Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\SA.DAT
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- '<SYSTEM32>\urdvxc.exe' /service
- '<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Полный путь к вирусу>
- '<SYSTEM32>\urdvxc.exe' /installservice
- '<SYSTEM32>\urdvxc.exe' /start
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1136 -dm 7 7 %TEMP%\WEReb99.dir00\svchost.exe.mdmp 16325836412032040
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- <SYSTEM32>\urdvxc.exe
- %TEMP%\WEReb99.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
Самоудаляется.
Сетевая активность:
Подключается к:
- '21#.#3.76.59':139
- '21#.#3.58.234':139
- '21#.#3.99.74':139
- '21#.#3.72.60':139
- '21#.#3.200.51':139
- '21#.#3.72.76':139
- '21#.#3.180.189':139
- '21#.#3.190.73':139
- '21#.#3.74.75':139
- '21#.#3.49.98':139
- '21#.#3.98.91':139
- '21#.#3.145.63':139
- '21#.#3.135.161':139
- '21#.#3.250.94':139
- '21#.#3.188.121':139
- '21#.#3.91.167':139
- '21#.#3.228.152':139
- '21#.#3.91.60':139
- '21#.#3.18.91':139
- '21#.#3.41.177':139
- '21#.#3.94.40':139
- '21#.#3.145.14':139
- '21#.#3.83.228':139
- '21#.#3.228.135':139
- '21#.#3.46.158':139
- '21#.#3.117.168':139
- '21#.#3.237.226':139
- '21#.#3.227.35':139
- '21#.#3.178.77':139
- '21#.#3.70.154':139
- '21#.#3.156.17':139
- '21#.#3.176.82':139
- '21#.#3.160.213':139
- '21#.#3.213.63':139
- '21#.#3.40.126':9988
- '21#.#3.65.226':139
- '21#.#3.57.52':139
- '21#.#3.49.24':139
- '21#.#3.57.71':139
- '21#.#3.240.204':139
- '21#.#3.205.14':139
- '21#.#3.14.114':139
- '21#.#3.236.201':139
- '21#.#3.86.161':139
- '21#.#3.42.173':139
- '21#.#3.134.97':139
- '21#.#3.96.127':139
- '21#.#3.229.56':139
- '21#.#3.53.46':139
- '21#.#3.26.65':139
- '21#.#3.139.139':139
- '21#.#3.167.158':139
- '21#.#3.72.76':445
- '21#.#3.76.59':445
- '21#.#3.58.234':445
- '21#.#3.135.161':445
- '21#.#3.72.60':445
- '21#.#3.200.51':445
- '21#.#3.145.63':445
- '21#.#3.180.189':445
- '21#.#3.190.73':445
- '21#.#3.99.74':445
- '21#.#3.49.98':445
- '21#.#3.98.91':445
- '21#.#3.145.14':445
- '21#.#3.18.91':445
- '21#.#3.250.94':445
- '21#.#3.188.121':445
- '21#.#3.167.158':445
- '21#.#3.228.152':445
- '21#.#3.91.60':445
- '21#.#3.46.158':445
- '21#.#3.41.177':445
- '21#.#3.94.40':445
- '21#.#3.91.167':445
- '21#.#3.83.228':445
- '21#.#3.228.135':445
- '21#.#3.86.161':445
- '21#.#3.176.82':445
- '21#.#3.237.226':445
- '21#.#3.227.35':445
- '21#.#3.57.71':445
- '21#.#3.70.154':445
- '21#.#3.156.17':445
- '21#.#3.49.24':445
- '21#.#3.160.213':445
- '21#.#3.213.63':445
- '21#.#3.178.77':445
- '21#.#3.65.226':445
- '21#.#3.57.52':445
- '21#.#3.229.56':445
- '21#.#3.205.14':445
- '21#.#3.42.173':445
- '21#.#3.240.204':445
- '21#.#3.236.201':445
- '21#.#3.74.75':445
- '21#.#3.117.168':445
- '21#.#3.139.139':445
- '21#.#3.134.97':445
- '21#.#3.96.127':445
- '21#.#3.14.114':445
- '21#.#3.53.46':445
- '21#.#3.26.65':445
- '21#.#3.83.248':139
- '21#.#3.27.46':139
- '21#.#3.160.191':139
- '21#.#3.113.14':139
- '21#.93.7.34':139
- '21#.93.34.2':139
- '21#.#3.190.76':139
- '21#.#3.112.13':139
- '21#.#3.27.18':139
- '21#.#3.177.13':139
- '21#.#3.109.42':139
- '21#.#3.17.236':139
- '21#.#3.28.192':139
- '21#.#3.25.254':139
- '21#.#3.87.253':139
- '21#.#3.12.68':139
- '21#.#3.118.200':139
- '21#.#3.58.133':139
- '21#.#3.132.234':139
- '21#.#3.128.228':139
- '21#.#3.42.245':139
- '21#.#3.48.123':139
- '21#.#3.173.213':139
- '21#.#3.194.20':139
- '21#.#3.105.113':139
- '21#.#3.233.46':139
- '21#.#3.54.154':139
- '21#.#3.32.160':139
- '21#.#3.22.41':139
- '21#.#3.70.89':139
- '21#.#3.30.222':139
- '21#.#3.130.54':139
- '21#.#3.74.40':139
- '21#.#3.224.92':139
- '21#.#3.86.189':139
- '21#.#3.40.126':139
- '21#.#3.1.138':139
- '21#.#3.174.79':139
- '21#.#3.99.112':139
- '21#.#3.185.129':139
- '21#.#3.140.158':139
- '21#.#3.93.124':139
- '21#.#3.198.31':139
- '21#.#3.30.253':139
- '21#.#3.253.23':139
- '21#.#3.73.144':139
- '21#.#3.138.121':139
- '21#.#3.143.220':139
- '21#.#3.124.144':139
- '21#.#3.143.232':139
- '21#.#3.67.207':139
- '21#.#3.86.189':445
- '21#.93.34.2':445
- '21#.#3.160.191':445
- '21#.#3.28.192':445
- '21#.#3.128.228':445
- '21#.#3.27.46':445
- '21#.#3.83.248':445
- '21#.#3.17.236':445
- '21#.#3.30.253':445
- '21#.#3.112.13':445
- '21#.93.7.34':445
- '21#.#3.177.13':445
- '21#.#3.109.42':445
- '21#.#3.113.14':445
- '21#.#3.58.133':445
- '21#.#3.132.234':445
- '21#.#3.118.200':445
- '21#.#3.86.189':9988
- '21#.#3.87.253':445
- '21#.#3.173.213':445
- '21#.#3.42.245':445
- '21#.#3.48.123':445
- '21#.#3.194.20':445
- '21#.#3.25.254':445
- '21#.#3.105.113':445
- '21#.#3.12.68':445
- '21#.#3.190.76':445
- '21#.#3.54.154':445
- '21#.#3.70.89':445
- '21#.#3.32.160':445
- '21#.#3.130.54':445
- '21#.#3.143.220':445
- '21#.#3.30.222':445
- '21#.#3.174.79':445
- '21#.#3.74.40':445
- '21#.#3.224.92':445
- '21#.#3.22.41':445
- '21#.#3.1.138':445
- '21#.#3.40.126':445
- '21#.#3.138.121':445
- '21#.#3.140.158':445
- '21#.#3.253.23':445
- '21#.#3.27.18':445
- '21#.#3.233.46':445
- '21#.#3.198.31':445
- '21#.#3.185.129':445
- '21#.#3.73.144':445
- '21#.#3.67.207':445
- '21#.#3.99.112':445
- '21#.#3.93.124':445
- '21#.#3.124.144':445
- '21#.#3.143.232':445
