Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\SA.DAT
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe' -k netsvcs
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
Сетевая активность:
Подключается к:
- '14.#9.50.18':445
- '14.#9.18.32':445
- '14.##.43.215':445
- '14.##.19.188':445
- '14.##.32.204':445
- '14.#9.25.83':445
- '14.##.236.77':445
- '14.##.68.103':445
- '14.##.223.46':445
- '14.##.41.241':9988
- '14.##.111.138':9988
- '14.#9.54.38':9988
- '14.##.141.24':9988
- '14.#9.96.58':9988
- '14.#9.24.33':445
- '14.##.254.196':445
- '14.##.137.233':9988
- '14.##.155.240':9988
- '14.##.157.162':445
- '14.##.104.108':445
- '14.##.152.154':445
- '14.##.126.210':445
- '14.#9.66.15':445
- '14.##.84.111':445
- '14.#9.28.82':445
- '14.##.114.232':445
- '14.##.182.77':445
- '14.##.133.202':445
- '14.##.62.249':445
- '14.##.40.162':445
- '14.##.14.254':445
- '14.##.249.115':445
- '14.##.111.185':445
- '14.##.152.57':445
- '14.##.168.56':445
- '14.##.83.111':445
- '14.##.104.108':9988
- '14.##.152.154':9988
- '14.##.40.162':9988
- '14.##.254.196':9988
- '14.#9.50.18':9988
- '14.##.14.254':9988
- '14.#9.79.28':9988
- '14.##.111.185':9988
- '14.##.83.111':9988
- '14.##.249.115':9988
- '14.#9.18.32':9988
- '14.#9.24.33':9988
- '14.#9.25.83':9988
- '14.##.68.103':9988
- '14.##.19.188':9988
- '14.##.133.202':9988
- '14.##.32.204':9988
- '14.##.236.77':9988
- '14.##.43.215':9988
- '14.#9.253.0':9988
- '14.##.176.166':9988
- '14.#9.78.73':9988
- '14.##.243.161':9988
- '14.##.186.74':9988
- '14.##.84.111':9988
- '14.#9.38.48':9988
- '14.##.223.46':9988
- '14.##.33.195':9988
- '14.##.114.232':9988
- '14.##.166.56':9988
- '14.##.157.162':9988
- '14.##.126.210':9988
- '14.##.152.57':9988
- '14.##.235.196':9988
- '14.#9.39.73':9988
- '14.##.124.53':9988
- '14.#9.28.82':9988
- '14.##.182.77':139
- '14.##.84.111':139
- '14.#9.66.15':139
- '14.##.114.232':139
- '14.#9.28.82':139
- '14.#9.78.73':139
- '14.##.235.196':139
- '14.##.82.137':139
- '14.##.138.15':139
- '14.##.83.111':139
- '14.##.111.185':139
- '14.##.249.115':139
- '14.##.168.56':139
- '14.##.152.57':139
- '14.##.104.108':139
- '14.##.157.162':139
- '14.##.152.154':139
- '14.##.126.210':139
- '14.##.155.240':139
- '14.##.186.74':139
- '14.#9.73.0':139
- '14.##.243.161':139
- '14.#9.253.0':139
- '14.##.176.166':139
- '14.##.41.241':139
- '14.#9.54.38':139
- '14.##.166.56':139
- '14.##.111.138':139
- '14.##.137.233':139
- '14.##.141.24':139
- '14.#9.79.28':139
- '14.#9.96.58':139
- '14.##.124.53':139
- '14.#9.39.73':139
- '14.##.33.195':139
- '14.#9.38.48':139
- '14.##.62.249':139
- '14.##.124.53':445
- '14.#9.39.73':445
- '14.##.33.195':445
- '14.#9.38.48':445
- '14.#9.73.0':445
- '14.##.155.240':445
- '14.##.41.241':445
- '14.##.243.161':445
- '14.##.176.166':445
- '14.#9.78.73':445
- '14.##.235.196':445
- '14.##.82.137':445
- '14.##.138.15':445
- '14.##.141.24':445
- '14.##.137.233':445
- '14.#9.96.58':445
- '14.#9.79.28':445
- '14.##.111.138':445
- '14.##.68.103':139
- '14.##.223.46':139
- '14.#9.18.32':139
- '14.##.32.204':139
- '14.#9.25.83':139
- '14.##.14.254':139
- '14.##.133.202':139
- '14.##.40.162':139
- '14.##.236.77':139
- '14.#9.253.0':445
- '14.#9.54.38':445
- '14.##.186.74':445
- '14.##.166.56':445
- '14.#9.24.33':139
- '14.##.19.188':139
- '14.#9.50.18':139
- '14.##.254.196':139
- '14.##.43.215':139
