Техническая информация
Для обеспечения автозапуска и распространения:
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- <SYSTEM32>\urdvxc.exe /service /uninstallservice patch:<Полный путь к вирусу> /installservice /start
Изменения в файловой системе:
Создает следующие файлы:
- <SYSTEM32>\urdvxc.exe
Самоудаляется.
Сетевая активность:
Подключается к:
- '83.##.106.84':445
- '83.##.241.173':445
- '83.##.33.115':445
- '83.##.136.143':445
- '83.#1.197.8':445
- '83.##.78.254':445
- '83.##.219.163':445
- '83.##.129.136':445
- '83.##.103.134':445
- '83.#1.47.36':445
- '21#.#1.120.220':139
- '21#.#1.74.79':139
- '21#.#1.36.75':139
- '21#.#1.184.217':139
- '21#.#1.85.67':139
- '21#.#1.235.229':139
- '21#.#1.151.158':139
- '21#.#1.67.241':139
- '21#.#1.253.92':139
- '83.##.167.165':445
- '83.##.255.104':139
- '83.##.159.76':139
- '83.##.10.167':139
- '83.##.136.10':139
- '83.#1.77.37':445
- '83.#1.105.4':139
- '83.##.64.240':445
- '83.##.101.97':139
- '83.##.225.49':139
- '83.#1.69.43':445
- '83.##.226.137':445
- '83.#1.46.64':445
- '83.#1.76.1':445
- '83.##.123.94':445
- '83.##.96.180':445
- '83.##.182.41':445
- '83.##.48.210':445
- '83.##.106.12':445
- '83.##.221.82':445
- '21#.#1.85.67':445
- '21#.#1.15.254':139
- '21#.#1.14.126':139
- '21#.#1.54.37':139
- '21#.#1.67.241':445
- '21#.#1.222.53':139
- '21#.#1.149.129':139
- '21#.#1.253.92':445
- '21#.#1.184.136':139
- '21#.#1.133.66':139
- '21#.#1.30.91':139
- '21#.#1.184.217':445
- '21#.#1.36.75':445
- '21#.#1.88.216':139
- '21#.#1.229.34':139
- '21#.#1.126.35':139
- '21#.#1.192.129':139
- '21#.#1.120.220':445
- '21#.#1.74.79':445
- '21#.#1.235.229':445
- '21#.#1.15.189':139
- '21#.#1.194.8':139
- '21#.#1.55.31':139
- '21#.#1.195.58':139
- '21#.#1.135.192':139
- '21#.#1.138.116':139
- '21#.#1.191.68':139
- '21#.#1.75.230':139
- '21#.#1.74.237':139
- '21#.#1.71.190':139
- '21#.#1.253.18':139
- '21#.#1.176.140':139
- '21#.#1.105.46':139
- '21#.#1.207.212':139
- '21#.#1.151.158':445
- '21#.#1.149.139':139
- '21#.#1.230.115':139
- '21#.#1.133.161':139
- '21#.#1.191.74':139
- '59.##1.83.95':139
- '59.##1.31.30':445
- '59.##1.226.226':139
- '59.#71.26.1':445
- '59.##1.54.14':139
- '59.##1.26.132':139
- '59.##1.48.151':445
- '59.##1.171.3':139
- '59.##1.52.197':139
- '59.##1.35.98':445
- '83.#1.77.37':139
- '83.##.64.240':139
- '83.##.48.210':139
- '83.#1.69.43':139
- '59.##1.87.235':445
- '59.##1.0.224':139
- '59.##1.78.236':139
- '59.##1.6.213':445
- '59.##1.14.215':139
- '59.##1.55.35':445
- '59.##1.35.98':139
- '59.#71.26.1':139
- '59.##1.87.235':139
- '59.##1.6.213':139
- '59.##1.31.30':139
- '59.##1.77.54':139
- '59.##1.207.242':139
- '59.##1.48.151':139
- '59.##1.55.35':139
- '59.##1.173.24':139
- '59.##1.207.242':445
- '59.##1.10.66':139
- '59.##1.77.54':445
- '59.##1.63.109':139
- '59.##1.151.235':139
- '59.#71.2.31':139
- '59.#71.8.10':139
- '59.#71.2.94':139
- '59.##1.62.116':139
- '83.#1.195.0':139
- '83.##.188.20':139
- '83.##.73.241':139
- '83.##.31.171':139
- '83.##.25.201':139
- '83.##.243.201':139
- '83.##.152.231':139
- '83.##.128.143':139
- '83.##.67.244':139
- '83.##.229.49':139
- '83.##.15.121':139
- '83.#1.14.35':139
- '83.##.50.173':139
- '83.##.72.164':139
- '83.##.253.18':139
- '83.##.90.217':139
- '83.##.217.78':139
- '83.#1.77.57':139
- '83.##.234.38':139
- '83.#1.65.1':139
- '83.##.123.94':139
- '83.##.226.137':139
- '83.##.167.165':139
- '83.#1.76.1':139
- '83.##.96.180':139
- '83.##.221.82':139
- '83.##.182.41':139
- '83.#1.46.64':139
- '83.##.106.12':139
- '83.##.219.163':139
- '83.##.136.143':139
- '83.##.106.84':139
- '83.#1.47.36':139
- '83.##.33.115':139
- '83.##.241.173':139
- '83.##.103.134':139
- '83.##.78.254':139
- '83.#1.197.8':139
- '83.##.129.136':139
