '75.##.102.186':3140
- '29.##7.18.223':3127
- '12#.#04.206.99':2745
- '95.##.104.170':3127
- '12#.#63.147.162':3127
- '25#.#06.192.21':2745
- '24#.#34.87.67':2745
- '17#.#47.11.56':27347
- '21#.#49.239.154':903
- '92.##.253.106':903
- '23#.#22.19.82':903
- '67.##2.50.156':3127
- '12#.#58.159.193':3127
- '16#.#76.161.42':27347
- '43.##2.44.153':3127
- '92.##7.210.169':3127
- '92.##.135.201':3127
- '16#.#6.86.161':3127
- '20#.#9.20.233':3127
- '16.##.185.139':3127
- '46.##3.69.226':27347
- '92.#36.7.98':903
- '16#.3.80.82':3127
- '16#.#0.73.136':3127
- '32.##.222.65':3127
- '85.##.102.186':903
