Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- %WINDIR%\Tasks\SA.DAT
Malicious functions:
Executes the following:
- '<SYSTEM32>\svchost.exe' -k netsvcs
Modifies file system :
Creates the following files:
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
Network activity:
Connects to:
- '21#.#43.32.214':445
- '21#.#43.120.16':445
- '21#.#43.19.197':445
- '21#.#43.97.20':445
- '21#.#43.24.81':445
- '21#.#43.228.212':445
- '21#.#43.123.172':445
- '21#.#43.6.88':445
- '21#.#43.250.17':445
- '21#.#43.146.36':445
- '21#.#43.188.3':139
- '21#.#43.36.229':139
- '21#.#43.140.234':139
- '21#.#43.1.141':139
- '21#.#43.27.37':139
- '21#.#43.228.99':139
- '21#.#43.7.223':445
- '21#.#43.26.78':139
- '21#.#43.202.200':139
- '21#.#43.220.241':445
- '21#.#43.125.235':445
- '21#.#43.74.125':445
- '21#.#43.46.206':445
- '21#.#43.235.46':445
- '21#.#43.138.86':445
- '21#.#43.73.97':445
- '21#.#43.245.108':445
- '21#.#43.11.229':445
- '21#.#43.83.135':445
- '21#.#43.137.6':445
- '21#.#43.205.9':445
- '21#.#43.217.96':445
- '21#.#43.227.80':445
- '21#.#43.14.85':445
- '21#.#43.116.108':445
- '21#.#43.227.244':445
- '21#.#43.202.227':445
- '21#.#43.25.13':445
- '21#.#43.137.211':445
- '21#.#43.116.108':139
- '21#.#43.25.13':139
- '21#.#43.205.9':139
- '21#.#43.217.96':139
- '21#.#43.137.211':139
- '21#.#43.137.6':139
- '21#.#43.46.206':139
- '21#.#43.227.244':139
- '21#.#43.202.227':139
- '21#.#43.14.85':139
- '21#.#43.24.81':139
- '21#.#43.6.88':139
- '21#.#43.32.214':139
- '21#.#43.120.16':139
- '21#.#43.250.17':139
- '21#.#43.220.241':139
- '21#.#43.227.80':139
- '21#.#43.228.212':139
- '21#.#43.123.172':139
- '21#.#43.235.46':139
- '21#.#43.204.208':139
- '21#.#43.75.185':139
- '21#.#43.60.165':139
- '21#.#43.119.28':139
- '21#.#43.128.209':139
- '21#.#43.62.214':139
- '21#.#43.100.49':139
- '21#.#43.91.222':139
- '21#.#43.182.22':139
- '21#.#43.102.250':139
- '21#.#43.138.86':139
- '21#.#43.11.229':139
- '21#.#43.125.235':139
- '21#.#43.74.125':139
- '21#.#43.83.135':139
- '21#.#43.23.24':139
- '21#.#43.90.64':139
- '21#.#43.73.97':139
- '21#.#43.245.108':139
- '21#.#43.53.40':139
- '21#.#43.38.59':139
- '21#.#43.240.54':139
- '21#.#43.19.13':139
- '21#.#43.188.189':139
- '21#.#43.56.163':139
- '21#.#43.224.61':139
- '21#.#43.135.49':139
- '21#.#43.98.31':139
- '21#.#43.168.0':139
- '21#.#43.60.196':139
- '21#.#43.84.51':139
- '21#.#43.175.160':139
- '21#.#43.17.244':139
- '21#.#43.160.122':139
- '21#.#43.36.195':139
- '21#.#43.1.37':139
- '21#.#43.25.128':139
- '21#.#43.229.221':139
- '21#.#43.247.200':139
- '21#.#43.20.215':445
- '21#.#43.194.107':445
- '21#.#43.76.237':139
- '21#.#43.51.122':139
- '21#.#43.246.94':445
- '21#.#43.153.223':445
- '21#.#43.20.154':445
- '21#.#43.185.25':445
- '21#.#43.222.184':445
- '21#.#43.215.26':139
- '21#.#43.68.138':139
- '21#.#43.14.79':139
- '21#.#43.87.142':139
- '21#.#43.155.87':139
- '21#.#43.220.84':139
- '21#.#43.183.83':139
- '21#.#43.96.53':139
- '21#.#43.86.20':139
- '21#.#43.66.0':139
- '21#.#43.140.234':445
- '21#.#43.1.141':445
- '21#.#43.62.214':445
- '21#.#43.100.49':445
- '21#.#43.188.3':445
- '21#.#43.26.78':445
- '21#.#43.202.200':445
- '21#.#43.36.229':445
- '21#.#43.27.37':445
- '21#.#43.182.22':445
- '21#.#43.102.250':445
- '21#.#43.60.165':445
- '21#.#43.23.24':445
- '21#.#43.90.64':445
- '21#.#43.119.28':445
- '21#.#43.128.209':445
- '21#.#43.91.222':445
- '21#.#43.204.208':445
- '21#.#43.75.185':445
- '21#.#43.228.99':445
- '21#.#43.31.42':139
- '21#.#43.210.210':139
- '21#.#43.53.75':139
- '21#.#43.123.34':139
- '21#.#43.81.17':139
- '21#.#43.123.212':139
- '21#.#43.105.145':139
- '21#.#43.22.249':139
- '21#.#43.242.243':139
- '21#.#43.37.22':139
- '21#.#43.246.94':139
- '21#.#43.185.25':139
- '21#.#43.20.215':139
- '21#.#43.194.107':139
- '21#.#43.222.184':139
- '21#.#43.114.20':139
- '21#.#43.122.21':139
- '21#.#43.153.223':139
- '21#.#43.20.154':139
- '21#.#43.97.20':139
- '21#.#43.220.215':445
- '21#.#43.82.188':445
- '21#.#43.228.57':139
- '21#.#43.74.228':139
- '21#.#43.216.5':445
- '21#.#43.79.2':445
- '21#.#43.18.135':445
- '21#.#43.27.33':445
- '21#.#43.59.27':445
- '21#.#43.57.157':139
- '21#.#43.60.106':139
- '21#.#43.61.180':139
- '21#.#43.142.41':139
- '21#.#43.209.132':139
- '21#.#43.60.36':139
- '21#.#43.41.97':139
- '21#.#43.252.109':139
- '21#.#43.75.231':139
- '21#.#43.69.81':139
- '21#.#43.249.85':445
- '21#.#43.81.106':445
- '21#.#43.227.163':445
- '21#.#43.232.26':445
- '21#.#43.116.237':445
- '21#.#43.157.139':445
- '21#.#43.124.50':445
- '21#.#43.153.146':445
- '21#.#43.201.30':445
- '21#.#43.38.242':445
- '21#.#43.149.58':445
- '21#.#43.50.108':445
- '21#.#43.56.189':445
- '21#.#43.203.165':445
- '21#.#43.144.203':445
- '21#.#43.177.202':445
- '21#.#43.130.216':445
- '21#.#43.179.23':445
- '21#.#43.222.203':445
- '21#.#43.15.8':445
- '21#.#43.177.202':139
- '21#.#43.222.203':139
- '21#.#43.50.108':139
- '21#.#43.56.189':139
- '21#.#43.15.8':139
- '21#.#43.149.58':139
- '21#.#43.232.26':139
- '21#.#43.130.216':139
- '21#.#43.179.23':139
- '21#.#43.144.203':139
- '21#.#43.82.188':139
- '21#.#43.27.33':139
- '21#.#43.220.215':139
- '21#.#43.216.5':139
- '21#.#43.59.27':139
- '21#.#43.249.85':139
- '21#.#43.203.165':139
- '21#.#43.79.2':139
- '21#.#43.18.135':139
- '21#.#43.116.237':139
- '21#.#43.32.229':139
- '21#.#43.148.9':139
- '21#.#43.12.207':139
- '21#.#43.226.36':139
- '21#.#43.71.216':139
- '21#.#43.157.247':139
- '21#.#43.60.251':139
- '21#.#43.26.26':139
- '21#.#43.248.27':139
- '21#.#43.28.177':139
- '21#.#43.157.139':139
- '21#.#43.201.30':139
- '21#.#43.81.106':139
- '21#.#43.227.163':139
- '21#.#43.38.242':139
- '21#.#43.13.201':139
- '21#.#43.76.13':139
- '21#.#43.124.50':139
- '21#.#43.153.146':139
- '21#.#43.2.183':139
- '21#.#43.221.67':139
- '21#.#43.38.239':139
- '21#.#43.88.182':139
- '21#.#43.172.102':139
- '21#.#43.7.64':139
- '21#.#43.114.221':139
- '21#.#43.252.77':139
- '21#.#43.2.38':139
- '21#.#43.124.113':139
- '21#.#43.15.6':139
- '21#.#43.134.75':139
- '21#.#43.41.97':9988
- '21#.#43.57.157':9988
- '21#.#43.83.21':139
- '21#.#43.176.65':139
- '21#.#43.163.176':139
- '21#.#43.33.82':139
- '21#.#43.149.104':139
- '21#.#43.15.6':445
- '21#.#43.252.77':445
- '21#.#43.2.38':445
- '21#.#43.221.67':445
- '21#.#43.172.102':445
- '21#.#43.7.64':445
- '21#.#43.146.36':139
- '21#.#43.19.197':139
- '21#.#43.114.221':445
- '21#.#43.7.223':139
- '21#.#43.2.183':445
- '21#.#43.33.82':445
- '21#.#43.149.104':445
- '21#.#43.134.75':445
- '21#.#43.83.21':445
- '21#.#43.176.65':445
- '21#.#43.38.239':445
- '21#.#43.88.182':445
- '21#.#43.163.176':445
- '21#.#43.124.113':445
- '21#.#43.142.41':445
- '21#.#43.209.132':445
- '21#.#43.157.247':445
- '21#.#43.60.251':445
- '21#.#43.60.106':445
- '21#.#43.75.231':445
- '21#.#43.69.81':445
- '21#.#43.61.180':445
- '21#.#43.60.36':445
- '21#.#43.248.27':445
- '21#.#43.28.177':445
- '21#.#43.12.207':445
- '21#.#43.13.201':445
- '21#.#43.76.13':445
- '21#.#43.226.36':445
- '21#.#43.71.216':445
- '21#.#43.26.26':445
- '21#.#43.32.229':445
- '21#.#43.148.9':445
- '21#.#43.41.97':445
- '21#.#43.124.50':9988
- '21#.#43.153.146':9988
- '21#.#43.201.30':9988
- '21#.#43.38.242':9988
- '21#.#43.13.201':9988
- '21#.#43.142.41':9988
- '21#.#43.209.132':9988
- '21#.#43.148.9':9988
- '21#.#43.28.177':9988
- '21#.#43.116.237':9988
- '21#.#43.228.57':445
- '21#.#43.74.228':445
- '21#.#43.252.109':445
- '21#.#43.57.157':445
- '21#.#43.82.188':9988
- '21#.#43.220.215':9988
- '21#.#43.56.189':9988
- '21#.#43.216.5':9988
- '21#.#43.27.33':9988
