Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\SA.DAT
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe' -k netsvcs
Сетевая активность:
Подключается к:
- '88.##3.190.173':139
- '88.##3.105.250':139
- '88.##3.63.245':139
- '88.##3.68.101':139
- '88.##3.133.88':139
- '88.##3.32.161':139
- '88.##3.124.207':139
- '88.##3.86.100':139
- '88.##3.205.230':139
- '88.##3.169.19':139
- '88.##3.207.239':139
- '88.##3.151.251':139
- '88.##3.239.204':139
- '88.##3.104.121':139
- '88.##3.188.225':139
- '88.##3.68.208':139
- '88.##3.208.90':139
- '88.##3.5.173':139
- '88.##3.124.127':139
- '88.##3.58.194':139
- '88.##3.91.98':139
- '88.##3.70.50':139
- '88.##3.134.131':139
- '88.##3.50.224':139
- '88.##3.224.241':139
- '88.##3.237.109':139
- '88.##3.140.117':139
- '88.##3.129.233':139
- '88.##3.124.128':139
- '88.##3.51.161':139
- '88.##3.124.203':139
- '88.##3.109.169':139
- '88.##3.119.79':139
- '88.##3.161.125':139
- '88.##3.78.181':9988
- '88.##3.2.172':9988
- '88.##3.204.182':9988
- '88.##3.114.9':139
- '88.##3.140.70':9988
- '88.##3.205.88':9988
- '88.##3.228.103':139
- '88.##3.178.218':139
- '88.##3.19.168':139
- '88.##3.65.60':139
- '88.##3.60.149':139
- '88.##3.34.33':139
- '88.##3.225.198':139
- '88.##3.182.132':139
- '88.##3.187.31':139
- '88.##3.127.29':139
- '88.#43.30.7':139
- '88.##3.132.150':139
- '88.##3.150.122':139
- '88.##3.122.89':139
- '88.##3.207.239':445
- '88.##3.63.245':445
- '88.##3.205.230':445
- '88.##3.134.131':445
- '88.##3.104.121':445
- '88.##3.68.101':445
- '88.##3.133.88':445
- '88.##3.105.250':445
- '88.##3.32.161':445
- '88.##3.239.204':445
- '88.##3.86.100':445
- '88.##3.124.207':445
- '88.##3.151.251':445
- '88.##3.50.224':445
- '88.##3.110.61':445
- '88.##3.58.194':445
- '88.##3.68.208':445
- '88.##3.5.173':445
- '88.##3.209.160':139
- '88.##3.103.121':445
- '88.##3.188.225':445
- '88.##3.70.50':445
- '88.##3.140.117':445
- '88.##3.224.241':445
- '88.##3.91.98':445
- '88.##3.208.90':445
- '88.##3.237.109':445
- '88.##3.124.203':445
- '88.##3.127.29':445
- '88.##3.119.79':445
- '88.##3.109.169':445
- '88.#43.30.7':445
- '88.##3.187.31':445
- '88.##3.124.128':445
- '88.##3.124.127':445
- '88.##3.110.61':139
- '88.##3.103.121':139
- '88.##3.114.9':445
- '88.##3.51.161':445
- '88.##3.161.125':445
- '88.##3.228.103':445
- '88.##3.34.33':445
- '88.##3.225.198':445
- '88.##3.182.132':445
- '88.##3.190.173':445
- '88.##3.169.19':445
- '88.##3.60.149':445
- '88.##3.19.168':445
- '88.##3.150.122':445
- '88.##3.129.233':445
- '88.##3.122.89':445
- '88.##3.65.60':445
- '88.##3.178.218':445
- '88.##3.132.150':445
- '88.##3.83.106':139
- '88.##3.211.227':139
- '88.##3.65.182':139
- '88.##3.56.199':139
- '88.##3.18.26':139
- '88.##3.134.27':139
- '88.##3.205.88':139
- '88.##3.118.23':139
- '88.##3.227.121':139
- '88.##3.55.134':139
- '88.##3.167.152':139
- '88.##3.3.239':139
- '88.##3.78.207':139
- '88.#43.31.0':139
- '88.##3.19.114':139
- '88.##3.88.46':139
- '88.##3.106.230':139
- '88.##3.100.113':445
- '88.##3.209.247':445
- '88.##3.226.205':445
- '88.##3.196.17':139
- '88.##3.103.195':139
- '88.##3.113.103':139
- '88.##3.171.126':139
- '88.##3.56.101':139
- '88.##3.17.69':139
- '88.##3.78.181':139
- '88.##3.179.121':139
- '88.##3.217.102':139
- '88.##3.171.140':139
- '88.##3.112.14':139
- '88.##3.57.161':139
- '88.##3.121.100':139
- '88.#43.6.38':139
- '88.##3.33.112':139
- '88.##3.100.113':139
- '88.##3.106.242':139
- '88.##3.183.83':139
- '88.##3.226.205':139
- '88.##3.209.247':139
- '88.##3.102.226':139
- '88.##3.46.132':139
- '88.##3.39.87':139
- '88.##3.35.131':139
- '88.##3.100.208':139
- '88.#43.7.90':139
- '88.##3.20.165':139
- '88.##3.187.247':139
- '88.##3.112.240':139
- '88.##3.204.182':139
- '88.##3.2.172':139
- '88.##3.26.55':139
- '88.##3.63.16':139
- '88.##3.140.70':139
- '88.##3.113.103':445
- '88.#43.31.0':445
- '88.##3.3.239':445
- '88.##3.56.101':445
- '88.##3.171.126':445
- '88.##3.78.181':445
- '88.##3.227.121':445
- '88.##3.112.240':445
- '88.##3.217.102':445
- '88.##3.134.27':445
- '88.##3.205.88':445
- '88.##3.65.182':445
- '88.##3.211.227':445
- '88.##3.196.17':445
- '88.##3.171.140':9988
- '88.##3.17.69':9988
- '88.##3.196.17':9988
- '88.##3.56.101':9988
- '88.##3.226.205':9988
- '88.##3.113.103':9988
- '88.##3.103.195':445
- '88.##3.88.46':445
- '88.##3.106.230':445
- '88.##3.19.114':445
- '88.##3.17.69':445
- '88.##3.56.199':445
- '88.##3.18.26':445
- '88.##3.112.14':445
- '88.##3.57.161':445
- '88.##3.179.121':445
- '88.##3.26.55':445
- '88.##3.121.100':445
- '88.##3.204.182':445
- '88.##3.63.16':445
- '88.##3.171.140':445
- '88.##3.33.112':445
- '88.##3.106.242':445
- '88.##3.102.226':445
- '88.##3.183.83':445
- '88.#43.6.38':445
- '88.##3.140.70':445
- '88.##3.39.87':445
- '88.##3.46.132':445
- '88.##3.20.165':445
- '88.##3.118.23':445
- '88.##3.100.208':445
- '88.##3.55.134':445
- '88.##3.35.131':445
- '88.##3.167.152':445
- '88.##3.78.207':445
- '88.##3.2.172':445
- '88.##3.187.247':445
- '88.##3.83.106':445
- '88.#43.7.90':445
