Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\SA.DAT
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe' -k netsvcs
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
Сетевая активность:
Подключается к:
- '82.##.70.141':445
- '82.##.150.152':445
- '82.#0.2.137':445
- '82.##.232.210':445
- '82.##.124.143':445
- '82.##.170.175':445
- '82.##.48.211':445
- '82.##.190.192':445
- '82.##.13.155':445
- '82.#0.12.64':445
- '82.##.124.132':445
- '82.##.142.100':445
- '82.#0.34.43':445
- '82.##.198.79':445
- '82.##.28.143':445
- '82.##.112.138':445
- '82.##.104.20':445
- '82.#0.25.6':445
- '82.##.136.167':445
- '82.##.106.103':445
- '82.##.162.147':445
- '82.##.176.244':445
- '82.##.61.237':445
- '82.#0.25.38':445
- '82.##.252.188':445
- '82.##.77.211':445
- '82.##.211.236':445
- '82.##.150.162':445
- '82.##.122.67':445
- '82.#0.22.85':445
- '82.##.102.204':445
- '82.##.73.119':445
- '82.#0.22.85':139
- '82.##.102.204':139
- '82.##.150.162':139
- '82.##.122.67':139
- '82.#0.25.6':139
- '82.##.136.167':139
- '82.#0.25.38':139
- '82.##.252.188':139
- '82.##.170.175':139
- '82.##.48.211':139
- '82.##.232.210':139
- '82.##.124.143':139
- '82.##.77.211':139
- '82.##.211.236':139
- '82.##.112.138':139
- '82.##.104.20':139
- '82.##.86.211':445
- '82.##.122.61':445
- '82.##.142.145':445
- '82.##.126.129':445
- '82.##.104.159':445
- '82.##.104.117':445
- '82.##.204.151':445
- '82.##.90.125':139
- '82.##.176.244':139
- '82.##.61.237':139
- '82.##.106.103':139
- '82.##.162.147':139
- '82.##.149.196':139
- '82.##.216.83':139
- '82.##.231.194':139
- '82.#0.187.2':139
- '82.##.144.116':139
- '82.##.124.72':139
- '82.##.226.235':139
- '82.##.158.19':139
- '82.##.157.163':139
- '82.#0.68.31':139
- '82.#0.80.76':139
- '82.##.204.133':139
- '82.##.243.246':139
- '82.#0.50.23':139
- '82.##.93.171':139
- '82.#0.5.209':139
- '82.##.12.254':139
- '82.##.253.60':139
- '82.##.61.175':139
- '82.##.211.63':139
- '82.##.48.101':139
- '82.##.20.163':139
- '82.#0.98.41':139
- '82.#0.25.28':139
- '82.##.197.184':139
- '82.#0.185.8':139
- '82.#0.36.20':139
- '82.##.55.169':139
- '82.##.151.78':139
- '82.#0.7.152':139
- '82.##.105.176':139
- '82.##.201.65':139
- '82.##.255.200':139
- '82.##.47.241':139
- '82.##.204.33':139
- '82.#0.9.3':139
- '82.#0.69.15':139
- '82.##.123.86':139
- '82.##.94.137':139
- '82.#0.92.12':445
- '82.##.52.224':445
- '82.##.149.95':445
- '82.##.114.235':139
- '82.##.149.196':445
- '82.##.216.83':445
- '82.##.231.194':445
- '82.##.90.125':445
- '82.#0.92.12':139
- '82.##.52.224':139
- '82.##.149.95':139
- '82.##.114.235':445
- '82.#0.25.18':139
- '82.#0.18.3':139
- '82.#0.3.53':139
- '82.##.108.128':139
- '82.##.18.131':139
- '82.##.222.136':139
- '82.#0.58.33':139
- '82.#0.20.84':139
- '82.#0.9.3':445
- '82.#0.69.15':445
- '82.##.123.86':445
- '82.##.94.137':445
- '82.##.84.140':139
- '82.##.140.22':139
- '82.#0.22.68':139
- '82.##.172.253':139
- '82.##.253.138':139
- '82.##.234.149':139
- '82.#0.79.80':139
- '82.##.47.122':139
- '82.##.119.183':139
- '82.#0.29.49':139
- '82.#0.29.85':139
- '82.##.94.176':139
- '82.##.64.147':139
- '82.#0.30.85':139
- '82.#0.53.19':139
- '82.#0.136.5':139
- '82.#0.10.49':139
- '82.##.30.254':139
- '82.##.162.47':139
- '82.##.62.194':445
- '82.##.234.52':445
- '82.##.48.123':445
- '82.##.68.135':445
- '82.##.121.155':445
- '82.##.154.250':445
- '82.##.144.207':445
- '82.##.229.222':445
- '82.##.176.78':139
- '82.##.107.92':139
- '82.##.121.207':139
- '82.##.71.119':445
- '82.##.211.31':445
- '82.##.46.245':445
- '82.##.52.214':445
- '82.##.221.205':139
- '82.##.154.250':139
- '82.##.144.207':139
- '82.##.68.135':139
- '82.##.121.155':139
- '82.##.100.91':139
- '82.#0.91.21':139
- '82.##.21.122':139
- '82.##.62.194':139
- '82.##.229.222':139
- '82.##.48.123':139
- '82.##.211.31':139
- '82.##.71.119':139
- '82.##.234.52':139
- '82.##.52.214':139
- '82.##.46.245':139
- '82.##.113.107':139
- '82.#0.15.12':139
- '82.##.91.196':139
- '82.##.254.253':139
- '82.##.17.154':139
- '82.##.26.139':139
- '82.##.78.118':139
- '82.##.118.144':139
- '82.##.253.208':139
- '82.##.71.192':139
- '82.##.41.122':139
- '82.#0.50.3':139
- '82.##.132.10':139
- '82.##.179.244':139
- '82.#0.1.194':139
- '82.##.142.151':139
- '82.##.253.208':9988
- '82.##.121.155':9988
- '82.##.229.222':9988
- '82.##.17.154':9988
- '82.##.86.211':139
- '82.##.122.61':139
- '82.##.142.145':139
- '82.##.48.123':9988
- '82.##.47.122':445
- '82.##.119.183':445
- '82.#0.29.49':445
- '82.##.162.47':445
- '82.##.176.78':445
- '82.##.107.92':445
- '82.##.121.207':445
- '82.##.126.129':139
- '82.#0.34.43':139
- '82.##.198.79':139
- '82.##.28.143':139
- '82.##.190.192':139
- '82.##.70.141':139
- '82.##.150.152':139
- '82.#0.2.137':139
- '82.##.142.100':139
- '82.##.104.159':139
- '82.##.104.117':139
- '82.##.204.151':139
- '82.##.73.119':139
- '82.##.13.155':139
- '82.#0.12.64':139
- '82.##.124.132':139
- '82.#0.79.80':445
- '82.##.179.244':445
- '82.#0.1.194':445
- '82.##.142.151':445
- '82.##.253.208':445
- '82.#0.15.12':445
- '82.##.91.196':445
- '82.##.254.253':445
- '82.##.132.10':445
- '82.##.100.91':445
- '82.#0.91.21':445
- '82.##.21.122':445
- '82.##.113.107':445
- '82.##.71.192':445
- '82.##.41.122':445
- '82.#0.50.3':445
- '82.##.17.154':445
- '82.#0.136.5':445
- '82.#0.10.49':445
- '82.##.30.254':445
- '82.#0.29.85':445
- '82.##.172.253':445
- '82.##.253.138':445
- '82.##.234.149':445
- '82.#0.53.19':445
- '82.##.26.139':445
- '82.##.78.118':445
- '82.##.118.144':445
- '82.##.221.205':445
- '82.##.94.176':445
- '82.##.64.147':445
- '82.#0.30.85':445
