Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\SA.DAT
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- '<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Полный путь к вирусу>
- '<SYSTEM32>\urdvxc.exe' /service
- '<SYSTEM32>\urdvxc.exe' /installservice
- '<SYSTEM32>\urdvxc.exe' /start
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1144 -dm 7 7 %TEMP%\WER8037.dir00\svchost.exe.mdmp 16325836412032452
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- <SYSTEM32>\urdvxc.exe
- %TEMP%\WER8037.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
Самоудаляется.
Сетевая активность:
Подключается к:
- '81.##.249.118':139
- '81.##.112.28':139
- '81.##.62.188':139
- '81.##.152.13':139
- '81.#2.13.62':139
- '81.##.123.93':9988
- '81.##.21.165':9988
- '81.##.161.234':9988
- '81.##.125.61':9988
- '81.##.146.158':9988
- '81.##.235.21':9988
- '81.##.57.201':139
- '81.##.242.151':445
- '81.#2.13.62':445
- '81.##.199.150':9988
- '81.#2.20.62':445
- '81.##.152.13':445
- '81.#2.20.62':139
- '81.##.242.151':139
- '81.##.112.28':445
- '81.##.62.188':445
- '81.##.249.118':445
- '81.##.140.126':445
- '81.##.22.139':445
- '81.##.61.214':445
- '81.##.146.158':445
- '81.#2.27.0':445
- '81.##.226.140':445
- '81.##.202.177':445
- '81.##.41.158':445
- '81.##.66.240':445
- '81.#2.78.73':445
- '81.##.41.227':445
- '81.##.131.221':9988
- '81.#2.63.84':9988
- '81.##.107.247':9988
- '81.##.192.210':9988
- '81.#2.33.31':9988
- '81.##.56.151':9988
- '81.##.182.94':445
- '81.##.122.91':445
- '81.##.19.124':445
- '81.##.181.207':9988
- '81.##.107.109':9988
- '81.##.207.93':139
- '81.#2.40.42':139
- '81.##.205.121':139
- '81.##.35.247':139
- '81.##.12.135':139
- '81.##.77.192':139
- '81.##.205.53':139
- '81.##.39.220':139
- '81.#2.13.13':139
- '81.#2.18.21':139
- '81.#2.7.142':139
- '81.#2.4.9':445
- '81.#2.129.8':445
- '81.##.39.220':445
- '81.#2.19.95':445
- '81.##.94.201':445
- '81.##.165.39':445
- '81.##.217.148':139
- '81.##.26.237':139
- '81.##.86.168':139
- '81.##.50.106':445
- '81.##.204.50':445
- '81.##.27.148':9988
- '81.##.19.124':9988
- '81.##.111.121':9988
- '81.#2.7.37':139
- '81.##.57.201':445
- '81.##.168.98':9988
- '81.#2.4.69':9988
- '81.##.27.200':9988
- '81.##.217.167':9988
- '81.#2.8.135':9988
- '81.##.176.125':9988
- '81.#2.129.8':139
- '81.#2.4.9':139
- '81.##.111.11':139
- '81.#2.19.95':139
- '81.##.94.201':139
- '81.##.165.39':139
- '81.#2.7.37':445
- '81.##.111.133':139
- '81.##.111.133':445
- '81.##.204.50':139
- '81.##.50.106':139
- '81.#2.9.182':139
- '81.##.107.247':139
- '81.##.120.115':139
- '81.##.27.148':139
- '81.##.202.177':139
- '81.##.181.207':139
- '81.#2.4.69':139
- '81.##.112.121':139
- '81.#2.5.144':139
- '81.#2.8.135':139
- '81.##.56.151':139
- '81.##.22.139':139
- '81.##.204.66':139
- '81.##.146.158':139
- '81.#2.78.73':139
- '81.##.19.124':139
- '81.##.66.240':139
- '81.##.150.100':139
- '81.##.67.200':139
- '81.##.199.150':139
- '81.##.41.158':139
- '81.##.27.200':139
- '81.#2.6.216':139
- '81.##.252.190':139
- '81.##.11.198':139
- '81.##.235.21':139
- '81.##.217.167':139
- '81.##.167.246':139
- '81.##.187.167':139
- '81.##.246.149':139
- '81.#2.63.84':139
- '81.#2.33.31':139
- '81.##.168.98':139
- '81.##.111.121':139
- '81.##.123.93':139
- '81.##.131.221':139
- '81.##.192.210':139
- '81.##.176.125':139
- '81.#2.111.1':139
- '81.##.125.61':139
- '81.##.21.218':139
- '81.##.161.234':139
- '81.##.107.109':139
- '81.##.21.165':139
- '81.##.112.121':445
- '81.##.192.210':445
- '81.#2.4.69':445
- '81.##.56.151':445
- '81.#2.5.144':445
- '81.##.176.125':445
- '81.#2.111.1':445
- '81.##.107.109':445
- '81.##.123.93':445
- '81.##.131.221':445
- '81.##.111.121':445
- '81.#2.9.182':445
- '81.##.150.100':445
- '81.##.199.150':445
- '81.##.27.200':445
- '81.##.120.115':445
- '81.##.27.148':445
- '81.##.181.207':445
- '81.#2.8.135':445
- '81.##.107.247':445
- '81.##.67.200':445
- '81.##.204.66':445
- '81.##.235.21':445
- '81.##.122.91':139
- '81.##.217.167':445
- '81.##.125.61':445
- '81.#2.6.216':445
- '81.##.182.94':139
- '81.#2.27.0':139
- '81.##.61.214':139
- '81.##.140.126':139
- '81.##.41.227':139
- '81.##.226.140':139
- '81.##.168.98':445
- '81.#2.33.31':445
- '81.##.252.190':445
- '81.##.21.165':445
- '81.##.161.234':445
- '81.##.11.198':445
- '81.##.167.246':445
- '81.#2.63.84':445
- '81.##.21.218':445
- '81.##.187.167':445
- '81.##.246.149':445
