Техническая информация
Для обеспечения автозапуска и распространения:
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- '<SYSTEM32>\urdvxc.exe' /service
- '<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Полный путь к вирусу>
- '<SYSTEM32>\urdvxc.exe' /installservice
- '<SYSTEM32>\urdvxc.exe' /start
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1116 -dm 7 7 %TEMP%\WERe520.dir00\svchost.exe.mdmp 16325836412032128
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- <SYSTEM32>\urdvxc.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
Самоудаляется.
Сетевая активность:
Подключается к:
- '64.#6.92.94':445
- '64.#6.0.144':445
- '64.##.19.152':445
- '64.##.213.199':445
- '64.##.223.48':445
- '64.#6.30.65':445
- '64.##.246.12':445
- '64.#6.98.28':445
- '64.##.22.250':445
- '64.##.186.165':445
- '64.##.67.244':445
- '64.##.139.166':445
- '64.##.158.166':445
- '64.##.78.147':445
- '64.##.108.84':445
- '64.##.140.27':445
- '64.##.156.235':445
- '64.##.12.225':445
- '64.#6.59.51':445
- '64.##.180.236':445
- '64.##.10.165':445
- '64.##.190.12':445
- '64.##.132.65':445
- '64.##.137.40':445
- '64.##.40.165':445
- '64.##.203.23':445
- '64.##.97.243':445
- '64.##.233.73':445
- '64.##.69.162':445
- '64.##.56.219':445
- '64.#6.57.93':445
- '64.##.30.251':445
- '64.##.170.156':445
- '64.#6.33.57':139
- '64.##.56.207':139
- '64.#6.36.37':139
- '64.##.193.221':139
- '64.##.53.201':139
- '64.##.101.174':139
- '64.#6.37.1':139
- '64.#6.4.76':139
- '64.##.159.118':139
- '64.##.44.170':139
- '64.##.162.160':139
- '64.##.160.72':139
- '64.##.66.198':139
- '64.#6.148.7':139
- '64.#6.37.96':139
- '64.##.39.173':139
- '64.##.75.116':139
- '64.##.12.225':9988
- '64.##.190.12':9988
- '64.#6.98.28':9988
- '64.##.172.251':9988
- '64.##.252.214':445
- '64.##.215.68':445
- '64.##.40.165':9988
- '64.##.132.65':9988
- '64.##.65.160':139
- '64.##.160.93':139
- '64.##.19.243':139
- '64.##.107.211':139
- '64.##.213.199':9988
- '64.##.246.12':9988
- '64.##.76.110':139
- '64.##.19.152':9988
- '64.##.64.185':445
- '64.##.10.165':139
- '64.##.12.225':139
- '64.#6.57.93':139
- '64.##.180.236':139
- '64.##.40.165':139
- '64.##.190.12':139
- '64.#6.59.51':139
- '64.##.137.40':139
- '64.##.69.162':139
- '64.##.203.23':139
- '64.##.156.235':139
- '64.##.233.73':139
- '64.##.170.156':139
- '64.##.56.219':139
- '64.##.97.243':139
- '64.##.30.251':139
- '64.##.132.65':139
- '64.#6.38.85':139
- '64.##.239.235':139
- '64.##.140.88':139
- '64.#6.43.22':139
- '64.##.35.173':139
- '64.##.14.226':139
- '64.##.172.251':139
- '64.##.210.50':139
- '64.##.166.116':139
- '64.##.247.213':139
- '64.##.64.185':139
- '64.##.116.137':139
- '64.##.243.248':139
- '64.##.43.182':139
- '64.##.214.220':139
- '64.##.126.183':139
- '64.##.239.235':445
- '64.##.210.50':445
- '64.#6.43.22':445
- '64.#6.38.85':445
- '64.##.172.251':445
- '64.##.252.214':139
- '64.##.14.226':445
- '64.##.35.173':445
- '64.##.247.213':445
- '64.##.126.183':445
- '64.##.116.137':445
- '64.##.166.116':445
- '64.##.43.182':445
- '64.##.140.88':445
- '64.##.214.220':445
- '64.##.243.248':445
- '64.##.215.68':139
- '64.#6.92.94':139
- '64.#6.0.144':139
- '64.##.19.152':139
- '64.##.213.199':139
- '64.##.223.48':139
- '64.#6.30.65':139
- '64.##.246.12':139
- '64.#6.98.28':139
- '64.##.22.250':139
- '64.##.186.165':139
- '64.##.67.244':139
- '64.##.139.166':139
- '64.##.158.166':139
- '64.##.78.147':139
- '64.##.108.84':139
- '64.##.140.27':139
