Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- %WINDIR%\Tasks\SA.DAT
Malicious functions:
Executes the following:
- '<SYSTEM32>\svchost.exe' -k netsvcs
Modifies file system:
Creates the following files:
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
Network activity:
Connects to:
- '69.##.209.165':139
- '69.#7.23.12':139
- '69.##.47.132':139
- '69.##.158.129':139
- '69.#7.73.54':139
- '69.##.176.40':139
- '69.##.172.147':139
- '69.#7.6.193':139
- '69.##.193.53':139
- '69.##.53.123':139
- '69.##.105.107':139
- '69.#7.64.12':139
- '69.##.231.152':139
- '69.##.56.159':139
- '69.#7.1.238':139
- '69.#7.62.42':139
- '69.##.51.152':139
- '69.#7.2.186':139
- '69.##.138.82':139
- '69.#7.14.33':139
- '69.#7.43.49':139
- '69.##.25.118':139
- '69.##.76.158':139
- '69.##.24.180':139
- '69.##.44.194':139
- '69.##.248.101':139
- '69.##.15.211':139
- '69.#7.10.33':139
- '69.#7.10.1':139
- '69.##.222.96':139
- '69.##.30.213':139
- '69.##.188.185':139
- '69.##.90.244':139
- '69.##.153.53':139
- '69.##.211.23':9988
- '69.##.219.139':9988
- '69.##.149.10':139
- '69.#7.87.16':139
- '69.#7.7.230':139
- '69.##.180.184':139
- '69.##.193.199':139
- '69.##.71.215':139
- '69.##.13.252':139
- '69.##.176.219':139
- '69.##.167.25':139
- '69.##.64.177':139
- '69.##.131.186':139
- '69.##.242.204':139
- '69.#7.127.4':139
- '69.##.109.13':139
- '69.##.129.62':139
- '69.##.110.34':139
- '69.##.85.222':139
- '69.#7.73.54':445
- '69.##.176.40':445
- '69.##.209.165':445
- '69.##.25.118':445
- '69.##.76.158':445
- '69.##.158.129':445
- '69.#7.23.12':445
- '69.#7.64.12':445
- '69.##.231.152':445
- '69.#7.6.193':445
- '69.##.47.132':445
- '69.##.172.147':445
- '69.##.105.107':445
- '69.#7.2.186':445
- '69.##.138.82':445
- '69.##.56.159':445
- '69.##.226.90':139
- '69.##.85.222':445
- '69.##.51.152':445
- '69.#7.1.238':445
- '69.##.44.194':445
- '69.##.248.101':445
- '69.#7.43.49':445
- '69.#7.62.42':445
- '69.#7.14.33':445
- '69.##.24.180':445
- '69.##.30.213':445
- '69.##.188.185':445
- '69.##.15.211':445
- '69.##.242.204':445
- '69.#7.127.4':445
- '69.##.222.96':445
- '69.#7.10.33':445
- '69.#7.87.16':445
- '69.#7.7.230':445
- '69.##.153.53':445
- '69.#7.10.1':445
- '69.##.90.244':445
- '69.##.149.10':445
- '69.##.176.219':445
- '69.##.167.25':445
- '69.##.180.184':445
- '69.##.193.53':445
- '69.##.53.123':445
- '69.##.13.252':445
- '69.##.193.199':445
- '69.##.129.62':445
- '69.##.110.34':445
- '69.##.131.186':445
- '69.##.71.215':445
- '69.##.64.177':445
- '69.##.109.13':445
- '69.##.176.197':139
- '69.##.155.74':139
- '69.##.74.154':139
- '69.##.43.202':139
- '69.#7.81.88':139
- '69.##.232.19':139
- '69.##.154.174':139
- '69.##.178.220':139
- '69.##.83.242':139
- '69.##.219.139':139
- '69.##.174.54':139
- '69.#7.32.19':139
- '69.##.62.179':139
- '69.#7.24.85':139
- '69.##.124.199':139
- '69.#7.1.81':139
- '69.#7.91.42':445
- '69.##.123.160':139
- '69.##.160.152':139
- '69.#7.158.6':139
- '69.##.132.123':139
- '69.#7.26.86':139
- '69.##.211.23':139
- '69.#7.6.169':139
- '69.##.169.178':139
- '69.##.201.65':139
- '69.##.203.138':139
- '69.##.138.146':139
- '69.#7.12.83':139
- '69.##.119.144':139
- '69.#7.96.1':139
- '69.##.93.144':139
- '69.#7.92.90':139
- '69.#7.91.42':139
- '69.#7.12.52':139
- '69.##.60.201':139
- '69.##.90.130':139
- '69.#7.36.56':139
- '69.##.20.111':139
- '69.##.27.198':139
- '69.##.198.110':139
- '69.##.43.247':139
- '69.##.99.148':139
- '69.##.162.53':139
- '69.#7.35.70':139
- '69.##.146.108':139
- '69.#7.91.10':139
- '69.#7.76.39':139
- '69.##.45.191':139
- '69.##.232.97':139
- '69.##.48.173':139
- '69.##.122.213':139
- '69.#7.12.52':445
- '69.#7.81.88':445
- '69.##.232.19':445
- '69.##.176.197':445
- '69.#7.26.86':445
- '69.##.211.23':445
- '69.##.43.202':445
- '69.##.155.74':445
- '69.#7.32.19':445
- '69.##.62.179':445
- '69.##.178.220':445
- '69.##.74.154':445
- '69.##.154.174':445
- '69.##.174.54':445
- '69.##.123.160':445
- '69.##.160.152':445
- '69.#7.24.85':445
- '69.##.232.97':9988
- '69.#7.91.42':9988
- '69.##.60.201':9988
- '69.##.124.199':445
- '69.##.169.178':445
- '69.##.201.65':445
- '69.##.132.123':445
- '69.#7.1.81':445
- '69.#7.158.6':445
- '69.#7.6.169':445
- '69.#7.96.1':445
- '69.##.93.144':445
- '69.##.203.138':445
- '69.#7.76.39':445
- '69.##.45.191':445
- '69.##.119.144':445
- '69.##.138.146':445
- '69.##.20.111':445
- '69.#7.36.56':445
- '69.##.60.201':445
- '69.#7.12.83':445
- '69.#7.92.90':445
- '69.##.90.130':445
- '69.##.162.53':445
- '69.#7.35.70':445
- '69.##.27.198':445
- '69.##.83.242':445
- '69.##.219.139':445
- '69.##.99.148':445
- '69.##.198.110':445
- '69.##.48.173':445
- '69.##.122.213':445
- '69.#7.91.10':445
- '69.##.43.247':445
- '69.##.146.108':445
- '69.##.232.97':445
